Installation/ss-mgmt provisioning improvements.

install.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -eu
+set -exu
 cd "$(dirname "$0")"
 
 # see https://www.sovereign-stack.org/management/
@@ -16,19 +16,19 @@ DISK="rpool/lxd"
 
 export DISK="$DISK"
 
-# let's check to ensure the management machine is on the Baseline ubuntu 21.04
+# let's check to ensure the management machine is on the Baseline ubuntu
+# TODO maybe remove this check; this theoretically should work on anything that support bash and lxd?
 if ! lsb_release -d | grep -q "Ubuntu 22.04"; then
     echo "ERROR: Your machine is not running the Ubuntu 22.04 LTS baseline OS on your management machine."
     exit 1
 fi
 
-# install snap
+# install lxd snap and initialize it
 if ! snap list | grep -q lxd; then
-    sudo snap install lxd --channel=5.11/stable
+    sudo snap install lxd
     sleep 5
 
-    # run lxd init on the remote server./dev/nvme1n1
+    # run lxd init
-    # 
     cat <<EOF | lxd init --preseed
 config: {}
 networks:
@@ -65,53 +65,63 @@ EOF
 
 fi
 
-# pull the vm image down if it's not there.
+SS_ROOT_PATH="$HOME/.ss"
+
+# pull the image down if it's not there.
 if ! lxc image list | grep -q "$UBUNTU_BASE_IMAGE_NAME"; then
     lxc image copy "images:$BASE_LXC_IMAGE" local: --alias "$UBUNTU_BASE_IMAGE_NAME" --vm --auto-update
 fi
 
+# if the ss-mgmt doesn't exist, create it.
 if ! lxc list --format csv | grep -q ss-mgmt; then
     lxc init "images:$BASE_LXC_IMAGE" ss-mgmt --vm -c limits.cpu=4 -c limits.memory=4GiB --profile=default
 
     # mount the pre-verified sovereign stack git repo into the new vm
     lxc config device add ss-mgmt sscode disk source="$(pwd)" path=/home/ubuntu/sovereign-stack
+
+    # if the System Owner has a ~/.ss directory, then we'll mount it into the vm
+    # this allows the data to persist across ss-mgmt vms; ie. install/uninstall
+    if [ -d "$SS_ROOT_PATH" ]; then
+        lxc config device add ss-mgmt ssroot disk source="$SS_ROOT_PATH" path=/home/ubuntu/.ss
+    fi
 fi
 
+# start the vm if it's not already running
 if lxc list --format csv | grep -q "ss-mgmt,STOPPED"; then
     lxc start ss-mgmt
-    sleep 20
+    sleep 10
 fi
 
+# wait for the vm to have an IP address
 . ./management/wait_for_lxc_ip.sh
 
-
+# wait for the VM to complete its default cloud-init.
-# TODO wait for cloud-init to finish (but in the VM)
+while lxc exec ss-mgmt -- [ ! -f /var/lib/cloud/instance/boot-finished ]; do
-# while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
+    sleep 1
-#     sleep 1
+done
-# done
 
 SSH_PUBKEY_PATH="$HOME/.ssh/id_rsa.pub"
 if [ ! -f "$SSH_PUBKEY_PATH" ]; then
     ssh-keygen -f "$SSH_HOME/id_rsa" -t ecdsa -b 521 -N ""
 fi
 
-# now run the mgmt provisioning script.
+# place the bare metal mgmt machine ssh pubkey on the remote host in the authorzed_keys section
-
 if [ -f "$SSH_PUBKEY_PATH" ]; then
     lxc file push "$SSH_PUBKEY_PATH" ss-mgmt/home/ubuntu/.ssh/authorized_keys
 fi
 
+# do some other preparations for user experience
 lxc file push ./management/bash_profile ss-mgmt/home/ubuntu/.bash_profile
 lxc file push ./management/bashrc ss-mgmt/home/ubuntu/.bashrc
 lxc file push ./management/motd ss-mgmt/etc/update-motd.d/sovereign-stack
 
+# install SSH
 lxc exec ss-mgmt apt-get update
 lxc exec ss-mgmt -- apt-get install -y openssh-server
 lxc file push ./management/sshd_config ss-mgmt/etc/ssh/sshd_config
 lxc exec ss-mgmt -- sudo systemctl restart sshd
 
-# make the Sovereign Stack commands available to the user via ~/.bashrc
+# add 'ss-manage' to the bare metal ~/.bashrc
-# we use ~/.bashrc
 ADDED_COMMAND=false
 if ! < "$HOME/.bashrc" grep -q "ss-manage"; then
     echo "alias ss-manage='$(pwd)/manage.sh \$@'" >> "$HOME/.bashrc"
@@ -131,13 +141,13 @@ ssh "ubuntu@$IP_V4_ADDRESS" sudo chown -R ubuntu:ubuntu /home/ubuntu
 
 ssh "ubuntu@$IP_V4_ADDRESS" /home/ubuntu/sovereign-stack/management/provision.sh
 
-lxc restart ss-mgmt
+#lxc restart ss-mgmt
 
 if [ "$ADDED_COMMAND" = true ]; then
     echo "NOTICE! You need to run 'source ~/.bashrc' before continuing. After that, type 'ss-manage' to enter your management environment."
 fi
 
-
+. ./defaults.sh
 # As part of the install script, we pull down any other sovereign-stack git repos
 PROJECTS_SCRIPTS_REPO_URL="https://git.sovereign-stack.org/ss/project"
 PROJECTS_SCRIPTS_PATH="$(pwd)/deployment/project"
@@ -146,5 +156,7 @@ if [ ! -d "$PROJECTS_SCRIPTS_PATH" ]; then
 else
     cd "$PROJECTS_SCRIPTS_PATH"
     git pull origin main
+    git checkout "$TARGET_PROJECT_GIT_COMMIT"
     cd -
 fi
+

management/provision.sh

@@ -5,9 +5,9 @@ cd "$(dirname "$0")"
 
 # NOTE! This script MUST be executed as root.
 sudo apt-get update
-sudo apt-get install -y gnupg ca-certificates curl lsb-release
+sudo apt-get install -y ca-certificates curl gnupg lsb-release
 
-mkdir -p /etc/apt/keyrings
+sudo mkdir -m 0755 -p /etc/apt/keyrings
 
 # add the docker gpg key to keyring for docker-ce-cli
 if [ ! -f /etc/apt/keyrings/docker.gpg ]; then
@@ -17,24 +17,24 @@ fi
 
 # TODO REVIEW mgmt software requirements
 sudo apt-get update
-sudo apt-get install -y wait-for-it dnsutils rsync sshfs apt-transport-https docker-ce-cli \
+sudo apt-get install -y wait-for-it dnsutils rsync sshfs apt-transport-https docker-ce-cli libcanberra-gtk-module snapd nano git
-    libcanberra-gtk-module snapd nano git
 
-sleep 1
 
-#apt install python3-pip python3-dev libusb-1.0-0-dev libudev-dev pinentry-curses  for trezor stuff
+sleep 10
-# for trezor installation
-#pip3 install setuptools wheel
-#pip3 install trezor_agent
 
-# ensure the trezor-t udev rules are in place.
+# #apt install python3-pip python3-dev libusb-1.0-0-dev libudev-dev pinentry-curses  for trezor stuff
-# if [ ! -f /etc/udev/rules.d/51-trezor.rules ]; then
+# # for trezor installation
-#     sudo cp ./51-trezor.rules /etc/udev/rules.d/51-trezor.rules
+# #pip3 install setuptools wheel
-# fi
+# #pip3 install trezor_agent
+
+# # ensure the trezor-t udev rules are in place.
+# # if [ ! -f /etc/udev/rules.d/51-trezor.rules ]; then
+# #     sudo cp ./51-trezor.rules /etc/udev/rules.d/51-trezor.rules
+# # fi
 
 # install snap
 if ! snap list | grep -q lxd; then
-    sudo snap install lxd --channel=5.11/stable
+    sudo snap install lxd
     sleep 6
 
     # We just do an auto initialization. All we are using is the LXD client inside the management environment.

uninstall.sh

@@ -1,6 +1,22 @@
 #!/bin/bash
 
-set -eu
+set -exu
+
+PURGE_LXD=false
+
+# grab any modifications from the command line.
+for i in "$@"; do
+    case $i in
+        --purge)
+            PURGE_LXD=true
+            shift
+        ;;
+        *)
+        echo "Unexpected option: $1"
+        exit 1
+        ;;
+    esac
+done
 
 # this script undoes install.sh
 if ! command -v lxc >/dev/null 2>&1; then
@@ -10,16 +26,24 @@ fi
 
 . ./defaults.sh
 
-if lxc list --format csv | grep -q ss-mgmt; then
+if lxc list --format csv | grep -q "ss-mgmt"; then
 
-    if ! lxc list --format csv | grep ss-mgmt | grep -q "RUNNING"; then
+    if lxc list --format csv -q | grep -q "ss-mgmt,RUNNING"; then
         lxc stop ss-mgmt
     fi
 
     lxc config device remove ss-mgmt sscode
-    lxc delete ss-mgmt -f
+
+    SS_ROOT_PATH="$HOME/.ss"
+    if [ -d "$SS_ROOT_PATH" ]; then
+        lxc config device remove ss-mgmt ssroot
     fi
 
+    lxc delete ss-mgmt
+fi
+
+if [ "$PURGE_LXD" = true ]; then
+
     if lxc profile device list default | grep -q root; then
         lxc profile device remove default root
     fi
@@ -42,13 +66,5 @@ fi
 
     if snap list | grep -q lxd; then
         sudo snap remove lxd
-    sleep 2
     fi
-
-if zfs list | grep -q sovereign-stack; then
-    sudo zfs destroy -r sovereign-stack
-fi
-
-if zfs list | grep -q "sovereign-stack"; then
-    sudo zfs destroy -r "rpool/lxd"
 fi