justin/tinyboard
1
0
Fork 0
forked from finn/tinyboard
Code Pull Requests 1 Activity

Compare commits

merge into: justin:rclone-tweaks
Branches Tags
justin:master justin:rclone-tweaks justin:onboard-spoke-logic finn:master
...
pull from: justin:onboard-spoke-logic
Branches Tags
justin:master justin:rclone-tweaks justin:onboard-spoke-logic finn:master

4 Commits
rclone-twe ... onboard-sp

Author SHA1 Message Date
finn
5941f95b00 slight addition to pre key verification section 2026-04-19 14:18:52 -07:00
finn
747c8a81d8 Merge remote-tracking branch 'origin/master' into onboard-spoke-logic 2026-04-19 14:18:21 -07:00
finn
1f4e8555da Merge branch 'master' into onboard-spoke-logic 2026-04-19 14:05:54 -07:00
finn
56325a1b06 changed onboard-spoke flow 2026-04-19 14:04:12 -07:00
1 changed files with 122 additions and 129 deletions
Expand all files Collapse all files

251
hub/onboard-spoke.sh
View File

@@ -11,44 +11,51 @@ YELLOW='\033[1;33m'
CYAN='\033[0;36m' CYAN='\033[0;36m'
NC='\033[0m' NC='\033[0m'
info() { echo -e "${GREEN}[+]${NC} $*"; } info() { echo -e "${GREEN}[+]${NC} $*"; }
warn() { echo -e "${YELLOW}[!]${NC} $*"; } warn() { echo -e "${YELLOW}[!]${NC} $*"; }
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; } die() {
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; } echo -e "${RED}[ERROR]${NC} $*" >&2
exit 1
}
header() {
echo -e "\n${CYAN}══════════════════════════════════════════${NC}"
echo -e "${CYAN} $*${NC}"
echo -e "${CYAN}══════════════════════════════════════════${NC}"
}
check_deps() { check_deps() {
local missing=() local missing=()
for cmd in "$@"; do for cmd in "$@"; do
if ! command -v "$cmd" >/dev/null 2>&1; then if ! command -v "$cmd" >/dev/null 2>&1; then
missing+=("$cmd") missing+=("$cmd")
fi
done
if [ ${#missing[@]} -gt 0 ]; then
die "Missing required dependencies: ${missing[*]}"
fi fi
done
if [ ${#missing[@]} -gt 0 ]; then
die "Missing required dependencies: ${missing[*]}"
fi
} }
retry_or_abort() { retry_or_abort() {
local test_cmd="$1" local test_cmd="$1"
local fail_msg="$2" local fail_msg="$2"
while true; do while true; do
if eval "$test_cmd" 2>/dev/null; then if eval "$test_cmd" 2>/dev/null; then
return 0 return 0
fi fi
echo "" echo ""
warn "$fail_msg" warn "$fail_msg"
echo -e " ${YELLOW}[R]${NC} Retry ${RED}[A]${NC} Abort" echo -e " ${YELLOW}[R]${NC} Retry ${RED}[A]${NC} Abort"
read -rp "Choice: " CHOICE read -rp "Choice: " CHOICE
case "${CHOICE,,}" in case "${CHOICE,,}" in
r) info "Retrying..." ;; r) info "Retrying..." ;;
a) die "Aborted." ;; a) die "Aborted." ;;
*) warn "Press R to retry or A to abort." ;; *) warn "Press R to retry or A to abort." ;;
esac esac
done done
} }
if [ "$(id -u)" -eq 0 ]; then if [ "$(id -u)" -eq 0 ]; then
die "Running as root — keys will be written to /root/.ssh. Run as the hub user instead." die "Running as root — keys will be written to /root/.ssh. Run as the hub user instead."
fi fi
mkdir -p "$SSH_DIR" mkdir -p "$SSH_DIR"
touch "$SSH_DIR/known_hosts" touch "$SSH_DIR/known_hosts"
@@ -73,49 +80,28 @@ KEY_PATH="$SSH_DIR/$KEY_NAME"
mkdir -p "$(dirname "$RCLONE_CONF")" mkdir -p "$(dirname "$RCLONE_CONF")"
header "Select Tunnel Key"
AVAILABLE_KEYS=()
while IFS= read -r keyfile; do
AVAILABLE_KEYS+=("$keyfile")
done < <(find "$SSH_DIR" -maxdepth 1 -type f ! -name "*.pub" ! -name "known_hosts" ! -name "authorized_keys" ! -name "config" | sort)
if [ ${#AVAILABLE_KEYS[@]} -eq 0 ]; then
die "No private keys found in $SSH_DIR."
fi
echo "Available keys:"
for i in "${!AVAILABLE_KEYS[@]}"; do
echo " $i) ${AVAILABLE_KEYS[$i]}"
done
echo ""
read -rp "Choose key to use for tunnel access [0]: " KEY_CHOICE
KEY_CHOICE="${KEY_CHOICE:-0}"
[[ "$KEY_CHOICE" =~ ^[0-9]+$ ]] && [ "$KEY_CHOICE" -lt "${#AVAILABLE_KEYS[@]}" ] || die "Invalid choice."
TUNNEL_KEY="${AVAILABLE_KEYS[$KEY_CHOICE]}"
info "Using key: $TUNNEL_KEY"
header "Checking Tunnel" header "Checking Tunnel"
info "Verifying spoke SSH service is reachable on port $TUNNEL_PORT..."
# Test TCP connectivity first
if ! timeout 5 bash -c "cat < /dev/null > /dev/tcp/localhost/$TUNNEL_PORT" 2>/dev/null; then
die "Cannot connect to port $TUNNEL_PORT on localhost — is the tunnel up?"
fi
info "Scanning spoke host key..." info "Scanning spoke host key..."
KEYSCAN=$(ssh-keyscan -p "$TUNNEL_PORT" -H localhost 2>/dev/null) KEYSCAN=$(ssh-keyscan -p "$TUNNEL_PORT" -H localhost 2>/dev/null)
[ -n "$KEYSCAN" ] || die "Spoke not reachable on port $TUNNEL_PORT — is the tunnel up?" [ -n "$KEYSCAN" ] || die "Spoke not reachable on port $TUNNEL_PORT — is the tunnel up?"
while IFS= read -r KEYSCAN_LINE; do while IFS= read -r KEYSCAN_LINE; do
KEYSCAN_KEY=$(echo "$KEYSCAN_LINE" | awk '{print $2, $3}') KEYSCAN_KEY=$(echo "$KEYSCAN_LINE" | awk '{print $2, $3}')
if ! grep -qF "$KEYSCAN_KEY" "$SSH_DIR/known_hosts" 2>/dev/null; then if ! grep -qF "$KEYSCAN_KEY" "$SSH_DIR/known_hosts" 2>/dev/null; then
echo "$KEYSCAN_LINE" >> "$SSH_DIR/known_hosts" echo "$KEYSCAN_LINE" >>"$SSH_DIR/known_hosts"
fi fi
done <<< "$KEYSCAN" done <<<"$KEYSCAN"
info "Verifying spoke is reachable on port $TUNNEL_PORT..."
retry_or_abort \
"ssh -i \"$TUNNEL_KEY\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \
"Spoke not reachable on port $TUNNEL_PORT. Make sure the tunnel is up."
header "Generating Hub SSH Key" header "Generating Hub SSH Key"
if [ -f "$KEY_PATH" ]; then if [ -f "$KEY_PATH" ]; then
warn "Key $KEY_PATH already exists, skipping generation." warn "Key $KEY_PATH already exists, skipping generation."
else else
ssh-keygen -t ed25519 -f "$KEY_PATH" -N "" ssh-keygen -t ed25519 -f "$KEY_PATH" -N "" -C "$KEY_NAME"
info "Key generated: $KEY_PATH" info "Key generated: $KEY_PATH"
fi fi
chmod 600 "$KEY_PATH" chmod 600 "$KEY_PATH"
info "Permissions set: $KEY_PATH is 600" info "Permissions set: $KEY_PATH is 600"
@@ -123,31 +109,31 @@ info "Permissions set: $KEY_PATH is 600"
header "Installing Hub Access Key on Spoke" header "Installing Hub Access Key on Spoke"
info "Copying hub public key to spoke's authorized_keys so the hub can SSH in for rclone..." info "Copying hub public key to spoke's authorized_keys so the hub can SSH in for rclone..."
info "(You will be prompted for the $SPOKE_USER password on the spoke)" info "(You will be prompted for the $SPOKE_USER password on the spoke)"
if ssh-copy-id -i "$KEY_PATH.pub" -o "IdentityFile=$TUNNEL_KEY" -p "$TUNNEL_PORT" "$SPOKE_USER"@localhost; then if ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" "$SPOKE_USER"@localhost; then
info "Key copied." info "Key copied."
else else
warn "ssh-copy-id failed — password auth may be disabled on the spoke." warn "ssh-copy-id failed — password auth may be disabled on the spoke."
warn "Manually append the hub public key to the spoke's authorized_keys:" warn "Manually append the hub public key to the spoke's authorized_keys:"
echo "" echo ""
echo " cat $KEY_PATH.pub" echo " cat $KEY_PATH.pub"
echo " Then on the spoke, append the output to:" echo " Then on the spoke, append the output to:"
echo " /home/$SPOKE_USER/.ssh/authorized_keys" echo " /home/$SPOKE_USER/.ssh/authorized_keys"
echo "" echo ""
read -rp "Press ENTER once the key has been added to the spoke..." read -rp "Press ENTER once the key has been added to the spoke..."
fi fi
header "Testing Hub -> Spoke Key Auth" header "Testing Hub -> Spoke Key Auth"
retry_or_abort \ retry_or_abort \
"ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \ "ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \
"Key auth failed. Check authorized_keys on the spoke." "Key auth failed. Check authorized_keys on the spoke."
info "Key auth to spoke successful." info "Key auth to spoke successful."
header "Adding rclone Remote" header "Adding rclone Remote"
if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then
warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping." warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping."
else else
[ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >> "$RCLONE_CONF" [ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >>"$RCLONE_CONF"
cat >> "$RCLONE_CONF" <<EOF cat >>"$RCLONE_CONF" <<EOF
[${SPOKE_NAME}-remote] [${SPOKE_NAME}-remote]
type = sftp type = sftp
@@ -158,39 +144,43 @@ shell_type = unix
md5sum_command = md5sum md5sum_command = md5sum
sha1sum_command = sha1sum sha1sum_command = sha1sum
EOF EOF
info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF." info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF."
fi fi
header "Union Remote (optional)" header "Union Remote (optional)"
read -rp "Add this spoke to a union remote for redundancy? [y/N]: " ADD_UNION read -rp "Add this spoke to a union remote for redundancy? [y/N]: " ADD_UNION
ADD_UNION="${ADD_UNION:-n}" ADD_UNION="${ADD_UNION:-n}"
if [[ "${ADD_UNION,,}" == "y" ]]; then if [[ "${ADD_UNION,,}" == "y" ]]; then
read -rp "Union remote name [shared-union]: " UNION_NAME read -rp "Union remote name [shared-union]: " UNION_NAME
UNION_NAME="${UNION_NAME:-shared-union}" UNION_NAME="${UNION_NAME:-shared-union}"
read -rp "Subfolder path on this spoke (e.g. books, leave blank for root): " UNION_PATH read -rp "Subfolder path on this spoke (e.g. books, leave blank for root): " UNION_PATH
echo "" echo ""
echo "Upstream access mode for this spoke:" echo "Upstream access mode for this spoke:"
echo " 0) None - full read/write (default)" echo " 0) None - full read/write (default)"
echo " 1) :ro - read only" echo " 1) :ro - read only"
echo " 2) :nc - no create (read/write existing, no new files)" echo " 2) :nc - no create (read/write existing, no new files)"
echo " 3) :writeback - writeback cache" echo " 3) :writeback - writeback cache"
echo "" echo ""
read -rp "Choose [0-3]: " UNION_MODE read -rp "Choose [0-3]: " UNION_MODE
UNION_MODE="${UNION_MODE:-0}" UNION_MODE="${UNION_MODE:-0}"
case "$UNION_MODE" in case "$UNION_MODE" in
0) UPSTREAM_TAG="" ;; 0) UPSTREAM_TAG="" ;;
1) UPSTREAM_TAG=":ro" ;; 1) UPSTREAM_TAG=":ro" ;;
2) UPSTREAM_TAG=":nc" ;; 2) UPSTREAM_TAG=":nc" ;;
3) UPSTREAM_TAG=":writeback" ;; 3) UPSTREAM_TAG=":writeback" ;;
*) warn "Invalid choice, defaulting to full read/write."; UPSTREAM_TAG="" ;; *)
esac warn "Invalid choice, defaulting to full read/write."
if [ -n "$UNION_PATH" ]; then UPSTREAM_TAG=""
UPSTREAM="${SPOKE_NAME}-remote:${UNION_PATH}${UPSTREAM_TAG}" ;;
else esac
UPSTREAM="${SPOKE_NAME}-remote:${UPSTREAM_TAG}" if [ -n "$UNION_PATH" ]; then
fi UPSTREAM="${SPOKE_NAME}-remote:${UNION_PATH}${UPSTREAM_TAG}"
if grep -q "^\[${UNION_NAME}\]" "$RCLONE_CONF" 2>/dev/null; then else
ALREADY=$(python3 - "$RCLONE_CONF" "$UNION_NAME" "${SPOKE_NAME}-remote:" <<'PYEOF' UPSTREAM="${SPOKE_NAME}-remote:${UPSTREAM_TAG}"
fi
if grep -q "^\[${UNION_NAME}\]" "$RCLONE_CONF" 2>/dev/null; then
ALREADY=$(
python3 - "$RCLONE_CONF" "$UNION_NAME" "${SPOKE_NAME}-remote:" <<'PYEOF'
import sys import sys
path, section, prefix = sys.argv[1], sys.argv[2], sys.argv[3] path, section, prefix = sys.argv[1], sys.argv[2], sys.argv[3]
with open(path) as f: with open(path) as f:
@@ -206,11 +196,11 @@ for line in lines:
sys.exit(0) sys.exit(0)
print("no") print("no")
PYEOF PYEOF
) )
if [ "$ALREADY" = "yes" ]; then if [ "$ALREADY" = "yes" ]; then
warn "Upstream for ${SPOKE_NAME}-remote already in union remote [${UNION_NAME}], skipping." warn "Upstream for ${SPOKE_NAME}-remote already in union remote [${UNION_NAME}], skipping."
else else
python3 - "$RCLONE_CONF" "$UNION_NAME" "$UPSTREAM" <<'PYEOF' python3 - "$RCLONE_CONF" "$UNION_NAME" "$UPSTREAM" <<'PYEOF'
import sys import sys
path, section, upstream = sys.argv[1], sys.argv[2], sys.argv[3] path, section, upstream = sys.argv[1], sys.argv[2], sys.argv[3]
with open(path) as f: with open(path) as f:
@@ -228,20 +218,20 @@ for line in lines:
with open(path, "w") as f: with open(path, "w") as f:
f.writelines(out) f.writelines(out)
PYEOF PYEOF
info "Added '$UPSTREAM' to union remote [${UNION_NAME}]." info "Added '$UPSTREAM' to union remote [${UNION_NAME}]."
fi
else
[ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >> "$RCLONE_CONF"
printf '\n[%s]\ntype = union\nupstreams = %s\n' "$UNION_NAME" "$UPSTREAM" >> "$RCLONE_CONF"
info "Union remote [${UNION_NAME}] created with upstream '$UPSTREAM'."
fi fi
else
[ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >>"$RCLONE_CONF"
printf '\n[%s]\ntype = union\nupstreams = %s\n' "$UNION_NAME" "$UPSTREAM" >>"$RCLONE_CONF"
info "Union remote [${UNION_NAME}] created with upstream '$UPSTREAM'."
fi
fi fi
header "Testing rclone Connection" header "Testing rclone Connection"
if rclone lsd "${SPOKE_NAME}-remote:" --config "$RCLONE_CONF" 2>/dev/null; then if rclone lsd "${SPOKE_NAME}-remote:" --config "$RCLONE_CONF" 2>/dev/null; then
info "rclone connection to $SPOKE_NAME successful." info "rclone connection to $SPOKE_NAME successful."
else else
warn "rclone test failed. Check the remote config in $RCLONE_CONF." warn "rclone test failed. Check the remote config in $RCLONE_CONF."
fi fi
header "Registering Spoke" header "Registering Spoke"
@@ -249,11 +239,11 @@ mkdir -p "$(dirname "$REGISTRY")"
MOUNT_POINT="${HOME}/mnt/${SPOKE_NAME}" MOUNT_POINT="${HOME}/mnt/${SPOKE_NAME}"
mkdir -p "$MOUNT_POINT" mkdir -p "$MOUNT_POINT"
if grep -q "^${SPOKE_NAME} " "$REGISTRY" 2>/dev/null; then if grep -q "^${SPOKE_NAME} " "$REGISTRY" 2>/dev/null; then
warn "$SPOKE_NAME already in registry, updating." warn "$SPOKE_NAME already in registry, updating."
grep -v "^${SPOKE_NAME} " "$REGISTRY" > "${REGISTRY}.tmp" 2>/dev/null || true grep -v "^${SPOKE_NAME} " "$REGISTRY" >"${REGISTRY}.tmp" 2>/dev/null || true
mv "${REGISTRY}.tmp" "$REGISTRY" mv "${REGISTRY}.tmp" "$REGISTRY"
fi fi
echo "${SPOKE_NAME} ${TUNNEL_PORT} ${KEY_PATH} ${MOUNT_POINT}" >> "$REGISTRY" echo "${SPOKE_NAME} ${TUNNEL_PORT} ${KEY_PATH} ${MOUNT_POINT}" >>"$REGISTRY"
info "$SPOKE_NAME registered." info "$SPOKE_NAME registered."
header "Setting Up Auto-Mount" header "Setting Up Auto-Mount"
@@ -261,14 +251,17 @@ MOUNT_CMD="rclone mount ${SPOKE_NAME}-remote: ${MOUNT_POINT} --config ${HOME}/.c
CRON_ENTRY="@reboot ${MOUNT_CMD}" CRON_ENTRY="@reboot ${MOUNT_CMD}"
EXISTING=$(crontab -l 2>/dev/null || true) EXISTING=$(crontab -l 2>/dev/null || true)
if echo "$EXISTING" | grep -qF "${SPOKE_NAME}-remote:"; then if echo "$EXISTING" | grep -qF "${SPOKE_NAME}-remote:"; then
warn "Crontab entry for ${SPOKE_NAME}-remote already exists, skipping." warn "Crontab entry for ${SPOKE_NAME}-remote already exists, skipping."
else else
CRONTAB_BACKUP="${HOME}/.config/tinyboard/crontab.$(date +%Y%m%d%H%M%S)" CRONTAB_BACKUP="${HOME}/.config/tinyboard/crontab.$(date +%Y%m%d%H%M%S)"
mkdir -p "$(dirname "$CRONTAB_BACKUP")" mkdir -p "$(dirname "$CRONTAB_BACKUP")"
echo "$EXISTING" > "$CRONTAB_BACKUP" echo "$EXISTING" >"$CRONTAB_BACKUP"
info "Crontab backed up to $CRONTAB_BACKUP" info "Crontab backed up to $CRONTAB_BACKUP"
{ echo "$EXISTING"; echo "$CRON_ENTRY"; } | crontab - {
info "Auto-mount crontab entry added for ${SPOKE_NAME}." echo "$EXISTING"
echo "$CRON_ENTRY"
} | crontab -
info "Auto-mount crontab entry added for ${SPOKE_NAME}."
fi fi
info "Starting mount now..." info "Starting mount now..."
mkdir -p "$MOUNT_POINT" mkdir -p "$MOUNT_POINT"