Control and formatting updates.

deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eux
 cd "$(dirname "$0")"
 
 check_dependencies () {
@@ -13,13 +13,13 @@ check_dependencies () {
 }
 
 # Check system's dependencies
-check_dependencies wait-for-it dig rsync sshfs lxc docker-machine
+check_dependencies wait-for-it dig rsync sshfs lxc docker-machine duplicity
 # TODO remove dependency on Docker-machine. That's what we use to provision VM on 3rd party vendors. Looking for LXD endpoint.
 
 
 MIGRATE_VPS=false
 DOMAIN_NAME=
-VPS_HOSTING_TARGET=
+VPS_HOSTING_TARGET=lxd
 RUN_CERT_RENEWAL=true
 USER_NO_BACKUP=false
 USER_RUN_RESTORE=false
@@ -32,7 +32,7 @@ DEPLOY_BTCPAY_SERVER=false
 REDEPLOY_STACK=false
 MACVLAN_INTERFACE=
 
-
+# grab any modifications from the command line.
 for i in "$@"; do
     case $i in
         --aws)
@@ -41,6 +41,8 @@ for i in "$@"; do
         ;;
         --restore)
             USER_RUN_RESTORE=true
+            RUN_CERT_RENEWAL=false
+            USER_NO_BACKUP=true
             shift
         ;;
         --update-btcpay)
@@ -55,10 +57,6 @@ for i in "$@"; do
             MIGRATE_VPS=true
             shift
         ;;
-        --storage-backend=*)
-            LXD_DISK_TO_USE="${i#*=}"
-            shift
-        ;;
         --no-cert-renew)
             RUN_CERT_RENEWAL=false
             shift
@@ -71,6 +69,10 @@ for i in "$@"; do
             BTC_CHAIN=testnet
             shift
         ;;
+        --regtest)
+            BTC_CHAIN=regtest
+            shift
+        ;;
         --reconfigure-btcpay)
             RECONFIGURE_BTCPAY_SERVER=true
             shift
@@ -81,26 +83,193 @@ for i in "$@"; do
     esac
 done
 
+# set up our default paths.
+export CLUSTERS_DIR="$HOME/ss-clusters"
+export CACHES_DIR="$HOME/ss-cache"
+export SSH_HOME="$HOME/.ssh"
+
+export REGISTRY_DOCKER_IMAGE="registry:2"
+CURRENT_REMOTE="$(lxc remote get-default)"
+export LXD_REMOTE_PATH="$CLUSTERS_DIR/$CURRENT_REMOTE"
+export CURRENT_REMOTE="$CURRENT_REMOTE"
+
+mkdir -p "$CACHES_DIR" "$LXD_REMOTE_PATH"
+
+CLUSTER_DEFINTION="$LXD_REMOTE_PATH/cluster_definition"
+export CLUSTER_DEFINTION="$CLUSTER_DEFINTION"
+if [ ! -f "$CLUSTER_DEFINTION" ]; then
+    # stub out a cluster_definition.
+    cat >"$CLUSTER_DEFINTION" <<EOL
+#!/bin/bash
+
+# Note: the path above ./ corresponds to your LXD Remote. If your remote is set to 'cluster1'
+# Then $HOME/clusters/cluster1 will be your cluster working path.
+
+# This is REQUIRED. A list of all sites in ~/sites/ that will be deployed. 
+# e.g., 'domain1.tld,domain2.tld,domain3.tld'
+SITE_LIST="domain1.tld"
+
+# REQUIRED - change the MACVLAN_INTERFACE to the host adapter that attaches to the SERVERS LAN segment/VLAN/subnet.
+MACVLAN_INTERFACE="REQUIRED_CHANGE_ME"
+#LXD_DISK_TO_USE=""
+
+# Deploy a registry cache on your management machine.
+DEPLOY_REGISTRY=true
+
+# only relevant
+export REGISTRY_URL="http://\$HOSTNAME:5000"
+export REGISTRY_USERNAME=<USERNAME TO DOCKERHUB.COM>
+export REGISTRY_PASSWORD=<PASSWORD TO DOCKERHUB.COM>
+
+export MACVLAN_INTERFACE="\$MACVLAN_INTERFACE"
+export LXD_DISK_TO_USE="\$LXD_DISK_TO_USE"
+export SITE_LIST="\$SITE_LIST"
+
+EOL
+
+    chmod 0744 "$CLUSTER_DEFINTION"
+    echo "We stubbed out a '$CLUSTER_DEFINTION' file for you."
+    echo "Use this file to customize your cluster deployment;"
+    echo "Check out 'https://www.sovereign-stack.org/cluster-definition' for an example."
+    exit 1
+fi
+
+
+# if an authorized_keys file does not exist, we'll stub one out with the current user.
+# add additional id_rsa.pub entries manually for more administrative logins.
+if [ ! -f "$LXD_REMOTE_PATH/authorized_keys" ]; then
+    cat "$SSH_HOME/id_rsa.pub" >> "$LXD_REMOTE_PATH/authorized_keys"
+    echo "INFO: Sovereign Stack just stubbed out '$LXD_REMOTE_PATH/authorized_keys'. Go update it."
+    echo "      Add ssh pubkeys for your various management machines, if any. We've stubbed it out"
+    echo "      with your ssh pubkey at '$HOME/.ssh/id_rsa.pub'."
+    exit 1
+fi
+
+
+#########################################
 # check for the env file. Source it if there.
-if [ -f "$(pwd)/env" ]; then
+if [ -f "$CLUSTER_DEFINTION" ]; then
-    source "$(pwd)/env";
+    source "$CLUSTER_DEFINTION"
+
+    ###########################3
+    # # This section is done to the management machine. We deploy a registry pull through cache on port 5000
+    # if ! docker volume list | grep -q registry_data; then
+    #     docker volume create registry_data
+    # fi
+
+    # if the registry URL isn't defined, then we just use the upstream dockerhub.
+    # recommended to run a registry cache on your management machine though.
+    if [ ! -z "$REGISTRY_URL" ]; then
+
+cat > "$LXD_REMOTE_PATH/registry.yml" <<EOL
+version: 0.1
+http:
+  addr: 0.0.0.0:5000
+  host: ${REGISTRY_URL}
+
+proxy:
+    remoteurl: ${REGISTRY_URL}
+    username: ${REGISTRY_USERNAME}
+    password: ${REGISTRY_PASSWORD}
+EOL
+
+        # enable docker swarm mode so we can support docker stacks.
+        if ! docker info | grep -q "Swarm: active"; then
+            docker swarm init
+        fi
+    
+        mkdir -p "${CACHES_DIR}/registry_images"
+
+        # run a docker reigstry pull through cache on the management 
+        if ! docker stack list | grep -q registry; then
+            docker stack deploy -c management/registry_mirror.yml registry
+        fi
+    fi
 else
-    echo "ERROR: '$(pwd)/env' does not exist. Please go run install.sh again."
+    echo "ERROR: CLUSTER DEFINITION NOT PRESENT."
     exit 1
 fi
 
-# ensure the VPS_HOSTING_TARGET
+# iterate through our site list as provided by operator from cluster_definition
-if [ -z "$VPS_HOSTING_TARGET" ]; then
+for i in ${SITE_LIST//,/ }; do
-    echo "ERROR: You MUST specicy --hosting-provider=[lxd|aws]"
+    export DOMAIN_NAME="$i"
+
+    source ./defaults.sh
+
+    if [ -f "$SITE_PATH/site_definition" ]; then
+        source "$SITE_PATH/site_definition"
+    else
+
+        # check to see if the enf file exists. exist if not.
+        SITE_DEFINITION_PATH="$SITE_PATH/site_definition"
+        if [ ! -f "$SITE_DEFINITION_PATH" ]; then
+        
+function new_pass {
+    apg -a 1 -M nc -n 3 -m 26 -E GHIJKLMNOPQRSTUVWXYZ | head -n1 | awk '{print $1;}'
+} 
+
+# stub out a site_definition with new passwords.
+cat >"$SITE_DEFINITION_PATH" <<EOL
+#!/bin/bash
+
+#export SITE_TITLE="Short Title of Project"
+export DOMAIN_NAME="domain.tld"
+
+# duplicitiy backup archive password
+export DUPLICITY_BACKUP_PASSPHRASE="$(new_pass)"
+
+# AWS only
+#export DDNS_PASSWORD=
+#export SMTP_PASSWORD=
+
+## WWW
+export DEPLOY_WWW_SERVER=true
+
+# REQUIRED - CHANGE ME - RESERVE ME IN DHCP
+export WWW_MAC_ADDRESS="CHANGE_ME"
+
+# Deploy APPS to www
+export DEPLOY_GHOST=true
+export DEPLOY_NOSTR=false
+export DEPLOY_NEXTCLOUD=true
+export DEPLOY_ONION_SITE=false
+export NOSTR_ACCOUNT_PUBKEY="CHANGE_ME"
+
+# passwords for WWW apps
+export GHOST_MYSQL_PASSWORD="$(new_pass)"
+export GHOST_MYSQL_ROOT_PASSWORD="$(new_pass)"
+export NEXTCLOUD_MYSQL_PASSWORD="$(new_pass)"
+export GITEA_MYSQL_PASSWORD="$(new_pass)"
+export NEXTCLOUD_MYSQL_ROOT_PASSWORD="$(new_pass)"
+export GITEA_MYSQL_ROOT_PASSWORD="$(new_pass)"
+
+
+## BTCPAY SERVER
+export DEPLOY_BTCPAY_SERVER=false
+
+# REQUIRED if DEPLOY_BTCPAY_SERVER=true
+#export BTCPAY_MAC_ADDRESS="CHANGE_ME"
+
+## BTCPAY Server
+export DEPLOY_UMBREL_VPS=false
+
+# REQUIRED if DEPLOY_UMBREL_VPS=true
+#export UMBREL_MAC_ADDRESS="CHANGE_ME"
+
+# CHAIN to DEPLOY; valid are 'testnet' and 'mainnet'
+export BTC_CHAIN=regtest
+
+EOL
+
+            chmod 0744 "$SITE_DEFINITION_PATH"
+            echo "INFO: we stubbed a new site_defintion for you at '$SITE_DEFINITION_PATH'. Go update it yo!"
+            exit 1
+
+fi
+
         exit 1
     fi
 
-if [ -z "$DOMAIN_NAME" ]; then
-    echo "ERROR: You MUST specify --domain=domain.tld"
-    exit 1
-fi
-
-export DOMAIN_NAME="$DOMAIN_NAME"
     export VPS_HOSTING_TARGET="$VPS_HOSTING_TARGET"
     export LXD_DISK_TO_USE="$LXD_DISK_TO_USE"
     export RUN_CERT_RENEWAL="$RUN_CERT_RENEWAL"
@@ -117,9 +286,6 @@ export MACVLAN_INTERFACE="$MACVLAN_INTERFACE"
     #     exit 1
     # fi
 
-# shellcheck disable=SC1091
-source "$(pwd)/deployment/defaults.sh"
-
     # iterate over all our server endpoints and provision them if needed.
     # www
     VPS_HOSTNAME=
@@ -127,7 +293,7 @@ for APP_TO_DEPLOY in btcpay www umbrel; do
         FQDN=
         export APP_TO_DEPLOY="$APP_TO_DEPLOY"
         # shellcheck disable=SC1091
-    source "$(pwd)/deployment/shared.sh"
+        source ./shared.sh
 
         # skip this iteration if the site_definition says not to deploy btcpay server.
         if [ "$APP_TO_DEPLOY" = btcpay ]; then
@@ -161,8 +327,8 @@ for APP_TO_DEPLOY in btcpay www umbrel; do
         export FQDN="$VPS_HOSTNAME.$DOMAIN_NAME"
 
         # generate the docker yaml and nginx configs.
-    bash -c "$(pwd)/deployment/stub_docker_yml.sh"
+        bash -c ./deployment/stub_docker_yml.sh
-    bash -c "$(pwd)/deployment/stub_nginxconf.sh"
+        bash -c ./deployment/stub_nginxconf.sh
 
         MACHINE_EXISTS=false
         if [ "$VPS_HOSTING_TARGET" = aws ] && docker-machine ls -q | grep -q "$FQDN"; then
@@ -224,3 +390,6 @@ for APP_TO_DEPLOY in btcpay www umbrel; do
             RUN_RESTORE="$USER_RUN_RESTORE" RUN_BACKUP=false RUN_SERVICES=true "$(pwd)/deployment/domain_init.sh"
         fi
     done
+
+done
+

deployment/backup_btcpay.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -ex
+set -e
 
 # take the services down, create a backup archive, then pull it down.
 ssh "$FQDN" "cd $REMOTE_HOME/btcpayserver-docker/; sudo bash -c ./backup.sh"

deployment/backup_www.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 # TODO: We are using extra space on the remote VPS at the moment for the duplicity backup files.

deployment/domain_init.sh

@@ -9,12 +9,6 @@ if [ ! -f "$SSH_HOME/id_rsa" ]; then
     ssh-keygen -f "$SSH_HOME/id_rsa" -t ecdsa -b 521 -N ""
 fi
 
-# if an authorized_keys file does not exist, we'll stub one out with the current user.
-# add additional id_rsa.pub entries manually for more administrative logins.
-if [ ! -f "$SITE_PATH/authorized_keys" ]; then
-    cat "$SSH_HOME/id_rsa.pub" >> "$SITE_PATH/authorized_keys"
-fi
-
 ## This is a weird if clause since we need to LEFT-ALIGN the statement below.
 SSH_STRING="Host ${FQDN}"
 if ! grep -q "$SSH_STRING" "$SSH_HOME/config"; then
@@ -43,25 +37,14 @@ if [ "$VPS_HOSTING_TARGET" = aws ]; then
 elif [ "$VPS_HOSTING_TARGET" = lxd ]; then
     ssh-keygen -f "$SSH_HOME/known_hosts" -R "$FQDN"
 
-    #check to ensure the MACVLAN interface has been set by the user
-    if [ -z "$MACVLAN_INTERFACE" ]; then
-        echo "ERROR: MACVLAN_INTERFACE has not been defined. Use '--macvlan-interface=eno1' for example."
-        exit 1
-    fi
-
-    # let's first check to ensure there's a cert.tar.gz. We need a valid cert for testing.
-    if [ ! -f "$SITE_PATH/certs.tar.gz" ]; then
-        echo "ERROR: We need a valid cert for testing."
-        exit 1
-    fi
-
     # if the machine doesn't exist, we create it.
     if ! lxc list --format csv | grep -q "$LXD_VM_NAME"; then
         export RUN_BACKUP=false
 
         # create a base image if needed and instantiate a VM.
         if [ -z "$MAC_ADDRESS_TO_PROVISION" ]; then
-            echo "ERROR: You MUST define a MAC Address for all your machines."
+            echo "ERROR: You MUST define a MAC Address for all your machines by setting WWW_MAC_ADDRESS, BTCPAY_MAC_ADDRESS, UMBREL_MAC_ADDRESS, in your site defintion."
+            echo "INFO: IMPORTANT! You MUST have DHCP Reservations for these MAC addresses. You also need static DNS entries."
             exit 1
         fi
 
@@ -72,10 +55,16 @@ elif [ "$VPS_HOSTING_TARGET" = lxd ]; then
     ./prepare_vps_host.sh
 fi
 
+# if the local docker client isn't logged in, do so;
+# this helps prevent docker pull errors since they throttle.
+if [ ! -f "$HOME/.docker/config.json" ]; then
+    echo "$REGISTRY_PASSWORD" | docker login --username "$REGISTRY_USERNAME" --password-stdin
+fi
 
 # this tells our local docker client to target the remote endpoint via SSH
 export DOCKER_HOST="ssh://ubuntu@$FQDN"    
 
+
 # the following scripts take responsibility for the rest of the provisioning depending on the app you're deploying.
 if [ "$APP_TO_DEPLOY" = www ]; then
     ./go_www.sh

deployment/generate_certs.sh

@@ -1,7 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -e
-cd "$(dirname "$0")"
 
 
 if [ "$VPS_HOSTING_TARGET" = aws ]; then

deployment/go_btcpay.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 if [ "$RUN_BACKUP"  = true ]; then

deployment/go_umbrel.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 
 ssh "$FQDN" "
   set -x
@@ -32,7 +32,7 @@ ssh "$FQDN" "
 
 # Start services back up.
 ssh "$FQDN" "
-  set -ex
+  set -e
   cd /home/ubuntu/umbrel
 
   git config pull.rebase true

deployment/prepare_vps_host.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 
 # scan the remote machine and install it's identity in our SSH known_hosts file.
 ssh-keyscan -H -t ecdsa "$FQDN" >> "$SSH_HOME/known_hosts"

deployment/restore_btcpay.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+u
 
 # this scripts ASSUMES services have already been taken down.
 

deployment/run_btcpay_setup.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -ex
+set -e
 
 
 # export BTCPAY_FASTSYNC_ARCHIVE_FILENAME="utxo-snapshot-bitcoin-testnet-1445586.tar"
@@ -11,7 +11,7 @@ set -ex
 cat > "$SITE_PATH/btcpay.sh" <<EOL
 #!/bin/bash
 
-set -ex
+set -e
 
 # wait for cloud-init to complete yo
 while [ ! -f /var/lib/cloud/instance/boot-finished ]; do

deployment/stub_docker_yml.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 
@@ -269,6 +269,7 @@ cat >>"$DOCKER_YAML_PATH" <<EOL
     deploy:
       restart_policy:
         condition: on-failure
+        
 EOL
 
 if [ "$DEPLOY_ONION_SITE" = true ]; then

deployment/stub_nginxconf.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -exu
+set -eu
 cd "$(dirname "$0")"
 
 
@@ -104,6 +104,7 @@ cat >>"$NGINX_CONF_PATH" <<EOL
     ssl_stapling on;
     ssl_stapling_verify on;
     resolver 198.54.117.10;
+    # TODO change resolver to local DNS resolver, or inherit from system.
 
 
     # default server if hostname not specified.

management/registry_mirror.yml

@@ -0,0 +1,54 @@
+version: '3.8'
+services:
+  registry-mirror:
+    image: ${REGISTRY_DOCKER_IMAGE}
+    ports:
+      - 5000:5000
+    volumes:
+      - ${CACHES_DIR}/registry_images:/data
+    environment:
+      REGISTRY_HTTP_ADDR: :5000
+      REGISTRY_HTTP_HOST: http://0.0.0.0:5000
+      REGISTRY_HTTP_SECRET: ${REGISTRY_HTTP_SECRET:-CHANGEME}
+      REGISTRY_PROXY_REMOTEURL: ${REGISTRY_PROXY_REMOTEURL:-https://registry-1.docker.io}
+      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
+    configs:
+      - source: registry-config
+        target: /etc/docker/registry/config.yml
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+    # secrets:
+    #   - source: regmirror_tls_cert
+    #     target: /var/lib/registry/regmirror:5000.cert
+    #     uid: '0'
+    #     gid: '0'
+    #     mode: 0400
+    #   - source: regmirror_tls_key
+    #     target: /var/lib/registry/regmirror:5000.key
+    #     uid: '0'
+    #     gid: '0'
+    #     mode: 0400
+    #   - source: regmirror_ca_crt
+    #     target: /var/lib/registry/ca.crt
+    #     uid: '0'
+    #     gid: '0'
+    #     mode: 0400
+
+
+# secrets:
+#   regmirror_tls_cert:
+#     file: regmirror.cert
+#   regmirror_tls_key:
+#     file: regmirror.key
+#   regmirror_ca_crt:
+#     file: ca.crt
+
+configs:
+  registry-config:
+    file: ${LXD_REMOTE_PATH}/registry.yml
+
+volumes:
+  registry_data: