Compare commits
12
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 l.kirchner
|
43c19f2cce | ||
|
l.kirchner
|
63a735e697 | ||
|
l.kirchner
|
ebdd3f5eac | ||
|
l.kirchner
|
f06e873118 | ||
|
l.kirchner
|
ad04edec5b | ||
|
l.kirchner
|
2941afa53f | ||
|
l.kirchner
|
cad741a97c | ||
|
l.kirchner
|
828e3d1aad | ||
|
l.kirchner
|
ab0354bc22 | ||
|
l.kirchner
|
e8bace387d | ||
|
l.kirchner
|
559ad8dc2d | ||
|
l.kirchner
|
0ee7ceae55 |
+107
@@ -0,0 +1,107 @@
|
||||
#!/usr/bin/env bash
|
||||
# Authentik — zentraler Homelab-IdP (nexus ADR-0003)
|
||||
#
|
||||
# Creates an unprivileged Debian 12 LXC with nesting enabled that runs the
|
||||
# official Authentik docker-compose stack (server, worker, postgres, redis).
|
||||
#
|
||||
# Automation-friendly by design (nexus-hub K-102):
|
||||
# - bootstrap admin password AND API token are generated headlessly
|
||||
# (-> /root/authentik.credentials) so an agent can apply blueprints via
|
||||
# API without ever touching the UI
|
||||
# - optional dedicated SSH public key for agent access (Claude Code)
|
||||
# - blueprints dir mounted at /opt/authentik/blueprints (compose override)
|
||||
#
|
||||
# Manual steps that remain AFTER this script (by design):
|
||||
# 1. NPMplus: proxy host auth.<domain> -> http://<LXC-IP>:9000
|
||||
# (WebSockets ON; the auth domain is PERMANENT — WebAuthn RP-ID!)
|
||||
# 2. Passkey enrollment of the human admin account
|
||||
#
|
||||
# Run on a Proxmox VE host:
|
||||
# bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/authentik.sh)"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
APP="authentik"
|
||||
APP_DESCRIPTION="Authentik IdP (Docker-Compose) — Passkeys, TOTP, OIDC für nexus & Homelab"
|
||||
APP_PORT="${APP_PORT:-9000}"
|
||||
|
||||
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||
INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/authentik-install.sh}"
|
||||
|
||||
source <(curl -fsSL "$LIB_URL/build.func")
|
||||
|
||||
# LXC defaults (server+worker+postgres+redis brauchen Luft)
|
||||
DEFAULT_HOSTNAME="authentik"
|
||||
DEFAULT_DISK="20"
|
||||
DEFAULT_CORES="2"
|
||||
DEFAULT_RAM="4096"
|
||||
|
||||
prompt_app_config() {
|
||||
echo
|
||||
echo "── Authentik configuration ─────────────────────────────────"
|
||||
if [[ -z "${AUTH_DOMAIN:-}" ]]; then
|
||||
read -rp "Auth-Domain (dauerhaft! WebAuthn-RP-ID), z. B. auth.luki-net.org: " AUTH_DOMAIN
|
||||
fi
|
||||
[[ -n "${AUTH_DOMAIN:-}" ]] || { msg_err "AUTH_DOMAIN ist Pflicht"; exit 1; }
|
||||
if [[ -z "${CLAUDE_SSH_PUBKEY:-}" ]]; then
|
||||
read -rp "SSH-Public-Key für Agent-Zugang (leer = überspringen): " CLAUDE_SSH_PUBKEY || true
|
||||
fi
|
||||
# Authentik-Version: leer = Default des offiziellen Compose-Files
|
||||
AUTHENTIK_TAG="${AUTHENTIK_TAG:-}"
|
||||
echo " → domain: $AUTH_DOMAIN port: $APP_PORT tag: ${AUTHENTIK_TAG:-compose-default}"
|
||||
}
|
||||
|
||||
push_app_config() {
|
||||
msg_info "Pushing config into container..."
|
||||
local tmpf; tmpf=$(mktemp)
|
||||
cat >"$tmpf" <<EOF
|
||||
AUTH_DOMAIN='$AUTH_DOMAIN'
|
||||
APP_PORT='$APP_PORT'
|
||||
AUTHENTIK_TAG='$AUTHENTIK_TAG'
|
||||
CLAUDE_SSH_PUBKEY='${CLAUDE_SSH_PUBKEY:-}'
|
||||
EOF
|
||||
pct push "$CTID" "$tmpf" /root/authentik.deploy.env --perms 600
|
||||
rm -f "$tmpf"
|
||||
}
|
||||
|
||||
# Docker im unprivilegierten LXC braucht nesting+keyctl — vor dem Bootstrap setzen.
|
||||
enable_nesting() {
|
||||
msg_info "Enabling nesting+keyctl features (Docker in unprivileged LXC)..."
|
||||
pct set "$CTID" --features nesting=1,keyctl=1
|
||||
pct reboot "$CTID"
|
||||
# warten bis der Container wieder antwortet
|
||||
for _ in $(seq 1 30); do
|
||||
pct exec "$CTID" -- true >/dev/null 2>&1 && break
|
||||
sleep 2
|
||||
done
|
||||
msg_ok "Container restarted with nesting enabled"
|
||||
}
|
||||
|
||||
print_app_summary() {
|
||||
cat <<EOF
|
||||
Authentik: http://$IP_CT:$APP_PORT (UI nach erstem Start, dauert 1–2 min)
|
||||
Credentials/API-Token: /root/authentik.credentials (im LXC; akadmin + Bootstrap-Token)
|
||||
Blueprints: /opt/authentik/blueprints (gemountet; Agent legt YAMLs ab,
|
||||
Quelle versioniert in nexus-hub infra/authentik/)
|
||||
|
||||
⚠️ JETZT MANUELL (dauerhaft — WebAuthn-RP-ID):
|
||||
NPMplus: Proxy Host $AUTH_DOMAIN → http://$IP_CT:$APP_PORT (WebSockets: ON)
|
||||
|
||||
Danach: Agent (Claude Code) per SSH übernimmt Blueprints/OIDC-Provider;
|
||||
zuletzt Passkey-Enrollment des menschlichen Admin-Accounts über $AUTH_DOMAIN.
|
||||
|
||||
Logs: pct exec $CTID -- docker compose -f /opt/authentik/docker-compose.yml logs -f
|
||||
EOF
|
||||
}
|
||||
|
||||
trap _on_error ERR
|
||||
preflight_pve
|
||||
show_header "$APP" "$APP_DESCRIPTION"
|
||||
prompt_lxc_config
|
||||
prompt_app_config
|
||||
resolve_debian_template
|
||||
create_lxc
|
||||
enable_nesting
|
||||
push_app_config
|
||||
bootstrap_install_script "$INSTALL_SCRIPT_URL"
|
||||
print_summary
|
||||
Executable
+95
@@ -0,0 +1,95 @@
|
||||
#!/usr/bin/env bash
|
||||
# nexus-db — PostgreSQL 16 (+pgvector) for nexus (Family Knowledge Hub)
|
||||
#
|
||||
# Creates an unprivileged Debian 12 LXC that:
|
||||
# - runs PostgreSQL 16 from the PGDG repo with the pgvector extension
|
||||
# - hosts database `nexus` owned by a least-privilege role `nexus`
|
||||
# - accepts connections ONLY from the nexus app LXC (pg_hba allowlist);
|
||||
# every other host is rejected
|
||||
#
|
||||
# Companion card: nexus-hub K-102. Run on a Proxmox VE host:
|
||||
# bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/nexus-db.sh)"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
APP="nexus-db"
|
||||
APP_DESCRIPTION="PostgreSQL 16 + pgvector for nexus (access restricted to the nexus LXC)"
|
||||
|
||||
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||
INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/nexus-db-install.sh}"
|
||||
|
||||
# LXC defaults (DB only: small CPU, RAM matters for shared_buffers/cache)
|
||||
DEFAULT_HOSTNAME="nexus-db"
|
||||
DEFAULT_DISK="16"
|
||||
DEFAULT_CORES="2"
|
||||
DEFAULT_RAM="4096"
|
||||
|
||||
DEFAULT_DB_NAME="nexus"
|
||||
DEFAULT_DB_USER="nexus"
|
||||
DEFAULT_DB_PORT="5432"
|
||||
|
||||
source <(curl -fsSL "$LIB_URL/build.func")
|
||||
|
||||
# ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
|
||||
prompt_app_config() {
|
||||
echo
|
||||
echo "── nexus-db configuration ───────────────────────────────────"
|
||||
# The ONLY host that may connect (pg_hba allowlist) — the nexus app LXC.
|
||||
if [[ -z "${NEXUS_APP_IP:-}" ]]; then
|
||||
read -rp "IP of the nexus app LXC (sole allowed client): " NEXUS_APP_IP
|
||||
fi
|
||||
[[ -n "${NEXUS_APP_IP:-}" ]] || { msg_err "NEXUS_APP_IP is required (pg_hba allowlist)"; exit 1; }
|
||||
|
||||
DB_NAME="${DB_NAME:-$DEFAULT_DB_NAME}"
|
||||
DB_USER="${DB_USER:-$DEFAULT_DB_USER}"
|
||||
DB_PORT="${DB_PORT:-$DEFAULT_DB_PORT}"
|
||||
|
||||
echo " → database: $DB_NAME role: $DB_USER port: $DB_PORT"
|
||||
echo " → allowed client: $NEXUS_APP_IP/32 (everything else is rejected)"
|
||||
}
|
||||
|
||||
# ── push gathered config into the container for the installer to consume ─────
|
||||
push_app_config() {
|
||||
msg_info "Pushing db config into container..."
|
||||
local tmpf; tmpf=$(mktemp)
|
||||
cat >"$tmpf" <<EOF
|
||||
NEXUS_APP_IP='$NEXUS_APP_IP'
|
||||
DB_NAME='$DB_NAME'
|
||||
DB_USER='$DB_USER'
|
||||
DB_PORT='$DB_PORT'
|
||||
EOF
|
||||
pct push "$CTID" "$tmpf" /root/nexus-db.deploy.env --perms 600
|
||||
rm -f "$tmpf"
|
||||
}
|
||||
|
||||
# ── trailing summary ─────────────────────────────────────────────────────────
|
||||
print_app_summary() {
|
||||
local pg_state
|
||||
pg_state=$(pct exec "$CTID" -- systemctl is-active postgresql 2>/dev/null | tr -d '\r\n')
|
||||
cat <<EOF
|
||||
PostgreSQL 16: $IP_CT:$DB_PORT — $pg_state
|
||||
Database: $DB_NAME (owner: $DB_USER, extension: vector)
|
||||
Allowed client: $NEXUS_APP_IP/32 — all other hosts are rejected
|
||||
Credentials + DSN: /root/nexus-db.credentials (inside the LXC)
|
||||
|
||||
Smoke test FROM THE NEXUS LXC (uses the DSN from the credentials file):
|
||||
psql "postgresql://$DB_USER:<password>@$IP_CT:$DB_PORT/$DB_NAME" -c "SELECT extname FROM pg_extension;"
|
||||
|
||||
Negative test from any OTHER host (must fail):
|
||||
psql "postgresql://$DB_USER:<password>@$IP_CT:$DB_PORT/$DB_NAME" -c "SELECT 1;"
|
||||
|
||||
Logs: pct exec $CTID -- journalctl -u postgresql -f
|
||||
EOF
|
||||
}
|
||||
|
||||
# ── orchestrate ───────────────────────────────────────────────────────────────
|
||||
trap _on_error ERR
|
||||
preflight_pve
|
||||
show_header "$APP" "$APP_DESCRIPTION"
|
||||
prompt_lxc_config
|
||||
prompt_app_config
|
||||
resolve_debian_template
|
||||
create_lxc
|
||||
push_app_config
|
||||
bootstrap_install_script "$INSTALL_SCRIPT_URL"
|
||||
print_summary
|
||||
+155
@@ -0,0 +1,155 @@
|
||||
#!/usr/bin/env bash
|
||||
# Allgemeiner Gitea-Actions-Runner — instanzweit, OHNE Deploy-Rechte
|
||||
#
|
||||
# Motivation (nexus K-114-Blocker): Der nexus-Runner läuft auf dem
|
||||
# Produktions-LXC und besitzt sudoers-Deploy-Rechte — er darf deshalb NICHT
|
||||
# instanzweit registriert werden (jedes Repo könnte sonst Workflows auf der
|
||||
# Produktionsmaschine ausführen). Dieser LXC ist die saubere Trennung:
|
||||
# - instanzweite Registrierung (Site Administration → Actions → Runners)
|
||||
# - Label "homelab:host" (Deploy-Jobs bleiben auf "nexus")
|
||||
# - KEINE sudoers-Regeln, kein Zugriff auf Produktions-Verzeichnisse
|
||||
# - Docker via Nesting für Wegwerf-Test-Container (z. B. pgvector in CI)
|
||||
#
|
||||
# Sicherheitsmodell: siehe Kopfkommentar in install/runner-install.sh —
|
||||
# instanzweit + docker-Gruppe heißt: jedes Repo der Instanz kann diesen LXC
|
||||
# kontrollieren. Akzeptiert, WEIL er nichts besitzt. Nicht auf privilegierte
|
||||
# LXCs übertragen.
|
||||
#
|
||||
# Run on a Proxmox VE host:
|
||||
# bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/runner.sh)"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
APP="runner"
|
||||
APP_DESCRIPTION="Allgemeiner Gitea-Actions-Runner (instanzweit, Label homelab, Docker, ohne Deploy-Rechte)"
|
||||
|
||||
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||
INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/runner-install.sh}"
|
||||
|
||||
source <(curl -fsSL "$LIB_URL/build.func")
|
||||
|
||||
DEFAULT_HOSTNAME="runner"
|
||||
DEFAULT_DISK="30"
|
||||
DEFAULT_CORES="4"
|
||||
DEFAULT_RAM="6144"
|
||||
|
||||
# ── Validierung (Review-Finding 80): Werte wandern in die Deploy-Env und in
|
||||
# systemd/argv — strikte Zeichenklassen, Re-Prompt statt Abbruch.
|
||||
# Bewusst LOKALE Validatoren: die Libs werden zur Laufzeit von main geladen,
|
||||
# dieses Script muss aber unabhängig vom Merge-Stand der K-114-Helfer
|
||||
# (prompt_validated/require_valid) funktionieren. Semantik ist identisch;
|
||||
# Konsolidierung auf die build.func-Helfer ist als Follow-up notiert. ──────
|
||||
_valid_url() { [[ "$1" =~ ^https?://[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]]; }
|
||||
_valid_token() { [[ "$1" =~ ^[A-Za-z0-9_-]{16,128}$ ]]; }
|
||||
_valid_word() { [[ "$1" =~ ^[A-Za-z0-9._:,-]+$ ]]; }
|
||||
|
||||
_prompt_until_valid() { # var prompt default validator secret(0|1)
|
||||
local __var="$1" __prompt="$2" __default="$3" __validator="$4" __secret="${5:-0}" __val
|
||||
while true; do
|
||||
if [[ "$__secret" == "1" ]]; then
|
||||
read -rsp "$__prompt" __val || { echo; msg_err "Eingabe abgebrochen (EOF)"; exit 1; }
|
||||
echo
|
||||
else
|
||||
read -rp "$__prompt" __val || { echo; msg_err "Eingabe abgebrochen (EOF)"; exit 1; }
|
||||
fi
|
||||
__val="${__val:-$__default}"
|
||||
if [[ -n "$__val" ]] && "$__validator" "$__val"; then
|
||||
printf -v "$__var" '%s' "$__val"
|
||||
return 0
|
||||
fi
|
||||
msg_warn "Ungültige Eingabe — bitte erneut (kein Paste mit Sonderzeichen)."
|
||||
done
|
||||
}
|
||||
|
||||
prompt_app_config() {
|
||||
echo
|
||||
echo "── Runner configuration ─────────────────────────────────────"
|
||||
# env-präsetzte Werte werden validiert (Abbruch bei ungültig — K-114-Konvention),
|
||||
# interaktive Eingaben re-prompten bis gültig.
|
||||
if [[ -n "${GITEA_INSTANCE_URL:-}" ]]; then
|
||||
_valid_url "$GITEA_INSTANCE_URL" || { msg_err "GITEA_INSTANCE_URL (env) ungültig"; exit 1; }
|
||||
else
|
||||
_prompt_until_valid GITEA_INSTANCE_URL \
|
||||
"Gitea instance URL [https://gitea.luki-net.org]: " \
|
||||
"https://gitea.luki-net.org" _valid_url 0
|
||||
fi
|
||||
# WICHTIG: den INSTANZWEITEN Token verwenden
|
||||
# (Site Administration → Actions → Runners → Create new runner),
|
||||
# NICHT den Repo-Token — sonst wiederholt sich der K-114-Scope-Blocker.
|
||||
if [[ -n "${RUNNER_TOKEN:-}" ]]; then
|
||||
_valid_token "$RUNNER_TOKEN" || { msg_err "RUNNER_TOKEN (env) ungültig (16–128 Zeichen [A-Za-z0-9_-])"; exit 1; }
|
||||
else
|
||||
_prompt_until_valid RUNNER_TOKEN \
|
||||
"INSTANZWEITER Runner-Registration-Token: " \
|
||||
"" _valid_token 1
|
||||
fi
|
||||
RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"
|
||||
RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
|
||||
RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
|
||||
NODE_MAJOR="${NODE_MAJOR:-22}"
|
||||
_valid_word "$RUNNER_NAME" || { msg_err "RUNNER_NAME ungültig"; exit 1; }
|
||||
_valid_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS ungültig"; exit 1; }
|
||||
[[ "$RUNNER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { msg_err "RUNNER_VERSION ungültig"; exit 1; }
|
||||
[[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] || { msg_err "NODE_MAJOR ungültig"; exit 1; }
|
||||
echo " → instance: $GITEA_INSTANCE_URL"
|
||||
echo " → runner: $RUNNER_NAME labels: $RUNNER_LABELS (act_runner $RUNNER_VERSION, host mode, scope: INSTANZ)"
|
||||
}
|
||||
|
||||
push_app_config() {
|
||||
msg_info "Pushing runner config into container..."
|
||||
local tmpf; tmpf=$(mktemp)
|
||||
# Werte sind oben strikt validiert (keine Quotes/Whitespace möglich) —
|
||||
# damit ist die env-Datei frei von Quoting-/Injection-Fallen (vgl. Finding 76).
|
||||
cat >"$tmpf" <<EOF
|
||||
GITEA_INSTANCE_URL=$GITEA_INSTANCE_URL
|
||||
RUNNER_TOKEN=$RUNNER_TOKEN
|
||||
RUNNER_NAME=$RUNNER_NAME
|
||||
RUNNER_LABELS=$RUNNER_LABELS
|
||||
RUNNER_VERSION=$RUNNER_VERSION
|
||||
NODE_MAJOR=$NODE_MAJOR
|
||||
EOF
|
||||
pct push "$CTID" "$tmpf" /root/runner.deploy.env --perms 600
|
||||
rm -f "$tmpf"
|
||||
}
|
||||
|
||||
# Docker im unprivilegierten LXC braucht nesting+keyctl (Test-Container in CI).
|
||||
enable_nesting() {
|
||||
msg_info "Enabling nesting+keyctl features (Docker für CI-Test-Container)..."
|
||||
pct set "$CTID" --features nesting=1,keyctl=1
|
||||
pct reboot "$CTID"
|
||||
for _ in $(seq 1 30); do
|
||||
pct exec "$CTID" -- true >/dev/null 2>&1 && break
|
||||
sleep 2
|
||||
done
|
||||
msg_ok "Container restarted with nesting enabled"
|
||||
}
|
||||
|
||||
print_app_summary() {
|
||||
local runner_state
|
||||
runner_state=$(pct exec "$CTID" -- systemctl is-active act-runner.service 2>/dev/null | tr -d '\r\n')
|
||||
cat <<EOF
|
||||
Gitea-Actions-Runner: $RUNNER_NAME [$RUNNER_LABELS] — $runner_state
|
||||
Scope: INSTANZWEIT — bedient alle Repos der Instanz
|
||||
Mode: host (Docker verfügbar für Test-Container)
|
||||
Sicherheit: kein sudoers, keine Deploy-Rechte, keine Produktions-Mounts
|
||||
(Modell: siehe install/runner-install.sh Kopfkommentar)
|
||||
Verify: $GITEA_INSTANCE_URL → Site Administration → Actions → Runners
|
||||
|
||||
Workflows anderer Repos nutzen: runs-on: ${RUNNER_LABELS%%:*}
|
||||
(Deploy-Jobs von nexus bleiben auf dem nexus-LXC-Runner, Label "nexus".)
|
||||
|
||||
Logs: pct exec $CTID -- journalctl -u act-runner -f
|
||||
EOF
|
||||
}
|
||||
|
||||
trap _on_error ERR
|
||||
preflight_pve
|
||||
show_header "$APP" "$APP_DESCRIPTION"
|
||||
prompt_lxc_config
|
||||
prompt_app_config
|
||||
resolve_debian_template
|
||||
create_lxc
|
||||
enable_nesting
|
||||
push_app_config
|
||||
bootstrap_install_script "$INSTALL_SCRIPT_URL"
|
||||
print_summary
|
||||
@@ -0,0 +1,139 @@
|
||||
#!/usr/bin/env bash
|
||||
# Authentik installer — runs inside the LXC, called by ct/authentik.sh
|
||||
#
|
||||
# Installs Docker + the official Authentik docker-compose stack, headless:
|
||||
# - secrets generated on-host (PG_PASS, AUTHENTIK_SECRET_KEY) — never printed
|
||||
# - bootstrap admin (akadmin) password + API token generated so that an
|
||||
# agent can configure everything via API/blueprints without the UI
|
||||
# - blueprints dir mounted via docker-compose.override.yml
|
||||
# - optional dedicated SSH key for agent access appended to authorized_keys
|
||||
#
|
||||
# Idempotent: re-running keeps existing secrets/.env and only updates images.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||
source <(curl -fsSL "$LIB_URL/install.func")
|
||||
|
||||
[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
|
||||
|
||||
CONF="/root/authentik.deploy.env"
|
||||
[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
|
||||
set -a; . "$CONF"; set +a
|
||||
: "${AUTH_DOMAIN:?missing AUTH_DOMAIN}"
|
||||
APP_PORT="${APP_PORT:-9000}"
|
||||
|
||||
AK_DIR="/opt/authentik"
|
||||
ENV_FILE="$AK_DIR/.env"
|
||||
CRED_FILE="/root/authentik.credentials"
|
||||
|
||||
# ── base packages + Docker ────────────────────────────────────────────────────
|
||||
setup_base_apt ca-certificates curl
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
msg_info "Installing Docker (get.docker.com)..."
|
||||
curl -fsSL https://get.docker.com | sh >/dev/null
|
||||
msg_ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
|
||||
else
|
||||
msg_warn "Docker already present, skipping"
|
||||
fi
|
||||
|
||||
# ── optional: dedicated agent SSH key ────────────────────────────────────────
|
||||
if [[ -n "${CLAUDE_SSH_PUBKEY:-}" ]]; then
|
||||
mkdir -p /root/.ssh && chmod 700 /root/.ssh
|
||||
touch /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
|
||||
if ! grep -qF "$CLAUDE_SSH_PUBKEY" /root/.ssh/authorized_keys; then
|
||||
echo "$CLAUDE_SSH_PUBKEY" >> /root/.ssh/authorized_keys
|
||||
msg_ok "Agent SSH key installed"
|
||||
else
|
||||
msg_warn "Agent SSH key already present"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── compose stack ─────────────────────────────────────────────────────────────
|
||||
mkdir -p "$AK_DIR/blueprints" "$AK_DIR/media" "$AK_DIR/custom-templates" "$AK_DIR/certs"
|
||||
cd "$AK_DIR"
|
||||
|
||||
if [[ ! -f docker-compose.yml ]]; then
|
||||
msg_info "Fetching official Authentik compose file..."
|
||||
curl -fsSL -o docker-compose.yml https://goauthentik.io/docker-compose.yml
|
||||
msg_ok "docker-compose.yml fetched"
|
||||
else
|
||||
msg_warn "docker-compose.yml exists, keeping (idempotent)"
|
||||
fi
|
||||
|
||||
# Override: Blueprints in server+worker mounten, Port-Bind nur auf LXC-Netz nötig?
|
||||
# Authentik bleibt im LAN hinter NPMplus — Standard-Bind reicht; Blueprints-Mount ergänzen.
|
||||
if [[ ! -f docker-compose.override.yml ]]; then
|
||||
cat > docker-compose.override.yml <<EOF
|
||||
services:
|
||||
server:
|
||||
volumes:
|
||||
- ./blueprints:/blueprints/custom:ro
|
||||
worker:
|
||||
volumes:
|
||||
- ./blueprints:/blueprints/custom:ro
|
||||
EOF
|
||||
msg_ok "compose override (custom blueprints mount) written"
|
||||
fi
|
||||
|
||||
# ── secrets / env (idempotent: vorhandene .env bleibt) ────────────────────────
|
||||
if [[ ! -f "$ENV_FILE" ]]; then
|
||||
msg_info "Generating secrets (.env)..."
|
||||
PG_PASS="$(openssl rand -base64 36 | tr -d '\n=/+' | cut -c1-32)"
|
||||
AK_SECRET="$(openssl rand -base64 60 | tr -d '\n')"
|
||||
AK_BOOT_PW="$(openssl rand -base64 24 | tr -d '\n=/+' | cut -c1-20)"
|
||||
AK_BOOT_TOKEN="$(openssl rand -hex 32)"
|
||||
cat >"$ENV_FILE" <<EOF
|
||||
PG_PASS=$PG_PASS
|
||||
AUTHENTIK_SECRET_KEY=$AK_SECRET
|
||||
AUTHENTIK_BOOTSTRAP_PASSWORD=$AK_BOOT_PW
|
||||
AUTHENTIK_BOOTSTRAP_TOKEN=$AK_BOOT_TOKEN
|
||||
AUTHENTIK_BOOTSTRAP_EMAIL=admin@$AUTH_DOMAIN
|
||||
COMPOSE_PORT_HTTP=$APP_PORT
|
||||
${AUTHENTIK_TAG:+AUTHENTIK_TAG=$AUTHENTIK_TAG}
|
||||
# E-Mail-Versand bewusst unkonfiguriert (Familien-Setup; bei Bedarf nachziehen):
|
||||
# AUTHENTIK_EMAIL__HOST=...
|
||||
EOF
|
||||
chmod 600 "$ENV_FILE"
|
||||
|
||||
cat >"$CRED_FILE" <<EOF
|
||||
Authentik — zentraler Homelab-IdP (nexus ADR-0003)
|
||||
|
||||
URL (LAN): http://$(hostname -I | awk '{print $1}'):$APP_PORT
|
||||
URL (final): https://$AUTH_DOMAIN (nach NPMplus-Eintrag; Domain ist DAUERHAFT)
|
||||
|
||||
Bootstrap-Admin: akadmin
|
||||
Passwort: $AK_BOOT_PW
|
||||
API-Token: $AK_BOOT_TOKEN
|
||||
-> für Agent-Automation (Blueprints/OIDC via API). Nach Abschluss der
|
||||
Einrichtung rotieren oder widerrufen; menschlicher Admin nutzt eigenen
|
||||
Account mit Passkey, NICHT akadmin.
|
||||
|
||||
Blueprints: $AK_DIR/blueprints (Quelle: nexus-hub infra/authentik/)
|
||||
Stack: cd $AK_DIR && docker compose ps|logs|pull
|
||||
EOF
|
||||
chmod 600 "$CRED_FILE"
|
||||
msg_ok "Secrets + credentials written ($CRED_FILE)"
|
||||
else
|
||||
msg_warn ".env exists — keeping existing secrets (idempotent)"
|
||||
fi
|
||||
|
||||
# ── start ─────────────────────────────────────────────────────────────────────
|
||||
msg_info "Pulling images & starting Authentik (first start takes 1–2 min)..."
|
||||
docker compose pull -q
|
||||
docker compose up -d
|
||||
|
||||
# Warten bis der Server antwortet (Healthcheck)
|
||||
for _ in $(seq 1 60); do
|
||||
if curl -fsS "http://127.0.0.1:$APP_PORT/-/health/live/" >/dev/null 2>&1; then
|
||||
msg_ok "Authentik is up (http://127.0.0.1:$APP_PORT)"
|
||||
break
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
curl -fsS "http://127.0.0.1:$APP_PORT/-/health/live/" >/dev/null 2>&1 || \
|
||||
msg_warn "Authentik antwortet noch nicht — 'docker compose logs -f' prüfen (Migrationslauf kann dauern)"
|
||||
|
||||
shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
|
||||
apt_cleanup
|
||||
msg_ok "authentik installation finished"
|
||||
Executable
+154
@@ -0,0 +1,154 @@
|
||||
#!/usr/bin/env bash
|
||||
# nexus-db installer — runs inside the LXC, called by ct/nexus-db.sh
|
||||
#
|
||||
# PostgreSQL 16 from the PGDG repo, pgvector extension, database `nexus`
|
||||
# with a least-privilege role, network access restricted to the nexus app
|
||||
# LXC via pg_hba. Idempotent: safe to re-run (existing role/db/extension
|
||||
# are kept, the password is NOT rotated on re-run).
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
APP="nexus-db"
|
||||
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||
source <(curl -fsSL "$LIB_URL/install.func")
|
||||
|
||||
[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
|
||||
|
||||
# ── load config pushed in by the host script ─────────────────────────────────
|
||||
CONF="/root/nexus-db.deploy.env"
|
||||
[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
|
||||
set -a; . "$CONF"; set +a
|
||||
|
||||
: "${NEXUS_APP_IP:?missing NEXUS_APP_IP}"
|
||||
DB_NAME="${DB_NAME:-nexus}"
|
||||
DB_USER="${DB_USER:-nexus}"
|
||||
DB_PORT="${DB_PORT:-5432}"
|
||||
|
||||
# Values land verbatim in SQL and pg_hba.conf — accept only safe shapes.
|
||||
[[ "$DB_NAME" =~ ^[a-z_][a-z0-9_]*$ ]] || { msg_err "DB_NAME must be a plain lowercase identifier: $DB_NAME"; exit 1; }
|
||||
[[ "$DB_USER" =~ ^[a-z_][a-z0-9_]*$ ]] || { msg_err "DB_USER must be a plain lowercase identifier: $DB_USER"; exit 1; }
|
||||
[[ "$DB_PORT" =~ ^[0-9]{2,5}$ ]] || { msg_err "DB_PORT must be numeric: $DB_PORT"; exit 1; }
|
||||
[[ "$NEXUS_APP_IP" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ || "$NEXUS_APP_IP" =~ ^[0-9a-fA-F:]+$ ]] \
|
||||
|| { msg_err "NEXUS_APP_IP must be a single host IP: $NEXUS_APP_IP"; exit 1; }
|
||||
|
||||
PG_MAJOR=16
|
||||
CRED_FILE="/root/nexus-db.credentials"
|
||||
|
||||
# ── packages: PGDG repo + PostgreSQL 16 + pgvector ────────────────────────────
|
||||
setup_base_apt curl ca-certificates gnupg lsb-release
|
||||
|
||||
if [[ ! -f /etc/apt/sources.list.d/pgdg.sources ]] && [[ ! -f /etc/apt/sources.list.d/pgdg.list ]]; then
|
||||
msg_info "Adding PGDG apt repo..."
|
||||
apt-get install -y -qq postgresql-common >/dev/null
|
||||
/usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y >/dev/null
|
||||
msg_ok "PGDG repo added"
|
||||
else
|
||||
msg_warn "PGDG repo already present, skipping"
|
||||
fi
|
||||
|
||||
msg_info "Installing PostgreSQL $PG_MAJOR + pgvector..."
|
||||
apt-get install -y -qq "postgresql-$PG_MAJOR" "postgresql-$PG_MAJOR-pgvector" >/dev/null
|
||||
msg_ok "PostgreSQL $(psql --version | awk '{print $3}') installed"
|
||||
|
||||
PG_CONF_DIR="/etc/postgresql/$PG_MAJOR/main"
|
||||
PG_CONF="$PG_CONF_DIR/postgresql.conf"
|
||||
PG_HBA="$PG_CONF_DIR/pg_hba.conf"
|
||||
|
||||
# ── network exposure: listen on all interfaces, gate via pg_hba ───────────────
|
||||
if ! grep -q "^listen_addresses = '\*'" "$PG_CONF"; then
|
||||
msg_info "Configuring listen_addresses + port $DB_PORT..."
|
||||
sed -i "s/^#\?listen_addresses\s*=.*/listen_addresses = '*'/" "$PG_CONF"
|
||||
sed -i "s/^#\?port\s*=.*/port = $DB_PORT/" "$PG_CONF"
|
||||
msg_ok "postgresql.conf updated"
|
||||
else
|
||||
msg_warn "listen_addresses already configured, skipping"
|
||||
fi
|
||||
|
||||
# ── pg_hba: ONLY the nexus LXC may connect over the network ──────────────────
|
||||
# Strategy: replace the default file with an explicit allowlist. Local
|
||||
# UNIX-socket access stays peer-authenticated for the postgres superuser
|
||||
# (maintenance), the nexus role may connect from exactly one IP, everyone
|
||||
# else hits the final reject rule (defense-in-depth on top of "no other
|
||||
# rule matches").
|
||||
HBA_MARKER="# managed by nexus-db-install.sh"
|
||||
if ! grep -q "$HBA_MARKER" "$PG_HBA"; then
|
||||
msg_info "Writing restrictive pg_hba.conf..."
|
||||
cp -a "$PG_HBA" "$PG_HBA.dist"
|
||||
cat >"$PG_HBA" <<EOF
|
||||
$HBA_MARKER — change via card, not by hand (nexus-hub K-102)
|
||||
# TYPE DATABASE USER ADDRESS METHOD
|
||||
local all postgres peer
|
||||
local all all peer
|
||||
host $DB_NAME $DB_USER $NEXUS_APP_IP/32 scram-sha-256
|
||||
host all all 0.0.0.0/0 reject
|
||||
host all all ::/0 reject
|
||||
EOF
|
||||
msg_ok "pg_hba.conf restricted to $NEXUS_APP_IP/32"
|
||||
else
|
||||
msg_warn "pg_hba.conf already managed, skipping"
|
||||
fi
|
||||
|
||||
systemctl enable postgresql >/dev/null 2>&1
|
||||
systemctl restart postgresql
|
||||
|
||||
# ── role + database + extension (idempotent, password kept on re-run) ─────────
|
||||
run_psql() { runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qAt "$@"; }
|
||||
|
||||
if [[ "$(run_psql -c "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'")" != "1" ]]; then
|
||||
msg_info "Creating role $DB_USER + database $DB_NAME..."
|
||||
DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
|
||||
run_psql -c "CREATE ROLE $DB_USER LOGIN PASSWORD '$DB_PASS' NOSUPERUSER NOCREATEDB NOCREATEROLE"
|
||||
msg_ok "Role $DB_USER created (least privilege)"
|
||||
elif [[ ! -f "$CRED_FILE" ]]; then
|
||||
# Recovery: role exists but the generated password was never persisted
|
||||
# (first run died between CREATE ROLE and credentials write). Rotate so
|
||||
# the credentials file is authoritative again.
|
||||
msg_warn "Role $DB_USER exists but $CRED_FILE is missing — rotating password"
|
||||
DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
|
||||
run_psql -c "ALTER ROLE $DB_USER PASSWORD '$DB_PASS'"
|
||||
msg_ok "Password rotated"
|
||||
else
|
||||
DB_PASS=""
|
||||
msg_warn "Role $DB_USER already exists, password unchanged"
|
||||
fi
|
||||
|
||||
if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" != "1" ]]; then
|
||||
run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER"
|
||||
# Only the owner may connect — no PUBLIC access.
|
||||
run_psql -c "REVOKE CONNECT ON DATABASE $DB_NAME FROM PUBLIC"
|
||||
msg_ok "Database $DB_NAME created (owner $DB_USER, PUBLIC revoked)"
|
||||
else
|
||||
msg_warn "Database $DB_NAME already exists, skipping"
|
||||
fi
|
||||
|
||||
# pgvector: CREATE EXTENSION needs superuser; installed now (per ADR-0002:
|
||||
# "Extension ab Tag 1 installiert, ungenutzt bis Phase 2").
|
||||
run_psql -d "$DB_NAME" -c "CREATE EXTENSION IF NOT EXISTS vector" >/dev/null
|
||||
msg_ok "Extension vector available in $DB_NAME"
|
||||
|
||||
# ── credentials / DSN summary ─────────────────────────────────────────────────
|
||||
IP_SELF="$(hostname -I | awk '{print $1}')"
|
||||
if [[ -n "$DB_PASS" ]]; then
|
||||
cat >"$CRED_FILE" <<EOF
|
||||
nexus-db — PostgreSQL $PG_MAJOR for nexus (Family Knowledge Hub)
|
||||
|
||||
Host: $IP_SELF:$DB_PORT
|
||||
Database: $DB_NAME
|
||||
Role: $DB_USER (NOSUPERUSER NOCREATEDB NOCREATEROLE, sole owner)
|
||||
Password: $DB_PASS
|
||||
|
||||
DSN for /etc/nexus/env on the nexus LXC (NEXUS_DATABASE_URL):
|
||||
postgresql+psycopg://$DB_USER:$DB_PASS@$IP_SELF:$DB_PORT/$DB_NAME
|
||||
|
||||
Access policy (pg_hba): only $NEXUS_APP_IP/32 may connect; all other
|
||||
hosts are rejected. Local socket stays peer-auth for maintenance:
|
||||
pct exec <CTID> -- runuser -u postgres -- psql -d $DB_NAME
|
||||
EOF
|
||||
chmod 600 "$CRED_FILE"
|
||||
msg_ok "Credentials written to $CRED_FILE (chmod 600)"
|
||||
else
|
||||
msg_warn "Re-run detected: $CRED_FILE untouched (password not rotated)"
|
||||
fi
|
||||
|
||||
apt_cleanup
|
||||
msg_ok "$APP installation finished"
|
||||
@@ -0,0 +1,196 @@
|
||||
#!/usr/bin/env bash
|
||||
# Runner installer — runs inside the LXC, called by ct/runner.sh
|
||||
#
|
||||
# Allgemeiner, INSTANZWEITER Gitea-Actions-Runner ohne Deploy-Rechte:
|
||||
# - Node.js (für actions/checkout im Host-Mode) + git + rsync
|
||||
# - Docker (für Wegwerf-Test-Container in CI, z. B. pgvector)
|
||||
# - act_runner als unprivilegierter User "runner" in der docker-Gruppe
|
||||
# - systemd-Unit act-runner.service (Requires=docker.service)
|
||||
#
|
||||
# SICHERHEITSMODELL (Review-Finding 88, bewusst akzeptiert & dokumentiert):
|
||||
# docker-Gruppe == de-facto root IN DIESEM LXC. Da der Runner instanzweit
|
||||
# ist, kann jedes Repo der Gitea-Instanz via Workflow den Runner-Container
|
||||
# vollständig kontrollieren. Das ist hier akzeptiert, weil (a) alle Repos
|
||||
# der Instanz vom selben Admin (Lutz) stammen — kein Multi-Tenant — und
|
||||
# (b) dieser LXC GENAU DESHALB nichts besitzt: keine sudoers, keine
|
||||
# Produktions-Mounts, keine Secrets außer dem (geshredderten) Reg-Token.
|
||||
# Bei Öffnung der Instanz für Dritte: Docker rootless oder eigener Runner
|
||||
# pro Vertrauenszone. NICHT auf LXCs mit Deploy-Rechten übertragen.
|
||||
#
|
||||
# Idempotent: erneuter Lauf (auch OHNE /root/runner.deploy.env) überspringt
|
||||
# Vorhandenes und provisioniert nur nach — Registrierung braucht die env-Datei
|
||||
# nur beim Erstlauf (Finding 90).
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
||||
source <(curl -fsSL "$LIB_URL/install.func")
|
||||
|
||||
[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
|
||||
|
||||
APP_USER="runner"
|
||||
APP_HOME="/opt/runner"
|
||||
RUNNER_DIR="$APP_HOME/data"
|
||||
|
||||
# ── Konfiguration laden (optional bei Re-Run, Finding 90) ─────────────────────
|
||||
CONF="/root/runner.deploy.env"
|
||||
if [[ -f "$CONF" ]]; then
|
||||
set -a; . "$CONF"; set +a
|
||||
fi
|
||||
RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
|
||||
RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
|
||||
RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
|
||||
NODE_MAJOR="${NODE_MAJOR:-22}"
|
||||
|
||||
# ── Validierung (Finding 80): Werte landen in Shell-Fragmenten/systemd —
|
||||
# strikte Zeichenklassen statt Vertrauen. Re-Runs ohne CONF validieren
|
||||
# nur, was gesetzt ist; Registrierungs-Pflichtwerte prüft der Reg-Block. ──
|
||||
valid_url() { [[ "$1" =~ ^https?://[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]]; }
|
||||
valid_token() { [[ "$1" =~ ^[A-Za-z0-9_-]{16,128}$ ]]; }
|
||||
valid_token_word() { [[ "$1" =~ ^[A-Za-z0-9._:,-]+$ ]]; }
|
||||
|
||||
[[ -z "${GITEA_INSTANCE_URL:-}" ]] || valid_url "$GITEA_INSTANCE_URL" \
|
||||
|| { msg_err "GITEA_INSTANCE_URL ungültig: nur http(s)://host[:port]"; exit 1; }
|
||||
[[ -z "${RUNNER_TOKEN:-}" ]] || valid_token "$RUNNER_TOKEN" \
|
||||
|| { msg_err "RUNNER_TOKEN ungültig (erwartet 16–128 Zeichen [A-Za-z0-9_-])"; exit 1; }
|
||||
valid_token_word "$RUNNER_NAME" || { msg_err "RUNNER_NAME enthält unzulässige Zeichen"; exit 1; }
|
||||
valid_token_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS enthält unzulässige Zeichen"; exit 1; }
|
||||
[[ "$RUNNER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { msg_err "RUNNER_VERSION ungültig"; exit 1; }
|
||||
[[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] || { msg_err "NODE_MAJOR ungültig"; exit 1; }
|
||||
|
||||
# Finding 85 (Re-Review): act_runner schreibt .runner ins CWD — run_user wechselt
|
||||
# deshalb hart ins RUNNER_DIR (env -C), sonst landet die Registrierung in / und
|
||||
# der unprivilegierte User darf dort nicht schreiben.
|
||||
run_user() { runuser -u "$APP_USER" -- env -C "$RUNNER_DIR" HOME="$APP_HOME" "$@"; }
|
||||
|
||||
# ── Pakete: git/rsync, Node (checkout-Action), Docker (Test-Container) ────────
|
||||
setup_base_apt git rsync ca-certificates curl
|
||||
|
||||
NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
|
||||
if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
|
||||
msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
|
||||
curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
|
||||
apt-get install -y -qq nodejs >/dev/null
|
||||
msg_ok "Node $(node -v) installed"
|
||||
else
|
||||
msg_warn "Node $(node -v) already present, skipping"
|
||||
fi
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
msg_info "Installing Docker (get.docker.com)..."
|
||||
curl -fsSL https://get.docker.com | sh >/dev/null
|
||||
msg_ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
|
||||
else
|
||||
msg_warn "Docker already present, skipping"
|
||||
fi
|
||||
|
||||
# ── act_runner binary ─────────────────────────────────────────────────────────
|
||||
if [[ ! -x /usr/local/bin/act_runner ]]; then
|
||||
ARCH="$(dpkg --print-architecture)"
|
||||
case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
|
||||
msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
|
||||
curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
|
||||
-o /usr/local/bin/act_runner
|
||||
chmod +x /usr/local/bin/act_runner
|
||||
msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
|
||||
else
|
||||
msg_warn "act_runner already present, skipping download"
|
||||
fi
|
||||
|
||||
# ── User (docker-Gruppe VOR dem Daemon-Start — Lesson aus nexus K-103:
|
||||
# Gruppenmitgliedschaften werden beim Prozessstart eingefroren) ─────────────
|
||||
create_system_user "$APP_USER" "$APP_HOME"
|
||||
usermod -aG docker "$APP_USER"
|
||||
mkdir -p "$RUNNER_DIR"
|
||||
chown -R "$APP_USER:$APP_USER" "$APP_HOME"
|
||||
|
||||
# ── Registrierung (idempotent; braucht CONF-Werte nur beim Erstlauf) ──────────
|
||||
if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
|
||||
: "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL (Erstlauf braucht /root/runner.deploy.env)}"
|
||||
: "${RUNNER_TOKEN:?missing RUNNER_TOKEN (Erstlauf braucht /root/runner.deploy.env)}"
|
||||
msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL (instance scope)..."
|
||||
# Werte sind oben strikt validiert (keine Quotes/Whitespace möglich) —
|
||||
# Übergabe als argv an runuser, keine erneute Shell-Interpolation (vgl. Finding 76).
|
||||
# CWD = RUNNER_DIR via run_user (Finding 85).
|
||||
run_user /usr/local/bin/act_runner register \
|
||||
--no-interactive \
|
||||
--config /dev/null \
|
||||
--instance "$GITEA_INSTANCE_URL" \
|
||||
--token "$RUNNER_TOKEN" \
|
||||
--name "$RUNNER_NAME" \
|
||||
--labels "$RUNNER_LABELS" \
|
||||
2>&1 | sed "s#$RUNNER_TOKEN#<redacted>#g" || { msg_err "Registrierung fehlgeschlagen"; exit 1; }
|
||||
# Belt-and-suspenders: falls eine künftige act_runner-Version doch ins HOME schreibt
|
||||
if [[ -f "$APP_HOME/.runner" && ! -f "$RUNNER_DIR/.runner" ]]; then
|
||||
mv "$APP_HOME/.runner" "$RUNNER_DIR/.runner"
|
||||
fi
|
||||
[[ -f "$RUNNER_DIR/.runner" ]] || { msg_err ".runner nach Registrierung nicht gefunden"; exit 1; }
|
||||
chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
|
||||
msg_ok "Runner registered"
|
||||
else
|
||||
msg_warn "Runner already registered (.runner exists), skipping"
|
||||
fi
|
||||
|
||||
# ── SSH-Root-Login-Policy anwenden, falls vom Host-Script übergeben
|
||||
# (Funktion existiert in install.func ab K-114/PR #5 — guarded Aufruf,
|
||||
# damit dieser Branch vor und nach dem Merge funktioniert) ────────────────
|
||||
if declare -F configure_ssh_root_login >/dev/null 2>&1; then
|
||||
configure_ssh_root_login
|
||||
fi
|
||||
|
||||
# ── systemd-Unit (bewusst KEINE sudoers-Datei; Findings 82 + 70) ──────────────
|
||||
cat >/etc/systemd/system/act-runner.service <<EOF
|
||||
[Unit]
|
||||
Description=Gitea Actions runner (instance-wide, label ${RUNNER_LABELS%%:*}, no deploy rights)
|
||||
After=network-online.target docker.service
|
||||
Wants=network-online.target
|
||||
# Finding 82: ohne Docker keine Jobs annehmen — harte Kopplung
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=$APP_USER
|
||||
Group=$APP_USER
|
||||
WorkingDirectory=$RUNNER_DIR
|
||||
Environment=HOME=$APP_HOME
|
||||
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
ExecStart=/usr/local/bin/act_runner daemon
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
# Finding 70: Basis-Härtung (docker-CLI über Socket bleibt funktional)
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now act-runner.service
|
||||
msg_ok "act-runner.service installed + started"
|
||||
|
||||
CRED_FILE="/root/runner.credentials"
|
||||
cat >"$CRED_FILE" <<EOF
|
||||
Allgemeiner Gitea-Actions-Runner (instanzweit)
|
||||
|
||||
Instance: ${GITEA_INSTANCE_URL:-<bestehende Registrierung, siehe $RUNNER_DIR/.runner>}
|
||||
Name/Label: $RUNNER_NAME [$RUNNER_LABELS]
|
||||
User: $APP_USER (docker-Gruppe, KEIN sudo)
|
||||
Workdir: $RUNNER_DIR
|
||||
Logs: journalctl -u act-runner -f
|
||||
|
||||
Repos nutzen ihn mit: runs-on: ${RUNNER_LABELS%%:*}
|
||||
|
||||
SICHERHEITSMODELL: docker-Gruppe == de-facto root in DIESEM LXC; instanzweit
|
||||
heißt: jedes Repo der Instanz kann den Runner-LXC kontrollieren. Akzeptiert,
|
||||
weil Single-Admin-Instanz und dieser LXC nichts besitzt (keine sudoers, keine
|
||||
Produktions-Mounts). Deploy-Jobs gehören NICHT hierher — die bleiben auf dem
|
||||
repo-scoped nexus-Runner. Trennung beibehalten.
|
||||
EOF
|
||||
chmod 600 "$CRED_FILE"
|
||||
|
||||
if [[ -f "$CONF" ]]; then
|
||||
shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
|
||||
fi
|
||||
apt_cleanup
|
||||
msg_ok "runner installation finished"
|
||||
Reference in New Issue
Block a user