-
Notifications
You must be signed in to change notification settings - Fork 4
Expand file tree
/
Copy pathinstall.sh
More file actions
executable file
·202 lines (165 loc) · 7.19 KB
/
Copy pathinstall.sh
File metadata and controls
executable file
·202 lines (165 loc) · 7.19 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
#!/bin/bash
set -Eeuox pipefail
cd "$(dirname "$0")"
# first, let's check to ensure the Administrator has done their job with respect to storage
if [[ ! -d /hdd ]]; then
echo "ERROR: The '/hdd' directory does not exist. Please read the BCM preparation instructions before running this script."
exit
fi
if [[ ! -d /sd ]]; then
echo "ERROR: The '/sd' directory does not exist. Please read the BCM preparation instructions before running this script."
exit
fi
# shellcheck source=./env
source ./env
# let's wait for apt upgrade/software locks to be released.
while sudo fuser /var/{lib/{dpkg,apt/lists},cache/apt/archives}/lock >/dev/null 2>&1; do
sleep 1
done
#install necessary software.
apt-get install -y curl git apg snap snapd gnupg rsync jq pass
# removed unneeded software
apt autoremove
# if the lxd group doesn't exist, create it.
if ! grep -q lxd /etc/group; then
addgroup --system lxd
fi
# add the SUDO_USER user to the lxd group
if ! groups | grep -q lxd; then
usermod -G lxd -a "$SUDO_USER"
fi
# install LXD
if [[ ! -f "$(command -v lxc)" ]]; then
snap set system snapshots.automatic.retention=no
snap install lxd --channel="latest/edge"
fi
BCM_GIT_DIR="$(pwd)"
export BCM_GIT_DIR="$BCM_GIT_DIR"
SUDO_USER_HOME="/home/$SUDO_USER"
# Let's make sure the .ssh folder exists. This will hold known SSH BCM hosts
# SSH authentication to remote hosts uses the trezor
mkdir -p "$SUDO_USER_HOME/.ssh"
if [[ ! -f "$SUDO_USER_HOME/.ssh/authorized_keys" ]]; then
touch "$SUDO_USER_HOME/.ssh/authorized_keys"
chown "$SUDO_USER:$SUDO_USER" -R "$SUDO_USER_HOME/.ssh"
fi
# this section configured the local SSH client on the Controller
# so it uses the local SOCKS5 proxy for any SSH host that has a
# ".onion" address. We use SSH tunneling to expose the remote onion
# server's LXD API and access it on the controller via a locally
# expose port (after SSH tunneling)
SSH_LOCAL_CONF="$SUDO_USER_HOME/.ssh/config"
if [[ ! -f "$SSH_LOCAL_CONF" ]]; then
# if the .ssh/config file doesn't exist, create it.
touch "$SSH_LOCAL_CONF"
fi
# Next, paste in the necessary .ssh/config settings for accessing
# remote SSH services exposed as an onion. This will make any 'ssh' command
# redirect all .onion hostnames to your tor SOCKS5 proxy.
if [[ -f "$SSH_LOCAL_CONF" ]]; then
SSH_ONION_TEXT="Host *.onion"
if ! grep -Fxq "$SSH_ONION_TEXT" "$SSH_LOCAL_CONF"; then
{
echo "$SSH_ONION_TEXT"
echo " ProxyCommand nc -xlocalhost:9050 -X5 %h %p"
} >>"$SSH_LOCAL_CONF"
fi
fi
# let's ensure the image has /snap/bin in its PATH environment variable.
# using .profile works for both bare-metal and VM-based deployments.
BASHRC_FILE="$SUDO_USER_HOME/.profile"
BASHRC_TEXT="export PATH=\$PATH:/snap/bin:/home/$SUDO_USER/bcm"
if ! grep -qF "$BASHRC_TEXT" "$BASHRC_FILE"; then
{
echo "$BASHRC_TEXT"
echo "DEBIAN_FRONTEND=noninteractive"
} >> "$BASHRC_FILE"
fi
# in this section, we configure the underlying storage. We create LOOP devices storated
# at /sd /ssd and /hdd. The ADMINISTRATOR MUST mount these directories BEFORE running this
# install script.
function createLoopDevice () {
IMAGE_PATH="$1/bcm-$2.img"
# let's first check to see if the loop device already exists.
LOOP_DEVICE=
if losetup --list --output NAME,BACK-FILE | grep -q "$IMAGE_PATH"; then
LOOP_DEVICE="$(losetup --list --output NAME,BACK-FILE | grep "$IMAGE_PATH" | head -n1 | cut -d " " -f1)"
fi
# remove the loop device and delete the image.
if [ -n "$LOOP_DEVICE" ]; then
losetup -d "$LOOP_DEVICE"
losetup -D
fi
# if the loop file doesn't exist, create it.
if [ ! -f "$IMAGE_PATH" ]; then
touch "$IMAGE_PATH"
fi
truncate -s +"$3" "$IMAGE_PATH"
# create the actual file that's backing the loop device
#dd if=/dev/zero of="$IMAGE_PATH" bs="$3" count="$4"
# next, create the loop device
losetup -fP "$IMAGE_PATH"
# get the new loop device, then remove any existing filesystem entries with wipefs.
if losetup --list --output NAME,BACK-FILE | grep -q "$IMAGE_PATH"; then
LOOP_DEVICE="$(losetup --list --output NAME,BACK-FILE | grep "$IMAGE_PATH" | head -n1 | cut -d " " -f1)"
fi
wipefs -a "$LOOP_DEVICE"
}
createLoopDevice /sd sd 64MB
createLoopDevice "/home/$SUDO_USER" ssd 10GB
createLoopDevice /hdd hdd 20GB
# This creates LXC storage pools for each of teh
for STORAGE_POOL in ssd hdd sd; do
# if the profile doesn't already exist, we create it.
if ! lxc storage list --format csv | grep -q "bcm-$STORAGE_POOL"; then
# let's first check to see if the loop device already exists.
LOOP_DEVICE=
IMAGE_PATH="$SUDO_USER_HOME/bcm-$STORAGE_POOL.img" #for ssd
if [ $STORAGE_POOL != "ssd" ] ; then
IMAGE_PATH="/$STORAGE_POOL/bcm-$STORAGE_POOL.img"
fi
# if the loop device exists, let's pull it into LXC as a loop device-backed storage pool formatted with BTRFS
if losetup --list --output NAME,BACK-FILE | grep -q "$IMAGE_PATH"; then
LOOP_DEVICE="$(losetup --list --output NAME,BACK-FILE | grep $IMAGE_PATH | head -n1 | cut -d " " -f1)"
lxc storage create "bcm-$STORAGE_POOL" btrfs source="$LOOP_DEVICE"
else
echo "ERROR: Loop device for storage pool '$STORAGE_POOL' does not exist! You may need to run the BCM installer script."
exit
fi
# if the profile doesn't already exist, we create it.
export LOOP_DEVICE="$LOOP_DEVICE"
if ! lxc profile list --format csv | grep -q "bcm-$STORAGE_POOL"; then
lxc profile create "bcm-$STORAGE_POOL"
fi
PROFILE_YAML="$(envsubst <./resources/lxd_profiles/$STORAGE_POOL.yml)"
echo "$PROFILE_YAML" | lxc profile edit "bcm-$STORAGE_POOL"
fi
done
mkdir -p "$SUDO_USER_HOME/.local/bcm/lxc"
chown -R "$SUDO_USER:$SUDO_USER" "$SUDO_USER_HOME/.local/bcm"
# this section creates the yml necessary to run 'lxd init'
# TODO add CLI option to specify the interface manually, then store the user's selection in ~/.bashrc
IP_OF_MACVLAN_INTERFACE="$(ip addr show "$BCM_MACVLAN_INTERFACE" | grep "inet " | cut -d/ -f1 | awk '{print $NF}')"
BCM_LXD_SECRET="$(apg -n 1 -m 30 -M CN)"
export BCM_LXD_SECRET="$BCM_LXD_SECRET"
LXD_SERVER_NAME="$(hostname)"
# these two lines are so that ssh hosts can have the correct naming convention for LXD node info.
if [[ ! "$LXD_SERVER_NAME" == *"-01"* ]]; then
LXD_SERVER_NAME="$LXD_SERVER_NAME-01"
fi
if [[ ! "$LXD_SERVER_NAME" == *"bcm-"* ]]; then
LXD_SERVER_NAME="bcm-$LXD_SERVER_NAME"
fi
export LXD_SERVER_NAME="$LXD_SERVER_NAME"
export IP_OF_MACVLAN_INTERFACE="$IP_OF_MACVLAN_INTERFACE"
PRESEED_YAML="$(envsubst <./resources/lxd_profiles/lxd_master_preseed.yml)"
echo "$PRESEED_YAML" | lxd init --preseed
# This for loop makes sure that all subsequent commands have access to the
# bcm LXD profiles.
for PROFILE_NAME in unprivileged privileged; do
# if the profile doesn't already exist, we create it.
if ! lxc profile list --format csv | grep -q "bcm-$PROFILE_NAME"; then
lxc profile create "bcm-$PROFILE_NAME"
fi
cat "./resources/lxd_profiles/$PROFILE_NAME.yml" | lxc profile edit "bcm-$PROFILE_NAME"
done