l.kirchner
aa3ad2f716
prompt_lxc_config asks 'SSH-Root-Login erlauben? [Y/n]' (env-presettable via SSH_ROOT_LOGIN, validated, normalized to yes|no). The bootstrap passes the value into the container; configure_ssh_root_login writes /etc/ssh/sshd_config.d/zz-root-login.conf (yes -> PermitRootLogin yes, no -> prohibit-password) and reloads sshd.
110 lines
4.7 KiB
Bash
110 lines
4.7 KiB
Bash
#!/usr/bin/env bash
|
|
# lib/install.func — shared in-container helpers for install/*-install.sh
|
|
#
|
|
# Sourced via:
|
|
# source <(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib/install.func)
|
|
|
|
# ── colors / logging ─────────────────────────────────────────────────────────
|
|
if [[ -z "${_COLORS_LOADED:-}" ]]; then
|
|
RED="\033[0;31m"; GREEN="\033[0;32m"; YELLOW="\033[1;33m"; BLUE="\033[0;34m"; NC="\033[0m"
|
|
_COLORS_LOADED=1
|
|
fi
|
|
msg_info() { echo -e "${BLUE}[i]${NC} $*"; }
|
|
msg_ok() { echo -e "${GREEN}[✓]${NC} $*"; }
|
|
msg_warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
|
msg_err() { echo -e "${RED}[✗]${NC} $*" >&2; }
|
|
|
|
# ── apt ──────────────────────────────────────────────────────────────────────
|
|
# Always installs: ca-certificates curl openssl tzdata gnupg
|
|
# Additional packages can be passed as args.
|
|
setup_base_apt() {
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
msg_info "Updating apt index..."
|
|
apt-get update -qq
|
|
if [[ $# -gt 0 ]]; then
|
|
msg_info "Installing base packages + $*..."
|
|
else
|
|
msg_info "Installing base packages..."
|
|
fi
|
|
apt-get install -y -qq \
|
|
ca-certificates curl openssl tzdata gnupg \
|
|
"$@" \
|
|
>/dev/null
|
|
msg_ok "apt setup complete"
|
|
}
|
|
|
|
apt_cleanup() {
|
|
apt-get autoremove -y -qq >/dev/null || true
|
|
apt-get autoclean -qq >/dev/null || true
|
|
}
|
|
|
|
# ── ssh ──────────────────────────────────────────────────────────────────────
|
|
# SSH-Root-Login gemäß Host-Prompt (prompt_lxc_config setzt SSH_ROOT_LOGIN,
|
|
# bootstrap_install_script reicht es als Env durch; Default: yes).
|
|
# yes → PermitRootLogin yes (Passwort-Login mit dem generierten Root-Passwort)
|
|
# no → PermitRootLogin prohibit-password (Debian-Default, nur SSH-Key)
|
|
# Umsetzung als Drop-in, damit Paket-Updates von sshd_config nicht kollidieren.
|
|
configure_ssh_root_login() {
|
|
local choice="${SSH_ROOT_LOGIN:-yes}" value
|
|
case "$choice" in
|
|
yes) value="yes" ;;
|
|
no) value="prohibit-password" ;;
|
|
*) msg_err "SSH_ROOT_LOGIN must be yes|no, got: '$choice'"; return 1 ;;
|
|
esac
|
|
|
|
if [[ ! -d /etc/ssh/sshd_config.d ]]; then
|
|
if [[ "$choice" == "no" ]]; then
|
|
msg_warn "openssh-server not installed — nothing to configure (root login stays off)"
|
|
return 0
|
|
fi
|
|
msg_info "Installing openssh-server..."
|
|
apt-get install -y -qq openssh-server >/dev/null
|
|
fi
|
|
|
|
msg_info "Configuring SSH root login: PermitRootLogin $value"
|
|
printf 'PermitRootLogin %s\n' "$value" >/etc/ssh/sshd_config.d/zz-root-login.conf
|
|
systemctl reload ssh 2>/dev/null || systemctl restart ssh 2>/dev/null \
|
|
|| msg_warn "ssh.service not active yet — config applies on first start"
|
|
msg_ok "SSH root login: $choice"
|
|
}
|
|
|
|
# ── users / dirs ─────────────────────────────────────────────────────────────
|
|
create_system_user() {
|
|
local user="$1" home="$2"
|
|
if id -u "$user" >/dev/null 2>&1; then
|
|
msg_warn "User $user already exists, skipping"
|
|
return 0
|
|
fi
|
|
msg_info "Creating system user $user (home: $home)"
|
|
useradd --system --create-home --home-dir "$home" --shell /usr/sbin/nologin "$user"
|
|
}
|
|
|
|
# ── systemd ──────────────────────────────────────────────────────────────────
|
|
# write_systemd_unit NAME CONTENT
|
|
# Writes /etc/systemd/system/NAME.service, daemon-reloads, enables + starts.
|
|
write_systemd_unit() {
|
|
local name="$1" content="$2"
|
|
msg_info "Writing systemd unit: $name.service"
|
|
printf '%s\n' "$content" >"/etc/systemd/system/$name.service"
|
|
systemctl daemon-reload
|
|
systemctl enable --now "$name.service"
|
|
msg_ok "$name.service enabled and started"
|
|
}
|
|
|
|
# ── http wait ────────────────────────────────────────────────────────────────
|
|
# wait_for_http URL [TIMEOUT_SECONDS]
|
|
wait_for_http() {
|
|
local url="$1" timeout="${2:-30}"
|
|
msg_info "Waiting for $url..."
|
|
local i
|
|
for ((i=0; i<timeout; i++)); do
|
|
if curl -fsS "$url" >/dev/null 2>&1; then
|
|
msg_ok "$url responding"
|
|
return 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
msg_warn "$url did not respond within ${timeout}s"
|
|
return 1
|
|
}
|