Achmad
d8e8147919
Adds password piping so the script works without a sudoers NOPASSWD rule, on the assumption that the SSH login password is the same as the sudo password (common on these VMs). - ssh -tt now forces a TTY allocation; sudo -S requires one and was failing with 'sudo: no tty present' over plain non-interactive ssh. - New run_remote_sudo helper pipes the per-VM password to 'sudo -S -p ""' so each remote call authenticates without a prompt. The empty -p suppresses '[sudo] password for ...' from appearing in journal tail output. - install_unit, restart_unit, and the journalctl call in status_block all go through run_remote_sudo. systemctl status no longer needs sudo (the unit is owned by administrator and status doesn't require root for it). - If your sudo password differs from the login password, the script will silently no-op the install/restart steps. Fix by setting the right password via SDP_92_PASS / SDP_186_PASS, or add a NOPASSWD rule in /etc/sudoers.d/sdp-deploy and revert this change.
134 lines
5.7 KiB
Bash
Executable File
134 lines
5.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Push the built binaries, dashboard, and systemd unit files to both
|
|
# SDP VMs, then enable + start the services.
|
|
#
|
|
# 92 (micro): ~/SDP/agent-micro, sdp-agent-micro.service
|
|
# 186 (gateway): ~/SDP/{control-plane,agent-gateway,dashboard},
|
|
# sdp-control-plane.service, sdp-agent-gateway.service
|
|
#
|
|
# Nginx is configured by hand on 186 (out of scope for this script).
|
|
# Run scripts/build.sh first.
|
|
#
|
|
# Sudo: the user password and the sudo password are assumed to be the
|
|
# same on both VMs. Every sudo call uses `sudo -S -p ''` and reads the
|
|
# password from a per-VM here-string. If your sudo password differs
|
|
# from the login password, switch to a NOPASSWD rule in
|
|
# /etc/sudoers.d/sdp-deploy and remove the piping.
|
|
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
REPO_ROOT="$(pwd)"
|
|
|
|
# ponytail: paths can be overridden by env so the same script works from CI.
|
|
HOST_92="${SDP_92_HOST:-administrator@172.18.136.92}"
|
|
PASS_92="${SDP_92_PASS:-password}"
|
|
HOST_186="${SDP_186_HOST:-administrator@172.18.139.186}"
|
|
PASS_186="${SDP_186_PASS:-Bre@kthrough2312}"
|
|
|
|
if ! command -v sshpass >/dev/null 2>&1; then
|
|
echo "sshpass not found. Install with: brew install sshpass" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# -tt forces a TTY so sudo -S works without a "no tty" error.
|
|
SSH_92="sshpass -p $PASS_92 ssh -tt -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"
|
|
SCP_92="sshpass -p $PASS_92 scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"
|
|
SSH_186="sshpass -p $PASS_186 ssh -tt -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"
|
|
SCP_186="sshpass -p $PASS_186 scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"
|
|
|
|
# Wraps a command in `sudo -S -p ''` and pipes the password. The
|
|
# leading -S makes sudo read the password from stdin; -p '' suppresses
|
|
# the "[sudo] password for ..." prompt so it doesn't end up in the
|
|
# remote PTY output and confuse downstream parsing.
|
|
sudo_run() {
|
|
local pw="$1"; shift
|
|
printf '%s\n' "$pw" | sudo -S -p '' "$@"
|
|
}
|
|
|
|
# run_remote_sudo <ssh-prefix> <password> <cmd...>
|
|
# Runs `cmd` on the remote host, with the wrapped command preceded
|
|
# by sudo_run. Used so the rest of the script can stay readable.
|
|
run_remote_sudo() {
|
|
local ssh_prefix="$1"
|
|
local pw="$2"
|
|
shift 2
|
|
# Build the inner shell command: pipe pw to sudo -S -p '' "cmd".
|
|
# We pre-marshal the command into a single string the SSH side can
|
|
# `eval` safely (single-quote the arguments).
|
|
local inner=""
|
|
for a in "$@"; do
|
|
inner+=" '"$(printf %s "$a" | sed "s/'/'\\\\''/g")"'"
|
|
done
|
|
$ssh_prefix "printf '%s\n' '$pw' | sudo -S -p '' sh -c '$inner'"
|
|
}
|
|
|
|
# ponytail: Wipe-and-replace. The deploys are stateful on the VM only via
|
|
# SQLite + .log files in ~/SDP/data — we keep that. Binaries, dashboard,
|
|
# and unit files in /etc/systemd/system are replaced cleanly.
|
|
REMOTE_RESET='rm -rf ~/SDP/bin ~/SDP/dashboard && mkdir -p ~/SDP/bin ~/SDP/dashboard'
|
|
|
|
# install_unit <ssh-prefix> <unit-name> <password>
|
|
install_unit() {
|
|
local ssh_prefix="$1"
|
|
local unit="$2"
|
|
local pw="$3"
|
|
run_remote_sudo "$ssh_prefix" "$pw" "systemctl stop $unit || true"
|
|
run_remote_sudo "$ssh_prefix" "$pw" "install -m 644 -o root -g root /tmp/$unit /etc/systemd/system/$unit"
|
|
run_remote_sudo "$ssh_prefix" "$pw" "systemctl daemon-reload"
|
|
run_remote_sudo "$ssh_prefix" "$pw" "systemctl enable $unit"
|
|
}
|
|
|
|
# status_block <ssh-prefix> <unit> <password>
|
|
# Prints a short status + last 10 journal lines. Uses sudo -S for
|
|
# journalctl (always root-only) but `systemctl status` works for
|
|
# the administrator's own services without sudo on most distros.
|
|
status_block() {
|
|
local ssh_prefix="$1"
|
|
local unit="$2"
|
|
local pw="$3"
|
|
$ssh_prefix "echo ' status:'; systemctl --no-pager --full status $unit 2>/dev/null | head -3"
|
|
$ssh_prefix "echo ' journal (last 10):'; printf '%s\n' '$pw' | sudo -S -p '' journalctl -u $unit -n 10 --no-pager"
|
|
}
|
|
|
|
# restart_unit <ssh-prefix> <unit> <password>
|
|
restart_unit() {
|
|
local ssh_prefix="$1"
|
|
local unit="$2"
|
|
local pw="$3"
|
|
run_remote_sudo "$ssh_prefix" "$pw" "systemctl restart $unit"
|
|
}
|
|
|
|
echo "==> 92: $HOST_92"
|
|
$SSH_92 "$HOST_92" "$REMOTE_RESET"
|
|
$SCP_92 "$REPO_ROOT/bin/agent-micro" "$HOST_92:~/SDP/bin/agent-micro"
|
|
$SCP_92 "$REPO_ROOT/systemd/sdp-agent-micro.service" "$HOST_92:/tmp/sdp-agent-micro.service"
|
|
$SSH_92 "$HOST_92" "chmod +x ~/SDP/bin/agent-micro"
|
|
install_unit "$SSH_92 $HOST_92" sdp-agent-micro.service "$PASS_92"
|
|
restart_unit "$SSH_92 $HOST_92" sdp-agent-micro "$PASS_92"
|
|
status_block "$SSH_92 $HOST_92" sdp-agent-micro "$PASS_92"
|
|
echo " agent-micro installed"
|
|
|
|
echo
|
|
echo "==> 186: $HOST_186"
|
|
$SSH_186 "$HOST_186" "$REMOTE_RESET"
|
|
$SCP_186 "$REPO_ROOT/bin/control-plane" "$HOST_186:~/SDP/bin/control-plane"
|
|
$SCP_186 "$REPO_ROOT/bin/agent-gateway" "$HOST_186:~/SDP/bin/agent-gateway"
|
|
$SCP_186 -r "$REPO_ROOT/dashboard/out/." "$HOST_186:~/SDP/dashboard/"
|
|
$SCP_186 "$REPO_ROOT/systemd/sdp-control-plane.service" "$HOST_186:/tmp/sdp-control-plane.service"
|
|
$SCP_186 "$REPO_ROOT/systemd/sdp-agent-gateway.service" "$HOST_186:/tmp/sdp-agent-gateway.service"
|
|
$SSH_186 "$HOST_186" "chmod +x ~/SDP/bin/control-plane ~/SDP/bin/agent-gateway"
|
|
|
|
# Control plane first so the gateway agent has something to dial.
|
|
install_unit "$SSH_186 $HOST_186" sdp-control-plane.service "$PASS_186"
|
|
restart_unit "$SSH_186 $HOST_186" sdp-control-plane "$PASS_186"
|
|
status_block "$SSH_186 $HOST_186" sdp-control-plane "$PASS_186"
|
|
|
|
install_unit "$SSH_186 $HOST_186" sdp-agent-gateway.service "$PASS_186"
|
|
restart_unit "$SSH_186 $HOST_186" sdp-agent-gateway "$PASS_186"
|
|
status_block "$SSH_186 $HOST_186" sdp-agent-gateway "$PASS_186"
|
|
|
|
echo " control-plane, agent-gateway, dashboard installed"
|
|
|
|
echo
|
|
echo "done. (configure nginx by hand on 186; see AGENTS.md for the location block.)"
|