Compare commits
13 Commits
master
...
96c737709c
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
96c737709c | ||
|
|
2c8df6993d | ||
|
|
c86dca283f | ||
|
|
9015ff46c9 | ||
|
|
87c08fb543 | ||
|
|
7bdafd316c | ||
|
|
114c97a1cb | ||
|
|
c71ad59629 | ||
|
|
2abd6ac6a4 | ||
|
|
ccd9b205b8 | ||
|
|
f6c2c79a70 | ||
|
|
cf8a10818a | ||
|
|
fefd082af2 |
124
hub/onboard-spoke.sh
Normal file
124
hub/onboard-spoke.sh
Normal file
@@ -0,0 +1,124 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
RCLONE_CONF="${HOME}/.config/rclone/rclone.conf"
|
||||||
|
SSH_DIR="${HOME}/.ssh"
|
||||||
|
|
||||||
|
if [ "$(id -u)" -eq 0 ]; then
|
||||||
|
echo -e "\033[0;31m[WARNING]\033[0m Running as root — keys will be written to /root/.ssh. Run as armbian instead."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
mkdir -p "$SSH_DIR"
|
||||||
|
touch "$SSH_DIR/known_hosts"
|
||||||
|
chmod 700 "$SSH_DIR"
|
||||||
|
chmod 600 "$SSH_DIR/known_hosts"
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
retry_or_abort() {
|
||||||
|
local test_cmd="$1"
|
||||||
|
local fail_msg="$2"
|
||||||
|
while true; do
|
||||||
|
if eval "$test_cmd" 2>/dev/null; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
warn "$fail_msg"
|
||||||
|
echo -e " ${YELLOW}[R]${NC} Retry ${RED}[A]${NC} Abort"
|
||||||
|
read -rp "Choice: " CHOICE
|
||||||
|
case "${CHOICE,,}" in
|
||||||
|
r) info "Retrying..." ;;
|
||||||
|
a) die "Aborted." ;;
|
||||||
|
*) warn "Press R to retry or A to abort." ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
||||||
|
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
||||||
|
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
|
||||||
|
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
|
||||||
|
|
||||||
|
header "TinyBoard Hub — Onboard New Spoke"
|
||||||
|
|
||||||
|
read -rp "Spoke name (e.g. rocky): " SPOKE_NAME
|
||||||
|
[ -n "$SPOKE_NAME" ] || die "Spoke name cannot be empty"
|
||||||
|
|
||||||
|
read -rp "Tunnel port for $SPOKE_NAME: " TUNNEL_PORT
|
||||||
|
[[ "$TUNNEL_PORT" =~ ^[0-9]+$ ]] || die "Invalid port"
|
||||||
|
|
||||||
|
KEY_NAME="armbian-${SPOKE_NAME}-$(date +%Y%m)"
|
||||||
|
KEY_PATH="$SSH_DIR/$KEY_NAME"
|
||||||
|
|
||||||
|
command -v rclone >/dev/null || die "rclone is not installed"
|
||||||
|
mkdir -p "$(dirname "$RCLONE_CONF")"
|
||||||
|
|
||||||
|
header "Checking Tunnel"
|
||||||
|
info "Scanning spoke host key..."
|
||||||
|
KEYSCAN=$(ssh-keyscan -p "$TUNNEL_PORT" -H localhost 2>/dev/null)
|
||||||
|
[ -n "$KEYSCAN" ] || die "Spoke not reachable on port $TUNNEL_PORT — is the tunnel up?"
|
||||||
|
echo "$KEYSCAN" >> "$SSH_DIR/known_hosts"
|
||||||
|
|
||||||
|
info "Verifying spoke is reachable on port $TUNNEL_PORT..."
|
||||||
|
retry_or_abort \
|
||||||
|
"ssh -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" armbian@localhost exit" \
|
||||||
|
"Spoke not reachable on port $TUNNEL_PORT. Make sure the tunnel is up."
|
||||||
|
|
||||||
|
header "Generating Hub SSH Key"
|
||||||
|
if [ -f "$KEY_PATH" ]; then
|
||||||
|
warn "Key $KEY_PATH already exists, skipping generation."
|
||||||
|
else
|
||||||
|
ssh-keygen -t ed25519 -f "$KEY_PATH" -N ""
|
||||||
|
info "Key generated: $KEY_PATH"
|
||||||
|
fi
|
||||||
|
|
||||||
|
header "Copying Hub Key to Spoke"
|
||||||
|
info "Running ssh-copy-id to armbian@localhost:$TUNNEL_PORT..."
|
||||||
|
info "(You will be prompted for the armbian password on the spoke)"
|
||||||
|
ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" armbian@localhost
|
||||||
|
info "Key copied."
|
||||||
|
|
||||||
|
header "Testing Hub -> Spoke Key Auth"
|
||||||
|
retry_or_abort \
|
||||||
|
"ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" armbian@localhost exit" \
|
||||||
|
"Key auth failed. Check authorized_keys on the spoke."
|
||||||
|
info "Key auth to spoke successful."
|
||||||
|
|
||||||
|
header "Adding rclone Remote"
|
||||||
|
if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then
|
||||||
|
warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping."
|
||||||
|
else
|
||||||
|
cat >> "$RCLONE_CONF" <<EOF
|
||||||
|
|
||||||
|
[${SPOKE_NAME}-remote]
|
||||||
|
type = sftp
|
||||||
|
host = localhost
|
||||||
|
port = $TUNNEL_PORT
|
||||||
|
key_file = $KEY_PATH
|
||||||
|
shell_type = unix
|
||||||
|
md5sum_command = md5sum
|
||||||
|
sha1sum_command = sha1sum
|
||||||
|
EOF
|
||||||
|
info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF."
|
||||||
|
fi
|
||||||
|
|
||||||
|
header "Testing rclone Connection"
|
||||||
|
if rclone lsd "${SPOKE_NAME}-remote:" --config "$RCLONE_CONF" 2>/dev/null; then
|
||||||
|
info "rclone connection to $SPOKE_NAME successful."
|
||||||
|
else
|
||||||
|
warn "rclone test failed. Check the remote config in $RCLONE_CONF."
|
||||||
|
fi
|
||||||
|
|
||||||
|
header "Onboarding Complete"
|
||||||
|
echo -e " Spoke: ${GREEN}$SPOKE_NAME${NC}"
|
||||||
|
echo -e " Port: ${GREEN}$TUNNEL_PORT${NC}"
|
||||||
|
echo -e " Hub key: ${GREEN}$KEY_PATH${NC}"
|
||||||
|
echo -e " rclone: ${GREEN}${SPOKE_NAME}-remote${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e "${YELLOW}To mount this spoke:${NC}"
|
||||||
|
echo " RCLONE_REMOTE=${SPOKE_NAME}-remote hubspoke-helper.sh hub start"
|
||||||
|
echo ""
|
||||||
166
setup-network.sh
Normal file
166
setup-network.sh
Normal file
@@ -0,0 +1,166 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
||||||
|
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
||||||
|
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
|
||||||
|
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
|
||||||
|
|
||||||
|
[ "$(id -u)" -eq 0 ] || die "Run as root"
|
||||||
|
|
||||||
|
header "TinyBoard Network Setup"
|
||||||
|
|
||||||
|
info "Available interfaces:"
|
||||||
|
ip -o link show | awk -F': ' 'NR>1 {print " " $2}'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
read -rp "Enter interface name to configure (e.g. wlan0, eth0, end0): " IFACE
|
||||||
|
[ -n "$IFACE" ] || die "Interface name cannot be empty"
|
||||||
|
ip link show "$IFACE" >/dev/null 2>&1 || die "Interface $IFACE not found"
|
||||||
|
|
||||||
|
IS_WIFI=false
|
||||||
|
if [[ "$IFACE" == wl* ]]; then
|
||||||
|
IS_WIFI=true
|
||||||
|
info "Wireless interface detected."
|
||||||
|
else
|
||||||
|
info "Wired interface detected — skipping WiFi credential setup."
|
||||||
|
fi
|
||||||
|
|
||||||
|
CURRENT_IP=$(ip -o -4 addr show "$IFACE" 2>/dev/null | awk '{print $4}' | head -1)
|
||||||
|
CURRENT_GW=$(ip route show default 2>/dev/null | awk '/default/ {print $3}' | head -1)
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
info "Current IP: ${CURRENT_IP:-none}"
|
||||||
|
info "Current gateway: ${CURRENT_GW:-none}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
read -rp "Set a static IP for this spoke? [Y/n]: " SET_STATIC
|
||||||
|
SET_STATIC="${SET_STATIC:-y}"
|
||||||
|
|
||||||
|
if [[ "${SET_STATIC,,}" != "y" ]]; then
|
||||||
|
info "Keeping DHCP. No changes made."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
header "Static IP Configuration"
|
||||||
|
|
||||||
|
read -rp "Enter static IP with prefix (e.g. 192.168.1.69/24): " STATIC_IP
|
||||||
|
[ -n "$STATIC_IP" ] || die "IP address cannot be empty"
|
||||||
|
|
||||||
|
DEFAULT_GW="${CURRENT_GW:-192.168.1.1}"
|
||||||
|
read -rp "Gateway [${DEFAULT_GW}]: " GATEWAY
|
||||||
|
GATEWAY="${GATEWAY:-$DEFAULT_GW}"
|
||||||
|
|
||||||
|
read -rp "DNS servers (comma-separated) [${GATEWAY},8.8.8.8]: " DNS_INPUT
|
||||||
|
DNS_INPUT="${DNS_INPUT:-${GATEWAY},8.8.8.8}"
|
||||||
|
|
||||||
|
DNS_YAML=""
|
||||||
|
IFS=',' read -ra DNS_LIST <<< "$DNS_INPUT"
|
||||||
|
for DNS in "${DNS_LIST[@]}"; do
|
||||||
|
DNS=$(echo "$DNS" | tr -d ' ')
|
||||||
|
DNS_YAML="${DNS_YAML} - ${DNS}\n"
|
||||||
|
done
|
||||||
|
|
||||||
|
info "Current netplan configs:"
|
||||||
|
ls /etc/netplan/ | sed 's/^/ /'
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
NETPLAN_FILE=$(ls /etc/netplan/*.yaml 2>/dev/null | head -1)
|
||||||
|
read -rp "Netplan file to update [${NETPLAN_FILE}]: " INPUT_FILE
|
||||||
|
NETPLAN_FILE="${INPUT_FILE:-$INPUT_FILE}"
|
||||||
|
NETPLAN_FILE="${NETPLAN_FILE:-$(ls /etc/netplan/*.yaml 2>/dev/null | head -1)}"
|
||||||
|
[ -n "$NETPLAN_FILE" ] || die "No netplan file specified"
|
||||||
|
|
||||||
|
if $IS_WIFI; then
|
||||||
|
header "WiFi Credentials"
|
||||||
|
CURRENT_SSID=""
|
||||||
|
if [ -f "$NETPLAN_FILE" ]; then
|
||||||
|
CURRENT_SSID=$(grep -A1 'access-points:' "$NETPLAN_FILE" 2>/dev/null | tail -1 | tr -d ' "' | sed 's/:$//' || true)
|
||||||
|
fi
|
||||||
|
|
||||||
|
KEEP_WIFI="n"
|
||||||
|
if [ -n "$CURRENT_SSID" ]; then
|
||||||
|
warn "Existing WiFi config found for: $CURRENT_SSID"
|
||||||
|
read -rp "Keep existing WiFi credentials? [Y/n]: " KEEP_WIFI
|
||||||
|
KEEP_WIFI="${KEEP_WIFI:-y}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "${KEEP_WIFI,,}" != "y" ]]; then
|
||||||
|
read -rp "WiFi SSID: " WIFI_SSID
|
||||||
|
[ -n "$WIFI_SSID" ] || die "SSID cannot be empty"
|
||||||
|
read -rsp "WiFi password: " WIFI_PASS
|
||||||
|
echo ""
|
||||||
|
[ -n "$WIFI_PASS" ] || die "Password cannot be empty"
|
||||||
|
else
|
||||||
|
WIFI_SSID="$CURRENT_SSID"
|
||||||
|
WIFI_PASS=$(grep -A2 "\"${WIFI_SSID}\"" "$NETPLAN_FILE" 2>/dev/null | grep password | awk -F': ' '{print $2}' | tr -d '"' || true)
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
header "Writing Netplan Config"
|
||||||
|
if [ -f "$NETPLAN_FILE" ]; then
|
||||||
|
cp "$NETPLAN_FILE" "${NETPLAN_FILE}.bak"
|
||||||
|
info "Backup saved to ${NETPLAN_FILE}.bak"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if $IS_WIFI; then
|
||||||
|
cat > "$NETPLAN_FILE" <<NETEOF
|
||||||
|
network:
|
||||||
|
version: 2
|
||||||
|
wifis:
|
||||||
|
${IFACE}:
|
||||||
|
dhcp4: no
|
||||||
|
addresses:
|
||||||
|
- ${STATIC_IP}
|
||||||
|
routes:
|
||||||
|
- to: default
|
||||||
|
via: ${GATEWAY}
|
||||||
|
nameservers:
|
||||||
|
addresses:
|
||||||
|
$(printf '%b' "$DNS_YAML") access-points:
|
||||||
|
"${WIFI_SSID}":
|
||||||
|
password: "${WIFI_PASS}"
|
||||||
|
NETEOF
|
||||||
|
else
|
||||||
|
cat > "$NETPLAN_FILE" <<NETEOF
|
||||||
|
network:
|
||||||
|
version: 2
|
||||||
|
ethernets:
|
||||||
|
${IFACE}:
|
||||||
|
dhcp4: no
|
||||||
|
addresses:
|
||||||
|
- ${STATIC_IP}
|
||||||
|
routes:
|
||||||
|
- to: default
|
||||||
|
via: ${GATEWAY}
|
||||||
|
nameservers:
|
||||||
|
addresses:
|
||||||
|
$(printf '%b' "$DNS_YAML")NETEOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
info "Netplan config written to $NETPLAN_FILE"
|
||||||
|
|
||||||
|
header "Applying Configuration"
|
||||||
|
warn "Testing netplan config..."
|
||||||
|
if netplan try --timeout 10 2>/dev/null; then
|
||||||
|
info "Netplan config applied successfully."
|
||||||
|
else
|
||||||
|
warn "netplan try timed out or failed — applying anyway..."
|
||||||
|
netplan apply
|
||||||
|
fi
|
||||||
|
|
||||||
|
STATIC_ADDR="${STATIC_IP%%/*}"
|
||||||
|
echo ""
|
||||||
|
echo -e "${YELLOW}══════════════════════════════════════════${NC}"
|
||||||
|
echo -e "${YELLOW} Network reconfigured.${NC}"
|
||||||
|
echo -e "${YELLOW} If you are connected via SSH, your session${NC}"
|
||||||
|
echo -e "${YELLOW} may drop. Reconnect to: ${STATIC_ADDR}${NC}"
|
||||||
|
echo -e "${YELLOW} Then run: sudo ./setup-spoke.sh${NC}"
|
||||||
|
echo -e "${YELLOW}══════════════════════════════════════════${NC}"
|
||||||
|
echo ""
|
||||||
36
setup.sh
Normal file
36
setup.sh
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
||||||
|
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
|
||||||
|
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
|
||||||
|
header "TinyBoard Setup"
|
||||||
|
echo ""
|
||||||
|
echo " 1) Set up this device as a new spoke"
|
||||||
|
echo " 2) Onboard a new spoke from the hub"
|
||||||
|
echo ""
|
||||||
|
read -rp "Choose [1/2]: " CHOICE
|
||||||
|
|
||||||
|
case "$CHOICE" in
|
||||||
|
1)
|
||||||
|
[ "$(id -u)" -eq 0 ] || die "Spoke setup must be run as root"
|
||||||
|
info "Starting spoke setup..."
|
||||||
|
exec "$SCRIPT_DIR/spoke/setup-spoke.sh"
|
||||||
|
;;
|
||||||
|
2)
|
||||||
|
info "Starting hub onboarding..."
|
||||||
|
exec "$SCRIPT_DIR/hub/onboard-spoke.sh"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
die "Invalid choice"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
207
spoke/setup-spoke.sh
Normal file
207
spoke/setup-spoke.sh
Normal file
@@ -0,0 +1,207 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
HUB_HOST="oily.dad"
|
||||||
|
HUB_USER="armbian"
|
||||||
|
ARMBIAN_HOME="/home/armbian"
|
||||||
|
SSH_DIR="$ARMBIAN_HOME/.ssh"
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
SPOKE_DIR="$SCRIPT_DIR/spoke"
|
||||||
|
COMPOSE="$SPOKE_DIR/compose.yaml"
|
||||||
|
START_PORT=11111
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
retry_or_abort() {
|
||||||
|
local test_cmd="$1"
|
||||||
|
local fail_msg="$2"
|
||||||
|
while true; do
|
||||||
|
if eval "$test_cmd" 2>/dev/null; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
warn "$fail_msg"
|
||||||
|
echo -e " ${YELLOW}[R]${NC} Retry ${RED}[A]${NC} Abort"
|
||||||
|
read -rp "Choice: " CHOICE
|
||||||
|
case "${CHOICE,,}" in
|
||||||
|
r) info "Retrying..." ;;
|
||||||
|
a) die "Aborted." ;;
|
||||||
|
*) warn "Press R to retry or A to abort." ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
||||||
|
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
||||||
|
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
|
||||||
|
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
|
||||||
|
|
||||||
|
[ "$(id -u)" -eq 0 ] || die "Run as root"
|
||||||
|
|
||||||
|
header "TinyBoard Spoke Setup"
|
||||||
|
|
||||||
|
info "Installing packages..."
|
||||||
|
apt-get update -q
|
||||||
|
apt-get install -y -q vim autossh docker.io docker-compose-plugin git openssh-server
|
||||||
|
|
||||||
|
info "Adding armbian to docker group..."
|
||||||
|
usermod -aG docker armbian 2>/dev/null || true
|
||||||
|
|
||||||
|
info "Enabling SSH server..."
|
||||||
|
systemctl enable ssh
|
||||||
|
systemctl start ssh
|
||||||
|
|
||||||
|
header "Hostname Setup"
|
||||||
|
CURRENT_HOSTNAME=$(hostname)
|
||||||
|
echo -e "Current hostname: ${YELLOW}$CURRENT_HOSTNAME${NC}"
|
||||||
|
read -rp "Enter a hostname for this spoke (e.g. rocky, gouda, camembert): " SPOKE_NAME
|
||||||
|
SPOKE_NAME="${SPOKE_NAME:-$CURRENT_HOSTNAME}"
|
||||||
|
hostnamectl set-hostname "$SPOKE_NAME"
|
||||||
|
echo "$SPOKE_NAME" > /etc/hostname
|
||||||
|
info "Hostname set to: $SPOKE_NAME"
|
||||||
|
|
||||||
|
header "SSH Key Setup"
|
||||||
|
echo "How would you like to handle the SSH key for the tunnel to $HUB_HOST?"
|
||||||
|
echo " 1) Generate a new key automatically"
|
||||||
|
echo " 2) Use an existing key (paste the private key)"
|
||||||
|
echo ""
|
||||||
|
read -rp "Choose [1/2]: " KEY_CHOICE
|
||||||
|
|
||||||
|
case "$KEY_CHOICE" in
|
||||||
|
1)
|
||||||
|
KEY_NAME="oilykey"
|
||||||
|
KEY_PATH="$SSH_DIR/$KEY_NAME"
|
||||||
|
mkdir -p "$SSH_DIR"
|
||||||
|
chown armbian:armbian "$SSH_DIR"
|
||||||
|
chmod 700 "$SSH_DIR"
|
||||||
|
|
||||||
|
if [ -f "$KEY_PATH" ]; then
|
||||||
|
warn "Key $KEY_PATH already exists, using it."
|
||||||
|
else
|
||||||
|
info "Generating new ED25519 key..."
|
||||||
|
sudo -u armbian ssh-keygen -t ed25519 -f "$KEY_PATH" -N ""
|
||||||
|
chown armbian:armbian "$KEY_PATH" "$KEY_PATH.pub"
|
||||||
|
chmod 600 "$KEY_PATH"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${YELLOW}══════════════════════════════════════════${NC}"
|
||||||
|
echo -e "${YELLOW} Send this public key to finn (oily.dad owner)${NC}"
|
||||||
|
echo -e "${YELLOW} and ask him to add it to armbian@oily.dad authorized_keys:${NC}"
|
||||||
|
echo -e "${YELLOW}══════════════════════════════════════════${NC}"
|
||||||
|
cat "$KEY_PATH.pub"
|
||||||
|
echo -e "${YELLOW}══════════════════════════════════════════${NC}"
|
||||||
|
echo ""
|
||||||
|
read -rp "Press ENTER once finn has added the key to oily.dad..."
|
||||||
|
;;
|
||||||
|
2)
|
||||||
|
read -rp "Enter a name for the key file (e.g. oilykey): " KEY_NAME
|
||||||
|
KEY_NAME="${KEY_NAME:-oilykey}"
|
||||||
|
KEY_PATH="$SSH_DIR/$KEY_NAME"
|
||||||
|
mkdir -p "$SSH_DIR"
|
||||||
|
chown armbian:armbian "$SSH_DIR"
|
||||||
|
chmod 700 "$SSH_DIR"
|
||||||
|
|
||||||
|
echo "Paste the private key content below, then press ENTER and CTRL+D:"
|
||||||
|
KEY_CONTENT=$(cat | tr -d '\r')
|
||||||
|
printf '%s\n' "$KEY_CONTENT" > "$KEY_PATH"
|
||||||
|
chown armbian:armbian "$KEY_PATH"
|
||||||
|
chmod 600 "$KEY_PATH"
|
||||||
|
info "Key saved to $KEY_PATH"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
die "Invalid choice"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
info "Scanning hub host key..."
|
||||||
|
sudo -u armbian touch "$SSH_DIR/known_hosts"
|
||||||
|
chown armbian:armbian "$SSH_DIR/known_hosts"
|
||||||
|
chmod 600 "$SSH_DIR/known_hosts"
|
||||||
|
sudo -u armbian ssh-keyscan -H "$HUB_HOST" >> "$SSH_DIR/known_hosts" 2>/dev/null
|
||||||
|
|
||||||
|
header "Testing SSH Connection"
|
||||||
|
info "Testing connection to $HUB_HOST..."
|
||||||
|
retry_or_abort \
|
||||||
|
"sudo -u armbian ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 \"$HUB_USER@$HUB_HOST\" exit" \
|
||||||
|
"SSH connection to $HUB_HOST failed. Check that finn added your public key."
|
||||||
|
|
||||||
|
header "Finding Available Tunnel Port"
|
||||||
|
info "Scanning for a free port on $HUB_HOST starting from $START_PORT..."
|
||||||
|
TUNNEL_PORT=""
|
||||||
|
for PORT in $(seq "$START_PORT" $((START_PORT + 20))); do
|
||||||
|
RESULT=$(sudo -u armbian ssh -i "$KEY_PATH" "$HUB_USER@$HUB_HOST" "ss -tlnp | grep :$PORT" 2>/dev/null || true)
|
||||||
|
if [ -z "$RESULT" ]; then
|
||||||
|
TUNNEL_PORT="$PORT"
|
||||||
|
info "Port $TUNNEL_PORT is available."
|
||||||
|
break
|
||||||
|
else
|
||||||
|
warn "Port $PORT is in use, trying next..."
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
[ -n "$TUNNEL_PORT" ] || die "Could not find a free port between $START_PORT and $((START_PORT + 20)). Ask finn to free up a port."
|
||||||
|
|
||||||
|
header "Configuring compose.yaml"
|
||||||
|
info "Setting port to $TUNNEL_PORT and key to $KEY_NAME..."
|
||||||
|
|
||||||
|
sed -i "s|-R [0-9]*:localhost:22|-R ${TUNNEL_PORT}:localhost:22|g" "$COMPOSE"
|
||||||
|
sed -i "s|-i /home/armbian/.ssh/[^ ]*|-i /home/armbian/.ssh/${KEY_NAME}|g" "$COMPOSE"
|
||||||
|
sed -i "s|/home/armbian/.ssh/oilykey[^:]*:/home/armbian/.ssh/oilykey[^:]*|${SSH_DIR}/${KEY_NAME}:${SSH_DIR}/${KEY_NAME}|g" "$COMPOSE"
|
||||||
|
sed -i "s|container_name: spoke-autossh|container_name: ${SPOKE_NAME}-autossh|g" "$COMPOSE"
|
||||||
|
sed -i "s|container_name: spoke-syncthing|container_name: ${SPOKE_NAME}-syncthing|g" "$COMPOSE"
|
||||||
|
sed -i "s|hostname: spoke-syncthing|hostname: ${SPOKE_NAME}-syncthing|g" "$COMPOSE"
|
||||||
|
sed -i '/^version:/d' "$COMPOSE"
|
||||||
|
|
||||||
|
SYNCTHING_MOUNT="$ARMBIAN_HOME/st"
|
||||||
|
mkdir -p "$SYNCTHING_MOUNT"
|
||||||
|
chown armbian:armbian "$SYNCTHING_MOUNT"
|
||||||
|
|
||||||
|
header "Building Docker Image"
|
||||||
|
cd "$SPOKE_DIR"
|
||||||
|
docker build \
|
||||||
|
--build-arg UID="$(id -u armbian)" \
|
||||||
|
--build-arg GID="$(id -g armbian)" \
|
||||||
|
-t spoke-autossh .
|
||||||
|
|
||||||
|
header "Starting Containers"
|
||||||
|
docker compose up -d
|
||||||
|
info "Waiting for tunnel to establish..."
|
||||||
|
sleep 6
|
||||||
|
|
||||||
|
LOGS=$(docker logs "${SPOKE_NAME}-autossh" 2>&1 || docker logs spoke-autossh 2>&1 || true)
|
||||||
|
if echo "$LOGS" | grep -q "remote port forwarding failed"; then
|
||||||
|
warn "Tunnel failed — port $TUNNEL_PORT may have been taken between check and connect."
|
||||||
|
warn "Try running: docker compose down && docker compose up -d"
|
||||||
|
warn "Or re-run this script."
|
||||||
|
else
|
||||||
|
info "Tunnel is up on port $TUNNEL_PORT."
|
||||||
|
fi
|
||||||
|
|
||||||
|
header "Setup Complete"
|
||||||
|
echo -e " Spoke name: ${GREEN}$SPOKE_NAME${NC}"
|
||||||
|
echo -e " Tunnel port: ${GREEN}$TUNNEL_PORT${NC} on $HUB_HOST"
|
||||||
|
echo -e " SSH key: ${GREEN}$KEY_PATH${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e "${YELLOW}Finn needs to do the following on oily.dad:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo " 1. Generate a hub->spoke key:"
|
||||||
|
echo " ssh-keygen -t ed25519 -f ~/.ssh/armbian-${SPOKE_NAME}-$(date +%Y%m)"
|
||||||
|
echo ""
|
||||||
|
echo " 2. Copy it to this spoke through the tunnel:"
|
||||||
|
echo " ssh-copy-id -i ~/.ssh/armbian-${SPOKE_NAME}-$(date +%Y%m).pub -p $TUNNEL_PORT armbian@localhost"
|
||||||
|
echo ""
|
||||||
|
echo " 3. Add an rclone remote in ~/.config/rclone/rclone.conf:"
|
||||||
|
echo " [${SPOKE_NAME}-remote]"
|
||||||
|
echo " type = sftp"
|
||||||
|
echo " host = localhost"
|
||||||
|
echo " port = $TUNNEL_PORT"
|
||||||
|
echo " key_file = /home/armbian/.ssh/armbian-${SPOKE_NAME}-$(date +%Y%m)"
|
||||||
|
echo " shell_type = unix"
|
||||||
|
echo " md5sum_command = md5sum"
|
||||||
|
echo " sha1sum_command = sha1sum"
|
||||||
|
echo ""
|
||||||
Reference in New Issue
Block a user