l.kirchner
aa3ad2f716
prompt_lxc_config asks 'SSH-Root-Login erlauben? [Y/n]' (env-presettable via SSH_ROOT_LOGIN, validated, normalized to yes|no). The bootstrap passes the value into the container; configure_ssh_root_login writes /etc/ssh/sshd_config.d/zz-root-login.conf (yes -> PermitRootLogin yes, no -> prohibit-password) and reloads sshd.
211 lines
9.1 KiB
Bash
211 lines
9.1 KiB
Bash
#!/usr/bin/env bash
|
|
# nexus installer — runs inside the LXC, called by ct/nexus.sh
|
|
#
|
|
# Sets up the deploy target for nexus (Family Knowledge Hub):
|
|
# - Node.js (NodeSource) + git + rsync + sudo (Node also needed by checkout action in host mode)
|
|
# - act_runner in HOST mode (no Docker), registered to the Gitea instance,
|
|
# running as the unprivileged `nexus` user and polling Gitea outbound
|
|
# - a SKELETON systemd service (nexus.service) — the stack-introducing SDD
|
|
# card in nexus-hub provides /opt/nexus/current/start.sh and may extend
|
|
# the RUNTIME section below (DB clients, Python/uv, etc.)
|
|
# - a narrow sudoers rule so the runner may only restart that one service
|
|
#
|
|
# The actual build/test/deploy logic lives in the nexus-hub repo workflows
|
|
# (.gitea/workflows/ci.yml + deploy.yml) — deploy-as-code.
|
|
|
|
set -euo pipefail
|
|
|
|
APP="nexus"
|
|
LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
|
|
source <(curl -fsSL "$LIB_URL/install.func")
|
|
|
|
[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
|
|
|
|
# ── load deploy config pushed in by the host script ──────────────────────────
|
|
CONF="/root/nexus.deploy.env"
|
|
[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
|
|
set -a; . "$CONF"; set +a
|
|
|
|
: "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL}"
|
|
: "${RUNNER_TOKEN:?missing RUNNER_TOKEN}"
|
|
APP_PORT="${APP_PORT:-8080}"
|
|
NODE_MAJOR="${NODE_MAJOR:-22}"
|
|
RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
|
|
RUNNER_LABELS="${RUNNER_LABELS:-nexus:host}"
|
|
RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
|
|
|
|
APP_USER="nexus"
|
|
APP_HOME="/opt/nexus"
|
|
RUNNER_DIR="$APP_HOME/runner"
|
|
CURRENT_DIR="$APP_HOME/current"
|
|
DATA_DIR="$APP_HOME/data"
|
|
CONF_DIR="/etc/nexus"
|
|
ENV_FILE="$CONF_DIR/env"
|
|
|
|
run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
|
|
|
|
# ── packages: git + rsync + sudo ; Node.js via NodeSource ─────────────────────
|
|
setup_base_apt git rsync sudo
|
|
configure_ssh_root_login
|
|
|
|
NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
|
|
if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
|
|
msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
|
|
curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
|
|
apt-get install -y -qq nodejs >/dev/null
|
|
msg_ok "Node $(node -v) installed"
|
|
else
|
|
msg_warn "Node $(node -v) already present, skipping"
|
|
fi
|
|
|
|
# ── RUNTIME ───────────────────────────────────────────────────────────────────
|
|
# Stack decided (nexus-hub ADR-0002, card K-101): Python 3.12 via uv, tesseract
|
|
# deu+eng, nexus-worker.service + sudoers extension. Provisioned by
|
|
# install/nexus-runtime.sh, invoked at the END of this script (it extends the
|
|
# sudoers rule and systemd units written below, so order matters). Commands are
|
|
# documented in nexus-hub docs/05_AGENT_RULES.md → Projekt-Kommandos.
|
|
|
|
# ── act_runner binary ─────────────────────────────────────────────────────────
|
|
if [[ ! -x /usr/local/bin/act_runner ]]; then
|
|
ARCH="$(dpkg --print-architecture)"
|
|
case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
|
|
msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
|
|
curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
|
|
-o /usr/local/bin/act_runner
|
|
chmod +x /usr/local/bin/act_runner
|
|
msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
|
|
else
|
|
msg_warn "act_runner already present, skipping download"
|
|
fi
|
|
|
|
# ── user + dirs ───────────────────────────────────────────────────────────────
|
|
create_system_user "$APP_USER" "$APP_HOME"
|
|
mkdir -p "$RUNNER_DIR" "$CURRENT_DIR" "$DATA_DIR" "$CONF_DIR"
|
|
chown -R "$APP_USER:$APP_USER" "$APP_HOME"
|
|
|
|
# ── env file (runtime config; populated further by the stack card) ────────────
|
|
cat >"$ENV_FILE" <<EOF
|
|
NEXUS_ENV=production
|
|
NEXUS_PORT=$APP_PORT
|
|
NEXUS_DATA_DIR=$DATA_DIR
|
|
EOF
|
|
chown root:"$APP_USER" "$ENV_FILE"
|
|
chmod 640 "$ENV_FILE"
|
|
|
|
# ── register the runner (idempotent) ──────────────────────────────────────────
|
|
if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
|
|
msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL..."
|
|
run_user bash -c "cd '$RUNNER_DIR' && /usr/local/bin/act_runner register \
|
|
--no-interactive \
|
|
--instance '$GITEA_INSTANCE_URL' \
|
|
--token '$RUNNER_TOKEN' \
|
|
--name '$RUNNER_NAME' \
|
|
--labels '$RUNNER_LABELS'"
|
|
chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
|
|
msg_ok "Runner registered"
|
|
else
|
|
msg_warn "Runner already registered (.runner exists), skipping"
|
|
fi
|
|
|
|
# ── narrow sudoers: runner may ONLY (re)start/stop/status nexus.service ───────
|
|
cat >/etc/sudoers.d/nexus-deploy <<EOF
|
|
$APP_USER ALL=(root) NOPASSWD: /usr/bin/systemctl restart nexus.service, /usr/bin/systemctl start nexus.service, /usr/bin/systemctl stop nexus.service, /usr/bin/systemctl status nexus.service
|
|
EOF
|
|
chmod 440 /etc/sudoers.d/nexus-deploy
|
|
visudo -cf /etc/sudoers.d/nexus-deploy >/dev/null
|
|
|
|
# ── systemd units ─────────────────────────────────────────────────────────────
|
|
# nexus.service: SKELETON. The deploy workflow populates /opt/nexus/current and
|
|
# the stack card provides current/start.sh. Enabled (starts on boot) but not
|
|
# started now — first successful deploy starts it via the sudoers-allowed restart.
|
|
cat >/etc/systemd/system/nexus.service <<EOF
|
|
[Unit]
|
|
Description=nexus — Family Knowledge Hub
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
# Skeleton-safe: only startable once the first deploy shipped the artifact
|
|
# (otherwise a reboot before first deploy leaves the unit in failed state).
|
|
ConditionPathExists=$CURRENT_DIR/start.sh
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=$APP_USER
|
|
Group=$APP_USER
|
|
WorkingDirectory=$CURRENT_DIR
|
|
EnvironmentFile=$ENV_FILE
|
|
ExecStart=$CURRENT_DIR/start.sh
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
NoNewPrivileges=true
|
|
ProtectSystem=full
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
cat >/etc/systemd/system/nexus-runner.service <<EOF
|
|
[Unit]
|
|
Description=nexus — Gitea Actions runner (host mode, CI + deploy)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=$APP_USER
|
|
Group=$APP_USER
|
|
WorkingDirectory=$RUNNER_DIR
|
|
Environment=HOME=$APP_HOME
|
|
Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
ExecStart=/usr/local/bin/act_runner daemon
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable nexus.service >/dev/null 2>&1
|
|
systemctl enable --now nexus-runner.service
|
|
msg_ok "systemd units installed (runner started; nexus.service enabled, starts on first deploy)"
|
|
|
|
# ── RUNTIME provisioning (K-101): uv/Python 3.12, tesseract, worker unit ──────
|
|
# Runs LAST on purpose: it extends the sudoers rule and unit set from above.
|
|
# Idempotent — the same script retrofits an existing LXC:
|
|
# curl -fsSL .../install/nexus-runtime.sh | bash
|
|
bash <(curl -fsSL "${LIB_URL%/lib}/install/nexus-runtime.sh")
|
|
|
|
# ── notes / summary file ──────────────────────────────────────────────────────
|
|
CRED_FILE="/root/nexus.credentials"
|
|
cat >"$CRED_FILE" <<EOF
|
|
nexus — Family Knowledge Hub deployed via a self-hosted Gitea Actions runner
|
|
|
|
Repo (informational): ${REPO_URL:-https://gitea.luki-net.org/l.kirchner/nexus-hub.git}
|
|
Gitea instance: $GITEA_INSTANCE_URL
|
|
Runner name / labels: $RUNNER_NAME [$RUNNER_LABELS] (act_runner $RUNNER_VERSION, host mode)
|
|
API (local): http://127.0.0.1:$APP_PORT (live after first deploy + stack card)
|
|
Live copy: $CURRENT_DIR
|
|
Data dir: $DATA_DIR
|
|
Runtime env: $ENV_FILE
|
|
|
|
CI + deploy are driven by the repo workflows .gitea/workflows/{ci,deploy}.yml
|
|
nexus.service is a SKELETON — ExecStart expects $CURRENT_DIR/start.sh, which
|
|
the stack-introducing SDD card provides. Until then only ci.yml is functional.
|
|
|
|
Manual restart: sudo systemctl restart nexus.service
|
|
Logs: journalctl -u nexus -u nexus-runner -f
|
|
|
|
Prerequisites on the Gitea side:
|
|
- Actions enabled on the instance and on the repo (repo -> Settings -> Actions)
|
|
- The LXC needs outbound HTTPS to $GITEA_INSTANCE_URL and to github.com
|
|
(the latter only to fetch actions/checkout, unless you self-host actions)
|
|
EOF
|
|
chmod 600 "$CRED_FILE"
|
|
|
|
# registration token already consumed → drop the bootstrap env file
|
|
shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
|
|
|
|
apt_cleanup
|
|
msg_ok "$APP installation finished"
|