220 lines
7.9 KiB
Bash
220 lines
7.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Migrates an existing keymanager-agent installation to vantage-agent.
|
|
# Run as root on each managed server.
|
|
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
|
|
info() { echo -e "${GREEN}[migrate]${NC} $*"; }
|
|
warn() { echo -e "${YELLOW}[migrate]${NC} $*"; }
|
|
die() { echo -e "${RED}[migrate]${NC} $*" >&2; exit 1; }
|
|
|
|
[ "$(id -u)" -eq 0 ] || die "Must be run as root"
|
|
|
|
GITEA_HOST="${GITEA_HOST:-}"
|
|
GITEA_OWNER="${GITEA_OWNER:-}"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 1. Detect old installation
|
|
# ---------------------------------------------------------------------------
|
|
OLD_BINARY="/usr/local/bin/keymanager-agent"
|
|
OLD_CONFIG_DIR="/etc/keymanager"
|
|
OLD_CONFIG="$OLD_CONFIG_DIR/config.yaml"
|
|
OLD_SERVICE="keymanager-agent"
|
|
OLD_SERVICE_FILE="/etc/systemd/system/${OLD_SERVICE}.service"
|
|
OLD_SSH_CONF="/root/.ssh/keymanager.conf"
|
|
OLD_SSH_CONFIG="/root/.ssh/config"
|
|
|
|
NEW_BINARY="/usr/local/bin/vantage-agent"
|
|
NEW_CONFIG_DIR="/etc/vantage"
|
|
NEW_CONFIG="$NEW_CONFIG_DIR/config.yaml"
|
|
NEW_SERVICE="vantage-agent"
|
|
NEW_SERVICE_FILE="/etc/systemd/system/${NEW_SERVICE}.service"
|
|
NEW_SSH_CONF="/root/.ssh/vantage.conf"
|
|
|
|
if [ ! -f "$OLD_CONFIG" ] && [ ! -f "$OLD_BINARY" ]; then
|
|
warn "No keymanager-agent installation found — nothing to migrate."
|
|
exit 0
|
|
fi
|
|
|
|
info "Found keymanager-agent installation. Starting migration to vantage-agent..."
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 2. Stop and disable old service
|
|
# ---------------------------------------------------------------------------
|
|
if systemctl is-active --quiet "$OLD_SERVICE" 2>/dev/null; then
|
|
info "Stopping $OLD_SERVICE..."
|
|
systemctl stop "$OLD_SERVICE"
|
|
fi
|
|
if systemctl is-enabled --quiet "$OLD_SERVICE" 2>/dev/null; then
|
|
systemctl disable "$OLD_SERVICE"
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 3. Migrate config directory
|
|
# ---------------------------------------------------------------------------
|
|
if [ -f "$OLD_CONFIG" ] && [ ! -f "$NEW_CONFIG" ]; then
|
|
info "Migrating config: $OLD_CONFIG -> $NEW_CONFIG"
|
|
mkdir -p "$NEW_CONFIG_DIR"
|
|
chmod 0700 "$NEW_CONFIG_DIR"
|
|
cp "$OLD_CONFIG" "$NEW_CONFIG"
|
|
chmod 0600 "$NEW_CONFIG"
|
|
elif [ -f "$NEW_CONFIG" ]; then
|
|
warn "$NEW_CONFIG already exists — skipping config copy."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 4. Migrate SSH managed conf file
|
|
# ---------------------------------------------------------------------------
|
|
if [ -f "$OLD_SSH_CONF" ]; then
|
|
info "Migrating SSH conf: $OLD_SSH_CONF -> $NEW_SSH_CONF"
|
|
|
|
# Rewrite IdentityFile paths: /root/.ssh/keymanager_* -> /root/.ssh/vantage_*
|
|
sed 's|/root/\.ssh/keymanager_|/root/.ssh/vantage_|g' "$OLD_SSH_CONF" > "$NEW_SSH_CONF"
|
|
chmod 0600 "$NEW_SSH_CONF"
|
|
fi
|
|
|
|
# Update Include directive in /root/.ssh/config
|
|
if [ -f "$OLD_SSH_CONFIG" ]; then
|
|
if grep -q "Include /root/.ssh/keymanager.conf" "$OLD_SSH_CONFIG"; then
|
|
info "Updating Include directive in $OLD_SSH_CONFIG"
|
|
sed -i 's|Include /root/\.ssh/keymanager\.conf|Include /root/.ssh/vantage.conf|g' "$OLD_SSH_CONFIG"
|
|
fi
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 5. Rename generated key files
|
|
# ---------------------------------------------------------------------------
|
|
shopt -s nullglob
|
|
OLD_KEYS=(/root/.ssh/keymanager_*)
|
|
if [ ${#OLD_KEYS[@]} -gt 0 ]; then
|
|
info "Renaming ${#OLD_KEYS[@]} key file(s)..."
|
|
for old_path in "${OLD_KEYS[@]}"; do
|
|
filename=$(basename "$old_path")
|
|
new_filename="${filename/keymanager_/vantage_}"
|
|
new_path="/root/.ssh/$new_filename"
|
|
if [ ! -e "$new_path" ]; then
|
|
cp "$old_path" "$new_path"
|
|
chmod "$(stat -c '%a' "$old_path")" "$new_path"
|
|
info " $old_path -> $new_path"
|
|
else
|
|
warn " $new_path already exists — skipping"
|
|
fi
|
|
done
|
|
fi
|
|
shopt -u nullglob
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 6. Download new vantage-agent binary
|
|
# ---------------------------------------------------------------------------
|
|
ARCH="$(uname -m)"
|
|
case "$ARCH" in
|
|
x86_64) ARCH="amd64" ;;
|
|
aarch64) ARCH="arm64" ;;
|
|
*) die "Unsupported architecture: $ARCH" ;;
|
|
esac
|
|
|
|
if [ -n "$GITEA_HOST" ] && [ -n "$GITEA_OWNER" ]; then
|
|
info "Fetching latest vantage-agent release from $GITEA_HOST..."
|
|
|
|
RELEASE_JSON=$(curl -fsSL "https://${GITEA_HOST}/api/v1/repos/${GITEA_OWNER}/vantage/releases?limit=1&type=tag" 2>/dev/null || echo "")
|
|
|
|
if [ -n "$RELEASE_JSON" ]; then
|
|
DOWNLOAD_URL=$(echo "$RELEASE_JSON" | grep -o "\"browser_download_url\":\"[^\"]*vantage-agent-linux-${ARCH}\"" | head -1 | cut -d'"' -f4)
|
|
CHECKSUM_URL=$(echo "$RELEASE_JSON" | grep -o "\"browser_download_url\":\"[^\"]*checksums\.txt\"" | head -1 | cut -d'"' -f4)
|
|
|
|
if [ -n "$DOWNLOAD_URL" ]; then
|
|
info "Downloading $DOWNLOAD_URL..."
|
|
TMP_BIN="/tmp/vantage-agent-new"
|
|
curl -fsSL -o "$TMP_BIN" "$DOWNLOAD_URL"
|
|
|
|
if [ -n "$CHECKSUM_URL" ]; then
|
|
TMP_SUMS="/tmp/vantage-checksums.txt"
|
|
curl -fsSL -o "$TMP_SUMS" "$CHECKSUM_URL"
|
|
EXPECTED=$(grep "vantage-agent-linux-${ARCH}" "$TMP_SUMS" | awk '{print $1}')
|
|
ACTUAL=$(sha256sum "$TMP_BIN" | awk '{print $1}')
|
|
[ "$EXPECTED" = "$ACTUAL" ] || die "Checksum mismatch! Expected $EXPECTED, got $ACTUAL"
|
|
rm -f "$TMP_SUMS"
|
|
info "Checksum verified."
|
|
fi
|
|
|
|
chmod 0755 "$TMP_BIN"
|
|
mv "$TMP_BIN" "$NEW_BINARY"
|
|
info "Installed $NEW_BINARY"
|
|
else
|
|
warn "Could not find vantage-agent binary in release — skipping binary install."
|
|
fi
|
|
else
|
|
warn "Could not reach Gitea API — skipping binary download."
|
|
fi
|
|
elif [ -f "$OLD_BINARY" ]; then
|
|
warn "GITEA_HOST/GITEA_OWNER not set — skipping binary download."
|
|
warn "You must manually install the vantage-agent binary to $NEW_BINARY before starting the service."
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 7. Install new systemd service
|
|
# ---------------------------------------------------------------------------
|
|
info "Installing $NEW_SERVICE_FILE..."
|
|
cat > "$NEW_SERVICE_FILE" <<'EOF'
|
|
[Unit]
|
|
Description=Vantage Agent
|
|
Documentation=https://github.com/your-org/vantage
|
|
After=network.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/vantage-agent
|
|
Restart=always
|
|
RestartSec=10
|
|
User=root
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=vantage-agent
|
|
NoNewPrivileges=true
|
|
ProtectSystem=false
|
|
ProtectHome=false
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable "$NEW_SERVICE"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 8. Start new service (only if binary exists)
|
|
# ---------------------------------------------------------------------------
|
|
if [ -f "$NEW_BINARY" ]; then
|
|
info "Starting $NEW_SERVICE..."
|
|
systemctl start "$NEW_SERVICE"
|
|
sleep 2
|
|
if systemctl is-active --quiet "$NEW_SERVICE"; then
|
|
info "vantage-agent is running."
|
|
else
|
|
warn "vantage-agent failed to start. Check: journalctl -u vantage-agent"
|
|
fi
|
|
else
|
|
warn "Binary not yet installed — service NOT started."
|
|
warn "Install the binary then run: systemctl start vantage-agent"
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 9. Clean up old installation
|
|
# ---------------------------------------------------------------------------
|
|
info "Cleaning up old keymanager-agent files..."
|
|
rm -f "$OLD_SERVICE_FILE"
|
|
rm -f "$OLD_BINARY"
|
|
rm -rf "$OLD_CONFIG_DIR"
|
|
rm -f "$OLD_SSH_CONF"
|
|
|
|
shopt -s nullglob
|
|
for old_key in /root/.ssh/keymanager_*; do
|
|
rm -f "$old_key"
|
|
done
|
|
shopt -u nullglob
|
|
|
|
systemctl daemon-reload
|
|
info "Migration complete."
|