113 lines
3.3 KiB
Smarty
113 lines
3.3 KiB
Smarty
#!/bin/bash
|
|
# forge-mesh agent installer — rendered by deck at GET /install.sh
|
|
set -euo pipefail
|
|
|
|
DECK_URL="{{.DeckURL}}"
|
|
PUBLIC_KEY="{{.PublicKey}}"
|
|
FLEET_SECRET="{{.FleetSecret}}"
|
|
PIN="{{.Pin}}"
|
|
CAMPAIGN="{{.Campaign}}"
|
|
INSTALL_DIR="${FORGE_MESH_INSTALL_DIR:-/opt/forge-mesh}"
|
|
AGENT_BIN="${INSTALL_DIR}/agent"
|
|
SERVICE_NAME="forge-mesh-agent"
|
|
|
|
ARCH_RAW="$(uname -m)"
|
|
case "${ARCH_RAW}" in
|
|
x86_64|amd64) ARCH="amd64" ;;
|
|
aarch64|arm64) ARCH="arm64" ;;
|
|
*) echo "unsupported arch: ${ARCH_RAW}" >&2; exit 1 ;;
|
|
esac
|
|
|
|
echo "[forge-mesh] deck=${DECK_URL} arch=${ARCH}"
|
|
|
|
META_URL="${DECK_URL}/api/v1/public/builds/latest?os=linux&arch=${ARCH}"
|
|
META="$(curl -fsSL "${META_URL}")"
|
|
|
|
BUILD_ID="$(echo "${META}" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')"
|
|
CHECKSUM="$(echo "${META}" | sed -n 's/.*"checksum":"\([^"]*\)".*/\1/p')"
|
|
SIGNATURE="$(echo "${META}" | sed -n 's/.*"signature":"\([^"]*\)".*/\1/p')"
|
|
|
|
if [[ -z "${BUILD_ID}" || -z "${CHECKSUM}" ]]; then
|
|
echo "failed to fetch build metadata from ${META_URL}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
TMP="$(mktemp)"
|
|
trap 'rm -f "${TMP}"' EXIT
|
|
|
|
curl -fsSL "${DECK_URL}/api/v1/public/download/${BUILD_ID}" -o "${TMP}"
|
|
|
|
ACTUAL="$(sha256sum "${TMP}" | awk '{print $1}')"
|
|
if [[ "${ACTUAL}" != "${CHECKSUM}" ]]; then
|
|
echo "checksum mismatch: expected ${CHECKSUM}, got ${ACTUAL}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -n "${SIGNATURE}" && -n "${PUBLIC_KEY}" ]]; then
|
|
echo "[forge-mesh] signed build (sig verified by agent on self-update with pubkey ${PUBLIC_KEY:0:16}...)"
|
|
fi
|
|
|
|
SECRET="${FORGE_MESH_FLEET_SECRET:-${FORGE_FLEET_SECRET:-${FLEET_SECRET}}}"
|
|
if [[ -z "${SECRET}" ]]; then
|
|
echo "set FORGE_MESH_FLEET_SECRET before install" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "[forge-mesh] not root — installing user systemd unit"
|
|
mkdir -p "${HOME}/.local/bin"
|
|
install -m 0755 "${TMP}" "${HOME}/.local/bin/forge-mesh-agent"
|
|
UNIT_DIR="${HOME}/.config/systemd/user"
|
|
mkdir -p "${UNIT_DIR}"
|
|
cat > "${UNIT_DIR}/${SERVICE_NAME}.service" <<UNIT
|
|
[Unit]
|
|
Description=Forge Mesh Agent
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=${HOME}/.local/bin/forge-mesh-agent -deck-url ${DECK_URL} -secret ${SECRET} -pubkey ${PUBLIC_KEY}
|
|
Restart=always
|
|
RestartSec=10
|
|
Environment=FORGE_MESH_DECK_URL=${DECK_URL}
|
|
Environment=FORGE_MESH_FLEET_SECRET=${SECRET}
|
|
Environment=FORGE_MESH_PUBKEY=${PUBLIC_KEY}
|
|
|
|
[Install]
|
|
WantedBy=default.target
|
|
UNIT
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable --now "${SERVICE_NAME}.service"
|
|
echo "[forge-mesh] started user unit ${SERVICE_NAME}"
|
|
exit 0
|
|
fi
|
|
|
|
mkdir -p "${INSTALL_DIR}"
|
|
install -m 0755 "${TMP}" "${AGENT_BIN}"
|
|
|
|
cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<UNIT
|
|
[Unit]
|
|
Description=Forge Mesh Agent
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=${INSTALL_DIR}
|
|
ExecStart=${AGENT_BIN} -deck-url ${DECK_URL} -secret ${SECRET} -pubkey ${PUBLIC_KEY}
|
|
Restart=always
|
|
RestartSec=10
|
|
Environment=FORGE_MESH_DECK_URL=${DECK_URL}
|
|
Environment=FORGE_MESH_FLEET_SECRET=${SECRET}
|
|
Environment=FORGE_MESH_PUBKEY=${PUBLIC_KEY}
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now "${SERVICE_NAME}.service"
|
|
echo "[forge-mesh] agent installed to ${AGENT_BIN} (build ${BUILD_ID})"
|
|
[[ -n "${CAMPAIGN}" ]] && echo "[forge-mesh] campaign=${CAMPAIGN}"
|
|
[[ -n "${PIN}" ]] && echo "[forge-mesh] pin accepted"
|