josh
211abdf08f
Splits the release workflow into three jobs (detect, build-live-image, bundle) so the ~9 min mkosi build only runs when live-image/VERSION bumps. The slim bundle (~30 MB: orchestrator + agent + deploy scripts + a live-image/VERSION pointer) rebuilds every push; the ~300 MB vmlinuz+initrd.img are published separately under the immutable live-image/<version>/ path. install.sh compares the pointer to /var/lib/vetting/live/VERSION and fetches the files only on mismatch, cutting repeat-install wall-clock from ~30 s + 300 MB to ~10 s + 0 MB on the common no-live-image-change release. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
103 lines
3.7 KiB
Bash
103 lines
3.7 KiB
Bash
#!/usr/bin/env bash
|
|
# proxmox-install.sh — one-shot installer for a fresh Proxmox LXC (or
|
|
# any Debian/Ubuntu host). Fetches a prebuilt release bundle from the
|
|
# Gitea package registry, extracts it, and hands off to install.sh.
|
|
#
|
|
# The bundle itself is slim (~30 MB: orchestrator + agent + deploy
|
|
# scripts + a live-image/VERSION pointer). install.sh compares that
|
|
# pointer against /var/lib/vetting/live/VERSION and fetches the
|
|
# ~300 MB vmlinuz+initrd.img from the registry only when they differ,
|
|
# so repeated runs cost ~10 s on no-live-image-change releases.
|
|
#
|
|
# Usage:
|
|
# curl -fsSL https://gitea.thewrightserver.net/josh/Vetting/raw/branch/main/deploy/proxmox-install.sh | sudo bash
|
|
#
|
|
# Flags / env overrides:
|
|
# REGISTRY_URL base URL of the Gitea instance hosting the
|
|
# package registry (default: https://gitea.thewrightserver.net)
|
|
# PACKAGE_OWNER Gitea owner of the `vetting` package
|
|
# (default: josh)
|
|
# FORCE_LIVE_IMAGE=1 or --force-live-image — re-download the live
|
|
# image even when the on-disk version matches
|
|
# (useful when the local files got corrupted).
|
|
set -euo pipefail
|
|
|
|
REGISTRY_URL="${REGISTRY_URL:-https://gitea.thewrightserver.net}"
|
|
PACKAGE_OWNER="${PACKAGE_OWNER:-josh}"
|
|
FORCE_LIVE_IMAGE="${FORCE_LIVE_IMAGE:-0}"
|
|
|
|
for arg in "$@"; do
|
|
case "${arg}" in
|
|
--force-live-image) FORCE_LIVE_IMAGE=1 ;;
|
|
*) echo "unknown arg: ${arg}" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
# Exported so install.sh (run as a child process inside the extracted
|
|
# bundle dir) sees them when deciding whether to fetch the live image
|
|
# and where to fetch it from.
|
|
export REGISTRY_URL PACKAGE_OWNER FORCE_LIVE_IMAGE
|
|
|
|
BUNDLE_URL="${REGISTRY_URL}/api/packages/${PACKAGE_OWNER}/generic/vetting/latest/vetting-bundle.tar.gz"
|
|
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "proxmox-install.sh must be run as root (try: sudo bash)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> installing prerequisites"
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y --no-install-recommends \
|
|
curl ca-certificates
|
|
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "${tmp}"' EXIT
|
|
|
|
echo "==> fetching bundle from ${BUNDLE_URL}"
|
|
# -f fails on HTTP errors; -L follows redirects. Default meter (rate +
|
|
# ETA) is fine now that the bundle is ~30 MB.
|
|
curl -fL "${BUNDLE_URL}" -o "${tmp}/vetting-bundle.tar.gz"
|
|
|
|
bundle_size="$(du -h "${tmp}/vetting-bundle.tar.gz" | cut -f1)"
|
|
echo "==> extracting (${bundle_size})"
|
|
tar -C "${tmp}" -xzf "${tmp}/vetting-bundle.tar.gz"
|
|
|
|
# New bundle extracts to vetting-bundle/; legacy bundles used
|
|
# vetting-bundle-<sha>/. Match both so a downgrade-pin still works.
|
|
shopt -s nullglob
|
|
candidates=( "${tmp}"/vetting-bundle "${tmp}"/vetting-bundle-* )
|
|
shopt -u nullglob
|
|
if [[ ${#candidates[@]} -ne 1 || ! -d "${candidates[0]}" ]]; then
|
|
echo "unexpected bundle layout: expected exactly one vetting-bundle* dir" >&2
|
|
exit 1
|
|
fi
|
|
bundle_dir="${candidates[0]}"
|
|
|
|
echo "==> handing off to install.sh (bundle ${bundle_dir##*/})"
|
|
cd "${bundle_dir}"
|
|
bash install.sh \
|
|
--binary "${bundle_dir}/bin/vetting-linux-amd64" \
|
|
--agent-binary "${bundle_dir}/bin/vetting-agent.linux-amd64"
|
|
|
|
orch_ver="$(cat "${bundle_dir}/VERSION" 2>/dev/null || echo unknown)"
|
|
li_ver="$(cat "${bundle_dir}/live-image/VERSION" 2>/dev/null || echo unknown)"
|
|
|
|
cat <<EOF
|
|
|
|
vetting installed: orchestrator ${orch_ver}, live-image ${li_ver}.
|
|
|
|
To upgrade later, rerun this one-liner. It always pulls the current
|
|
latest bundle; the live image is re-downloaded only when its VERSION
|
|
has bumped (override with --force-live-image).
|
|
|
|
For PXE support, run:
|
|
sudo vetting-pxe-setup \\
|
|
--interface eth0 \\
|
|
--subnet 192.168.1.0/24 \\
|
|
--orchestrator-url http://<lxc-lan-ip>:8080
|
|
|
|
See docs/operations.md for the full flow.
|
|
|
|
EOF
|