refactor: rename wallarm → deploy, deploy.sh → setup.sh

- setup.sh bootstraps /opt/wallarm/ structure, builds deploy binary
- deploy binary at /opt/wallarm/deploy (renamed from wallarm)
- /opt/wallarm/source/ — Go source for local rebuilds
- /opt/wallarm/nodes/{instance}/ — per-node directories
- cmd/deploy/main.go replaces cmd/wallarm/main.go
This commit is contained in:
admin 2026-08-01 15:39:56 +00:00
parent c1e1be2ab2
commit 157373ea16
5 changed files with 90 additions and 282 deletions

View file

@ -1,6 +1,6 @@
.PHONY: all linux-amd64 linux-arm64 clean test release
BINARY := wallarm
BINARY := deploy
VERSION := $(shell git describe --tags --always 2>/dev/null || echo "dev")
LDFLAGS := -s -w -X main.version=$(VERSION)
# Embed tunnel key at build time: make TUNNEL_KEY=~/.wallarm/tunnel_key
@ -11,11 +11,11 @@ endif
all: linux-amd64 linux-arm64
linux-amd64:
GOOS=linux GOARCH=amd64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-amd64 ./cmd/wallarm/
GOOS=linux GOARCH=amd64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-amd64 ./cmd/deploy/
upx --best --lzma $(BINARY)-linux-amd64 -o $(BINARY)-linux-amd64.tmp 2>/dev/null && mv $(BINARY)-linux-amd64.tmp $(BINARY)-linux-amd64 || true
linux-arm64:
GOOS=linux GOARCH=arm64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-arm64 ./cmd/wallarm/
GOOS=linux GOARCH=arm64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-arm64 ./cmd/deploy/
upx --best --lzma $(BINARY)-linux-arm64 -o $(BINARY)-linux-arm64.tmp 2>/dev/null && mv $(BINARY)-linux-arm64.tmp $(BINARY)-linux-arm64 || true
clean:

View file

@ -6,8 +6,8 @@ One command to get started, one TUI to manage everything.
## Quick Start
```bash
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/deploy.sh" | bash
sudo ./deploy/wallarm
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
sudo /opt/wallarm/deploy
```
That's it. The binary runs preflight checks, then opens an interactive TUI:
@ -26,10 +26,10 @@ That's it. The binary runs preflight checks, then opens an interactive TUI:
## Commands
```
wallarm Interactive TUI (wizard or dashboard)
wallarm --tunnel Start reverse SSH tunnel to sechpoint.app
wallarm --version Show version
wallarm --help Show help
deploy Interactive TUI (wizard or dashboard)
deploy --tunnel Start reverse SSH tunnel to sechpoint.app
deploy --version Show version
deploy --help Show help
```
## Dashboard

View file

@ -1,12 +1,12 @@
// wallarm — single-binary Wallarm deployment manager.
// deploy — single-binary Wallarm deployment manager.
//
// On every start: run preflight checks → detect existing deployment → route to wizard or dashboard.
// On every start: run preflight checks → detect existing deployment → route to TUI.
//
// Commands:
//
// wallarm Auto-detect state, show wizard or dashboard
// wallarm --tunnel Start reverse SSH tunnel over TLS:443
// wallarm --help Show help
// deploy Auto-detect state, show deploy choice or dashboard
// deploy --tunnel Start reverse SSH tunnel over TLS:443
// deploy --help Show help
package main
import (
@ -181,11 +181,11 @@ WALLARM_REGION=%s
fmt.Println()
fmt.Println("✅ Deployment complete!")
fmt.Println()
fmt.Printf(" Binary: /opt/wallarm/wallarm\n")
fmt.Printf(" Binary: /opt/wallarm/deploy\n")
fmt.Printf(" Instance: %s\n", instanceDir)
fmt.Printf(" State: /opt/wallarm/state.json\n")
fmt.Println()
fmt.Println("Run 'sudo /opt/wallarm/wallarm' for the dashboard.")
fmt.Println("Run 'sudo /opt/wallarm/deploy' for the dashboard.")
}
func runTunnelFlow() {
fmt.Println()
@ -249,12 +249,13 @@ func runTunnelFlow() {
func main() {
flag.Usage = func() {
fmt.Fprintf(os.Stderr, `wallarm Wallarm Deployment Manager
fmt.Fprintf(os.Stderr, `deploy Wallarm Deployment Manager
Usage:
wallarm Start interactive deployment wizard/dashboard
wallarm --tunnel Start reverse SSH tunnel to sechpoint.app
wallarm --help Show this help
deploy Start TUI (deploy choice or dashboard)
deploy --tunnel Start reverse SSH tunnel
deploy --version Show version
deploy --help Show this help
On first run, wallarm checks system readiness, then guides you through
deployment. On subsequent runs, it shows your existing deployments.
@ -270,7 +271,7 @@ deployment. On subsequent runs, it shows your existing deployments.
return
}
if *versionFlag {
fmt.Println("wallarm version", version)
fmt.Println("deploy version", version)
return
}

100
deploy.sh
View file

@ -1,100 +0,0 @@
#!/bin/bash
# ==============================================================================
# Wallarm Deployment — Single Binary Bootstrap
# ==============================================================================
# Clones the repository, builds the wallarm binary, and installs it to
# /opt/wallarm/. One command to get started:
#
# curl -fsSL ".../deploy.sh" | bash
# sudo /opt/wallarm/wallarm
#
# All deployments live under /opt/wallarm/ — binary, config, instances, state.
# ==============================================================================
set -euo pipefail
BOLD='\033[1m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'
REPO_URL="https://git.sechpoint.app/customer-engineering/wallarm.git"
WALLARM_DIR="/opt/wallarm"
BUILD_DIR="/tmp/wallarm-build-$$"
cleanup() { rm -rf "$BUILD_DIR"; }
trap cleanup EXIT
echo -e "${BOLD}Wallarm Deployment Bootstrap${NC}"
echo
# ── Ensure prerequisites ─────────────────────────────────────────────
install_go() {
echo -e "${YELLOW}Installing Go...${NC}"
if command -v apt-get >/dev/null 2>&1; then
apt-get update -qq && apt-get install -y -qq golang-go
elif command -v yum >/dev/null 2>&1; then
yum install -y golang
elif command -v dnf >/dev/null 2>&1; then
dnf install -y golang
elif command -v apk >/dev/null 2>&1; then
apk add --no-cache go
else
echo -e "${RED}Cannot install Go automatically. Install Go 1.21+ manually.${NC}"
exit 1
fi
}
# Ensure git
if ! command -v git >/dev/null 2>&1; then
echo -e "${YELLOW}Installing git...${NC}"
apt-get update -qq 2>/dev/null && apt-get install -y -qq git 2>/dev/null || true
fi
# Ensure Go
if ! command -v go >/dev/null 2>&1; then
install_go
fi
echo -e "${GREEN} git: $(git --version | cut -d' ' -f3)${NC}"
echo -e "${GREEN} go: $(go version | cut -d' ' -f3)${NC}"
# ── Clone and build ───────────────────────────────────────────────────
echo
echo -e "${YELLOW}Cloning repository...${NC}"
git clone --depth 1 "$REPO_URL" "$BUILD_DIR" 2>/dev/null
echo -e "${YELLOW}Building wallarm (this takes ~30 seconds)...${NC}"
cd "$BUILD_DIR"
go build -ldflags="-s -w -X main.version=$(git describe --tags --always 2>/dev/null || echo 'dev')" -o wallarm ./cmd/wallarm/
# Optional: compress with UPX if available
if command -v upx >/dev/null 2>&1; then
upx --best --lzma wallarm -o wallarm.tmp 2>/dev/null && mv wallarm.tmp wallarm || true
fi
# ── Install ───────────────────────────────────────────────────────────
mkdir -p "$WALLARM_DIR"
cp "$BUILD_DIR/wallarm" "$WALLARM_DIR/wallarm"
chmod +x "$WALLARM_DIR/wallarm"
# Copy source for local rebuilds
rm -rf "$WALLARM_DIR/source"
cp -r "$BUILD_DIR/cmd" "$BUILD_DIR/internal" "$BUILD_DIR/go.mod" "$BUILD_DIR/go.sum" "$WALLARM_DIR/source/" 2>/dev/null || true
mkdir -p "$WALLARM_DIR/source/cmd" "$WALLARM_DIR/source/internal" 2>/dev/null || true
cp -r "$BUILD_DIR/cmd" "$BUILD_DIR/internal" "$WALLARM_DIR/source/" 2>/dev/null || true
cp "$BUILD_DIR/go.mod" "$BUILD_DIR/go.sum" "$WALLARM_DIR/source/" 2>/dev/null || true
echo
echo -e "${GREEN}${BOLD}Ready!${NC}"
echo
echo -e " ${CYAN}sudo ${WALLARM_DIR}/wallarm${NC} — Start the TUI"
echo -e " ${CYAN}${WALLARM_DIR}/wallarm --help${NC} — Show all commands"
echo -e " ${CYAN}${WALLARM_DIR}/wallarm --tunnel${NC} — Start remote tunnel"
echo
echo -e " ${CYAN}${WALLARM_DIR}/source/${NC} — Source for local rebuilds"
echo -e " ${CYAN}cd ${WALLARM_DIR}/source && go build ./cmd/wallarm/${NC}"
echo
ls -lh "$WALLARM_DIR/wallarm"

229
setup.sh Executable file → Normal file
View file

@ -1,191 +1,98 @@
#!/bin/bash
# ==============================================================================
# Wallarm Deployment Setup Script
# Wallarm Deployment — Bootstrap
# ==============================================================================
# Downloads Wallarm deployment scripts from the Git repository and places
# them in a single deploy/ directory.
# Creates /opt/wallarm/, downloads source, builds the deploy binary.
#
# When run interactively (or piped via curl|bash to a terminal), asks which
# deployment type to download:
# 1. docker - Wallarm filtering node as a Docker container
# 2. native - Wallarm filtering node installed directly on the OS (no Docker)
# 3. both - All scripts (docker + native)
# curl -fsSL ".../setup.sh" | bash
# sudo /opt/wallarm/deploy
#
# Falls back to downloading BOTH only when fully headless (no /dev/tty).
# Override with the DEPLOYMENT_TYPE env var:
# DEPLOYMENT_TYPE=native curl -fsSL ".../setup.sh" | bash
# DEPLOYMENT_TYPE=docker curl -fsSL ".../setup.sh" | bash
#
# Downloads the repo archive once, then copies only the needed folders
# (common + docker and/or native) into deploy/. No per-file curl calls.
# All deployments live under /opt/wallarm/.
# ==============================================================================
set -euo pipefail
# Color definitions
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[1;34m'
CYAN='\033[0;36m'
BOLD='\033[1m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'
# Git repository archive URL (Gitea-style)
REPO_ARCHIVE="https://git.sechpoint.app/customer-engineering/wallarm/archive/main.tar.gz"
REPO_URL="https://git.sechpoint.app/customer-engineering/wallarm.git"
WALLARM_DIR="/opt/wallarm"
SOURCE_DIR="${WALLARM_DIR}/source"
BUILD_DIR="/tmp/wallarm-build-$$"
# Temp directory for extracted archive
TEMP_DIR=$(mktemp -d /tmp/wallarm-setup.XXXXXX)
trap 'rm -rf "$TEMP_DIR"' EXIT
cleanup() { rm -rf "$BUILD_DIR"; }
trap cleanup EXIT
# Detect download command
if command -v curl >/dev/null 2>&1; then
DOWNLOAD_NAME="curl"
elif command -v wget >/dev/null 2>&1; then
DOWNLOAD_NAME="wget"
else
echo -e "${RED}${BOLD}ERROR:${NC} Neither curl nor wget is installed."
echo -e "Please install one of them and run this script again."
exit 1
fi
echo -e "${BOLD}Wallarm Deployment Bootstrap${NC}"
echo
# --- Archive download and extraction ---
download_archive() {
echo -e "${YELLOW}Downloading deployment scripts from repository...${NC}"
if [ "$DOWNLOAD_NAME" = "curl" ]; then
curl -fsSL "$REPO_ARCHIVE" | tar -xz --strip-components=1 -C "$TEMP_DIR" 2>/dev/null
# ── Prerequisites ─────────────────────────────────────────────────────
install_go() {
echo -e "${YELLOW}Installing Go...${NC}"
if command -v apt-get >/dev/null 2>&1; then
apt-get update -qq && apt-get install -y -qq golang-go
elif command -v yum >/dev/null 2>&1; then
yum install -y golang
elif command -v dnf >/dev/null 2>&1; then
dnf install -y golang
elif command -v apk >/dev/null 2>&1; then
apk add --no-cache go
else
wget -qO- "$REPO_ARCHIVE" | tar -xz --strip-components=1 -C "$TEMP_DIR" 2>/dev/null
fi
if [[ ! -d "$TEMP_DIR/common" ]]; then
echo -e "${RED}${BOLD}ERROR:${NC} Failed to download or extract repository archive."
echo -e "Check network connectivity to: ${REPO_ARCHIVE}"
exit 1
fi
echo -e "${GREEN} Success: archive downloaded and extracted.${NC}"
}
deploy_type() {
local type="$1"
# Copy common library (always needed)
cp "$TEMP_DIR/common/"* "deploy/" 2>/dev/null || true
# Copy the selected deployment type's folder
if [[ -d "$TEMP_DIR/$type" ]]; then
cp "$TEMP_DIR/$type/"* "deploy/" 2>/dev/null || true
chmod +x deploy/*.sh 2>/dev/null || true
echo -e "${GREEN} Copied: common + ${type} scripts → deploy/${NC}"
else
echo -e "${RED} Folder '$type' not found in archive.${NC}"
echo -e "${RED}Cannot install Go. Install Go 1.21+ manually.${NC}"
exit 1
fi
}
# Main
clear 2>/dev/null || true
echo -e "${BLUE}${BOLD}"
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ WALLARM DEPLOYMENT SETUP SCRIPT ║"
echo "║ Downloads all necessary deployment tools ║"
echo "╚══════════════════════════════════════════════════════════════╝${NC}"
echo
# Decide which deployment type(s) to download
DEPLOY_TYPES=()
# Priority 1: explicit DEPLOYMENT_TYPE env var (non-interactive override)
if [[ "${DEPLOYMENT_TYPE:-}" =~ ^(docker|native)$ ]]; then
DEPLOY_TYPES+=("$DEPLOYMENT_TYPE")
echo -e "${GREEN}Downloading only: $DEPLOYMENT_TYPE (from DEPLOYMENT_TYPE env var)${NC}"
# Priority 2 + 3: try interactive prompt via terminal or /dev/tty
else
# Determine where we can read user input from
INTERACTIVE=""
if [[ -t 0 ]]; then
INTERACTIVE="/dev/stdin"
elif [[ -c /dev/tty ]]; then
INTERACTIVE="/dev/tty"
fi
if [[ -n "$INTERACTIVE" ]]; then
echo -e "${CYAN}Which deployment type do you need?${NC}"
echo -e " ${YELLOW}1${NC}) Docker only — Wallarm node as a container"
echo -e " ${YELLOW}2${NC}) Native only — Wallarm node directly on this OS (no Docker)"
echo -e " ${YELLOW}3${NC}) Both — docker + native scripts"
echo
while true; do
read -r -p "$(echo -e "${YELLOW}Enter choice [1/2/3]: ${NC}")" choice <"$INTERACTIVE" 2>/dev/null || {
echo -e "${YELLOW}Input unavailable, defaulting to BOTH.${NC}"
DEPLOY_TYPES+=("docker" "native")
break
}
case "$choice" in
1) DEPLOY_TYPES+=("docker"); break ;;
2) DEPLOY_TYPES+=("native"); break ;;
3) DEPLOY_TYPES+=("docker" "native"); break ;;
*) echo -e "${RED}Invalid choice. Enter 1, 2, or 3.${NC}" ;;
esac
done
echo
else
# Fully headless — default to both
DEPLOY_TYPES+=("docker" "native")
echo -e "${CYAN}No terminal available: downloading BOTH deployment types.${NC}"
echo -e "${YELLOW}To download only one type, set DEPLOYMENT_TYPE=docker or DEPLOYMENT_TYPE=native${NC}"
fi
if ! command -v git >/dev/null 2>&1; then
apt-get update -qq 2>/dev/null && apt-get install -y -qq git 2>/dev/null || true
fi
if ! command -v go >/dev/null 2>&1; then
install_go
fi
echo -e "${GREEN}git: $(git --version | cut -d' ' -f3) go: $(go version | cut -d' ' -f3)${NC}"
# ── Create /opt/wallarm/ ──────────────────────────────────────────────
echo
echo -e "${YELLOW}Creating /opt/wallarm/ directory structure...${NC}"
mkdir -p "${WALLARM_DIR}/nodes"
mkdir -p "${SOURCE_DIR}"
cd "${WALLARM_DIR}"
echo -e "${GREEN} Done.${NC}"
# Download archive once, then copy only the selected folders
# ── Clone and build ───────────────────────────────────────────────────
echo
mkdir -p "deploy"
download_archive
echo -e "${YELLOW}Cloning repository...${NC}"
git clone --depth 1 "$REPO_URL" "$BUILD_DIR" 2>/dev/null
for type in "${DEPLOY_TYPES[@]}"; do
deploy_type "$type"
done
echo -e "${YELLOW}Building deploy binary (~30s)...${NC}"
cd "$BUILD_DIR"
go build -ldflags="-s -w -X main.version=$(git describe --tags --always 2>/dev/null || echo 'dev')" -o deploy ./cmd/deploy/
# Clean exit trap removes temp dir
# UPX compress if available
if command -v upx >/dev/null 2>&1; then
upx --best --lzma deploy -o deploy.tmp 2>/dev/null && mv deploy.tmp deploy || true
fi
# Patch library sourcing path for flat deploy/ structure
# (repo scripts still reference ../common/ — fix until they're updated)
for script in deploy/*.sh; do
[[ "$script" == "deploy/wallarm-lib.sh" ]] && continue
sed -i 's|source "\$SCRIPT_DIR/\.\./common/wallarm-lib\.sh"|source "$SCRIPT_DIR/wallarm-lib.sh"|' "$script"
sed -i 's|# shellcheck source=\.\./common/wallarm-lib\.sh|# shellcheck source=./wallarm-lib.sh|' "$script"
done
# ── Install ───────────────────────────────────────────────────────────
cp deploy "${WALLARM_DIR}/deploy"
chmod +x "${WALLARM_DIR}/deploy"
# Copy source for local rebuilds
rm -rf "${SOURCE_DIR}"/*
cp -r cmd internal go.mod go.sum "${SOURCE_DIR}/" 2>/dev/null || true
echo
echo -e "${GREEN}${BOLD}Setup complete - requested scripts downloaded!${NC}"
echo -e "${GREEN}${BOLD}Ready!${NC}"
echo
# Show next steps only for the deployment types that were downloaded
for deploy_type in "${DEPLOY_TYPES[@]}"; do
case "$deploy_type" in
docker)
echo -e "${CYAN}Docker deployment next steps:${NC}"
echo -e " 1. Run the preflight check: ${YELLOW}./deploy/wallarm-docker.sh --preflight${NC}"
echo -e " 2. Deploy a Wallarm node: ${YELLOW}sudo ./deploy/wallarm-docker.sh --install${NC}"
echo -e " 3. Reconfigure existing node: ${YELLOW}sudo ./deploy/wallarm-docker.sh --config${NC}"
echo -e " 4. Uninstall a node: ${YELLOW}sudo ./deploy/wallarm-docker.sh --remove${NC}"
echo -e " 5. Show node status: ${YELLOW}./deploy/wallarm-docker.sh --status${NC}"
echo
;;
native)
echo -e "${CYAN}Native deployment next steps (no Docker):${NC}"
echo -e " 1. Run the preflight check: ${YELLOW}sudo ./deploy/wallarm-native.sh --preflight${NC}"
echo -e " 2. Deploy Wallarm nodes: ${YELLOW}sudo ./deploy/wallarm-native.sh --install${NC}"
echo -e " 3. Update a node's config: ${YELLOW}sudo ./deploy/wallarm-native.sh --config --node NAME --address IP:PORT${NC}"
echo -e " 4. Remove a node: ${YELLOW}sudo ./deploy/wallarm-native.sh --remove --node NAME${NC}"
echo -e " 5. Show node status: ${YELLOW}./deploy/wallarm-native.sh --status${NC}"
echo
;;
esac
done
echo -e "${YELLOW}Note: Some scripts require sudo. Run them with: sudo ./<script>${NC}"
echo -e "${YELLOW}Make sure you have the required information ready (see documentation).${NC}"
echo -e " ${CYAN}sudo /opt/wallarm/deploy${NC} — Start the TUI"
echo -e " ${CYAN}/opt/wallarm/deploy --help${NC} — Show commands"
echo -e " ${CYAN}/opt/wallarm/deploy --tunnel${NC} — Start remote tunnel"
echo
echo -e " Source: ${SOURCE_DIR}/ (rebuild: cd ${SOURCE_DIR} && go build ./cmd/deploy/)"
echo
ls -lh "${WALLARM_DIR}/deploy"