centos7-zimbra-repo.cfg

#platform=x86, AMD64, or Intel EM64T
#version=DEVEL
# Install OS instead of upgrade
install
# Keyboard layouts
keyboard 'us'# Reboot after installation
reboot
# Root password
rootpw "WeL0veZimbr@!"
# System timezone
timezone Europe/Amsterdam
# Use network installation
url --url="http://mirror.cisp.com/CentOS/7/os/x86_64/"
repo --name=epel --baseurl=http://download.fedoraproject.org/pub/epel/7/x86_64/
# System language
lang en_US
# Firewall configuration
firewall --enabled --ssh
# Network information
network  --bootproto=dhcp --device=eth0
# System authorization information
auth  --useshadow  --passalgo=sha512
# Use graphical install
graphical
firstboot --disable
# SELinux configuration
selinux --disabled
# Do not configure the X Window System
skipx

# System bootloader configuration
bootloader --location=mbr
zerombr
clearpart --all --initlabel

# Disk partitioning information
part swap --asprimary --fstype="swap" --size=2200
part /boot --fstype=ext4 --size=500
part pv.01 --size=1 --grow
volgroup rootvg01 pv.01
logvol / --fstype ext4 --name=lv01 --vgname=rootvg01 --size=1 --grow

%packages
@base
@core
epel-release
chrony
nmap-ncat
perl-core
git
ant
python-pip
nginx
%end

%post
pip install awscli
mkdir /var/repositories
cd /var/repositories
aws s3 sync s3://repo.zimbra.com/apt/87 ./apt/87 --no-sign-request --delete
aws s3 sync s3://repo.zimbra.com/rpm/87 ./rpm/87 --no-sign-request --delete
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --reload
mkdir /etc/nginx/certs
mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak
mv /etc/nginx/conf.d/ssl.conf /etc/nginx/conf.d/ssl.conf.bak
touch /etc/nginx/conf.d/default.conf
cat > /etc/nginx/conf.d/default.conf <<EOF
server {
     listen      443 ssl;
     ssl_certificate /etc/nginx/certs/server.crt;
     ssl_certificate_key /etc/nginx/certs/server.key;
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_ciphers HIGH:!aNULL:!MD5;
     ## Let your repository be the root directory
     root        /var/repositories;
 
     ## Always good to log
     access_log  /var/log/nginx/repo.access.log;
     error_log   /var/log/nginx/repo.error.log;
 
     ## Prevent access to Reprepro's files
     location ~ /(db|conf) {
         deny        all;
         return      404;
     }
}
EOF
service nginx restart
%end