justme
016dbc2bbf
Use Agent for native, container, systemd and OpenWrt installations and signed updates. Remove retired Probe deployment templates and smoke scripts.
160 lines
7.0 KiB
Bash
160 lines
7.0 KiB
Bash
#!/bin/sh
|
|
# Install signed OCI updates for system services (Podman/Docker) or rootless Podman user services.
|
|
# Rootless: install-updater.sh agent --user --volume V --helper-image I --image-repo R --unit U
|
|
# System: sudo install-updater.sh agent --engine podman|docker --volume V --helper-image I --image-repo R --unit U
|
|
set -eu
|
|
|
|
COMPONENT="${1:-}"; shift || true
|
|
case "$COMPONENT" in agent) ;; *) echo "usage: install-updater.sh <agent> [--user] [--engine podman|docker] --data-dir D --image-repo R --unit U [--policy auto|manual] [--channel dev|release] [--health-url URL] [--authfile F] [--no-enable]" >&2; exit 2 ;; esac
|
|
DATA_DIR=""; IMAGE_REPO=""; UNIT=""; POLICY=manual; AUTHFILE=""; ENGINE=podman; SERVICE_SCOPE=system; ENABLE=true; DATA_VOLUME=""; STATUS_VOLUME=""; HELPER_IMAGE=""
|
|
CHANNEL=""; HEALTH_URL=""
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--user) SERVICE_SCOPE=user; shift ;;
|
|
--engine) ENGINE="$2"; shift 2 ;;
|
|
--volume) DATA_VOLUME="$2"; shift 2 ;;
|
|
--status-volume) STATUS_VOLUME="$2"; shift 2 ;;
|
|
--helper-image) HELPER_IMAGE="$2"; shift 2 ;;
|
|
--data-dir) DATA_DIR="$2"; shift 2 ;;
|
|
--image-repo) IMAGE_REPO="$2"; shift 2 ;;
|
|
--unit) UNIT="$2"; shift 2 ;;
|
|
--policy) POLICY="$2"; shift 2 ;;
|
|
--channel) CHANNEL="$2"; shift 2 ;;
|
|
--health-url) HEALTH_URL="$2"; shift 2 ;;
|
|
--authfile) AUTHFILE="$2"; shift 2 ;;
|
|
--no-enable) ENABLE=false; shift ;;
|
|
*) echo "unknown option: $1" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
if [ -z "$IMAGE_REPO" ] || [ -z "$UNIT" ] || { [ -z "$DATA_DIR" ] && [ -z "$DATA_VOLUME" ]; }; then
|
|
echo "--image-repo, --unit and --volume (or legacy --data-dir) are required" >&2; exit 2
|
|
fi
|
|
case "$POLICY" in auto|manual) ;; *) echo "--policy must be auto or manual" >&2; exit 2 ;; esac
|
|
case "$ENGINE" in podman|docker) ;; *) echo "--engine must be podman or docker" >&2; exit 2 ;; esac
|
|
if [ -n "$DATA_VOLUME" ]; then
|
|
[ -z "$DATA_DIR" ] || { echo "use --volume or --data-dir, not both" >&2; exit 2; }
|
|
[ -n "$HELPER_IMAGE" ] || { echo "--volume needs --helper-image (an already pulled MoShiro image)" >&2; exit 2; }
|
|
STATUS_VOLUME="${STATUS_VOLUME:-moshiro-$COMPONENT-status}"
|
|
"$ENGINE" image inspect "$HELPER_IMAGE" >/dev/null
|
|
"$ENGINE" volume inspect "$DATA_VOLUME" >/dev/null 2>&1 || "$ENGINE" volume create "$DATA_VOLUME" >/dev/null
|
|
"$ENGINE" volume inspect "$STATUS_VOLUME" >/dev/null 2>&1 || "$ENGINE" volume create "$STATUS_VOLUME" >/dev/null
|
|
else
|
|
case "$DATA_DIR" in /*) ;; *) echo "--data-dir must be absolute" >&2; exit 2 ;; esac
|
|
fi
|
|
|
|
if [ "$SERVICE_SCOPE" = user ]; then
|
|
[ "$(id -u)" -ne 0 ] || { echo "--user must run as the rootless Podman user, without sudo" >&2; exit 1; }
|
|
[ "$ENGINE" = podman ] || { echo "--user currently supports rootless Podman; Docker uses system services" >&2; exit 2; }
|
|
CONF_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/moshiro"
|
|
STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/moshiro-update"
|
|
UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
|
|
BIN_DIR="$HOME/.local/bin"
|
|
TARGET=default.target
|
|
else
|
|
[ "$(id -u)" -eq 0 ] || { echo "system installation needs root; use --user for rootless Podman" >&2; exit 1; }
|
|
CONF_DIR=/etc/moshiro-update
|
|
STATE_DIR=/var/lib/moshiro-update
|
|
UNIT_DIR=/etc/systemd/system
|
|
BIN_DIR=/usr/local/sbin
|
|
TARGET=multi-user.target
|
|
fi
|
|
service_ctl() {
|
|
if [ "$SERVICE_SCOPE" = user ]; then systemctl --user "$@"; else systemctl "$@"; fi
|
|
}
|
|
# Config is sourced by the updater; quote arguments as shell data.
|
|
shell_quote() { printf "'"; printf '%s' "$1" | sed "s/'/'\"'\"'/g"; printf "'"; }
|
|
unit_escape() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'; }
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
install -d -m 755 "$CONF_DIR" "$STATE_DIR" "$UNIT_DIR" "$BIN_DIR"
|
|
BIN="$BIN_DIR/moshiro-update"
|
|
install -m 755 "$HERE/moshiro-update.sh" "$BIN"
|
|
install -m 644 "$HERE/release-key.pub.pem" "$CONF_DIR/release-key.pub.pem"
|
|
if [ -n "$DATA_VOLUME" ]; then
|
|
: # Named volumes are initialized by the image; no host directory or chown needed.
|
|
elif [ "$SERVICE_SCOPE" = user ]; then
|
|
install -d -m 700 "$DATA_DIR/update"
|
|
else
|
|
install -d -m 755 -o 1654 -g 1654 "$DATA_DIR/update"
|
|
fi
|
|
if [ -z "$DATA_VOLUME" ]; then install -d -m 755 "$DATA_DIR/update-status"; fi
|
|
# Rootless service templates mount update-status separately read-only.
|
|
ENV_FILE="$CONF_DIR/$COMPONENT.image"
|
|
PUBKEY="$CONF_DIR/release-key.pub.pem"
|
|
{
|
|
for name in DATA_DIR IMAGE_REPO UNIT PUBKEY ENV_FILE STATE_DIR POLICY AUTHFILE ENGINE SERVICE_SCOPE DATA_VOLUME STATUS_VOLUME HELPER_IMAGE CHANNEL HEALTH_URL; do
|
|
case "$name" in
|
|
DATA_DIR) value="$DATA_DIR" ;; IMAGE_REPO) value="$IMAGE_REPO" ;; UNIT) value="$UNIT" ;;
|
|
PUBKEY) value="$PUBKEY" ;; ENV_FILE) value="$ENV_FILE" ;; STATE_DIR) value="$STATE_DIR" ;;
|
|
DATA_VOLUME) value="$DATA_VOLUME" ;; STATUS_VOLUME) value="$STATUS_VOLUME" ;; HELPER_IMAGE) value="$HELPER_IMAGE" ;;
|
|
POLICY) value="$POLICY" ;; AUTHFILE) value="$AUTHFILE" ;; ENGINE) value="$ENGINE" ;; SERVICE_SCOPE) value="$SERVICE_SCOPE" ;;
|
|
CHANNEL) value="$CHANNEL" ;; HEALTH_URL) value="$HEALTH_URL" ;;
|
|
esac
|
|
printf '%s=' "$name"; shell_quote "$value"; printf '\n'
|
|
done
|
|
} > "$CONF_DIR/$COMPONENT.conf"
|
|
chmod 600 "$CONF_DIR/$COMPONENT.conf"
|
|
|
|
if [ -n "$DATA_VOLUME" ]; then
|
|
cat > "$UNIT_DIR/moshiro-update-$COMPONENT.service" <<UNITFILE
|
|
[Unit]
|
|
Description=Check/apply signed volume update for moshiro-$COMPONENT
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
TimeoutStartSec=300
|
|
Environment="MOSHIRO_UPDATE_CONF_DIR=$(unit_escape "$CONF_DIR")"
|
|
ExecStart="$(unit_escape "$BIN")" check $COMPONENT
|
|
UNITFILE
|
|
cat > "$UNIT_DIR/moshiro-update-$COMPONENT.timer" <<UNITFILE
|
|
[Unit]
|
|
Description=Poll the update volume for moshiro-$COMPONENT
|
|
|
|
[Timer]
|
|
OnBootSec=10s
|
|
OnUnitInactiveSec=30s
|
|
Unit=moshiro-update-$COMPONENT.service
|
|
|
|
[Install]
|
|
WantedBy=$TARGET
|
|
UNITFILE
|
|
else
|
|
for action in check apply; do
|
|
cat > "$UNIT_DIR/moshiro-update-$action-$COMPONENT.service" <<UNITFILE
|
|
[Unit]
|
|
Description=$action the signed update for moshiro-$COMPONENT
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
TimeoutStartSec=300
|
|
Environment="MOSHIRO_UPDATE_CONF_DIR=$(unit_escape "$CONF_DIR")"
|
|
ExecStart="$(unit_escape "$BIN")" $action $COMPONENT
|
|
UNITFILE
|
|
watched=offer.sig
|
|
[ "$action" != apply ] || watched=apply.request
|
|
cat > "$UNIT_DIR/moshiro-update-$action-$COMPONENT.path" <<UNITFILE
|
|
[Unit]
|
|
Description=Watch $action events for moshiro-$COMPONENT
|
|
|
|
[Path]
|
|
PathChanged=$DATA_DIR/update/$watched
|
|
Unit=moshiro-update-$action-$COMPONENT.service
|
|
|
|
[Install]
|
|
WantedBy=$TARGET
|
|
UNITFILE
|
|
done
|
|
fi
|
|
if [ "$ENABLE" = true ]; then
|
|
service_ctl daemon-reload
|
|
if [ -n "$DATA_VOLUME" ]; then
|
|
service_ctl disable --now "moshiro-update-check-$COMPONENT.path" "moshiro-update-apply-$COMPONENT.path" >/dev/null 2>&1 || true
|
|
service_ctl enable --now "moshiro-update-$COMPONENT.timer"
|
|
else
|
|
service_ctl disable --now "moshiro-update-$COMPONENT.timer" >/dev/null 2>&1 || true
|
|
service_ctl enable --now "moshiro-update-check-$COMPONENT.path" "moshiro-update-apply-$COMPONENT.path"
|
|
fi
|
|
fi
|
|
echo "updater installed for $COMPONENT (engine: $ENGINE, scope: $SERVICE_SCOPE, policy: $POLICY)"
|
|
echo "container service must read IMAGE from $ENV_FILE"
|