justme
016dbc2bbf
Use Agent for native, container, systemd and OpenWrt installations and signed updates. Remove retired Probe deployment templates and smoke scripts.
192 lines
6.9 KiB
Bash
192 lines
6.9 KiB
Bash
#!/bin/sh
|
|
# Installs moshiro-agent or moshiro-agent from an extracted release directory (the directory this script lives in).
|
|
# POSIX sh: runs on Debian/Ubuntu/Alpine/OpenWrt (busybox).
|
|
#
|
|
# ./install.sh agent --server https://panel.example.com --join <join-token> --name hk-1
|
|
# ./install.sh uninstall agent [--purge]
|
|
#
|
|
# Binaries go to /usr/lib/moshiro (root-owned: the collector cannot rewrite its own executable);
|
|
# config and identity go to /etc/moshiro (owned by the unprivileged `moshiro` user).
|
|
set -eu
|
|
|
|
PREFIX=/usr/lib/moshiro
|
|
CONFIG=/etc/moshiro
|
|
USER_NAME=moshiro
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
# busybox on OpenWrt has no `install`
|
|
put() { cp "$2" "$3" && chmod "$1" "$3"; }
|
|
die() { echo "install.sh: $*" >&2; exit 1; }
|
|
say() { echo "==> $*"; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || die "run as root"
|
|
|
|
init_system() {
|
|
if [ -d /run/systemd/system ]; then echo systemd
|
|
elif [ -f /etc/openwrt_release ]; then echo procd
|
|
else echo none; fi
|
|
}
|
|
|
|
check_openssl() {
|
|
for dir in /lib /usr/lib /lib64 /usr/lib64 /usr/lib/x86_64-linux-gnu /usr/lib/aarch64-linux-gnu /lib/x86_64-linux-gnu /lib/aarch64-linux-gnu; do
|
|
ls "$dir"/libssl.so.3* >/dev/null 2>&1 && return 0
|
|
done
|
|
die "OpenSSL 3 (libssl.so.3) is required. Debian/Ubuntu: apt install libssl3 | Alpine: apk add libssl3 | OpenWrt: opkg install libopenssl3 (newer snapshots: apk add libopenssl3)"
|
|
}
|
|
|
|
ensure_user() {
|
|
id "$USER_NAME" >/dev/null 2>&1 && return 0
|
|
if command -v useradd >/dev/null 2>&1; then
|
|
useradd --system --no-create-home --shell /usr/sbin/nologin "$USER_NAME"
|
|
elif command -v adduser >/dev/null 2>&1; then
|
|
adduser -S -D -H -s /sbin/nologin "$USER_NAME" 2>/dev/null || adduser -S -H -s /bin/false "$USER_NAME" 2>/dev/null || true
|
|
fi
|
|
if ! id "$USER_NAME" >/dev/null 2>&1 && [ -w /etc/passwd ] && [ -w /etc/group ]; then
|
|
# OpenWrt: no useradd/adduser in the default busybox; add a system user by hand
|
|
uid=900
|
|
while grep -q "^[^:]*:[^:]*:$uid:" /etc/passwd /etc/group 2>/dev/null; do uid=$((uid + 1)); done
|
|
echo "$USER_NAME:x:$uid:" >>/etc/group
|
|
echo "$USER_NAME:x:$uid:$uid:$USER_NAME:/var/run/$USER_NAME:/bin/false" >>/etc/passwd
|
|
fi
|
|
id "$USER_NAME" >/dev/null 2>&1 || {
|
|
echo "warning: could not create the '$USER_NAME' user; the service will run as root" >&2
|
|
return 1
|
|
}
|
|
}
|
|
|
|
install_binary() {
|
|
src="$1"
|
|
[ -f "$HERE/$src" ] || die "$HERE/$src not found (is this an extracted release?)"
|
|
mkdir -p "$PREFIX"
|
|
put 0755 "$HERE/$src" "$PREFIX/$src"
|
|
}
|
|
|
|
install_quic_runtime() {
|
|
[ -f "$HERE/libmsquic.so.2" ] || die "libmsquic.so.2 is missing from this Linux release archive"
|
|
[ -f "$HERE/libnuma.so.1" ] || die "libnuma.so.1 is missing from this Linux release archive"
|
|
set -- "$HERE"/lib*.so.*
|
|
mkdir -p "$PREFIX"
|
|
for library do put 0644 "$library" "$PREFIX/$(basename "$library")"; done
|
|
}
|
|
|
|
write_config() {
|
|
if [ "$1" = agent ]; then
|
|
cat >"$CONFIG/agent.json" <<JSON
|
|
{
|
|
"fleet": { "server": "$2", "identity_dir": "$CONFIG" },
|
|
"listen": { "bind": "::", "control_port": 7443, "quic_ports": [7443], "tcp_ports": [7444] },
|
|
"limits": { "max_total_mbps": 200, "max_total_pps": 20000, "allowed_target_cidrs": [], "max_concurrent_tests": 1 }
|
|
}
|
|
JSON
|
|
else
|
|
cat >"$CONFIG/agent.json" <<JSON
|
|
{
|
|
"fleet": { "server": "$2", "identity_dir": "$CONFIG" }
|
|
}
|
|
JSON
|
|
fi
|
|
chmod 0640 "$CONFIG/$1.json"
|
|
if [ "$have_user" -eq 1 ]; then chown "root:$(id -gn "$USER_NAME")" "$CONFIG/$1.json"; fi
|
|
}
|
|
|
|
install_role() {
|
|
role="$1"; shift
|
|
server=""; join=""; name=""; no_start=0
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--server) server="$2"; shift 2 ;;
|
|
--join) join="$2"; shift 2 ;;
|
|
--name) name="$2"; shift 2 ;;
|
|
--no-start) no_start=1; shift ;;
|
|
*) die "unknown option: $1" ;;
|
|
esac
|
|
done
|
|
|
|
check_openssl
|
|
have_user=0
|
|
ensure_user && have_user=1
|
|
mkdir -p "$CONFIG"
|
|
if [ "$have_user" -eq 1 ]; then chown "$USER_NAME" "$CONFIG"; fi
|
|
chmod 0750 "$CONFIG"
|
|
|
|
install_binary "moshiro-$role"
|
|
install_binary fleet-enroll
|
|
install_quic_runtime
|
|
say "installed binaries to $PREFIX"
|
|
|
|
init="$(init_system)"
|
|
case "$init" in
|
|
systemd)
|
|
put 0644 "$HERE/systemd/moshiro-$role.service" "/etc/systemd/system/moshiro-$role.service"
|
|
if [ "$have_user" -eq 0 ]; then sed -i '/^User=/d;/^Group=/d' "/etc/systemd/system/moshiro-$role.service"; fi
|
|
systemctl daemon-reload ;;
|
|
procd)
|
|
put 0755 "$HERE/openwrt/moshiro-agent.init" /etc/init.d/moshiro-agent
|
|
mkdir -p /lib/upgrade/keep.d
|
|
put 0644 "$HERE/openwrt/moshiro.keep" /lib/upgrade/keep.d/moshiro ;;
|
|
*) echo "warning: no systemd or procd found: start with LD_LIBRARY_PATH=$PREFIX $PREFIX/moshiro-$role --config $CONFIG/$role.json under your own supervisor" >&2 ;;
|
|
esac
|
|
|
|
ready=0
|
|
if [ -n "$server" ] && [ ! -f "$CONFIG/node.json" ]; then
|
|
[ -n "$join" ] && [ -n "$name" ] || die "--server needs --join and --name to enroll"
|
|
say "enrolling as $name"
|
|
if [ "$have_user" -eq 1 ]; then
|
|
su -s /bin/sh "$USER_NAME" -c "'$PREFIX/fleet-enroll' --server '$server' --join '$join' --name '$name' --identity-dir '$CONFIG'"
|
|
else
|
|
"$PREFIX/fleet-enroll" --server "$server" --join "$join" --name "$name" --identity-dir "$CONFIG"
|
|
fi
|
|
fi
|
|
if [ ! -f "$CONFIG/$role.json" ] && [ -n "$server" ]; then write_config "$role" "$server"; fi
|
|
if [ -f "$CONFIG/$role.json" ] && [ -f "$CONFIG/node.json" ]; then ready=1; fi
|
|
|
|
if [ "$ready" -eq 1 ] && [ "$no_start" -eq 0 ]; then
|
|
case "$init" in
|
|
systemd) systemctl enable --now "moshiro-$role" ;;
|
|
procd) /etc/init.d/moshiro-agent enable; /etc/init.d/moshiro-agent restart ;;
|
|
esac
|
|
say "moshiro-$role is installed"
|
|
else
|
|
say "installed, not started yet. Next:"
|
|
echo " $PREFIX/fleet-enroll --server <panel-url> --join <token> --name <name> --identity-dir $CONFIG (as the '$USER_NAME' user)"
|
|
echo " write $CONFIG/$role.json (see README.md), then: systemctl enable --now moshiro-$role"
|
|
echo " (OpenWrt: /etc/init.d/moshiro-agent enable && /etc/init.d/moshiro-agent start)"
|
|
fi
|
|
}
|
|
|
|
uninstall() {
|
|
role="$1"; purge=0
|
|
if [ "${2:-}" = "--purge" ]; then purge=1; fi
|
|
case "$(init_system)" in
|
|
systemd)
|
|
systemctl disable --now "moshiro-$role" 2>/dev/null || true
|
|
rm -f "/etc/systemd/system/moshiro-$role.service"
|
|
systemctl daemon-reload ;;
|
|
procd)
|
|
/etc/init.d/moshiro-agent stop 2>/dev/null || true
|
|
/etc/init.d/moshiro-agent disable 2>/dev/null || true
|
|
rm -f /etc/init.d/moshiro-agent /lib/upgrade/keep.d/moshiro ;;
|
|
esac
|
|
rm -f "$PREFIX/moshiro-$role"
|
|
rm -f "$PREFIX/fleet-enroll"
|
|
rm -f "$PREFIX"/lib*.so.*
|
|
rmdir "$PREFIX" 2>/dev/null || true
|
|
if [ "$purge" -eq 1 ]; then
|
|
rm -rf "$CONFIG"
|
|
say "removed $CONFIG (identity included: the node must enroll again)"
|
|
else
|
|
say "kept $CONFIG (use --purge to remove the identity as well)"
|
|
fi
|
|
}
|
|
|
|
cmd="${1:-}"
|
|
case "$cmd" in
|
|
agent) shift; install_role "$cmd" "$@" ;;
|
|
uninstall)
|
|
shift
|
|
role="${1:-}"
|
|
shift
|
|
uninstall "$role" "$@" ;;
|
|
*) die "usage: install.sh agent [options] | uninstall agent [--purge]" ;;
|
|
esac
|