rogee/agent-call
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: provision Debian cell with rogee SSH access

Browse Source
This commit is contained in:
rogee
2026-09-15 11:31:05 +08:00
parent 11b69fd309
commit fb21f56aec
3 changed files with 127 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/asterisk_bootstrap.sh
+56 -14
View File
@@ -9,12 +9,67 @@ set -euo pipefail
: "${RTP_CONF_B64:?missing rtp.conf payload}"
: "${EXTENSIONS_CONF_B64:?missing extensions.conf payload}"
ROGEE_USER="rogee"
ROGEE_PUBLIC_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPoGJTH1JrXbWu+ZhIgaHMhume0oWQiWmadhTwbk75Ny rogee@ipao.vip"
ASTERISK_CONFIG_DIR="/opt/agent-call/asterisk/generated"
ASTERISK_CONFIG_GID="${ASTERISK_CONFIG_GID:-1000}"
if [[ "$(id -u)" != 0 ]]; then
echo 'ECS user-data must run as root' >&2
exit 1
fi
export DEBIAN_FRONTEND=noninteractive
if ! command -v docker >/dev/null 2>&1 || ! command -v sshd >/dev/null 2>&1 || ! command -v sudo >/dev/null 2>&1; then
while fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock >/dev/null 2>&1; do
sleep 5
done
until apt-get update; do
sleep 10
done
until apt-get install -y --no-install-recommends ca-certificates curl docker.io docker-cli openssh-server sudo; do
sleep 10
done
fi
if ! getent group sudo >/dev/null 2>&1; then
groupadd --system sudo
fi
if ! getent group docker >/dev/null 2>&1; then
groupadd --system docker
fi
if ! id -u "$ROGEE_USER" >/dev/null 2>&1; then
useradd --create-home --shell /bin/bash "$ROGEE_USER"
fi
usermod --shell /bin/bash "$ROGEE_USER"
usermod --append --groups sudo "$ROGEE_USER"
usermod --append --groups docker "$ROGEE_USER"
install -d -o "$ROGEE_USER" -g "$ROGEE_USER" -m 0700 "/home/$ROGEE_USER/.ssh"
printf '%s\n' "$ROGEE_PUBLIC_KEY" >"/home/$ROGEE_USER/.ssh/authorized_keys"
chown "$ROGEE_USER:$ROGEE_USER" "/home/$ROGEE_USER/.ssh/authorized_keys"
chmod 0600 "/home/$ROGEE_USER/.ssh/authorized_keys"
cat >/etc/sudoers.d/agent-call-rogee <<'EOF'
rogee ALL=(root) NOPASSWD: /usr/bin/systemctl, /usr/bin/journalctl, /usr/bin/docker, /usr/bin/apt-get, /usr/bin/apt-cache
EOF
chmod 0440 /etc/sudoers.d/agent-call-rogee
visudo -cf /etc/sudoers.d/agent-call-rogee >/dev/null
cat >/etc/ssh/sshd_config.d/99-agent-call-rogee.conf <<'EOF'
Port 22
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin no
AllowUsers rogee
EOF
sshd -t
systemctl enable --now ssh
systemctl reload ssh
ASTERISK_CONFIG_GID="$(id -g "$ROGEE_USER")"
install -d -m 0750 "$ASTERISK_CONFIG_DIR"
write_config() {
local name="$1" payload="$2" path="$ASTERISK_CONFIG_DIR/$1"
local payload="$2" path="$ASTERISK_CONFIG_DIR/$1"
printf '%s' "$payload" | base64 --decode >"$path"
chgrp "$ASTERISK_CONFIG_GID" "$path"
chmod 0640 "$path"
@@ -25,19 +80,6 @@ write_config pjsip.conf "$PJSIP_CONF_B64"
write_config rtp.conf "$RTP_CONF_B64"
write_config extensions.conf "$EXTENSIONS_CONF_B64"
if ! command -v docker >/dev/null 2>&1; then
export DEBIAN_FRONTEND=noninteractive
while fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock >/dev/null 2>&1; do
sleep 5
done
until apt-get update; do
sleep 10
done
until apt-get install -y ca-certificates curl docker.io; do
sleep 10
done
fi
systemctl daemon-reload
systemctl enable --now docker
until docker info >/dev/null 2>&1; do