set conf permissions correctly; change log location

Makefile

@@ -3,6 +3,8 @@
 PREFIX = /usr/local
 NAGIOS_DIR = ${PREFIX}/nagios
 NAGIOS_EXEC = ${NAGIOS_DIR}/libexec
+NAGIOS_USER = _nagios
+NAGIOS_GROUP = ${NAGIOS_USER}
 SYSTEMD_UNIT_DIR = /lib/systemd/system
 
 rc: install
@@ -29,6 +31,9 @@ install:
 	@chmod 755 ${NAGIOS_EXEC}/check_onion
 	@echo installing ircbot.sh to ${PREFIX}/bin
 	@cp -f ircbot.sh ${PREFIX}/bin
+	@echo installing ircbot.conf to /etc
+	test -f /etc/ircbot.conf || install -m 640 -o root -g ${NAGIOS_GROUP} ircbot.conf.default /etc/ircbot.conf
+	test -f /var/log/ircbot.log || install -m 640 -o ${NAGIOS_USER} -g wheel /dev/null /var/log/ircbot.log
 	@chmod 755 ${PREFIX}/bin/ircbot.sh
 
 uninstall:

ircbot.conf.default

@@ -0,0 +1,10 @@
+nick='nagios'
+chan='#ops'
+server='irc.example.org'
+email='nagios@example.org'
+password='mysecretpass'
+port='6667'
+inputf=/tmp/ircinput
+msgf=/tmp/ircmsg
+logf=/var/log/ircbot.log
+joinmsg="nagios bot reporting"

ircbot.sh

@@ -2,19 +2,14 @@
 
 # TODO: make sure only nagios can write to $inputf and $msgf, else do not run
 
-# configuration area
-# TODO: separate configuration into a file owned by nagios user.
-# this improves security and allows reinstall (from git) to not clobber config.
-nick='nagios'
-chan='#ops'
-server='irc.anarchyplanet.org'
-email='nagios@anarchyplanet.org'
-password='mysecretpass'
-port='6667'
-inputf=/tmp/ircinput
-msgf=/tmp/ircmsg
-logf=/tmp/notify_irc.log
-joinmsg="nagios bot reporting"
+conf=/etc/ircbot.conf
+
+if ! test -r $conf; then
+    echo "cannot read configuration file, exiting"
+    exit 1
+else
+    . $conf
+fi
 
 touch $msgf