chore: remove license server installer — not for public distribution
This commit is contained in:
Amir Yahaya
parent
92b0eeec90
commit
bd67e55625
5 changed files with 0 additions and 379 deletions
|
|
@ -1,70 +0,0 @@
|
||||||
# Triton License Server — standalone compose file.
|
|
||||||
#
|
|
||||||
# Self-contained: bundles its own PostgreSQL. Designed to run on a host
|
|
||||||
# that ONLY hosts the licence server. For combined dev installs, see
|
|
||||||
# the root /compose.yaml.
|
|
||||||
#
|
|
||||||
# Reads .env from the same directory (this file's parent). The deploy
|
|
||||||
# install.sh writes that .env from env.template.
|
|
||||||
|
|
||||||
services:
|
|
||||||
|
|
||||||
postgres:
|
|
||||||
image: docker.io/library/postgres:18-alpine
|
|
||||||
container_name: triton-license-db
|
|
||||||
hostname: triton-license-db
|
|
||||||
restart: unless-stopped
|
|
||||||
environment:
|
|
||||||
POSTGRES_USER: ${POSTGRES_USER:-triton}
|
|
||||||
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
|
|
||||||
POSTGRES_DB: ${POSTGRES_DB:-triton_license}
|
|
||||||
volumes:
|
|
||||||
- triton-license-db-data:/var/lib/postgresql
|
|
||||||
ports:
|
|
||||||
# Bind to localhost only — never expose Postgres to the public internet.
|
|
||||||
- "127.0.0.1:${POSTGRES_PORT:-5436}:5432"
|
|
||||||
healthcheck:
|
|
||||||
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-triton} -d ${POSTGRES_DB:-triton_license}"]
|
|
||||||
interval: 5s
|
|
||||||
timeout: 3s
|
|
||||||
retries: 20
|
|
||||||
|
|
||||||
license-server:
|
|
||||||
image: ${TRITON_LICENSE_IMAGE:-ghcr.io/amiryahaya/triton-licenseserver:latest}
|
|
||||||
container_name: triton-licenseserver
|
|
||||||
hostname: triton-licenseserver
|
|
||||||
restart: unless-stopped
|
|
||||||
depends_on:
|
|
||||||
postgres:
|
|
||||||
condition: service_healthy
|
|
||||||
environment:
|
|
||||||
# Required
|
|
||||||
TRITON_LICENSE_SERVER_DB_URL: postgres://${POSTGRES_USER:-triton}:${POSTGRES_PASSWORD}@triton-license-db:5432/${POSTGRES_DB:-triton_license}?sslmode=disable
|
|
||||||
TRITON_LICENSE_SERVER_SIGNING_KEY: ${TRITON_LICENSE_SERVER_SIGNING_KEY}
|
|
||||||
TRITON_LICENSE_SERVER_ADMIN_EMAIL: ${TRITON_LICENSE_SERVER_ADMIN_EMAIL}
|
|
||||||
TRITON_LICENSE_SERVER_ADMIN_PASSWORD: ${TRITON_LICENSE_SERVER_ADMIN_PASSWORD}
|
|
||||||
# Optional — TLS termination at this container; omit if you proxy.
|
|
||||||
TRITON_LICENSE_SERVER_TLS_CERT: ${TRITON_LICENSE_SERVER_TLS_CERT:-}
|
|
||||||
TRITON_LICENSE_SERVER_TLS_KEY: ${TRITON_LICENSE_SERVER_TLS_KEY:-}
|
|
||||||
TRITON_LICENSE_SERVER_ALLOW_INSECURE: ${TRITON_LICENSE_SERVER_ALLOW_INSECURE:-}
|
|
||||||
TRITON_LICENSE_SERVER_LISTEN: ${TRITON_LICENSE_SERVER_LISTEN:-:8081}
|
|
||||||
TRITON_LICENSE_SERVER_STALE_THRESHOLD: ${TRITON_LICENSE_SERVER_STALE_THRESHOLD:-336h}
|
|
||||||
# Optional — public URL pushed to clients (used in invite emails).
|
|
||||||
TRITON_LICENSE_SERVER_PUBLIC_URL: ${TRITON_LICENSE_SERVER_PUBLIC_URL:-}
|
|
||||||
# Optional — Resend.com API key for sending invite emails.
|
|
||||||
RESEND_API_KEY: ${RESEND_API_KEY:-}
|
|
||||||
RESEND_FROM_EMAIL: ${RESEND_FROM_EMAIL:-}
|
|
||||||
# Worker binaries directory inside the container.
|
|
||||||
# The host directory (TRITON_LICENSE_SERVER_HOST_BIN_DIR) is mounted here.
|
|
||||||
TRITON_LICENSE_SERVER_BIN_DIR: /data/binaries
|
|
||||||
volumes:
|
|
||||||
# Mount TLS cert + key into the container if you set the env vars above.
|
|
||||||
- ${TLS_CERT_HOST_DIR:-/etc/triton/tls}:/etc/triton/tls:ro
|
|
||||||
# Worker binaries — persistent across container rebuilds.
|
|
||||||
- ${TRITON_LICENSE_SERVER_HOST_BIN_DIR:-/opt/triton/binaries}:/data/binaries
|
|
||||||
ports:
|
|
||||||
- "${TRITON_LICENSE_SERVER_HOST_PORT:-8081}:8081"
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
triton-license-db-data:
|
|
||||||
name: triton-license-db-data
|
|
||||||
|
|
@ -1,61 +0,0 @@
|
||||||
# Triton License Server environment template.
|
|
||||||
# Copy to .env in this directory; install.sh does that automatically.
|
|
||||||
#
|
|
||||||
# Required values are flagged. Generated values get auto-filled by install.sh
|
|
||||||
# when run without flags.
|
|
||||||
|
|
||||||
# ─── PostgreSQL (auto-generated) ─────────────────────────────────────────
|
|
||||||
POSTGRES_USER=triton
|
|
||||||
POSTGRES_PASSWORD=__GENERATED_BY_INSTALL_SH__ # openssl rand -hex 24
|
|
||||||
POSTGRES_DB=triton_license
|
|
||||||
POSTGRES_PORT=5436 # localhost-bound
|
|
||||||
|
|
||||||
# ─── License Server core (REQUIRED) ──────────────────────────────────────
|
|
||||||
# Ed25519 keypair as 128 hex chars (seed||pub). Generated once at install
|
|
||||||
# time. Back this up — losing it forces every customer to re-activate.
|
|
||||||
TRITON_LICENSE_SERVER_SIGNING_KEY=__GENERATED_BY_INSTALL_SH__
|
|
||||||
|
|
||||||
# Initial superadmin seeded on first boot. After login, rotate this.
|
|
||||||
TRITON_LICENSE_SERVER_ADMIN_EMAIL=admin@example.com
|
|
||||||
TRITON_LICENSE_SERVER_ADMIN_PASSWORD=__GENERATED_BY_INSTALL_SH__
|
|
||||||
|
|
||||||
# ─── Listener ────────────────────────────────────────────────────────────
|
|
||||||
TRITON_LICENSE_SERVER_LISTEN=:8081
|
|
||||||
TRITON_LICENSE_SERVER_HOST_PORT=8081 # host port to publish
|
|
||||||
|
|
||||||
# ─── TLS (recommended for production) ────────────────────────────────────
|
|
||||||
# Two paths:
|
|
||||||
# A) Reverse proxy terminates TLS — leave these blank, set ALLOW_INSECURE=1.
|
|
||||||
# B) Container terminates TLS — set CERT + KEY (paths inside container)
|
|
||||||
# and mount your /etc/triton/tls directory via TLS_CERT_HOST_DIR.
|
|
||||||
TRITON_LICENSE_SERVER_TLS_CERT=
|
|
||||||
TRITON_LICENSE_SERVER_TLS_KEY=
|
|
||||||
TRITON_LICENSE_SERVER_ALLOW_INSECURE=
|
|
||||||
TLS_CERT_HOST_DIR=/etc/triton/tls
|
|
||||||
|
|
||||||
# ─── Operations ──────────────────────────────────────────────────────────
|
|
||||||
# Hours after which a license is considered stale (offline grace window).
|
|
||||||
# 336h = 14 days. Increase for longer offline tolerance.
|
|
||||||
TRITON_LICENSE_SERVER_STALE_THRESHOLD=336h
|
|
||||||
|
|
||||||
# Public URL of this server. Used in invite emails and pushed to clients
|
|
||||||
# during validation. Leave blank if no email/external clients yet.
|
|
||||||
TRITON_LICENSE_SERVER_PUBLIC_URL=
|
|
||||||
|
|
||||||
# ─── Email (optional) ────────────────────────────────────────────────────
|
|
||||||
# Resend.com keys for sending platform-admin invites + temp passwords.
|
|
||||||
# Leave blank to disable email — invites are still issued, the password
|
|
||||||
# just isn't auto-mailed.
|
|
||||||
RESEND_API_KEY=
|
|
||||||
RESEND_FROM_EMAIL=
|
|
||||||
|
|
||||||
# ─── Worker binaries ─────────────────────────────────────────────────────
|
|
||||||
# Host directory bind-mounted into the container at /data/binaries.
|
|
||||||
# Binaries (triton-agent, triton-sshagent, triton-portscan) are stored as
|
|
||||||
# files — not in the DB — so this directory must survive container rebuilds.
|
|
||||||
# Created automatically by install.sh if it does not exist.
|
|
||||||
TRITON_LICENSE_SERVER_HOST_BIN_DIR=/opt/triton/binaries
|
|
||||||
|
|
||||||
# ─── Image ───────────────────────────────────────────────────────────────
|
|
||||||
# Override to pin a specific build. Default tracks :latest from ghcr.io.
|
|
||||||
TRITON_LICENSE_IMAGE=ghcr.io/amiryahaya/triton-licenseserver:latest
|
|
||||||
|
|
@ -1,129 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# install.sh — Triton License Server installer.
|
|
||||||
#
|
|
||||||
# Idempotent. Generates secrets on first run, reuses .env on subsequent runs.
|
|
||||||
# Container-based via Podman or Docker (auto-detected).
|
|
||||||
#
|
|
||||||
# Usage:
|
|
||||||
# sudo bash install.sh # interactive defaults
|
|
||||||
# sudo bash install.sh --admin-email a@b.com # set initial admin email
|
|
||||||
# sudo bash install.sh --image TAG # pin a specific image
|
|
||||||
# sudo bash install.sh --public-url URL # set TRITON_LICENSE_SERVER_PUBLIC_URL
|
|
||||||
# sudo bash install.sh --no-tls # skip TLS check (dev)
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
|
|
||||||
cd "$SCRIPT_DIR"
|
|
||||||
|
|
||||||
info() { printf '[license-server] %s\n' "$*"; }
|
|
||||||
die() { printf '[license-server] error: %s\n' "$*" >&2; exit 1; }
|
|
||||||
|
|
||||||
# ── arg parsing ──────────────────────────────────────────────────────────
|
|
||||||
ADMIN_EMAIL=""
|
|
||||||
PUBLIC_URL=""
|
|
||||||
IMAGE=""
|
|
||||||
NO_TLS=0
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
--admin-email) ADMIN_EMAIL="$2"; shift 2 ;;
|
|
||||||
--public-url) PUBLIC_URL="$2"; shift 2 ;;
|
|
||||||
--image) IMAGE="$2"; shift 2 ;;
|
|
||||||
--no-tls) NO_TLS=1; shift ;;
|
|
||||||
-h|--help)
|
|
||||||
grep '^#' "$0" | sed 's/^# //;s/^#//'; exit 0 ;;
|
|
||||||
*)
|
|
||||||
die "unknown flag: $1 (try --help)" ;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
[[ $EUID -eq 0 ]] || die "must run as root"
|
|
||||||
|
|
||||||
# ── runtime detection (podman > docker) ──────────────────────────────────
|
|
||||||
if command -v podman-compose >/dev/null 2>&1; then
|
|
||||||
COMPOSE=(podman-compose)
|
|
||||||
RUNTIME=podman
|
|
||||||
elif podman compose version >/dev/null 2>&1; then
|
|
||||||
COMPOSE=(podman compose)
|
|
||||||
RUNTIME=podman
|
|
||||||
elif docker compose version >/dev/null 2>&1; then
|
|
||||||
COMPOSE=(docker compose)
|
|
||||||
RUNTIME=docker
|
|
||||||
else
|
|
||||||
die "no compose runtime found. Install podman-compose or docker compose."
|
|
||||||
fi
|
|
||||||
info "using runtime: $RUNTIME ($(command -v $RUNTIME))"
|
|
||||||
|
|
||||||
# ── .env bootstrap ───────────────────────────────────────────────────────
|
|
||||||
ENV_FILE="$SCRIPT_DIR/.env"
|
|
||||||
if [[ ! -f "$ENV_FILE" ]]; then
|
|
||||||
info "writing .env from env.template (first install)"
|
|
||||||
cp env.template "$ENV_FILE"
|
|
||||||
chmod 600 "$ENV_FILE"
|
|
||||||
|
|
||||||
# Auto-generate secrets.
|
|
||||||
PG_PASS=$(openssl rand -hex 24)
|
|
||||||
|
|
||||||
# Ed25519 keypair: seed (32B) || pub (32B) = 64B = 128 hex chars.
|
|
||||||
# openssl emits PKCS#8 PEM; pull the seed out, re-derive the pub half via Go-style
|
|
||||||
# ed25519.NewKeyFromSeed at server startup. We just need the 128-hex format here.
|
|
||||||
TMP_PEM=$(mktemp)
|
|
||||||
trap 'rm -f "$TMP_PEM"' EXIT
|
|
||||||
openssl genpkey -algorithm ed25519 -out "$TMP_PEM" 2>/dev/null
|
|
||||||
SEED_HEX=$(openssl pkey -in "$TMP_PEM" -text -noout 2>/dev/null \
|
|
||||||
| awk '/priv:/{found=1; next} found && /pub:/{exit} found' \
|
|
||||||
| tr -d ' :\n' | head -c 64)
|
|
||||||
PUB_HEX=$(openssl pkey -in "$TMP_PEM" -pubout -outform DER 2>/dev/null \
|
|
||||||
| tail -c 32 | xxd -p -c 64 | tr -d '\n')
|
|
||||||
SIGNING_KEY="${SEED_HEX}${PUB_HEX}"
|
|
||||||
|
|
||||||
[[ ${#SIGNING_KEY} -eq 128 ]] || die "Ed25519 keygen produced bad length (${#SIGNING_KEY})"
|
|
||||||
|
|
||||||
ADMIN_PASS=$(openssl rand -base64 24 | tr -d '\n=+/' | head -c 28)
|
|
||||||
|
|
||||||
sed -i \
|
|
||||||
-e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=$PG_PASS|" \
|
|
||||||
-e "s|^TRITON_LICENSE_SERVER_SIGNING_KEY=.*|TRITON_LICENSE_SERVER_SIGNING_KEY=$SIGNING_KEY|" \
|
|
||||||
-e "s|^TRITON_LICENSE_SERVER_ADMIN_PASSWORD=.*|TRITON_LICENSE_SERVER_ADMIN_PASSWORD=$ADMIN_PASS|" \
|
|
||||||
"$ENV_FILE"
|
|
||||||
|
|
||||||
[[ -n "$ADMIN_EMAIL" ]] && sed -i "s|^TRITON_LICENSE_SERVER_ADMIN_EMAIL=.*|TRITON_LICENSE_SERVER_ADMIN_EMAIL=$ADMIN_EMAIL|" "$ENV_FILE"
|
|
||||||
[[ -n "$PUBLIC_URL" ]] && sed -i "s|^TRITON_LICENSE_SERVER_PUBLIC_URL=.*|TRITON_LICENSE_SERVER_PUBLIC_URL=$PUBLIC_URL|" "$ENV_FILE"
|
|
||||||
[[ -n "$IMAGE" ]] && sed -i "s|^TRITON_LICENSE_IMAGE=.*|TRITON_LICENSE_IMAGE=$IMAGE|" "$ENV_FILE"
|
|
||||||
[[ $NO_TLS -eq 1 ]] && sed -i "s|^TRITON_LICENSE_SERVER_ALLOW_INSECURE=.*|TRITON_LICENSE_SERVER_ALLOW_INSECURE=1|" "$ENV_FILE"
|
|
||||||
|
|
||||||
info ".env created at $ENV_FILE"
|
|
||||||
info "INITIAL ADMIN PASSWORD: $ADMIN_PASS"
|
|
||||||
info " rotate after first login (Account → Change password)"
|
|
||||||
else
|
|
||||||
info "reusing existing .env at $ENV_FILE"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# ── binary directory ─────────────────────────────────────────────────────
|
|
||||||
BIN_DIR_HOST=$(grep -E '^TRITON_LICENSE_SERVER_HOST_BIN_DIR=' "$ENV_FILE" | cut -d= -f2)
|
|
||||||
BIN_DIR_HOST="${BIN_DIR_HOST:-/opt/triton/binaries}"
|
|
||||||
if [[ ! -d "$BIN_DIR_HOST" ]]; then
|
|
||||||
info "creating binary directory: $BIN_DIR_HOST"
|
|
||||||
mkdir -p "$BIN_DIR_HOST"
|
|
||||||
chmod 755 "$BIN_DIR_HOST"
|
|
||||||
fi
|
|
||||||
info "binary directory: $BIN_DIR_HOST"
|
|
||||||
|
|
||||||
# ── start ────────────────────────────────────────────────────────────────
|
|
||||||
info "starting containers..."
|
|
||||||
"${COMPOSE[@]}" --env-file "$ENV_FILE" up -d
|
|
||||||
|
|
||||||
info "waiting for license server to become healthy..."
|
|
||||||
HOST_PORT=$(grep -E '^TRITON_LICENSE_SERVER_HOST_PORT=' "$ENV_FILE" | cut -d= -f2)
|
|
||||||
HOST_PORT=${HOST_PORT:-8081}
|
|
||||||
|
|
||||||
for i in $(seq 1 30); do
|
|
||||||
if curl -sf "http://localhost:${HOST_PORT}/api/v1/health" >/dev/null 2>&1; then
|
|
||||||
info "license server is up: http://localhost:${HOST_PORT}"
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
|
|
||||||
info "done. Admin UI: http://localhost:${HOST_PORT}/ui/"
|
|
||||||
info " login as: $(grep ADMIN_EMAIL "$ENV_FILE" | cut -d= -f2)"
|
|
||||||
info " see manage-server.md to wire a manage server to this licence server."
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# uninstall.sh — stop and remove License Server containers.
|
|
||||||
#
|
|
||||||
# By default, KEEPS the PostgreSQL volume (license data). Pass --purge-data
|
|
||||||
# to delete the volume as well — irreversible.
|
|
||||||
#
|
|
||||||
# Usage:
|
|
||||||
# sudo bash uninstall.sh # stop + remove containers, keep DB volume
|
|
||||||
# sudo bash uninstall.sh --purge-data # also delete DB volume (DESTRUCTIVE)
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
|
|
||||||
cd "$SCRIPT_DIR"
|
|
||||||
|
|
||||||
info() { printf '[license-server] %s\n' "$*"; }
|
|
||||||
die() { printf '[license-server] error: %s\n' "$*" >&2; exit 1; }
|
|
||||||
|
|
||||||
[[ $EUID -eq 0 ]] || die "must run as root"
|
|
||||||
|
|
||||||
PURGE=0
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
--purge-data) PURGE=1; shift ;;
|
|
||||||
-h|--help) grep '^#' "$0" | sed 's/^# //;s/^#//'; exit 0 ;;
|
|
||||||
*) die "unknown flag: $1" ;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
if command -v podman-compose >/dev/null 2>&1; then COMPOSE=(podman-compose)
|
|
||||||
elif podman compose version >/dev/null 2>&1; then COMPOSE=(podman compose)
|
|
||||||
elif docker compose version >/dev/null 2>&1; then COMPOSE=(docker compose)
|
|
||||||
else die "no compose runtime found"; fi
|
|
||||||
|
|
||||||
if [[ -f .env ]]; then
|
|
||||||
info "stopping containers..."
|
|
||||||
"${COMPOSE[@]}" --env-file .env down
|
|
||||||
else
|
|
||||||
info ".env not found, attempting raw container cleanup..."
|
|
||||||
podman rm -f triton-licenseserver triton-license-db 2>/dev/null || true
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ $PURGE -eq 1 ]]; then
|
|
||||||
info "DESTRUCTIVE: removing license DB volume..."
|
|
||||||
read -r -p " Are you sure? Type 'yes' to confirm: " CONFIRM
|
|
||||||
[[ "$CONFIRM" == "yes" ]] || die "aborted"
|
|
||||||
podman volume rm -f triton-license-db-data 2>/dev/null \
|
|
||||||
|| docker volume rm -f triton-license-db-data 2>/dev/null \
|
|
||||||
|| true
|
|
||||||
info " DB volume removed"
|
|
||||||
info " .env and signing key still on disk at $SCRIPT_DIR/.env — delete manually if desired"
|
|
||||||
else
|
|
||||||
info "DB volume retained (run with --purge-data to delete)"
|
|
||||||
fi
|
|
||||||
|
|
||||||
info "uninstall complete"
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
#!/usr/bin/env bash
|
|
||||||
# upgrade.sh — pull the latest license-server image and restart.
|
|
||||||
#
|
|
||||||
# DB schema migrations run on startup automatically. No app data is touched.
|
|
||||||
#
|
|
||||||
# Usage:
|
|
||||||
# sudo bash upgrade.sh # pull :latest, recreate containers
|
|
||||||
# sudo bash upgrade.sh --image TAG # pin a specific image
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
|
|
||||||
cd "$SCRIPT_DIR"
|
|
||||||
|
|
||||||
info() { printf '[license-server] %s\n' "$*"; }
|
|
||||||
die() { printf '[license-server] error: %s\n' "$*" >&2; exit 1; }
|
|
||||||
|
|
||||||
[[ $EUID -eq 0 ]] || die "must run as root"
|
|
||||||
[[ -f .env ]] || die ".env not found — run install.sh first"
|
|
||||||
|
|
||||||
IMAGE=""
|
|
||||||
while [[ $# -gt 0 ]]; do
|
|
||||||
case "$1" in
|
|
||||||
--image) IMAGE="$2"; shift 2 ;;
|
|
||||||
-h|--help) grep '^#' "$0" | sed 's/^# //;s/^#//'; exit 0 ;;
|
|
||||||
*) die "unknown flag: $1" ;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
if [[ -n "$IMAGE" ]]; then
|
|
||||||
sed -i "s|^TRITON_LICENSE_IMAGE=.*|TRITON_LICENSE_IMAGE=$IMAGE|" .env
|
|
||||||
info "pinned image to $IMAGE"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if command -v podman-compose >/dev/null 2>&1; then COMPOSE=(podman-compose)
|
|
||||||
elif podman compose version >/dev/null 2>&1; then COMPOSE=(podman compose)
|
|
||||||
elif docker compose version >/dev/null 2>&1; then COMPOSE=(docker compose)
|
|
||||||
else die "no compose runtime found"; fi
|
|
||||||
|
|
||||||
info "pre-upgrade DB backup..."
|
|
||||||
DUMP_DIR=/var/backups/triton
|
|
||||||
mkdir -p "$DUMP_DIR"
|
|
||||||
DUMP_FILE="$DUMP_DIR/license-pre-upgrade-$(date +%F-%H%M%S).sql.gz"
|
|
||||||
podman exec triton-license-db pg_dump -U triton triton_license 2>/dev/null \
|
|
||||||
| gzip > "$DUMP_FILE" || die "pg_dump failed — aborting upgrade"
|
|
||||||
info " saved: $DUMP_FILE"
|
|
||||||
|
|
||||||
info "pulling latest image..."
|
|
||||||
"${COMPOSE[@]}" --env-file .env pull license-server
|
|
||||||
|
|
||||||
info "recreating license-server container..."
|
|
||||||
"${COMPOSE[@]}" --env-file .env up -d --no-deps license-server
|
|
||||||
|
|
||||||
HOST_PORT=$(grep -E '^TRITON_LICENSE_SERVER_HOST_PORT=' .env | cut -d= -f2)
|
|
||||||
HOST_PORT=${HOST_PORT:-8081}
|
|
||||||
|
|
||||||
info "waiting for new container to become healthy..."
|
|
||||||
for i in $(seq 1 30); do
|
|
||||||
if curl -sf "http://localhost:${HOST_PORT}/api/v1/license/health" >/dev/null 2>&1; then
|
|
||||||
info "upgrade complete"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
die "new container did not become healthy in 60s — check logs and consider rollback"
|
|
||||||
Loading…
Add table
Reference in a new issue