Initial commit: AetherForge Linux (forge-mesh) v0.1.0-dev

scripts/install.sh.tpl

@@ -0,0 +1,112 @@
+#!/bin/bash
+# forge-mesh agent installer — rendered by deck at GET /install.sh
+set -euo pipefail
+
+DECK_URL="{{.DeckURL}}"
+PUBLIC_KEY="{{.PublicKey}}"
+FLEET_SECRET="{{.FleetSecret}}"
+PIN="{{.Pin}}"
+CAMPAIGN="{{.Campaign}}"
+INSTALL_DIR="${FORGE_MESH_INSTALL_DIR:-/opt/forge-mesh}"
+AGENT_BIN="${INSTALL_DIR}/agent"
+SERVICE_NAME="forge-mesh-agent"
+
+ARCH_RAW="$(uname -m)"
+case "${ARCH_RAW}" in
+  x86_64|amd64) ARCH="amd64" ;;
+  aarch64|arm64) ARCH="arm64" ;;
+  *) echo "unsupported arch: ${ARCH_RAW}" >&2; exit 1 ;;
+esac
+
+echo "[forge-mesh] deck=${DECK_URL} arch=${ARCH}"
+
+META_URL="${DECK_URL}/api/v1/public/builds/latest?os=linux&arch=${ARCH}"
+META="$(curl -fsSL "${META_URL}")"
+
+BUILD_ID="$(echo "${META}" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')"
+CHECKSUM="$(echo "${META}" | sed -n 's/.*"checksum":"\([^"]*\)".*/\1/p')"
+SIGNATURE="$(echo "${META}" | sed -n 's/.*"signature":"\([^"]*\)".*/\1/p')"
+
+if [[ -z "${BUILD_ID}" || -z "${CHECKSUM}" ]]; then
+  echo "failed to fetch build metadata from ${META_URL}" >&2
+  exit 1
+fi
+
+TMP="$(mktemp)"
+trap 'rm -f "${TMP}"' EXIT
+
+curl -fsSL "${DECK_URL}/api/v1/public/download/${BUILD_ID}" -o "${TMP}"
+
+ACTUAL="$(sha256sum "${TMP}" | awk '{print $1}')"
+if [[ "${ACTUAL}" != "${CHECKSUM}" ]]; then
+  echo "checksum mismatch: expected ${CHECKSUM}, got ${ACTUAL}" >&2
+  exit 1
+fi
+
+if [[ -n "${SIGNATURE}" && -n "${PUBLIC_KEY}" ]]; then
+  echo "[forge-mesh] signed build (sig verified by agent on self-update with pubkey ${PUBLIC_KEY:0:16}...)"
+fi
+
+SECRET="${FORGE_MESH_FLEET_SECRET:-${FORGE_FLEET_SECRET:-${FLEET_SECRET}}}"
+if [[ -z "${SECRET}" ]]; then
+  echo "set FORGE_MESH_FLEET_SECRET before install" >&2
+  exit 1
+fi
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "[forge-mesh] not root — installing user systemd unit"
+  mkdir -p "${HOME}/.local/bin"
+  install -m 0755 "${TMP}" "${HOME}/.local/bin/forge-mesh-agent"
+  UNIT_DIR="${HOME}/.config/systemd/user"
+  mkdir -p "${UNIT_DIR}"
+  cat > "${UNIT_DIR}/${SERVICE_NAME}.service" <<UNIT
+[Unit]
+Description=Forge Mesh Agent
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${HOME}/.local/bin/forge-mesh-agent -deck-url ${DECK_URL} -secret ${SECRET} -pubkey ${PUBLIC_KEY}
+Restart=always
+RestartSec=10
+Environment=FORGE_MESH_DECK_URL=${DECK_URL}
+Environment=FORGE_MESH_FLEET_SECRET=${SECRET}
+Environment=FORGE_MESH_PUBKEY=${PUBLIC_KEY}
+
+[Install]
+WantedBy=default.target
+UNIT
+  systemctl --user daemon-reload
+  systemctl --user enable --now "${SERVICE_NAME}.service"
+  echo "[forge-mesh] started user unit ${SERVICE_NAME}"
+  exit 0
+fi
+
+mkdir -p "${INSTALL_DIR}"
+install -m 0755 "${TMP}" "${AGENT_BIN}"
+
+cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<UNIT
+[Unit]
+Description=Forge Mesh Agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${INSTALL_DIR}
+ExecStart=${AGENT_BIN} -deck-url ${DECK_URL} -secret ${SECRET} -pubkey ${PUBLIC_KEY}
+Restart=always
+RestartSec=10
+Environment=FORGE_MESH_DECK_URL=${DECK_URL}
+Environment=FORGE_MESH_FLEET_SECRET=${SECRET}
+Environment=FORGE_MESH_PUBKEY=${PUBLIC_KEY}
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+
+systemctl daemon-reload
+systemctl enable --now "${SERVICE_NAME}.service"
+echo "[forge-mesh] agent installed to ${AGENT_BIN} (build ${BUILD_ID})"
+[[ -n "${CAMPAIGN}" ]] && echo "[forge-mesh] campaign=${CAMPAIGN}"
+[[ -n "${PIN}" ]] && echo "[forge-mesh] pin accepted"