129 lines
5.7 KiB
Bash
Executable file
129 lines
5.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# install.sh — Triton License Server installer.
|
|
#
|
|
# Idempotent. Generates secrets on first run, reuses .env on subsequent runs.
|
|
# Container-based via Podman or Docker (auto-detected).
|
|
#
|
|
# Usage:
|
|
# sudo bash install.sh # interactive defaults
|
|
# sudo bash install.sh --admin-email a@b.com # set initial admin email
|
|
# sudo bash install.sh --image TAG # pin a specific image
|
|
# sudo bash install.sh --public-url URL # set TRITON_LICENSE_SERVER_PUBLIC_URL
|
|
# sudo bash install.sh --no-tls # skip TLS check (dev)
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
|
|
cd "$SCRIPT_DIR"
|
|
|
|
info() { printf '[license-server] %s\n' "$*"; }
|
|
die() { printf '[license-server] error: %s\n' "$*" >&2; exit 1; }
|
|
|
|
# ── arg parsing ──────────────────────────────────────────────────────────
|
|
ADMIN_EMAIL=""
|
|
PUBLIC_URL=""
|
|
IMAGE=""
|
|
NO_TLS=0
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--admin-email) ADMIN_EMAIL="$2"; shift 2 ;;
|
|
--public-url) PUBLIC_URL="$2"; shift 2 ;;
|
|
--image) IMAGE="$2"; shift 2 ;;
|
|
--no-tls) NO_TLS=1; shift ;;
|
|
-h|--help)
|
|
grep '^#' "$0" | sed 's/^# //;s/^#//'; exit 0 ;;
|
|
*)
|
|
die "unknown flag: $1 (try --help)" ;;
|
|
esac
|
|
done
|
|
|
|
[[ $EUID -eq 0 ]] || die "must run as root"
|
|
|
|
# ── runtime detection (podman > docker) ──────────────────────────────────
|
|
if command -v podman-compose >/dev/null 2>&1; then
|
|
COMPOSE=(podman-compose)
|
|
RUNTIME=podman
|
|
elif podman compose version >/dev/null 2>&1; then
|
|
COMPOSE=(podman compose)
|
|
RUNTIME=podman
|
|
elif docker compose version >/dev/null 2>&1; then
|
|
COMPOSE=(docker compose)
|
|
RUNTIME=docker
|
|
else
|
|
die "no compose runtime found. Install podman-compose or docker compose."
|
|
fi
|
|
info "using runtime: $RUNTIME ($(command -v $RUNTIME))"
|
|
|
|
# ── .env bootstrap ───────────────────────────────────────────────────────
|
|
ENV_FILE="$SCRIPT_DIR/.env"
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
info "writing .env from env.template (first install)"
|
|
cp env.template "$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
|
|
# Auto-generate secrets.
|
|
PG_PASS=$(openssl rand -hex 24)
|
|
|
|
# Ed25519 keypair: seed (32B) || pub (32B) = 64B = 128 hex chars.
|
|
# openssl emits PKCS#8 PEM; pull the seed out, re-derive the pub half via Go-style
|
|
# ed25519.NewKeyFromSeed at server startup. We just need the 128-hex format here.
|
|
TMP_PEM=$(mktemp)
|
|
trap 'rm -f "$TMP_PEM"' EXIT
|
|
openssl genpkey -algorithm ed25519 -out "$TMP_PEM" 2>/dev/null
|
|
SEED_HEX=$(openssl pkey -in "$TMP_PEM" -text -noout 2>/dev/null \
|
|
| awk '/priv:/{found=1; next} found && /pub:/{exit} found' \
|
|
| tr -d ' :\n' | head -c 64)
|
|
PUB_HEX=$(openssl pkey -in "$TMP_PEM" -pubout -outform DER 2>/dev/null \
|
|
| tail -c 32 | xxd -p -c 64 | tr -d '\n')
|
|
SIGNING_KEY="${SEED_HEX}${PUB_HEX}"
|
|
|
|
[[ ${#SIGNING_KEY} -eq 128 ]] || die "Ed25519 keygen produced bad length (${#SIGNING_KEY})"
|
|
|
|
ADMIN_PASS=$(openssl rand -base64 24 | tr -d '\n=+/' | head -c 28)
|
|
|
|
sed -i \
|
|
-e "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=$PG_PASS|" \
|
|
-e "s|^TRITON_LICENSE_SERVER_SIGNING_KEY=.*|TRITON_LICENSE_SERVER_SIGNING_KEY=$SIGNING_KEY|" \
|
|
-e "s|^TRITON_LICENSE_SERVER_ADMIN_PASSWORD=.*|TRITON_LICENSE_SERVER_ADMIN_PASSWORD=$ADMIN_PASS|" \
|
|
"$ENV_FILE"
|
|
|
|
[[ -n "$ADMIN_EMAIL" ]] && sed -i "s|^TRITON_LICENSE_SERVER_ADMIN_EMAIL=.*|TRITON_LICENSE_SERVER_ADMIN_EMAIL=$ADMIN_EMAIL|" "$ENV_FILE"
|
|
[[ -n "$PUBLIC_URL" ]] && sed -i "s|^TRITON_LICENSE_SERVER_PUBLIC_URL=.*|TRITON_LICENSE_SERVER_PUBLIC_URL=$PUBLIC_URL|" "$ENV_FILE"
|
|
[[ -n "$IMAGE" ]] && sed -i "s|^TRITON_LICENSE_IMAGE=.*|TRITON_LICENSE_IMAGE=$IMAGE|" "$ENV_FILE"
|
|
[[ $NO_TLS -eq 1 ]] && sed -i "s|^TRITON_LICENSE_SERVER_ALLOW_INSECURE=.*|TRITON_LICENSE_SERVER_ALLOW_INSECURE=1|" "$ENV_FILE"
|
|
|
|
info ".env created at $ENV_FILE"
|
|
info "INITIAL ADMIN PASSWORD: $ADMIN_PASS"
|
|
info " rotate after first login (Account → Change password)"
|
|
else
|
|
info "reusing existing .env at $ENV_FILE"
|
|
fi
|
|
|
|
# ── binary directory ─────────────────────────────────────────────────────
|
|
BIN_DIR_HOST=$(grep -E '^TRITON_LICENSE_SERVER_HOST_BIN_DIR=' "$ENV_FILE" | cut -d= -f2)
|
|
BIN_DIR_HOST="${BIN_DIR_HOST:-/opt/triton/binaries}"
|
|
if [[ ! -d "$BIN_DIR_HOST" ]]; then
|
|
info "creating binary directory: $BIN_DIR_HOST"
|
|
mkdir -p "$BIN_DIR_HOST"
|
|
chmod 755 "$BIN_DIR_HOST"
|
|
fi
|
|
info "binary directory: $BIN_DIR_HOST"
|
|
|
|
# ── start ────────────────────────────────────────────────────────────────
|
|
info "starting containers..."
|
|
"${COMPOSE[@]}" --env-file "$ENV_FILE" up -d
|
|
|
|
info "waiting for license server to become healthy..."
|
|
HOST_PORT=$(grep -E '^TRITON_LICENSE_SERVER_HOST_PORT=' "$ENV_FILE" | cut -d= -f2)
|
|
HOST_PORT=${HOST_PORT:-8081}
|
|
|
|
for i in $(seq 1 30); do
|
|
if curl -sf "http://localhost:${HOST_PORT}/api/v1/health" >/dev/null 2>&1; then
|
|
info "license server is up: http://localhost:${HOST_PORT}"
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
|
|
info "done. Admin UI: http://localhost:${HOST_PORT}/ui/"
|
|
info " login as: $(grep ADMIN_EMAIL "$ENV_FILE" | cut -d= -f2)"
|
|
info " see manage-server.md to wire a manage server to this licence server."
|