37 lines
1.2 KiB
Bash
Executable File
37 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
NODE_ID=${1:?usage: bootstrap.sh NODE_ID MAP_FILE}
|
|
MAP_FILE=${2:?usage: bootstrap.sh NODE_ID MAP_FILE}
|
|
test "$(id -u)" -eq 0
|
|
test -s "$MAP_FILE"
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq ca-certificates curl git jq openssh-server python3 rsync unattended-upgrades
|
|
|
|
getent group guanghu >/dev/null || groupadd --system guanghu
|
|
for account in guanghu-authz guanghu-sentinel; do
|
|
id -u "$account" >/dev/null 2>&1 || useradd --system --home /nonexistent --shell /usr/sbin/nologin "$account"
|
|
usermod -aG guanghu "$account"
|
|
done
|
|
|
|
install -d -o root -g guanghu -m 750 /etc/guanghu /var/lib/guanghu
|
|
install -d -o root -g root -m 700 /etc/guanghu/secrets
|
|
install -d -o root -g root -m 755 /etc/guanghu/navigation-maps /opt/guanghu
|
|
install -m 644 "$MAP_FILE" "/etc/guanghu/navigation-maps/${NODE_ID}.json"
|
|
|
|
cat > /etc/guanghu/node.json <<EOF
|
|
{
|
|
"schema": "guanghu.node/v1",
|
|
"node_id": "${NODE_ID}",
|
|
"upstream": "JD-FD-PRIMARY",
|
|
"navigation_map": "/etc/guanghu/navigation-maps/${NODE_ID}.json",
|
|
"secret_policy": "private material stays in /etc/guanghu/secrets"
|
|
}
|
|
EOF
|
|
chmod 644 /etc/guanghu/node.json
|
|
|
|
systemctl enable --now ssh unattended-upgrades
|
|
printf 'GUANGHU_NODE_READY=%s\n' "$NODE_ID"
|