forked from finn/tinyboard
264 lines
8.7 KiB
Bash
264 lines
8.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m'
|
|
|
|
check_permissions() {
|
|
local file="$1"
|
|
local label="$2"
|
|
if [ ! -f "$file" ]; then
|
|
warn "Permission check: $label not found at $file"
|
|
return
|
|
fi
|
|
local perms
|
|
perms=$(stat -c "%a" "$file" 2>/dev/null || stat -f "%OLp" "$file" 2>/dev/null)
|
|
if [ -z "$perms" ]; then
|
|
warn "Could not read permissions for $label ($file)"
|
|
return
|
|
fi
|
|
local world="${perms: -1}"
|
|
local group="${perms: -2:1}"
|
|
if [ "$world" != "0" ] || [ "$group" != "0" ]; then
|
|
warn "UNSAFE PERMISSIONS on $label ($file): $perms — should be 600 or 400"
|
|
warn "Fixing permissions automatically..."
|
|
chmod 600 "$file"
|
|
info "Permissions fixed: $file is now 600"
|
|
else
|
|
info "Permissions OK: $label ($file) = $perms"
|
|
fi
|
|
}
|
|
|
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
|
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
|
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
|
|
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || die "Run as root"
|
|
|
|
header "TinyBoard Hub Setup"
|
|
|
|
read -rp "Hub username [armbian]: " HUB_USER
|
|
HUB_USER="${HUB_USER:-armbian}"
|
|
|
|
header "Detecting Package Manager"
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
PKG_MANAGER="apt"
|
|
PKG_INSTALL="apt-get install -y -q"
|
|
OPENSSH_PKG="openssh-server"
|
|
FUSE_PKG="fuse"
|
|
info "Detected: apt (Debian/Ubuntu)"
|
|
apt-get update -q
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
PKG_MANAGER="dnf"
|
|
PKG_INSTALL="dnf install -y -q"
|
|
OPENSSH_PKG="openssh-server"
|
|
FUSE_PKG="fuse"
|
|
info "Detected: dnf (Fedora/RHEL/Alma/Rocky)"
|
|
dnf check-update -q || true
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
PKG_MANAGER="yum"
|
|
PKG_INSTALL="yum install -y -q"
|
|
OPENSSH_PKG="openssh-server"
|
|
FUSE_PKG="fuse"
|
|
info "Detected: yum (older RHEL/CentOS)"
|
|
yum check-update -q || true
|
|
elif command -v pacman >/dev/null 2>&1; then
|
|
PKG_MANAGER="pacman"
|
|
PKG_INSTALL="pacman -S --noconfirm --quiet"
|
|
OPENSSH_PKG="openssh"
|
|
FUSE_PKG="fuse3"
|
|
info "Detected: pacman (Arch)"
|
|
pacman -Sy --quiet
|
|
else
|
|
die "No supported package manager found (apt, dnf, yum, pacman)"
|
|
fi
|
|
|
|
header "Installing Packages"
|
|
info "Installing curl if missing..."
|
|
if ! command -v curl >/dev/null 2>&1; then
|
|
$PKG_INSTALL curl
|
|
fi
|
|
|
|
$PKG_INSTALL "$OPENSSH_PKG" "$FUSE_PKG" git
|
|
|
|
if ! command -v rclone >/dev/null 2>&1; then
|
|
info "Installing rclone..."
|
|
if [ "$PKG_MANAGER" = "pacman" ]; then
|
|
$PKG_INSTALL rclone
|
|
else
|
|
curl -fsSL https://rclone.org/install.sh | bash
|
|
fi
|
|
else
|
|
warn "rclone already installed, skipping."
|
|
fi
|
|
|
|
header "Armbian User Setup"
|
|
if id "$HUB_USER" >/dev/null 2>&1; then
|
|
warn "User '$HUB_USER' already exists, skipping creation."
|
|
else
|
|
info "Creating $HUB_USER user..."
|
|
groupadd -g 1000 "$HUB_USER" 2>/dev/null || true
|
|
useradd -m -u 1000 -g 1000 -s /bin/bash "$HUB_USER"
|
|
|
|
ADDED_TO_GROUP=false
|
|
if getent group sudo >/dev/null 2>&1; then
|
|
if usermod -aG sudo "$HUB_USER" 2>/dev/null; then
|
|
ADDED_TO_GROUP=true
|
|
fi
|
|
fi
|
|
if [ "$ADDED_TO_GROUP" = false ] && getent group wheel >/dev/null 2>&1; then
|
|
if usermod -aG wheel "$HUB_USER" 2>/dev/null; then
|
|
ADDED_TO_GROUP=true
|
|
fi
|
|
fi
|
|
if [ "$ADDED_TO_GROUP" = false ]; then
|
|
warn "Neither sudo nor wheel group found — $HUB_USER user has no sudo access."
|
|
fi
|
|
|
|
info "$HUB_USER user created."
|
|
echo ""
|
|
warn "Set a password for the $HUB_USER user:"
|
|
passwd "$HUB_USER"
|
|
fi
|
|
|
|
ARMBIAN_HOME="/home/$HUB_USER"
|
|
SSH_DIR="$ARMBIAN_HOME/.ssh"
|
|
mkdir -p "$SSH_DIR"
|
|
touch "$SSH_DIR/authorized_keys"
|
|
chown -R "$HUB_USER":"$HUB_USER" "$SSH_DIR"
|
|
chmod 700 "$SSH_DIR"
|
|
chmod 600 "$SSH_DIR/authorized_keys"
|
|
|
|
header "SSH Server Configuration"
|
|
SSHD_CONF="/etc/ssh/sshd_config"
|
|
[ -f "$SSHD_CONF" ] || die "sshd_config not found at $SSHD_CONF"
|
|
|
|
for DIRECTIVE in "GatewayPorts yes" "AllowTcpForwarding yes"; do
|
|
KEY="${DIRECTIVE%% *}"
|
|
if grep -q "^$KEY" "$SSHD_CONF"; then
|
|
sed -i "s/^$KEY.*/$DIRECTIVE/" "$SSHD_CONF"
|
|
else
|
|
echo "$DIRECTIVE" >> "$SSHD_CONF"
|
|
fi
|
|
info "$DIRECTIVE set."
|
|
done
|
|
|
|
if systemctl enable ssh 2>/dev/null; then
|
|
systemctl restart ssh
|
|
elif systemctl enable sshd 2>/dev/null; then
|
|
systemctl restart sshd
|
|
else
|
|
warn "Could not enable/restart SSH service — please start it manually."
|
|
fi
|
|
info "SSH server restarted."
|
|
|
|
header "Password Authentication"
|
|
read -rp "Disable password auth for $HUB_USER and use keys only? [Y/n]: " DISABLE_PASS
|
|
DISABLE_PASS="${DISABLE_PASS:-y}"
|
|
if [[ "${DISABLE_PASS,,}" == "y" ]]; then
|
|
if [ ! -s "$SSH_DIR/authorized_keys" ]; then
|
|
warn "No keys found in $SSH_DIR/authorized_keys — skipping password auth disable to avoid lockout."
|
|
else
|
|
if grep -q "^PasswordAuthentication" "$SSHD_CONF"; then
|
|
sed -i "s/^PasswordAuthentication.*/PasswordAuthentication no/" "$SSHD_CONF"
|
|
else
|
|
echo "PasswordAuthentication no" >> "$SSHD_CONF"
|
|
fi
|
|
if grep -q "^PubkeyAuthentication" "$SSHD_CONF"; then
|
|
sed -i "s/^PubkeyAuthentication.*/PubkeyAuthentication yes/" "$SSHD_CONF"
|
|
else
|
|
echo "PubkeyAuthentication yes" >> "$SSHD_CONF"
|
|
fi
|
|
info "Password authentication disabled for $HUB_USER."
|
|
echo ""
|
|
warn "Restarting SSH will apply the new settings."
|
|
warn "If you are connected via SSH, your session may drop."
|
|
warn "Make sure you can reconnect using your key before continuing."
|
|
read -rp "Press ENTER to restart SSH or CTRL+C to abort..."
|
|
if systemctl restart ssh 2>/dev/null; then
|
|
info "SSH restarted."
|
|
elif systemctl restart sshd 2>/dev/null; then
|
|
info "SSH restarted."
|
|
else
|
|
warn "Could not restart SSH — please restart it manually."
|
|
fi
|
|
fi
|
|
else
|
|
info "Password authentication left enabled."
|
|
fi
|
|
|
|
header "FUSE Configuration"
|
|
FUSE_CONF="/etc/fuse.conf"
|
|
if [ -f "$FUSE_CONF" ]; then
|
|
if grep -q "^#user_allow_other" "$FUSE_CONF"; then
|
|
sed -i 's/^#user_allow_other/user_allow_other/' "$FUSE_CONF"
|
|
info "user_allow_other enabled in $FUSE_CONF."
|
|
elif grep -q "^user_allow_other" "$FUSE_CONF"; then
|
|
warn "user_allow_other already enabled."
|
|
else
|
|
echo "user_allow_other" >> "$FUSE_CONF"
|
|
info "user_allow_other added to $FUSE_CONF."
|
|
fi
|
|
else
|
|
echo "user_allow_other" > "$FUSE_CONF"
|
|
info "$FUSE_CONF created with user_allow_other."
|
|
fi
|
|
|
|
groupadd fuse 2>/dev/null || true
|
|
usermod -aG fuse "$HUB_USER" 2>/dev/null || true
|
|
info "$HUB_USER added to fuse group."
|
|
|
|
header "Permission Checks"
|
|
info "Checking SSH directory permissions..."
|
|
check_permissions "$SSH_DIR/authorized_keys" "authorized_keys"
|
|
[ -f "$RCLONE_CONF" ] && check_permissions "$RCLONE_CONF" "rclone.conf" || true
|
|
|
|
header "Rclone Setup"
|
|
RCLONE_CONF="$ARMBIAN_HOME/.config/rclone/rclone.conf"
|
|
mkdir -p "$(dirname "$RCLONE_CONF")"
|
|
chown -R "$HUB_USER":"$HUB_USER" "$ARMBIAN_HOME/.config"
|
|
|
|
if [ ! -f "$RCLONE_CONF" ]; then
|
|
touch "$RCLONE_CONF"
|
|
chown "$HUB_USER":"$HUB_USER" "$RCLONE_CONF"
|
|
info "Empty rclone.conf created at $RCLONE_CONF."
|
|
else
|
|
warn "rclone.conf already exists, skipping."
|
|
fi
|
|
|
|
header "Mount Point Setup"
|
|
read -rp "Mount point for spoke filesystems [/mnt/hub]: " MOUNT_POINT
|
|
MOUNT_POINT="${MOUNT_POINT:-/mnt/hub}"
|
|
mkdir -p "$MOUNT_POINT"
|
|
chown "$HUB_USER":"$HUB_USER" "$MOUNT_POINT"
|
|
info "Mount point created at $MOUNT_POINT."
|
|
|
|
header "Crontab Setup"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
HELPER="$SCRIPT_DIR/../hubspoke-helper.sh"
|
|
CRON_LINE="@reboot $HELPER hub start-background"
|
|
EXISTING=$(crontab -u "$HUB_USER" -l 2>/dev/null || true)
|
|
|
|
if echo "$EXISTING" | grep -qF "hub start-background"; then
|
|
warn "Crontab entry already exists, skipping."
|
|
else
|
|
(echo "$EXISTING"; echo "$CRON_LINE") | crontab -u "$HUB_USER" -
|
|
info "Added @reboot crontab entry for rclone mount."
|
|
fi
|
|
|
|
header "Hub Setup Complete"
|
|
echo -e " Hub user: ${GREEN}$HUB_USER${NC}"
|
|
echo -e " SSH config: ${GREEN}GatewayPorts yes, AllowTcpForwarding yes${NC}"
|
|
echo -e " FUSE: ${GREEN}user_allow_other enabled${NC}"
|
|
echo -e " rclone config: ${GREEN}$RCLONE_CONF${NC}"
|
|
echo -e " Mount point: ${GREEN}$MOUNT_POINT${NC}"
|
|
echo ""
|
|
echo -e "${YELLOW}Next steps:${NC}"
|
|
echo " For each spoke that connects, run:"
|
|
echo " ./setup.sh (choose option 2)"
|
|
echo ""
|