Support building non-HIC-TRE images

modules/base.ps1

@@ -5,32 +5,3 @@ Stop-Service -Name "wuauserv"
 
 # Fix Win Server 2019 Visual Style (hard to see window boarders)
 Set-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\DWM' -Name ColorPrevalence -Value 1
-
-# Create a desktop shortcut for remounting S3
-$batchPath = "C:\mount_s3.bat"
-New-Item $batchPath
-Set-Content $batchPath @"
-powershell.exe C:\fixs3.ps1
-powershell.exe C:\workdir\start-rclone.ps1
-"@
-
-$fixerPath = "C:\fixs3.ps1"
-New-Item $fixerPath
-Set-Content $fixerPath @"
-taskkill /IM rclone.exe /F
-
-Get-ChildItem -Path D:\ -Depth 0 -Directory -ErrorAction SilentlyContinue | ForEach-Object {
-  `$d = `$_
-  try {
-    `$files = `$d.GetFiles()
-  } catch {
-    `$name = `$d.Name
-    Remove-Item -Path "D:\`${name}" -Force
-  }
-}
-"@
-
-$WshShell = New-Object -comObject WScript.Shell
-$Shortcut = $WshShell.CreateShortcut("C:\Users\Administrator\Desktop\Remount D Drive.lnk")
-$Shortcut.TargetPath = $batchPath
-$Shortcut.Save()

modules/conda-setup.sh

@@ -29,9 +29,11 @@ for env in "${SETUPDIR}"/conda-environment*.yml ; do
     ~/conda/bin/mamba env update --file "$env"
 done
 
+if [ -n "${CONDA_SERVER:-}" ]; then
 echo "Setting default conda channel"
 cat > "$HOME/.condarc" <<EOF
 channels:
   - conda-forge
-channel_alias: http://conda.hic-tre.dundee.ac.uk
+channel_alias: ${CONDA_SERVER}
 EOF
+fi

modules/conda.ps1

@@ -40,10 +40,12 @@ if ( Test-Path -Path ${BASE_ENVIRONMENT_YML} -PathType Leaf ) {
     Write-Output "$BASE_ENVIRONMENT_YML not found, skipping"
 }
 
-$condarc = "C:\Users\Administrator\.condarc"
-New-Item $condarc
-Set-Content $condarc "channels:"
-Add-Content $condarc "  - conda-forge"
-Add-Content $condarc "channel_alias: http://conda.hic-tre.dundee.ac.uk"
+if ("$Env:CONDA_SERVER") {
+  $condarc = "C:\Users\Administrator\.condarc"
+  New-Item $condarc
+  Set-Content $condarc "channels:"
+  Add-Content $condarc "  - conda-forge"
+  Add-Content $condarc "channel_alias: $Env:CONDA_SERVER"
+}
 
 conda deactivate

modules/hictre-fixes.ps1

@@ -0,0 +1,28 @@
+# Create a desktop shortcut for remounting S3
+$batchPath = "C:\mount_s3.bat"
+New-Item $batchPath
+Set-Content $batchPath @"
+powershell.exe C:\fixs3.ps1
+powershell.exe C:\workdir\start-rclone.ps1
+"@
+
+$fixerPath = "C:\fixs3.ps1"
+New-Item $fixerPath
+Set-Content $fixerPath @"
+taskkill /IM rclone.exe /F
+
+Get-ChildItem -Path D:\ -Depth 0 -Directory -ErrorAction SilentlyContinue | ForEach-Object {
+  `$d = `$_
+  try {
+    `$files = `$d.GetFiles()
+  } catch {
+    `$name = `$d.Name
+    Remove-Item -Path "D:\`${name}" -Force
+  }
+}
+"@
+
+$WshShell = New-Object -comObject WScript.Shell
+$Shortcut = $WshShell.CreateShortcut("C:\Users\Administrator\Desktop\Remount D Drive.lnk")
+$Shortcut.TargetPath = $batchPath
+$Shortcut.Save()

modules/hictre-fixes.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+# Noop

modules/rapid7_insight.ps1

@@ -24,18 +24,27 @@ if($RAPID7_INSIGHT_TOKEN.length -ne 39) {
 Write-Output @"
 cd C:\Tools
 
-While ( Test-NetConnection -ComputerName ${Env:RAPID7_PROXY_HOST} -Port 3128 |
-  ? { ! `$_.TcpTestSucceeded } ) {
-      Start-Sleep -Seconds 10
-  }
-
-Start-Process msiexec.exe -ArgumentList ``
-  ("/i",   "$INSTALLER_FILENAME",
-   "/l*v", "$INSTALLER_LOGFILE",
-   "/quiet",
-   "CUSTOMTOKEN=$RAPID7_INSIGHT_TOKEN",
-   "HTTPSPROXY=${Env:RAPID7_PROXY_HOST}:3128"
-  ) -NoNewWindow -Wait -PassThru
+If ("${Env:RAPID7_PROXY_HOST}") {
+  While ( Test-NetConnection -ComputerName ${Env:RAPID7_PROXY_HOST} -Port 3128 |
+    ? { ! `$_.TcpTestSucceeded } ) {
+        Start-Sleep -Seconds 10
+    }
+
+  Start-Process msiexec.exe -ArgumentList ``
+    ("/i",  "$INSTALLER_FILENAME",
+    "/l*v", "$INSTALLER_LOGFILE",
+    "/quiet",
+    "CUSTOMTOKEN=$RAPID7_INSIGHT_TOKEN",
+    "HTTPSPROXY=${Env:RAPID7_PROXY_HOST}:3128"
+    ) -NoNewWindow -Wait -PassThru
+} else {
+  Start-Process msiexec.exe -ArgumentList ``
+    ("/i",  "$INSTALLER_FILENAME",
+    "/l*v", "$INSTALLER_LOGFILE",
+    "/quiet",
+    "CUSTOMTOKEN=$RAPID7_INSIGHT_TOKEN"
+    ) -NoNewWindow -Wait -PassThru
+}
 "@ | Out-File -FilePath C:\Tools\InsightSetup.ps1
 
 Register-ScheduledJob -Name InsightSetup -FilePath C:\Tools\InsightSetup.ps1 `

modules/rapid7_insight.sh

@@ -10,6 +10,12 @@ aws s3 cp "s3://${S3_PACKER_RESOURCES_PATH}/rapid7/$INSTALLER_FILENAME" .
 RAPID7_INSIGHT_TOKEN=$(aws s3 cp "s3://${S3_PACKER_RESOURCES_PATH}/rapid7/rapid7_insight_token.txt" -)
 chmod +x $INSTALLER_FILENAME
 
+if [ -z "${RAPID7_PROXY_HOST:-}" ]; then
+  RAPID7_PROXY_ARGS=""
+else
+  RAPID7_PROXY_ARGS="--https-proxy ${RAPID7_PROXY_HOST}:3128"
+fi
+
 cat > insight-install-job.sh <<EOF
 #!/bin/bash
 
@@ -21,11 +27,8 @@ cd /opt/ami-setup
 function install_insight () {
   ./$INSTALLER_FILENAME install_start \
       --token "${RAPID7_INSIGHT_TOKEN}" \
-      --https-proxy ${RAPID7_PROXY_HOST}:3128 \
-      --attributes "workspace,ubuntu,\
-SOPHOS_GROUP=${SOPHOS_GROUP},\
-AUTOHIBERNATE_TIME=${AUTOHIBERNATE_TIME:=None}\
-PACKER_BUILD_NAME=${PACKER_BUILD_NAME}"
+      ${RAPID7_PROXY_ARGS} \
+      --attributes "workspace,ubuntu"
 }
 
 while ! systemctl status ir_agent > /dev/null; do

modules/rstudio.ps1

@@ -12,13 +12,14 @@ Start-Process C:\Tools\RStudio-installer.exe -ArgumentList "/S" -NoNewWindow -Wa
 Invoke-WebRequest -Uri "https://github.com/r-windows/rtools-installer/releases/download/2022-02-06/rtools40-x86_64.exe" -OutFile C:\Tools\RTools.exe
 Start-Process C:\Tools\RTools.exe -ArgumentList "/VERYSILENT" -NoNewWindow -Wait -PassThru
 
+if ("$Env:CRAN_SERVER") {
 $RConfig = @"
 # Set the default help type
 options(help_type="html")
 
 # HIC TRE R Repository
 local({r <- getOption("repos")
-       r["CRAN"] <- "http://cran.hic-tre.dundee.ac.uk/"
+       r["CRAN"] <- "$Env:CRAN_SERVER"
        options(repos=r)
 })
 
@@ -27,3 +28,4 @@ Sys.setenv(TZ='Europe/London')
 "@
 Set-Content "C:\Program Files\R\R-4.1.3\etc\Rprofile.site" $RConfig
 Set-Content "C:\Users\Administrator\Documents\.Renviron" "RSTUDIO_DISABLE_SECURE_DOWNLOAD_WARNING=1"
+}

modules/rstudio.sh

@@ -37,13 +37,14 @@ else
     exit 1
 fi
 
+if [ -n "${CRAN_SERVER:-}" ]; then
 cat > "$HOME/.Rprofile" <<EOF
 # Set the default help type
 options(help_type="html")
 
 # HIC TRE R Repository
 local({r <- getOption("repos")
-       r["CRAN"] <- "http://cran.hic-tre.dundee.ac.uk/"
+       r["CRAN"] <- "${CRAN_SERVER}"
        options(repos=r)
 })
 
@@ -52,6 +53,7 @@ Sys.setenv(TZ='Europe/London')
 EOF
 
 echo "RSTUDIO_DISABLE_SECURE_DOWNLOAD_WARNING=1" >> "$HOME/.Renviron"
+fi
 
 sudo add-apt-repository -y ppa:c2d4u.team/c2d4u4.0+
 sudo apt update

modules/sophos.ps1

@@ -1,9 +1,18 @@
 # Sophos
 # We have to sleep for a while because the network takes some time to start up (with the correct nameserver etc).
 Invoke-WebRequest -Uri ${Env:SOPHOS_SETUP_EXE} -OutFile C:\SophosSetup.exe
+
+if ("$Env:SOPHOS_MESSAGE_RELAY") {
+  $SOPHOS_SETUP_ARGS="--messagerelays=${Env:SOPHOS_MESSAGE_RELAY} --proxyaddress=${Env:SOPHOS_MESSAGE_RELAY}"
+  $GROUP_PREFIX="HIC - AWS - Cloud TRE"
+} else {
+  $SOPHOS_SETUP_ARGS=""
+  $GROUP_PREFIX="HIC - AWS - Other"
+}
+
 Write-Output "`
 Start-Sleep -Seconds 600 `
-C:\SophosSetup.exe --quiet --messagerelays=${Env:SOPHOS_MESSAGE_RELAY} --proxyaddress=${Env:SOPHOS_MESSAGE_RELAY} --devicegroup='HIC - AWS - Cloud TRE\\${SOPHOS_GROUP}'" | `
+C:\SophosSetup.exe --quiet $SOPHOS_SETUP_ARGS --devicegroup='$GROUP_PREFIX\\${SOPHOS_GROUP}'" | `
   Out-File -FilePath C:\SophosSetup.ps1
 
 Register-ScheduledJob -Name SophosSetup -FilePath C:\SophosSetup.ps1 `

modules/sophos.sh

@@ -12,6 +12,14 @@ while [ ! -s SophosSetup.sh ] ; do
     chmod +x SophosSetup.sh
 done
 
+if [ -z "${SOPHOS_MESSAGE_RELAY:-}" ]; then
+  SOPHOS_SERVER=https://central.sophos.com
+  GROUP_PREFIX="HIC - AWS - Other"
+else
+  SOPHOS_SERVER=http://${SOPHOS_MESSAGE_RELAY}
+  GROUP_PREFIX="HIC - AWS - Cloud TRE"
+fi
+
 # if https://central.sophos.com is accessible assume full outbound access
 cat > sophos-install-job.sh <<EOF
 #!/bin/bash
@@ -22,16 +30,16 @@ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/b
 install_sophos() {
   [ -d /opt/sophos-spl ] && rm -rf /opt/sophos-spl
 
-  while ! curl -s http://${SOPHOS_MESSAGE_RELAY} && ! curl -s https://central.sophos.com > /dev/null ; do
+  while ! curl -s "${SOPHOS_SERVER}" > /dev/null ; do
     date
-    echo "${SOPHOS_MESSAGE_RELAY} not available yet, sleeping..."
+    echo "${SOPHOS_SERVER} not available yet, sleeping..."
     sleep 60
   done
 
   echo "Sophos is reachable!"
 
   date
-  /opt/ami-setup/SophosSetup.sh --group="HIC - AWS - Cloud TRE\\\\${SOPHOS_GROUP}"
+  /opt/ami-setup/SophosSetup.sh --group="${GROUP_PREFIX}\\\\${SOPHOS_GROUP}"
 
   date
   echo "Sophos install complete"

nontre-scripts/swb-non-amazonlinux.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Service workbench environment files only support Amazon Linux in userdata
+# https://github.com/awslabs/service-workbench-on-aws/blob/v4.3.1/addons/addon-base-raas/packages/base-raas-cfn-templates/src/templates/service-catalog/ec2-linux-instance.cfn.yml
+# https://github.com/awslabs/service-workbench-on-aws/blob/v4.3.1/main/solution/post-deployment/config/environment-files/get_bootstrap.sh
+# https://github.com/awslabs/service-workbench-on-aws/blob/v4.3.1/main/solution/post-deployment/config/environment-files/bootstrap.sh
+# https://github.com/awslabs/service-workbench-on-aws/tree/v4.3.1/main/solution/post-deployment/config/environment-files
+
+# To work around this install required packages here, and bundle a modified
+# bootstrap script that can be called from userdata
+
+set -eu
+
+SETUPDIR=$(realpath "$(dirname "${BASH_SOURCE[0]}")")
+cd "$SETUPDIR"
+
+sudo apt-get update -y -q
+
+sudo apt-get install -y -q \
+  fuse3 \
+  jq \
+  python3-pip
+
+sudo wget -qO /usr/local/bin/goofys https://github.com/kahing/goofys/releases/download/v0.24.0/goofys
+sudo chmod a+x /usr/local/bin/goofys
+
+# https://github.com/awslabs/aws-cloudformation-templates/blob/f14e6284488e0a3ac1f9238e3a15bbe0dd4216bd/aws/solutions/OperatingSystems/Ubuntu22.04_cfn-hup.yaml#L310C16-L316
+sudo mkdir -p /opt/aws/bin/
+sudo pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
+sudo ln -s /usr/local/init/ubuntu/cfn-hup /etc/init.d/cfn-hup
+sudo ln -s /usr/local/bin/cfn-* /opt/aws/bin/
+
+sudo useradd -m -s /bin/bash ec2-user
+
+sudo sed -i s/ubuntu/ec2-user/g /etc/systemd/system/[email protected]
+sudo cp -a /home/ubuntu/Desktop /home/ec2-user/
+sudo chown -R ec2-user:ec2-user /home/ec2-user/Desktop
+
+# Allow ec2-user to sudo without a password, same as default ubuntu user
+echo 'ec2-user ALL=(ALL) NOPASSWD:ALL' | sudo tee -a /etc/sudoers.d/99-ec2-user

templates/default.j2

@@ -6,8 +6,10 @@
 
 {% set env = env|default([],true) %}
 {% set private_env = private_env|default([],true) %}
+{% set private_tre_env = private_tre_env|default([],true) %}
 
 {% set modules = modules|default([],true) %}
+{% set tre_modules = tre_modules|default([],true) %}
 {% set security_modules = security_modules|default([],true) %}
 
 {% set s3_resources = s3_resources|default("",true) %}

templates/ubuntu.pkr.hcl

@@ -88,10 +88,13 @@ build {
       "{{ e }}",{% endfor %}
       {% for e in private_env %}
       "{{ e }}",{% endfor %}
+      {% for e in private_tre_env %}
+      "{{ e }}",{% endfor %}
     ]
     scripts = [
       "{{ module_basedir }}/cloudinit.sh",
       "{{ module_basedir }}/base.sh",{% for module in modules %}
+      "{{ module_basedir }}/{{ module }}.sh",{% endfor %}{% for module in tre_modules %}
       "{{ module_basedir }}/{{ module }}.sh",{% endfor %}{% for module in security_modules %}
       "{{ module_basedir }}/{{ module }}.sh",{% endfor %}{% for script in scripts %}
       "{{ script }}",{% endfor %}

templates/windows.pkr.hcl

@@ -84,10 +84,13 @@ build {
       "{{ e }}",{% endfor %}
       {% for e in private_env %}
       "{{ e }}",{% endfor %}
+      {% for e in private_tre_env %}
+      "{{ e }}",{% endfor %}
     ]
     scripts = [
       "{{ module_basedir }}/base.ps1",
       "{{ module_basedir }}/awscli.ps1",{% for module in modules %}
+      "{{ module_basedir }}/{{ module }}.ps1",{% endfor %}{% for module in tre_modules %}
       "{{ module_basedir }}/{{ module }}.ps1",{% endfor %}{% for module in security_modules %}
       "{{ module_basedir }}/{{ module }}.ps1",{% endfor %}{% for script in scripts %}
       "{{ script }}",{% endfor %}