360 lines
16 KiB
Bash
360 lines
16 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
IFS=$'\n\t'
|
|
|
|
readonly PROGRAM_NAME="smm-setup"
|
|
readonly DEFAULT_RELEASE_TAG="v0.1.0-alpha.20"
|
|
readonly DEFAULT_REPOSITORY="ochenstarik-ui/server-monitor-manager"
|
|
readonly INNER_ASSET="ochenstarik-server-monitor-manager.sh"
|
|
|
|
RELEASE_TAG="${SMM_TAG:-$DEFAULT_RELEASE_TAG}"
|
|
REPOSITORY="${SMM_REPOSITORY:-$DEFAULT_REPOSITORY}"
|
|
CACHE_DIR="${SMM_CACHE_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/server-monitor-manager}"
|
|
interactive=0
|
|
node_code=""
|
|
node_control_url=""
|
|
node_hub_endpoint=""
|
|
node_ca_fingerprint=""
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Usage:
|
|
smm-setup.sh
|
|
smm-setup.sh [--tag TAG] [--repository OWNER/REPO] COMMAND [ARG...]
|
|
|
|
With no arguments, an interactive terminal guides a complete Hub or Node
|
|
installation or a full removal. Non-interactive commands remain available:
|
|
install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]
|
|
install-node
|
|
uninstall-system --confirm-uninstall [--purge-data --confirm-destroy-data]
|
|
|
|
Other commands are passed to the verified ochenstarik-server-monitor-manager.sh
|
|
asset. Use -- before a command to force pass-through. Common commands:
|
|
install-agent | install-control | uninstall-agent | uninstall-control
|
|
backup-create | backup-restore | version
|
|
|
|
Environment overrides:
|
|
SMM_TAG Release tag (default: v0.1.0-alpha.20)
|
|
SMM_REPOSITORY GitHub repository (default: ochenstarik-ui/server-monitor-manager)
|
|
SMM_CACHE_DIR Verified-download cache directory
|
|
USAGE
|
|
}
|
|
|
|
no_tty_help() {
|
|
cat >&2 <<'HELP'
|
|
smm-setup: interactive installation requires a terminal on stdin and stdout.
|
|
For automation, choose an explicit command:
|
|
sudo ./smm-setup.sh install-hub PUBLIC_HOST [HTTPS_PORT] [WG_PORT]
|
|
sudo ./smm-setup.sh install-node
|
|
sudo ./smm-setup.sh uninstall-system --confirm-uninstall
|
|
Run ./smm-setup.sh --help for pass-through commands.
|
|
HELP
|
|
}
|
|
|
|
die() { printf '%s: %s\n' "$PROGRAM_NAME" "$*" >&2; exit 1; }
|
|
require_command() { command -v "$1" >/dev/null 2>&1 || die "required command is unavailable: $1"; }
|
|
|
|
validate_port() {
|
|
[[ "$1" =~ ^[0-9]{1,5}$ ]] && (( 10#$1 >= 1 && 10#$1 <= 65535 )) \
|
|
|| die "invalid port: $1"
|
|
}
|
|
|
|
validate_public_host() {
|
|
[[ "$1" != *:* && "$1" =~ ^[A-Za-z0-9]([A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$ ]] \
|
|
|| die "invalid public address: $1"
|
|
}
|
|
|
|
prompt_default() {
|
|
local prompt="$1" default="$2" value
|
|
read -r -p "$prompt [$default]: " value
|
|
printf '%s' "${value:-$default}"
|
|
}
|
|
|
|
confirm() {
|
|
local prompt="$1" answer
|
|
read -r -p "$prompt [y/N]: " answer
|
|
[[ "$answer" == "y" || "$answer" == "Y" || "$answer" == "yes" || "$answer" == "YES" ]]
|
|
}
|
|
|
|
os_value() {
|
|
local key="$1"
|
|
[[ -r /etc/os-release ]] || return 0
|
|
sed -n "s/^${key}=//p" /etc/os-release | head -n1 | sed 's/^"//;s/"$//'
|
|
}
|
|
|
|
detect_public_address() {
|
|
command -v curl >/dev/null 2>&1 || return 0
|
|
curl -fsS --max-time 5 https://api.ipify.org 2>/dev/null || true
|
|
}
|
|
|
|
role_status() {
|
|
local role="$1" binary
|
|
case "$role" in
|
|
Hub) binary=/usr/local/lib/ochenstarik-server-monitor-manager/control/ochenstarik-smm-control ;;
|
|
Node) binary=/usr/local/lib/ochenstarik-server-monitor-manager/agent/ochenstarik-smm-agent ;;
|
|
esac
|
|
[[ -x "$binary" ]] && printf 'installed' || printf 'not installed'
|
|
}
|
|
|
|
show_machine() {
|
|
local distro version architecture public_address
|
|
distro="$(os_value NAME)"
|
|
version="$(os_value VERSION_ID)"
|
|
architecture="$(uname -m)"
|
|
public_address="$(detect_public_address)"
|
|
printf '\nServer Monitor Manager setup\n'
|
|
printf ' System: %s %s\n' "${distro:-unknown Linux}" "${version:-unknown}"
|
|
printf ' Architecture: %s\n' "$architecture"
|
|
printf ' Public address: %s\n' "${public_address:-not detected}"
|
|
printf ' Hub: %s\n' "$(role_status Hub)"
|
|
printf ' Node: %s\n\n' "$(role_status Node)"
|
|
DETECTED_PUBLIC_ADDRESS="$public_address"
|
|
}
|
|
|
|
install_dependencies() {
|
|
local item missing=()
|
|
for item in curl sha256sum mktemp openssl base64 install; do
|
|
command -v "$item" >/dev/null 2>&1 || missing+=("$item")
|
|
done
|
|
if (( ${#missing[@]} > 0 )); then
|
|
[[ ${EUID:-$(id -u)} -eq 0 ]] || die "run with sudo to install dependencies: ${missing[*]}"
|
|
command -v apt-get >/dev/null 2>&1 || die "install required commands manually: ${missing[*]}"
|
|
printf 'Installing required system packages...\n'
|
|
DEBIAN_FRONTEND=noninteractive apt-get update
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl coreutils openssl
|
|
fi
|
|
printf 'Dependencies are ready. The verified bootstrap will provision cosign if needed.\n'
|
|
}
|
|
|
|
base64url_decode() {
|
|
local encoded="$1" padding
|
|
[[ -n "$encoded" && "$encoded" =~ ^[A-Za-z0-9_-]+$ ]] || return 1
|
|
encoded="${encoded//-/+}"
|
|
encoded="${encoded//_/\/}"
|
|
case $(( ${#encoded} % 4 )) in
|
|
0) padding="" ;; 2) padding="==" ;; 3) padding="=" ;; *) return 1 ;;
|
|
esac
|
|
printf '%s%s' "$encoded" "$padding" | base64 --decode 2>/dev/null
|
|
}
|
|
|
|
inspect_node_code() {
|
|
local code="$1" parts=() ca_file hub_key node_address mesh_network part
|
|
local control_url_pattern='^https://(\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9.-]+)(:[0-9]{1,5})?/?$'
|
|
IFS='.' read -r -a parts <<<"$code"
|
|
[[ ${#parts[@]} -eq 9 && "${parts[0]}" == "SMMNODE2" ]] \
|
|
|| die "invalid SMMNODE2 code: expected exactly nine segments"
|
|
for part in "${parts[@]:1}"; do [[ -n "$part" ]] || die "invalid SMMNODE2 code: empty segment"; done
|
|
node_control_url="$(base64url_decode "${parts[1]}")" || die "invalid SMMNODE2 Control URL encoding"
|
|
node_hub_endpoint="$(base64url_decode "${parts[5]}")" || die "invalid SMMNODE2 Hub endpoint encoding"
|
|
hub_key="$(base64url_decode "${parts[6]}")" || die "invalid SMMNODE2 Hub key encoding"
|
|
node_address="$(base64url_decode "${parts[7]}")" || die "invalid SMMNODE2 node address encoding"
|
|
mesh_network="$(base64url_decode "${parts[8]}")" || die "invalid SMMNODE2 network encoding"
|
|
[[ "$node_control_url" =~ $control_url_pattern ]] || die "invalid Control URL in SMMNODE2 code"
|
|
[[ "$node_hub_endpoint" =~ ^[A-Za-z0-9.-]+:[0-9]{1,5}$ ]] || die "invalid Hub endpoint in SMMNODE2 code"
|
|
validate_port "${node_hub_endpoint##*:}"
|
|
[[ "$hub_key" =~ ^[A-Za-z0-9+/]{43}=$ ]] || die "invalid Hub public key in SMMNODE2 code"
|
|
[[ "$node_address" =~ ^10\.77\.0\.([2-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-4])$ ]] \
|
|
|| die "invalid mesh address in SMMNODE2 code"
|
|
[[ "$mesh_network" == "10.77.0.0/24" ]] || die "invalid mesh network in SMMNODE2 code"
|
|
ca_file="$(mktemp -t smm-setup-ca.XXXXXXXX.crt)"
|
|
chmod 0600 "$ca_file"
|
|
if ! base64url_decode "${parts[2]}" >"$ca_file" \
|
|
|| ! openssl x509 -in "$ca_file" -noout >/dev/null 2>&1; then
|
|
rm -f -- "$ca_file"
|
|
die "invalid or tampered CA certificate in SMMNODE2 code"
|
|
fi
|
|
node_ca_fingerprint="$(openssl x509 -in "$ca_file" -noout -fingerprint -sha256 | cut -d= -f2)"
|
|
rm -f -- "$ca_file"
|
|
}
|
|
|
|
choose_interactive_action() {
|
|
local role host https_port wg_port existing default_host
|
|
show_machine
|
|
read -r -p 'Choose role: 1) Hub 2) Node 3) Uninstall: ' role
|
|
case "${role,,}" in
|
|
1|hub)
|
|
action=install-hub; existing="$(role_status Hub)"
|
|
default_host="${DETECTED_PUBLIC_ADDRESS:-hub.example.com}"
|
|
[[ -n "$default_host" ]] || default_host=hub.example.com
|
|
host="$(prompt_default 'Public IPv4 address or DNS name' "$default_host")"
|
|
https_port="$(prompt_default 'Control HTTPS port' 7443)"
|
|
wg_port="$(prompt_default 'WireGuard UDP port' 51820)"
|
|
validate_public_host "$host"; validate_port "$https_port"; validate_port "$wg_port"
|
|
action_args=("$host" "$https_port" "$wg_port")
|
|
;;
|
|
2|node)
|
|
action=install-node; existing="$(role_status Node)"
|
|
read -r -s -p 'Paste SMMNODE2 code: ' node_code; printf '\n'
|
|
[[ -n "$node_code" ]] || die "SMMNODE2 code is empty"
|
|
action_args=()
|
|
;;
|
|
3|uninstall|remove)
|
|
action=uninstall-system
|
|
action_args=()
|
|
return
|
|
;;
|
|
*) die "choose Hub (1), Node (2), or Uninstall (3)" ;;
|
|
esac
|
|
if [[ "$existing" == "installed" ]] && ! confirm "This role is already installed. Reinstall or update it?"; then
|
|
printf 'No changes were made.\n'; exit 0
|
|
fi
|
|
install_dependencies
|
|
if [[ "$action" == install-node ]]; then
|
|
inspect_node_code "$node_code"
|
|
printf '\nNode enrollment details:\n Control: %s\n WireGuard Hub: %s\n CA SHA-256: %s\n' \
|
|
"$node_control_url" "$node_hub_endpoint" "$node_ca_fingerprint"
|
|
confirm 'Do these Hub and CA fingerprint values match the operator application?' \
|
|
|| die "installation cancelled: Hub identity was not confirmed"
|
|
fi
|
|
}
|
|
|
|
run_interactive_uninstall() {
|
|
local depth answer
|
|
local -a plan_args=()
|
|
printf '\nRemoval depth:\n'
|
|
printf '%s\n' ' 1) Remove programs and accounts; preserve Control database, backups, and CA'
|
|
printf '%s\n' ' 2) Permanently remove everything, including Control database, backups, and CA'
|
|
read -r -p 'Choose removal depth [1]: ' depth
|
|
case "${depth:-1}" in
|
|
1|preserve) ;;
|
|
2|purge) plan_args=(--purge-data) ;;
|
|
*) die "choose removal depth 1 or 2" ;;
|
|
esac
|
|
|
|
printf '\n'
|
|
"$cached_script" uninstall-system-plan "${plan_args[@]}"
|
|
read -r -p 'Type UNINSTALL to remove the objects listed above: ' answer
|
|
[[ "$answer" == "UNINSTALL" ]] || die "removal cancelled: confirmation word did not match"
|
|
if (( ${#plan_args[@]} > 0 )); then
|
|
read -r -p 'Type DESTROY-DATA to permanently delete Control data, backups, and CA: ' answer
|
|
[[ "$answer" == "DESTROY-DATA" ]] || die "removal cancelled: data-destruction confirmation did not match"
|
|
exec "$cached_script" uninstall-system --confirm-uninstall --purge-data --confirm-destroy-data
|
|
fi
|
|
exec "$cached_script" uninstall-system --confirm-uninstall
|
|
}
|
|
|
|
original_count=$#
|
|
pass_through=0
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--tag) [[ $# -ge 2 ]] || die '--tag requires a value'; RELEASE_TAG="$2"; shift 2 ;;
|
|
--repository) [[ $# -ge 2 ]] || die '--repository requires a value'; REPOSITORY="$2"; shift 2 ;;
|
|
-h|--help) usage; exit 0 ;;
|
|
--) pass_through=1; shift; break ;;
|
|
-*) die "unknown option: $1" ;;
|
|
*) break ;;
|
|
esac
|
|
done
|
|
|
|
action_args=()
|
|
action=""
|
|
if (( original_count == 0 )); then
|
|
[[ -t 0 && -t 1 ]] || { no_tty_help; exit 2; }
|
|
interactive=1
|
|
choose_interactive_action
|
|
else
|
|
[[ $# -gt 0 ]] || die "a command is required after options"
|
|
action="$1"; shift; action_args=("$@")
|
|
fi
|
|
|
|
[[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || die "invalid release tag: $RELEASE_TAG"
|
|
[[ "$REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || die "invalid repository: $REPOSITORY"
|
|
|
|
if (( pass_through == 0 )); then
|
|
case "$action" in
|
|
install-hub) [[ ${#action_args[@]} -ge 1 && ${#action_args[@]} -le 3 ]] || die "install-hub requires PUBLIC_HOST [HTTPS_PORT] [WG_PORT]" ;;
|
|
install-node) [[ ${#action_args[@]} -eq 0 ]] || die "install-node takes no arguments" ;;
|
|
uninstall-system)
|
|
if (( interactive == 0 )); then
|
|
[[ ( ${#action_args[@]} -eq 1 && "${action_args[0]}" == "--confirm-uninstall" ) \
|
|
|| ( ${#action_args[@]} -eq 3 && "${action_args[0]}" == "--confirm-uninstall" \
|
|
&& "${action_args[1]}" == "--purge-data" \
|
|
&& "${action_args[2]}" == "--confirm-destroy-data" ) ]] \
|
|
|| die "uninstall-system requires --confirm-uninstall [--purge-data --confirm-destroy-data]"
|
|
fi
|
|
;;
|
|
esac
|
|
fi
|
|
|
|
require_command curl; require_command sha256sum; require_command mktemp
|
|
release_base="https://github.com/$REPOSITORY/releases/download/$RELEASE_TAG"
|
|
cache_release="$CACHE_DIR/$REPOSITORY/$RELEASE_TAG"
|
|
cached_script="$cache_release/$INNER_ASSET"
|
|
cached_checksum="$cache_release/$INNER_ASSET.sha256"
|
|
mkdir -p "$cache_release"
|
|
temporary_directory="$(mktemp -d -t smm-setup.XXXXXXXX)"
|
|
trap 'rm -rf -- "$temporary_directory"' EXIT
|
|
|
|
download() {
|
|
local url="$1" destination="$2"
|
|
if (( interactive == 1 )); then
|
|
printf 'Downloading %s\n' "${url##*/}"
|
|
curl -fL --progress-bar "$url" -o "$destination"
|
|
else
|
|
curl -fsSL "$url" -o "$destination"
|
|
fi
|
|
}
|
|
|
|
download "$release_base/$INNER_ASSET" "$temporary_directory/$INNER_ASSET"
|
|
download "$release_base/$INNER_ASSET.sha256" "$temporary_directory/$INNER_ASSET.sha256"
|
|
( cd "$temporary_directory"; sha256sum -c "$INNER_ASSET.sha256" >/dev/null ) \
|
|
|| die "checksum verification failed for $RELEASE_TAG/$INNER_ASSET"
|
|
install -m 0755 "$temporary_directory/$INNER_ASSET" "$cached_script"
|
|
install -m 0644 "$temporary_directory/$INNER_ASSET.sha256" "$cached_checksum"
|
|
|
|
download_required_asset() {
|
|
local asset="$1"
|
|
if ! download "$release_base/$asset" "$temporary_directory/$asset"; then
|
|
case "$asset" in
|
|
server-monitor-manager-manifest.json|server-monitor-manager-manifest.sig|server-monitor-manager-manifest.pem)
|
|
die "required signed-release asset is unavailable: $asset"
|
|
;;
|
|
*) die "required release asset is unavailable: $asset" ;;
|
|
esac
|
|
fi
|
|
}
|
|
|
|
download_platform_release() {
|
|
local platform archive_asset asset
|
|
case "$(uname -m)" in x86_64) platform="linux-x64" ;; aarch64|arm64) platform="linux-arm64" ;; *) die "unsupported architecture: $(uname -m)" ;; esac
|
|
archive_asset="server-monitor-manager-$platform.tar.gz"
|
|
for asset in "$archive_asset" "$archive_asset.sha256" server-monitor-manager-manifest.json \
|
|
server-monitor-manager-manifest.sig server-monitor-manager-manifest.pem; do
|
|
download_required_asset "$asset"
|
|
done
|
|
( cd "$temporary_directory"; sha256sum -c "$archive_asset.sha256" >/dev/null ) \
|
|
|| die "checksum verification failed for $RELEASE_TAG/$archive_asset"
|
|
downloaded_archive="$temporary_directory/$archive_asset"
|
|
}
|
|
|
|
if (( pass_through == 1 )); then exec "$cached_script" "$action" "${action_args[@]}"; fi
|
|
|
|
case "$action" in
|
|
install-hub)
|
|
download_platform_release; archive="$downloaded_archive"
|
|
public_host="${action_args[0]}"; https_port="${action_args[1]:-}"; wg_port="${action_args[2]:-}"
|
|
if [[ -n "$https_port" ]]; then "$cached_script" install-control "$archive" "$public_host" "$https_port"; else "$cached_script" install-control "$archive" "$public_host"; fi
|
|
if [[ -n "$wg_port" ]]; then "$cached_script" mesh-init "$public_host" "$wg_port"; else "$cached_script" mesh-init "$public_host"; fi
|
|
if (( interactive == 1 )); then
|
|
printf '\nHub installation is complete. Insert this device registration code into the operator application:\n'
|
|
"$cached_script" control-device-code operator
|
|
printf 'Hub CA SHA-256 fingerprint (verify it in the application):\n'
|
|
"$cached_script" control-ca-fingerprint
|
|
fi
|
|
;;
|
|
install-node)
|
|
download_platform_release; archive="$downloaded_archive"
|
|
if (( interactive == 1 )); then
|
|
SMM_ENROLL_CODE="$node_code" SMM_ACCEPT_CA_FINGERPRINT=1 "$cached_script" install-node "$archive"
|
|
node_code=""
|
|
printf '\nNode installation is complete. Insert the SMMPEER1 code printed above into the operator application for this Node.\n'
|
|
else
|
|
exec "$cached_script" install-node "$archive"
|
|
fi
|
|
;;
|
|
uninstall-system)
|
|
if (( interactive == 1 )); then run_interactive_uninstall; fi
|
|
exec "$cached_script" "$action" "${action_args[@]}"
|
|
;;
|
|
*) exec "$cached_script" "$action" "${action_args[@]}" ;;
|
|
esac
|