84 lines
3.4 KiB
Bash
Executable File
84 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ ${EUID} -ne 0 ]]; then
|
|
echo 'install.sh must run as root' >&2
|
|
exit 1
|
|
fi
|
|
|
|
ALLOW_NONPRODUCTION=false
|
|
START=false
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--allow-nonproduction) ALLOW_NONPRODUCTION=true ;;
|
|
--start) START=true ;;
|
|
*) echo "unknown option: $arg" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
PACKAGE_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
cd -- "$PACKAGE_DIR"
|
|
[[ -f package.SHA256SUMS ]] || { echo 'package.SHA256SUMS is missing' >&2; exit 1; }
|
|
sha256sum -c package.SHA256SUMS
|
|
|
|
. /etc/os-release
|
|
[[ ${ID:-} == debian && ${VERSION_ID:-} == 13 ]] || {
|
|
echo 'Debian 13 is required' >&2
|
|
exit 1
|
|
}
|
|
[[ $(uname -m) == x86_64 ]] || { echo 'amd64 host is required' >&2; exit 1; }
|
|
|
|
if ! grep -q '"source_dirty": false' manifest.json ||
|
|
! grep -q '"production_approval": true' manifest.json; then
|
|
if [[ "$ALLOW_NONPRODUCTION" != true ]]; then
|
|
echo 'release is dirty or not production-approved; use an approved package or --allow-nonproduction for smoke only' >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
VERSION=$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' manifest.json)
|
|
LOCK_VERSION=$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' versions.lock.json)
|
|
[[ "$VERSION" =~ ^[0-9A-Za-z][0-9A-Za-z.+_-]*$ ]] || { echo 'invalid release version' >&2; exit 1; }
|
|
[[ "$VERSION" == "$LOCK_VERSION" ]] || { echo 'release/version lock mismatch' >&2; exit 1; }
|
|
|
|
id -u rogee >/dev/null 2>&1 || useradd --create-home --shell /bin/bash rogee
|
|
install -d -m 0755 /opt/sip-go-agent/releases \
|
|
/etc/sip-go-agent/pki /etc/sip-go-agent/artifacts
|
|
install -d -m 0700 -o rogee -g rogee \
|
|
/var/lib/sip-go-agent/agent /var/lib/sip-go-agent/agent/spool \
|
|
/var/lib/sip-go-agent/dispatcher
|
|
install -m 0755 cell/nonprod-call-evidence.sh /usr/local/sbin/agent-call-nonprod-evidence
|
|
command -v visudo >/dev/null || { echo 'visudo is required for the non-production capture gate' >&2; exit 1; }
|
|
cat >/etc/sudoers.d/agent-call-nonprod-evidence <<'EOF'
|
|
rogee ALL=(root) NOPASSWD: /usr/local/sbin/agent-call-nonprod-evidence
|
|
EOF
|
|
chmod 0440 /etc/sudoers.d/agent-call-nonprod-evidence
|
|
visudo -cf /etc/sudoers.d/agent-call-nonprod-evidence >/dev/null
|
|
|
|
RELEASE_DIR=/opt/sip-go-agent/releases/$VERSION
|
|
install -d -m 0755 "$RELEASE_DIR"
|
|
install -m 0755 sip-go-agent "$RELEASE_DIR/sip-go-agent"
|
|
install -m 0644 go.mod go.sum manifest.json versions.lock.json "$RELEASE_DIR/"
|
|
ln -sfn "$RELEASE_DIR" /opt/sip-go-agent/current
|
|
chown -R root:root /opt/sip-go-agent/releases "$RELEASE_DIR"
|
|
|
|
install -m 0644 systemd/sip-go-agent-agent.service /etc/systemd/system/sip-go-agent-agent.service
|
|
install -m 0644 systemd/sip-go-agent-dispatcher.service /etc/systemd/system/sip-go-agent-dispatcher.service
|
|
if [[ ! -e /etc/sip-go-agent/agent.env ]]; then
|
|
install -m 0600 env/agent.env.example /etc/sip-go-agent/agent.env
|
|
fi
|
|
if [[ ! -e /etc/sip-go-agent/dispatcher.env ]]; then
|
|
install -m 0600 env/dispatcher.env.example /etc/sip-go-agent/dispatcher.env
|
|
fi
|
|
if [[ ! -e /etc/sip-go-agent/agent-endpoints.json ]]; then
|
|
install -m 0644 config/agent-endpoints.example.json /etc/sip-go-agent/agent-endpoints.json
|
|
fi
|
|
install -m 0644 versions.lock.json /etc/sip-go-agent/versions.lock.json
|
|
systemctl daemon-reload
|
|
systemctl enable sip-go-agent-agent.service sip-go-agent-dispatcher.service
|
|
|
|
if [[ "$START" == true ]]; then
|
|
systemctl restart sip-go-agent-dispatcher.service sip-go-agent-agent.service
|
|
fi
|
|
printf 'installed version=%s mode=physical-systemd start=%s\n' "$VERSION" "$START"
|