Installation/ss-mgmt provisioning improvements.
This commit is contained in:
parent
1775f28cdb
commit
e12ead7ede
GPG Key ID:
B443E530A14E1C90
50
install.sh
50
install.sh
|
|
@ -1,6 +1,6 @@
|
|||
#!/bin/bash
|
||||
|
||||
set -eu
|
||||
set -exu
|
||||
cd "$(dirname "$0")"
|
||||
|
||||
# see https://www.sovereign-stack.org/management/
|
||||
|
|
@ -16,19 +16,19 @@ DISK="rpool/lxd"
|
|||
|
||||
export DISK="$DISK"
|
||||
|
||||
# let's check to ensure the management machine is on the Baseline ubuntu 21.04
|
||||
# let's check to ensure the management machine is on the Baseline ubuntu
|
||||
# TODO maybe remove this check; this theoretically should work on anything that support bash and lxd?
|
||||
if ! lsb_release -d | grep -q "Ubuntu 22.04"; then
|
||||
echo "ERROR: Your machine is not running the Ubuntu 22.04 LTS baseline OS on your management machine."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# install snap
|
||||
# install lxd snap and initialize it
|
||||
if ! snap list | grep -q lxd; then
|
||||
sudo snap install lxd --channel=5.11/stable
|
||||
sudo snap install lxd
|
||||
sleep 5
|
||||
|
||||
# run lxd init on the remote server./dev/nvme1n1
|
||||
#
|
||||
# run lxd init
|
||||
cat <<EOF | lxd init --preseed
|
||||
config: {}
|
||||
networks:
|
||||
|
|
@ -65,53 +65,63 @@ EOF
|
|||
|
||||
fi
|
||||
|
||||
# pull the vm image down if it's not there.
|
||||
SS_ROOT_PATH="$HOME/.ss"
|
||||
|
||||
# pull the image down if it's not there.
|
||||
if ! lxc image list | grep -q "$UBUNTU_BASE_IMAGE_NAME"; then
|
||||
lxc image copy "images:$BASE_LXC_IMAGE" local: --alias "$UBUNTU_BASE_IMAGE_NAME" --vm --auto-update
|
||||
fi
|
||||
|
||||
# if the ss-mgmt doesn't exist, create it.
|
||||
if ! lxc list --format csv | grep -q ss-mgmt; then
|
||||
lxc init "images:$BASE_LXC_IMAGE" ss-mgmt --vm -c limits.cpu=4 -c limits.memory=4GiB --profile=default
|
||||
|
||||
# mount the pre-verified sovereign stack git repo into the new vm
|
||||
lxc config device add ss-mgmt sscode disk source="$(pwd)" path=/home/ubuntu/sovereign-stack
|
||||
|
||||
# if the System Owner has a ~/.ss directory, then we'll mount it into the vm
|
||||
# this allows the data to persist across ss-mgmt vms; ie. install/uninstall
|
||||
if [ -d "$SS_ROOT_PATH" ]; then
|
||||
lxc config device add ss-mgmt ssroot disk source="$SS_ROOT_PATH" path=/home/ubuntu/.ss
|
||||
fi
|
||||
fi
|
||||
|
||||
# start the vm if it's not already running
|
||||
if lxc list --format csv | grep -q "ss-mgmt,STOPPED"; then
|
||||
lxc start ss-mgmt
|
||||
sleep 20
|
||||
sleep 10
|
||||
fi
|
||||
|
||||
# wait for the vm to have an IP address
|
||||
. ./management/wait_for_lxc_ip.sh
|
||||
|
||||
|
||||
# TODO wait for cloud-init to finish (but in the VM)
|
||||
# while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
|
||||
# sleep 1
|
||||
# done
|
||||
# wait for the VM to complete its default cloud-init.
|
||||
while lxc exec ss-mgmt -- [ ! -f /var/lib/cloud/instance/boot-finished ]; do
|
||||
sleep 1
|
||||
done
|
||||
|
||||
SSH_PUBKEY_PATH="$HOME/.ssh/id_rsa.pub"
|
||||
if [ ! -f "$SSH_PUBKEY_PATH" ]; then
|
||||
ssh-keygen -f "$SSH_HOME/id_rsa" -t ecdsa -b 521 -N ""
|
||||
fi
|
||||
|
||||
# now run the mgmt provisioning script.
|
||||
|
||||
# place the bare metal mgmt machine ssh pubkey on the remote host in the authorzed_keys section
|
||||
if [ -f "$SSH_PUBKEY_PATH" ]; then
|
||||
lxc file push "$SSH_PUBKEY_PATH" ss-mgmt/home/ubuntu/.ssh/authorized_keys
|
||||
fi
|
||||
|
||||
# do some other preparations for user experience
|
||||
lxc file push ./management/bash_profile ss-mgmt/home/ubuntu/.bash_profile
|
||||
lxc file push ./management/bashrc ss-mgmt/home/ubuntu/.bashrc
|
||||
lxc file push ./management/motd ss-mgmt/etc/update-motd.d/sovereign-stack
|
||||
|
||||
# install SSH
|
||||
lxc exec ss-mgmt apt-get update
|
||||
lxc exec ss-mgmt -- apt-get install -y openssh-server
|
||||
lxc file push ./management/sshd_config ss-mgmt/etc/ssh/sshd_config
|
||||
lxc exec ss-mgmt -- sudo systemctl restart sshd
|
||||
|
||||
# make the Sovereign Stack commands available to the user via ~/.bashrc
|
||||
# we use ~/.bashrc
|
||||
# add 'ss-manage' to the bare metal ~/.bashrc
|
||||
ADDED_COMMAND=false
|
||||
if ! < "$HOME/.bashrc" grep -q "ss-manage"; then
|
||||
echo "alias ss-manage='$(pwd)/manage.sh \$@'" >> "$HOME/.bashrc"
|
||||
|
|
@ -131,13 +141,13 @@ ssh "ubuntu@$IP_V4_ADDRESS" sudo chown -R ubuntu:ubuntu /home/ubuntu
|
|||
|
||||
ssh "ubuntu@$IP_V4_ADDRESS" /home/ubuntu/sovereign-stack/management/provision.sh
|
||||
|
||||
lxc restart ss-mgmt
|
||||
#lxc restart ss-mgmt
|
||||
|
||||
if [ "$ADDED_COMMAND" = true ]; then
|
||||
echo "NOTICE! You need to run 'source ~/.bashrc' before continuing. After that, type 'ss-manage' to enter your management environment."
|
||||
fi
|
||||
|
||||
|
||||
. ./defaults.sh
|
||||
# As part of the install script, we pull down any other sovereign-stack git repos
|
||||
PROJECTS_SCRIPTS_REPO_URL="https://git.sovereign-stack.org/ss/project"
|
||||
PROJECTS_SCRIPTS_PATH="$(pwd)/deployment/project"
|
||||
|
|
@ -146,5 +156,7 @@ if [ ! -d "$PROJECTS_SCRIPTS_PATH" ]; then
|
|||
else
|
||||
cd "$PROJECTS_SCRIPTS_PATH"
|
||||
git pull origin main
|
||||
git checkout "$TARGET_PROJECT_GIT_COMMIT"
|
||||
cd -
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -5,9 +5,9 @@ cd "$(dirname "$0")"
|
|||
|
||||
# NOTE! This script MUST be executed as root.
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y gnupg ca-certificates curl lsb-release
|
||||
sudo apt-get install -y ca-certificates curl gnupg lsb-release
|
||||
|
||||
mkdir -p /etc/apt/keyrings
|
||||
sudo mkdir -m 0755 -p /etc/apt/keyrings
|
||||
|
||||
# add the docker gpg key to keyring for docker-ce-cli
|
||||
if [ ! -f /etc/apt/keyrings/docker.gpg ]; then
|
||||
|
|
@ -17,24 +17,24 @@ fi
|
|||
|
||||
# TODO REVIEW mgmt software requirements
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y wait-for-it dnsutils rsync sshfs apt-transport-https docker-ce-cli \
|
||||
libcanberra-gtk-module snapd nano git
|
||||
sudo apt-get install -y wait-for-it dnsutils rsync sshfs apt-transport-https docker-ce-cli libcanberra-gtk-module snapd nano git
|
||||
|
||||
sleep 1
|
||||
|
||||
#apt install python3-pip python3-dev libusb-1.0-0-dev libudev-dev pinentry-curses for trezor stuff
|
||||
# for trezor installation
|
||||
#pip3 install setuptools wheel
|
||||
#pip3 install trezor_agent
|
||||
sleep 10
|
||||
|
||||
# ensure the trezor-t udev rules are in place.
|
||||
# if [ ! -f /etc/udev/rules.d/51-trezor.rules ]; then
|
||||
# sudo cp ./51-trezor.rules /etc/udev/rules.d/51-trezor.rules
|
||||
# fi
|
||||
# #apt install python3-pip python3-dev libusb-1.0-0-dev libudev-dev pinentry-curses for trezor stuff
|
||||
# # for trezor installation
|
||||
# #pip3 install setuptools wheel
|
||||
# #pip3 install trezor_agent
|
||||
|
||||
# # ensure the trezor-t udev rules are in place.
|
||||
# # if [ ! -f /etc/udev/rules.d/51-trezor.rules ]; then
|
||||
# # sudo cp ./51-trezor.rules /etc/udev/rules.d/51-trezor.rules
|
||||
# # fi
|
||||
|
||||
# install snap
|
||||
if ! snap list | grep -q lxd; then
|
||||
sudo snap install lxd --channel=5.11/stable
|
||||
sudo snap install lxd
|
||||
sleep 6
|
||||
|
||||
# We just do an auto initialization. All we are using is the LXD client inside the management environment.
|
||||
|
|
|
|||
76
uninstall.sh
76
uninstall.sh
|
|
@ -1,6 +1,22 @@
|
|||
#!/bin/bash
|
||||
|
||||
set -eu
|
||||
set -exu
|
||||
|
||||
PURGE_LXD=false
|
||||
|
||||
# grab any modifications from the command line.
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
--purge)
|
||||
PURGE_LXD=true
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
echo "Unexpected option: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
# this script undoes install.sh
|
||||
if ! command -v lxc >/dev/null 2>&1; then
|
||||
|
|
@ -10,45 +26,45 @@ fi
|
|||
|
||||
. ./defaults.sh
|
||||
|
||||
if lxc list --format csv | grep -q ss-mgmt; then
|
||||
if lxc list --format csv | grep -q "ss-mgmt"; then
|
||||
|
||||
if ! lxc list --format csv | grep ss-mgmt | grep -q "RUNNING"; then
|
||||
if lxc list --format csv -q | grep -q "ss-mgmt,RUNNING"; then
|
||||
lxc stop ss-mgmt
|
||||
fi
|
||||
|
||||
lxc config device remove ss-mgmt sscode
|
||||
lxc delete ss-mgmt -f
|
||||
|
||||
SS_ROOT_PATH="$HOME/.ss"
|
||||
if [ -d "$SS_ROOT_PATH" ]; then
|
||||
lxc config device remove ss-mgmt ssroot
|
||||
fi
|
||||
|
||||
lxc delete ss-mgmt
|
||||
fi
|
||||
|
||||
if lxc profile device list default | grep -q root; then
|
||||
lxc profile device remove default root
|
||||
fi
|
||||
if [ "$PURGE_LXD" = true ]; then
|
||||
|
||||
if lxc profile device list default | grep -q enp5s0; then
|
||||
lxc profile device remove default enp5s0
|
||||
fi
|
||||
if lxc profile device list default | grep -q root; then
|
||||
lxc profile device remove default root
|
||||
fi
|
||||
|
||||
if lxc network list | grep -q lxdbr0; then
|
||||
lxc network delete lxdbr0
|
||||
fi
|
||||
if lxc profile device list default | grep -q enp5s0; then
|
||||
lxc profile device remove default enp5s0
|
||||
fi
|
||||
|
||||
if lxc image list | grep -q "$UBUNTU_BASE_IMAGE_NAME"; then
|
||||
lxc image delete "$UBUNTU_BASE_IMAGE_NAME"
|
||||
fi
|
||||
if lxc network list | grep -q lxdbr0; then
|
||||
lxc network delete lxdbr0
|
||||
fi
|
||||
|
||||
if lxc storage list --format csv | grep -q sovereign-stack; then
|
||||
lxc storage delete sovereign-stack
|
||||
fi
|
||||
if lxc image list | grep -q "$UBUNTU_BASE_IMAGE_NAME"; then
|
||||
lxc image delete "$UBUNTU_BASE_IMAGE_NAME"
|
||||
fi
|
||||
|
||||
if snap list | grep -q lxd; then
|
||||
sudo snap remove lxd
|
||||
sleep 2
|
||||
fi
|
||||
if lxc storage list --format csv | grep -q sovereign-stack; then
|
||||
lxc storage delete sovereign-stack
|
||||
fi
|
||||
|
||||
if zfs list | grep -q sovereign-stack; then
|
||||
sudo zfs destroy -r sovereign-stack
|
||||
fi
|
||||
|
||||
if zfs list | grep -q "sovereign-stack"; then
|
||||
sudo zfs destroy -r "rpool/lxd"
|
||||
fi
|
||||
if snap list | grep -q lxd; then
|
||||
sudo snap remove lxd
|
||||
fi
|
||||
fi
|
||||
Loading…
Reference in New Issue