feat: Updated brand to be vantage
This commit is contained in:
domrichardson
@@ -0,0 +1,219 @@
|
||||
#!/usr/bin/env bash
|
||||
# Migrates an existing keymanager-agent installation to vantage-agent.
|
||||
# Run as root on each managed server.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
||||
info() { echo -e "${GREEN}[migrate]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[migrate]${NC} $*"; }
|
||||
die() { echo -e "${RED}[migrate]${NC} $*" >&2; exit 1; }
|
||||
|
||||
[ "$(id -u)" -eq 0 ] || die "Must be run as root"
|
||||
|
||||
GITEA_HOST="${GITEA_HOST:-}"
|
||||
GITEA_OWNER="${GITEA_OWNER:-}"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 1. Detect old installation
|
||||
# ---------------------------------------------------------------------------
|
||||
OLD_BINARY="/usr/local/bin/keymanager-agent"
|
||||
OLD_CONFIG_DIR="/etc/keymanager"
|
||||
OLD_CONFIG="$OLD_CONFIG_DIR/config.yaml"
|
||||
OLD_SERVICE="keymanager-agent"
|
||||
OLD_SERVICE_FILE="/etc/systemd/system/${OLD_SERVICE}.service"
|
||||
OLD_SSH_CONF="/root/.ssh/keymanager.conf"
|
||||
OLD_SSH_CONFIG="/root/.ssh/config"
|
||||
|
||||
NEW_BINARY="/usr/local/bin/vantage-agent"
|
||||
NEW_CONFIG_DIR="/etc/vantage"
|
||||
NEW_CONFIG="$NEW_CONFIG_DIR/config.yaml"
|
||||
NEW_SERVICE="vantage-agent"
|
||||
NEW_SERVICE_FILE="/etc/systemd/system/${NEW_SERVICE}.service"
|
||||
NEW_SSH_CONF="/root/.ssh/vantage.conf"
|
||||
|
||||
if [ ! -f "$OLD_CONFIG" ] && [ ! -f "$OLD_BINARY" ]; then
|
||||
warn "No keymanager-agent installation found — nothing to migrate."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
info "Found keymanager-agent installation. Starting migration to vantage-agent..."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 2. Stop and disable old service
|
||||
# ---------------------------------------------------------------------------
|
||||
if systemctl is-active --quiet "$OLD_SERVICE" 2>/dev/null; then
|
||||
info "Stopping $OLD_SERVICE..."
|
||||
systemctl stop "$OLD_SERVICE"
|
||||
fi
|
||||
if systemctl is-enabled --quiet "$OLD_SERVICE" 2>/dev/null; then
|
||||
systemctl disable "$OLD_SERVICE"
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 3. Migrate config directory
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ -f "$OLD_CONFIG" ] && [ ! -f "$NEW_CONFIG" ]; then
|
||||
info "Migrating config: $OLD_CONFIG -> $NEW_CONFIG"
|
||||
mkdir -p "$NEW_CONFIG_DIR"
|
||||
chmod 0700 "$NEW_CONFIG_DIR"
|
||||
cp "$OLD_CONFIG" "$NEW_CONFIG"
|
||||
chmod 0600 "$NEW_CONFIG"
|
||||
elif [ -f "$NEW_CONFIG" ]; then
|
||||
warn "$NEW_CONFIG already exists — skipping config copy."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 4. Migrate SSH managed conf file
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ -f "$OLD_SSH_CONF" ]; then
|
||||
info "Migrating SSH conf: $OLD_SSH_CONF -> $NEW_SSH_CONF"
|
||||
|
||||
# Rewrite IdentityFile paths: /root/.ssh/keymanager_* -> /root/.ssh/vantage_*
|
||||
sed 's|/root/\.ssh/keymanager_|/root/.ssh/vantage_|g' "$OLD_SSH_CONF" > "$NEW_SSH_CONF"
|
||||
chmod 0600 "$NEW_SSH_CONF"
|
||||
fi
|
||||
|
||||
# Update Include directive in /root/.ssh/config
|
||||
if [ -f "$OLD_SSH_CONFIG" ]; then
|
||||
if grep -q "Include /root/.ssh/keymanager.conf" "$OLD_SSH_CONFIG"; then
|
||||
info "Updating Include directive in $OLD_SSH_CONFIG"
|
||||
sed -i 's|Include /root/\.ssh/keymanager\.conf|Include /root/.ssh/vantage.conf|g' "$OLD_SSH_CONFIG"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 5. Rename generated key files
|
||||
# ---------------------------------------------------------------------------
|
||||
shopt -s nullglob
|
||||
OLD_KEYS=(/root/.ssh/keymanager_*)
|
||||
if [ ${#OLD_KEYS[@]} -gt 0 ]; then
|
||||
info "Renaming ${#OLD_KEYS[@]} key file(s)..."
|
||||
for old_path in "${OLD_KEYS[@]}"; do
|
||||
filename=$(basename "$old_path")
|
||||
new_filename="${filename/keymanager_/vantage_}"
|
||||
new_path="/root/.ssh/$new_filename"
|
||||
if [ ! -e "$new_path" ]; then
|
||||
cp "$old_path" "$new_path"
|
||||
chmod "$(stat -c '%a' "$old_path")" "$new_path"
|
||||
info " $old_path -> $new_path"
|
||||
else
|
||||
warn " $new_path already exists — skipping"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
shopt -u nullglob
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 6. Download new vantage-agent binary
|
||||
# ---------------------------------------------------------------------------
|
||||
ARCH="$(uname -m)"
|
||||
case "$ARCH" in
|
||||
x86_64) ARCH="amd64" ;;
|
||||
aarch64) ARCH="arm64" ;;
|
||||
*) die "Unsupported architecture: $ARCH" ;;
|
||||
esac
|
||||
|
||||
if [ -n "$GITEA_HOST" ] && [ -n "$GITEA_OWNER" ]; then
|
||||
info "Fetching latest vantage-agent release from $GITEA_HOST..."
|
||||
|
||||
RELEASE_JSON=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/${GITEA_OWNER}/vantage/releases?limit=1&type=tag" 2>/dev/null || echo "")
|
||||
|
||||
if [ -n "$RELEASE_JSON" ]; then
|
||||
DOWNLOAD_URL=$(echo "$RELEASE_JSON" | grep -o "\"browser_download_url\":\"[^\"]*vantage-agent-linux-${ARCH}\"" | head -1 | cut -d'"' -f4)
|
||||
CHECKSUM_URL=$(echo "$RELEASE_JSON" | grep -o "\"browser_download_url\":\"[^\"]*checksums\.txt\"" | head -1 | cut -d'"' -f4)
|
||||
|
||||
if [ -n "$DOWNLOAD_URL" ]; then
|
||||
info "Downloading $DOWNLOAD_URL..."
|
||||
TMP_BIN="/tmp/vantage-agent-new"
|
||||
curl -fsSL -o "$TMP_BIN" "$DOWNLOAD_URL"
|
||||
|
||||
if [ -n "$CHECKSUM_URL" ]; then
|
||||
TMP_SUMS="/tmp/vantage-checksums.txt"
|
||||
curl -fsSL -o "$TMP_SUMS" "$CHECKSUM_URL"
|
||||
EXPECTED=$(grep "vantage-agent-linux-${ARCH}" "$TMP_SUMS" | awk '{print $1}')
|
||||
ACTUAL=$(sha256sum "$TMP_BIN" | awk '{print $1}')
|
||||
[ "$EXPECTED" = "$ACTUAL" ] || die "Checksum mismatch! Expected $EXPECTED, got $ACTUAL"
|
||||
rm -f "$TMP_SUMS"
|
||||
info "Checksum verified."
|
||||
fi
|
||||
|
||||
chmod 0755 "$TMP_BIN"
|
||||
mv "$TMP_BIN" "$NEW_BINARY"
|
||||
info "Installed $NEW_BINARY"
|
||||
else
|
||||
warn "Could not find vantage-agent binary in release — skipping binary install."
|
||||
fi
|
||||
else
|
||||
warn "Could not reach Gitea API — skipping binary download."
|
||||
fi
|
||||
elif [ -f "$OLD_BINARY" ]; then
|
||||
warn "GITEA_HOST/GITEA_OWNER not set — skipping binary download."
|
||||
warn "You must manually install the vantage-agent binary to $NEW_BINARY before starting the service."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 7. Install new systemd service
|
||||
# ---------------------------------------------------------------------------
|
||||
info "Installing $NEW_SERVICE_FILE..."
|
||||
cat > "$NEW_SERVICE_FILE" <<'EOF'
|
||||
[Unit]
|
||||
Description=Vantage Agent
|
||||
Documentation=https://github.com/your-org/vantage
|
||||
After=network.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/usr/local/bin/vantage-agent
|
||||
Restart=always
|
||||
RestartSec=10
|
||||
User=root
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=vantage-agent
|
||||
NoNewPrivileges=true
|
||||
ProtectSystem=false
|
||||
ProtectHome=false
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl enable "$NEW_SERVICE"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 8. Start new service (only if binary exists)
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ -f "$NEW_BINARY" ]; then
|
||||
info "Starting $NEW_SERVICE..."
|
||||
systemctl start "$NEW_SERVICE"
|
||||
sleep 2
|
||||
if systemctl is-active --quiet "$NEW_SERVICE"; then
|
||||
info "vantage-agent is running."
|
||||
else
|
||||
warn "vantage-agent failed to start. Check: journalctl -u vantage-agent"
|
||||
fi
|
||||
else
|
||||
warn "Binary not yet installed — service NOT started."
|
||||
warn "Install the binary then run: systemctl start vantage-agent"
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 9. Clean up old installation
|
||||
# ---------------------------------------------------------------------------
|
||||
info "Cleaning up old keymanager-agent files..."
|
||||
rm -f "$OLD_SERVICE_FILE"
|
||||
rm -f "$OLD_BINARY"
|
||||
rm -rf "$OLD_CONFIG_DIR"
|
||||
rm -f "$OLD_SSH_CONF"
|
||||
|
||||
shopt -s nullglob
|
||||
for old_key in /root/.ssh/keymanager_*; do
|
||||
rm -f "$old_key"
|
||||
done
|
||||
shopt -u nullglob
|
||||
|
||||
systemctl daemon-reload
|
||||
info "Migration complete."
|
||||
Reference in New Issue
Block a user