126 lines
4.3 KiB
Bash
126 lines
4.3 KiB
Bash
#!/usr/bin/env bash
|
|
# User-data template. build_asterisk_userdata.py prepends the image and config payloads.
|
|
set -euo pipefail
|
|
|
|
: "${ASTERISK_IMAGE:?generated user-data must set an immutable Asterisk image digest}"
|
|
: "${HTTP_CONF_B64:?missing http.conf payload}"
|
|
: "${ARI_CONF_B64:?missing ari.conf payload}"
|
|
: "${PJSIP_CONF_B64:?missing pjsip.conf payload}"
|
|
: "${RTP_CONF_B64:?missing rtp.conf payload}"
|
|
: "${EXTENSIONS_CONF_B64:?missing extensions.conf payload}"
|
|
|
|
ROGEE_USER="rogee"
|
|
ROGEE_PUBLIC_KEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPoGJTH1JrXbWu+ZhIgaHMhume0oWQiWmadhTwbk75Ny rogee@ipao.vip"
|
|
ASTERISK_CONFIG_DIR="/opt/agent-call/asterisk/generated"
|
|
ASTERISK_CONFIG_GID="${ASTERISK_CONFIG_GID:-1000}"
|
|
|
|
if [[ "$(id -u)" != 0 ]]; then
|
|
echo 'ECS user-data must run as root' >&2
|
|
exit 1
|
|
fi
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
if ! command -v docker >/dev/null 2>&1 || ! command -v sshd >/dev/null 2>&1 || ! command -v sudo >/dev/null 2>&1; then
|
|
while fuser /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock >/dev/null 2>&1; do
|
|
sleep 5
|
|
done
|
|
until apt-get update; do
|
|
sleep 10
|
|
done
|
|
until apt-get install -y --no-install-recommends ca-certificates curl docker.io docker-cli openssh-server sudo; do
|
|
sleep 10
|
|
done
|
|
fi
|
|
|
|
if ! getent group sudo >/dev/null 2>&1; then
|
|
groupadd --system sudo
|
|
fi
|
|
if ! getent group docker >/dev/null 2>&1; then
|
|
groupadd --system docker
|
|
fi
|
|
if ! id -u "$ROGEE_USER" >/dev/null 2>&1; then
|
|
useradd --create-home --shell /bin/bash "$ROGEE_USER"
|
|
fi
|
|
usermod --shell /bin/bash "$ROGEE_USER"
|
|
usermod --append --groups sudo "$ROGEE_USER"
|
|
usermod --append --groups docker "$ROGEE_USER"
|
|
install -d -o "$ROGEE_USER" -g "$ROGEE_USER" -m 0700 "/home/$ROGEE_USER/.ssh"
|
|
printf '%s\n' "$ROGEE_PUBLIC_KEY" >"/home/$ROGEE_USER/.ssh/authorized_keys"
|
|
chown "$ROGEE_USER:$ROGEE_USER" "/home/$ROGEE_USER/.ssh/authorized_keys"
|
|
chmod 0600 "/home/$ROGEE_USER/.ssh/authorized_keys"
|
|
cat >/etc/sudoers.d/agent-call-rogee <<'EOF'
|
|
rogee ALL=(root) NOPASSWD: /usr/bin/systemctl, /usr/bin/journalctl, /usr/bin/docker, /usr/bin/apt-get, /usr/bin/apt-cache
|
|
EOF
|
|
chmod 0440 /etc/sudoers.d/agent-call-rogee
|
|
visudo -cf /etc/sudoers.d/agent-call-rogee >/dev/null
|
|
cat >/etc/ssh/sshd_config.d/99-agent-call-rogee.conf <<'EOF'
|
|
Port 22
|
|
PubkeyAuthentication yes
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
ChallengeResponseAuthentication no
|
|
PermitRootLogin no
|
|
AllowUsers rogee
|
|
EOF
|
|
sshd -t
|
|
systemctl enable --now ssh
|
|
systemctl reload ssh
|
|
ASTERISK_CONFIG_GID="$(id -g "$ROGEE_USER")"
|
|
|
|
install -d -m 0750 "$ASTERISK_CONFIG_DIR"
|
|
write_config() {
|
|
local payload="$2" path="$ASTERISK_CONFIG_DIR/$1"
|
|
printf '%s' "$payload" | base64 --decode >"$path"
|
|
chgrp "$ASTERISK_CONFIG_GID" "$path"
|
|
chmod 0640 "$path"
|
|
}
|
|
write_config http.conf "$HTTP_CONF_B64"
|
|
write_config ari.conf "$ARI_CONF_B64"
|
|
write_config pjsip.conf "$PJSIP_CONF_B64"
|
|
write_config rtp.conf "$RTP_CONF_B64"
|
|
write_config extensions.conf "$EXTENSIONS_CONF_B64"
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now docker
|
|
until docker info >/dev/null 2>&1; do
|
|
sleep 5
|
|
done
|
|
until docker pull "$ASTERISK_IMAGE"; do
|
|
sleep 15
|
|
done
|
|
|
|
docker rm -f agent-call-asterisk >/dev/null 2>&1 || true
|
|
docker volume create agent-call-recordings >/dev/null
|
|
docker run -d \
|
|
--name agent-call-asterisk \
|
|
--network host \
|
|
--restart unless-stopped \
|
|
--stop-timeout 60 \
|
|
--log-opt max-size=10m \
|
|
--log-opt max-file=3 \
|
|
-v "$ASTERISK_CONFIG_DIR/http.conf:/etc/asterisk/http.conf:ro" \
|
|
-v "$ASTERISK_CONFIG_DIR/ari.conf:/etc/asterisk/ari.conf:ro" \
|
|
-v "$ASTERISK_CONFIG_DIR/pjsip.conf:/etc/asterisk/pjsip.conf:ro" \
|
|
-v "$ASTERISK_CONFIG_DIR/rtp.conf:/etc/asterisk/rtp.conf:ro" \
|
|
-v "$ASTERISK_CONFIG_DIR/extensions.conf:/etc/asterisk/extensions.conf:ro" \
|
|
-v agent-call-recordings:/var/spool/asterisk/recording \
|
|
"$ASTERISK_IMAGE"
|
|
|
|
ready=0
|
|
for _ in $(seq 1 60); do
|
|
if docker exec agent-call-asterisk asterisk -rx 'core show version' >/dev/null 2>&1; then
|
|
ready=1
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if [[ "$ready" != 1 ]]; then
|
|
echo 'Asterisk did not become CLI-ready; inspect docker logs' >&2
|
|
exit 1
|
|
fi
|
|
docker exec agent-call-asterisk asterisk -rx 'pjsip set logger on'
|
|
docker exec agent-call-asterisk asterisk -rx 'pjsip show endpoint provider-primary'
|
|
install -d -m 0750 /var/lib/agent-call
|
|
date -u +%Y-%m-%dT%H:%M:%SZ >/var/lib/agent-call/bootstrap.done
|
|
chmod 0600 /var/lib/agent-call/bootstrap.done
|