forked from finn/tinyboard
131 lines
4.7 KiB
Bash
Executable File
131 lines
4.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
RCLONE_CONF="${HOME}/.config/rclone/rclone.conf"
|
|
SSH_DIR="${HOME}/.ssh"
|
|
REGISTRY="${HOME}/.config/tinyboard/spokes"
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
CYAN='\033[0;36m'
|
|
NC='\033[0m'
|
|
|
|
info() { echo -e "${GREEN}[+]${NC} $*"; }
|
|
warn() { echo -e "${YELLOW}[!]${NC} $*"; }
|
|
die() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
|
|
header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN} $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
|
|
|
|
check_deps() {
|
|
local missing=()
|
|
for cmd in "$@"; do
|
|
if ! command -v "$cmd" >/dev/null 2>&1; then
|
|
missing+=("$cmd")
|
|
fi
|
|
done
|
|
if [ ${#missing[@]} -gt 0 ]; then
|
|
die "Missing required dependencies: ${missing[*]}"
|
|
fi
|
|
}
|
|
|
|
retry_or_abort() {
|
|
local test_cmd="$1"
|
|
local fail_msg="$2"
|
|
while true; do
|
|
if eval "$test_cmd" 2>/dev/null; then
|
|
return 0
|
|
fi
|
|
echo ""
|
|
warn "$fail_msg"
|
|
echo -e " ${YELLOW}[R]${NC} Retry ${RED}[A]${NC} Abort"
|
|
read -rp "Choice: " CHOICE
|
|
case "${CHOICE,,}" in
|
|
r) info "Retrying..." ;;
|
|
a) die "Aborted." ;;
|
|
*) warn "Press R to retry or A to abort." ;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
die "Running as root — keys will be written to /root/.ssh. Run as the hub user instead."
|
|
fi
|
|
mkdir -p "$SSH_DIR"
|
|
touch "$SSH_DIR/known_hosts"
|
|
chmod 700 "$SSH_DIR"
|
|
chmod 600 "$SSH_DIR/known_hosts"
|
|
|
|
check_deps ssh ssh-keygen ssh-keyscan ssh-copy-id rclone
|
|
|
|
header "TinyBoard Hub — Onboard New Spoke"
|
|
|
|
read -rp "Spoke local user [armbian]: " SPOKE_USER
|
|
SPOKE_USER="${SPOKE_USER:-armbian}"
|
|
|
|
read -rp "Spoke name (e.g. rocky): " SPOKE_NAME
|
|
[ -n "$SPOKE_NAME" ] || die "Spoke name cannot be empty"
|
|
|
|
read -rp "Tunnel port for $SPOKE_NAME: " TUNNEL_PORT
|
|
[[ "$TUNNEL_PORT" =~ ^[0-9]+$ ]] || die "Invalid port"
|
|
|
|
KEY_NAME="${SPOKE_USER}-${SPOKE_NAME}-$(date +%Y%m)"
|
|
KEY_PATH="$SSH_DIR/$KEY_NAME"
|
|
|
|
mkdir -p "$(dirname "$RCLONE_CONF")"
|
|
|
|
header "Checking Tunnel"
|
|
info "Verifying spoke SSH service is reachable on port $TUNNEL_PORT..."
|
|
if ! timeout 5 bash -c "cat < /dev/null > /dev/tcp/localhost/$TUNNEL_PORT" 2>/dev/null; then
|
|
die "Cannot connect to port $TUNNEL_PORT on localhost — is the tunnel up?"
|
|
fi
|
|
info "Scanning spoke host key..."
|
|
KEYSCAN=$(ssh-keyscan -p "$TUNNEL_PORT" -H localhost 2>/dev/null)
|
|
[ -n "$KEYSCAN" ] || die "Spoke not reachable on port $TUNNEL_PORT — is the tunnel up?"
|
|
while IFS= read -r KEYSCAN_LINE; do
|
|
KEYSCAN_KEY=$(echo "$KEYSCAN_LINE" | awk '{print $2, $3}')
|
|
if ! grep -qF "$KEYSCAN_KEY" "$SSH_DIR/known_hosts" 2>/dev/null; then
|
|
echo "$KEYSCAN_LINE" >> "$SSH_DIR/known_hosts"
|
|
fi
|
|
done <<< "$KEYSCAN"
|
|
|
|
header "Generating Hub-to-Spoke Access Key"
|
|
if [ -f "$KEY_PATH" ]; then
|
|
warn "Key $KEY_PATH already exists, skipping generation."
|
|
else
|
|
ssh-keygen -t ed25519 -f "$KEY_PATH" -N "" -C "$KEY_NAME"
|
|
info "Key generated: $KEY_PATH"
|
|
fi
|
|
chmod 600 "$KEY_PATH"
|
|
info "Permissions set: $KEY_PATH is 600"
|
|
|
|
header "Installing Hub-to-Spoke Access Key on Spoke"
|
|
info "Copying hub public key to spoke's authorized_keys so the hub can SSH in for rclone..."
|
|
info "(You will be prompted for the $SPOKE_USER password on the spoke)"
|
|
if ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" "$SPOKE_USER"@localhost; then
|
|
info "Key copied."
|
|
else
|
|
warn "ssh-copy-id failed — password auth may be disabled on the spoke."
|
|
warn "Manually append the hub public key to the spoke's authorized_keys:"
|
|
echo ""
|
|
echo " cat $KEY_PATH.pub"
|
|
echo " Then on the spoke, append the output to:"
|
|
echo " /home/$SPOKE_USER/.ssh/authorized_keys"
|
|
echo ""
|
|
read -rp "Press ENTER once the key has been added to the spoke..."
|
|
fi
|
|
|
|
header "Testing Hub-to-Spoke Key Auth"
|
|
retry_or_abort \
|
|
"ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \
|
|
"Key auth failed. Check authorized_keys on the spoke."
|
|
info "Key auth to spoke successful."
|
|
|
|
header "Adding rclone Remote"
|
|
if grep -q "\[${SPOKE_NAME}-remote\]" "$RCLONE_CONF" 2>/dev/null; then
|
|
warn "Remote [${SPOKE_NAME}-remote] already exists in $RCLONE_CONF, skipping."
|
|
else
|
|
[ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >> "$RCLONE_CONF"
|
|
printf '\\n[%s-remote]\\ntype = sftp\\nhost = localhost\\nport = %s\\nkey_file = %s\\nshell_type = unix\\nmd5sum_command = md5sum\\nsha1sum_command = sha1sum\\n' "$SPOKE_NAME" "$TUNNEL_PORT" "$KEY_PATH" >> "$RCLONE_CONF"
|
|
info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF."
|
|
fi
|