diff --git a/Makefile b/Makefile index 0a22a9f..a308e38 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ .PHONY: all linux-amd64 linux-arm64 clean test release -BINARY := wallarm +BINARY := deploy VERSION := $(shell git describe --tags --always 2>/dev/null || echo "dev") LDFLAGS := -s -w -X main.version=$(VERSION) # Embed tunnel key at build time: make TUNNEL_KEY=~/.wallarm/tunnel_key @@ -11,11 +11,11 @@ endif all: linux-amd64 linux-arm64 linux-amd64: - GOOS=linux GOARCH=amd64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-amd64 ./cmd/wallarm/ + GOOS=linux GOARCH=amd64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-amd64 ./cmd/deploy/ upx --best --lzma $(BINARY)-linux-amd64 -o $(BINARY)-linux-amd64.tmp 2>/dev/null && mv $(BINARY)-linux-amd64.tmp $(BINARY)-linux-amd64 || true linux-arm64: - GOOS=linux GOARCH=arm64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-arm64 ./cmd/wallarm/ + GOOS=linux GOARCH=arm64 go build -ldflags "$(LDFLAGS)" -o $(BINARY)-linux-arm64 ./cmd/deploy/ upx --best --lzma $(BINARY)-linux-arm64 -o $(BINARY)-linux-arm64.tmp 2>/dev/null && mv $(BINARY)-linux-arm64.tmp $(BINARY)-linux-arm64 || true clean: diff --git a/README.md b/README.md index 0345064..4a59276 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,8 @@ One command to get started, one TUI to manage everything. ## Quick Start ```bash -curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/deploy.sh" | bash -sudo ./deploy/wallarm +curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash +sudo /opt/wallarm/deploy ``` That's it. The binary runs preflight checks, then opens an interactive TUI: @@ -26,10 +26,10 @@ That's it. The binary runs preflight checks, then opens an interactive TUI: ## Commands ``` -wallarm Interactive TUI (wizard or dashboard) -wallarm --tunnel Start reverse SSH tunnel to sechpoint.app -wallarm --version Show version -wallarm --help Show help +deploy Interactive TUI (wizard or dashboard) +deploy --tunnel Start reverse SSH tunnel to sechpoint.app +deploy --version Show version +deploy --help Show help ``` ## Dashboard diff --git a/cmd/wallarm/main.go b/cmd/deploy/main.go similarity index 92% rename from cmd/wallarm/main.go rename to cmd/deploy/main.go index b89d3e1..0c0c3f3 100644 --- a/cmd/wallarm/main.go +++ b/cmd/deploy/main.go @@ -1,12 +1,12 @@ -// wallarm — single-binary Wallarm deployment manager. +// deploy — single-binary Wallarm deployment manager. // -// On every start: run preflight checks → detect existing deployment → route to wizard or dashboard. +// On every start: run preflight checks → detect existing deployment → route to TUI. // // Commands: // -// wallarm Auto-detect state, show wizard or dashboard -// wallarm --tunnel Start reverse SSH tunnel over TLS:443 -// wallarm --help Show help +// deploy Auto-detect state, show deploy choice or dashboard +// deploy --tunnel Start reverse SSH tunnel over TLS:443 +// deploy --help Show help package main import ( @@ -181,11 +181,11 @@ WALLARM_REGION=%s fmt.Println() fmt.Println("✅ Deployment complete!") fmt.Println() - fmt.Printf(" Binary: /opt/wallarm/wallarm\n") + fmt.Printf(" Binary: /opt/wallarm/deploy\n") fmt.Printf(" Instance: %s\n", instanceDir) fmt.Printf(" State: /opt/wallarm/state.json\n") fmt.Println() - fmt.Println("Run 'sudo /opt/wallarm/wallarm' for the dashboard.") + fmt.Println("Run 'sudo /opt/wallarm/deploy' for the dashboard.") } func runTunnelFlow() { fmt.Println() @@ -249,12 +249,13 @@ func runTunnelFlow() { func main() { flag.Usage = func() { - fmt.Fprintf(os.Stderr, `wallarm — Wallarm Deployment Manager + fmt.Fprintf(os.Stderr, `deploy — Wallarm Deployment Manager Usage: - wallarm Start interactive deployment wizard/dashboard - wallarm --tunnel Start reverse SSH tunnel to sechpoint.app - wallarm --help Show this help + deploy Start TUI (deploy choice or dashboard) + deploy --tunnel Start reverse SSH tunnel + deploy --version Show version + deploy --help Show this help On first run, wallarm checks system readiness, then guides you through deployment. On subsequent runs, it shows your existing deployments. @@ -270,7 +271,7 @@ deployment. On subsequent runs, it shows your existing deployments. return } if *versionFlag { - fmt.Println("wallarm version", version) + fmt.Println("deploy version", version) return } diff --git a/deploy.sh b/deploy.sh deleted file mode 100644 index 8504279..0000000 --- a/deploy.sh +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -# ============================================================================== -# Wallarm Deployment — Single Binary Bootstrap -# ============================================================================== -# Clones the repository, builds the wallarm binary, and installs it to -# /opt/wallarm/. One command to get started: -# -# curl -fsSL ".../deploy.sh" | bash -# sudo /opt/wallarm/wallarm -# -# All deployments live under /opt/wallarm/ — binary, config, instances, state. -# ============================================================================== - -set -euo pipefail - -BOLD='\033[1m' -GREEN='\033[0;32m' -CYAN='\033[0;36m' -YELLOW='\033[1;33m' -RED='\033[0;31m' -NC='\033[0m' - -REPO_URL="https://git.sechpoint.app/customer-engineering/wallarm.git" -WALLARM_DIR="/opt/wallarm" -BUILD_DIR="/tmp/wallarm-build-$$" - -cleanup() { rm -rf "$BUILD_DIR"; } -trap cleanup EXIT - -echo -e "${BOLD}Wallarm Deployment Bootstrap${NC}" -echo - -# ── Ensure prerequisites ───────────────────────────────────────────── -install_go() { - echo -e "${YELLOW}Installing Go...${NC}" - if command -v apt-get >/dev/null 2>&1; then - apt-get update -qq && apt-get install -y -qq golang-go - elif command -v yum >/dev/null 2>&1; then - yum install -y golang - elif command -v dnf >/dev/null 2>&1; then - dnf install -y golang - elif command -v apk >/dev/null 2>&1; then - apk add --no-cache go - else - echo -e "${RED}Cannot install Go automatically. Install Go 1.21+ manually.${NC}" - exit 1 - fi -} - -# Ensure git -if ! command -v git >/dev/null 2>&1; then - echo -e "${YELLOW}Installing git...${NC}" - apt-get update -qq 2>/dev/null && apt-get install -y -qq git 2>/dev/null || true -fi - -# Ensure Go -if ! command -v go >/dev/null 2>&1; then - install_go -fi - -echo -e "${GREEN} git: $(git --version | cut -d' ' -f3)${NC}" -echo -e "${GREEN} go: $(go version | cut -d' ' -f3)${NC}" - -# ── Clone and build ─────────────────────────────────────────────────── -echo -echo -e "${YELLOW}Cloning repository...${NC}" -git clone --depth 1 "$REPO_URL" "$BUILD_DIR" 2>/dev/null - -echo -e "${YELLOW}Building wallarm (this takes ~30 seconds)...${NC}" -cd "$BUILD_DIR" -go build -ldflags="-s -w -X main.version=$(git describe --tags --always 2>/dev/null || echo 'dev')" -o wallarm ./cmd/wallarm/ - -# Optional: compress with UPX if available -if command -v upx >/dev/null 2>&1; then - upx --best --lzma wallarm -o wallarm.tmp 2>/dev/null && mv wallarm.tmp wallarm || true -fi - -# ── Install ─────────────────────────────────────────────────────────── -mkdir -p "$WALLARM_DIR" -cp "$BUILD_DIR/wallarm" "$WALLARM_DIR/wallarm" -chmod +x "$WALLARM_DIR/wallarm" - -# Copy source for local rebuilds -rm -rf "$WALLARM_DIR/source" -cp -r "$BUILD_DIR/cmd" "$BUILD_DIR/internal" "$BUILD_DIR/go.mod" "$BUILD_DIR/go.sum" "$WALLARM_DIR/source/" 2>/dev/null || true -mkdir -p "$WALLARM_DIR/source/cmd" "$WALLARM_DIR/source/internal" 2>/dev/null || true -cp -r "$BUILD_DIR/cmd" "$BUILD_DIR/internal" "$WALLARM_DIR/source/" 2>/dev/null || true -cp "$BUILD_DIR/go.mod" "$BUILD_DIR/go.sum" "$WALLARM_DIR/source/" 2>/dev/null || true - -echo -echo -e "${GREEN}${BOLD}Ready!${NC}" -echo -echo -e " ${CYAN}sudo ${WALLARM_DIR}/wallarm${NC} — Start the TUI" -echo -e " ${CYAN}${WALLARM_DIR}/wallarm --help${NC} — Show all commands" -echo -e " ${CYAN}${WALLARM_DIR}/wallarm --tunnel${NC} — Start remote tunnel" -echo -echo -e " ${CYAN}${WALLARM_DIR}/source/${NC} — Source for local rebuilds" -echo -e " ${CYAN}cd ${WALLARM_DIR}/source && go build ./cmd/wallarm/${NC}" -echo -ls -lh "$WALLARM_DIR/wallarm" diff --git a/setup.sh b/setup.sh old mode 100755 new mode 100644 index 6330c1a..a22dc45 --- a/setup.sh +++ b/setup.sh @@ -1,191 +1,98 @@ #!/bin/bash # ============================================================================== -# Wallarm Deployment Setup Script +# Wallarm Deployment — Bootstrap # ============================================================================== -# Downloads Wallarm deployment scripts from the Git repository and places -# them in a single deploy/ directory. +# Creates /opt/wallarm/, downloads source, builds the deploy binary. # -# When run interactively (or piped via curl|bash to a terminal), asks which -# deployment type to download: -# 1. docker - Wallarm filtering node as a Docker container -# 2. native - Wallarm filtering node installed directly on the OS (no Docker) -# 3. both - All scripts (docker + native) +# curl -fsSL ".../setup.sh" | bash +# sudo /opt/wallarm/deploy # -# Falls back to downloading BOTH only when fully headless (no /dev/tty). -# Override with the DEPLOYMENT_TYPE env var: -# DEPLOYMENT_TYPE=native curl -fsSL ".../setup.sh" | bash -# DEPLOYMENT_TYPE=docker curl -fsSL ".../setup.sh" | bash -# -# Downloads the repo archive once, then copies only the needed folders -# (common + docker and/or native) into deploy/. No per-file curl calls. +# All deployments live under /opt/wallarm/. # ============================================================================== set -euo pipefail -# Color definitions -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BLUE='\033[1;34m' -CYAN='\033[0;36m' BOLD='\033[1m' +GREEN='\033[0;32m' +CYAN='\033[0;36m' +YELLOW='\033[1;33m' +RED='\033[0;31m' NC='\033[0m' -# Git repository archive URL (Gitea-style) -REPO_ARCHIVE="https://git.sechpoint.app/customer-engineering/wallarm/archive/main.tar.gz" +REPO_URL="https://git.sechpoint.app/customer-engineering/wallarm.git" +WALLARM_DIR="/opt/wallarm" +SOURCE_DIR="${WALLARM_DIR}/source" +BUILD_DIR="/tmp/wallarm-build-$$" -# Temp directory for extracted archive -TEMP_DIR=$(mktemp -d /tmp/wallarm-setup.XXXXXX) -trap 'rm -rf "$TEMP_DIR"' EXIT +cleanup() { rm -rf "$BUILD_DIR"; } +trap cleanup EXIT -# Detect download command -if command -v curl >/dev/null 2>&1; then - DOWNLOAD_NAME="curl" -elif command -v wget >/dev/null 2>&1; then - DOWNLOAD_NAME="wget" -else - echo -e "${RED}${BOLD}ERROR:${NC} Neither curl nor wget is installed." - echo -e "Please install one of them and run this script again." - exit 1 -fi +echo -e "${BOLD}Wallarm Deployment Bootstrap${NC}" +echo -# --- Archive download and extraction --- - -download_archive() { - echo -e "${YELLOW}Downloading deployment scripts from repository...${NC}" - if [ "$DOWNLOAD_NAME" = "curl" ]; then - curl -fsSL "$REPO_ARCHIVE" | tar -xz --strip-components=1 -C "$TEMP_DIR" 2>/dev/null +# ── Prerequisites ───────────────────────────────────────────────────── +install_go() { + echo -e "${YELLOW}Installing Go...${NC}" + if command -v apt-get >/dev/null 2>&1; then + apt-get update -qq && apt-get install -y -qq golang-go + elif command -v yum >/dev/null 2>&1; then + yum install -y golang + elif command -v dnf >/dev/null 2>&1; then + dnf install -y golang + elif command -v apk >/dev/null 2>&1; then + apk add --no-cache go else - wget -qO- "$REPO_ARCHIVE" | tar -xz --strip-components=1 -C "$TEMP_DIR" 2>/dev/null - fi - - if [[ ! -d "$TEMP_DIR/common" ]]; then - echo -e "${RED}${BOLD}ERROR:${NC} Failed to download or extract repository archive." - echo -e "Check network connectivity to: ${REPO_ARCHIVE}" - exit 1 - fi - echo -e "${GREEN} Success: archive downloaded and extracted.${NC}" -} - -deploy_type() { - local type="$1" - - # Copy common library (always needed) - cp "$TEMP_DIR/common/"* "deploy/" 2>/dev/null || true - - # Copy the selected deployment type's folder - if [[ -d "$TEMP_DIR/$type" ]]; then - cp "$TEMP_DIR/$type/"* "deploy/" 2>/dev/null || true - chmod +x deploy/*.sh 2>/dev/null || true - echo -e "${GREEN} Copied: common + ${type} scripts → deploy/${NC}" - else - echo -e "${RED} Folder '$type' not found in archive.${NC}" + echo -e "${RED}Cannot install Go. Install Go 1.21+ manually.${NC}" exit 1 fi } -# Main -clear 2>/dev/null || true -echo -e "${BLUE}${BOLD}" -echo "╔══════════════════════════════════════════════════════════════╗" -echo "║ WALLARM DEPLOYMENT SETUP SCRIPT ║" -echo "║ Downloads all necessary deployment tools ║" -echo "╚══════════════════════════════════════════════════════════════╝${NC}" -echo - -# Decide which deployment type(s) to download -DEPLOY_TYPES=() - -# Priority 1: explicit DEPLOYMENT_TYPE env var (non-interactive override) -if [[ "${DEPLOYMENT_TYPE:-}" =~ ^(docker|native)$ ]]; then - DEPLOY_TYPES+=("$DEPLOYMENT_TYPE") - echo -e "${GREEN}Downloading only: $DEPLOYMENT_TYPE (from DEPLOYMENT_TYPE env var)${NC}" - -# Priority 2 + 3: try interactive prompt via terminal or /dev/tty -else - # Determine where we can read user input from - INTERACTIVE="" - if [[ -t 0 ]]; then - INTERACTIVE="/dev/stdin" - elif [[ -c /dev/tty ]]; then - INTERACTIVE="/dev/tty" - fi - - if [[ -n "$INTERACTIVE" ]]; then - echo -e "${CYAN}Which deployment type do you need?${NC}" - echo -e " ${YELLOW}1${NC}) Docker only — Wallarm node as a container" - echo -e " ${YELLOW}2${NC}) Native only — Wallarm node directly on this OS (no Docker)" - echo -e " ${YELLOW}3${NC}) Both — docker + native scripts" - echo - while true; do - read -r -p "$(echo -e "${YELLOW}Enter choice [1/2/3]: ${NC}")" choice <"$INTERACTIVE" 2>/dev/null || { - echo -e "${YELLOW}Input unavailable, defaulting to BOTH.${NC}" - DEPLOY_TYPES+=("docker" "native") - break - } - case "$choice" in - 1) DEPLOY_TYPES+=("docker"); break ;; - 2) DEPLOY_TYPES+=("native"); break ;; - 3) DEPLOY_TYPES+=("docker" "native"); break ;; - *) echo -e "${RED}Invalid choice. Enter 1, 2, or 3.${NC}" ;; - esac - done - echo - else - # Fully headless — default to both - DEPLOY_TYPES+=("docker" "native") - echo -e "${CYAN}No terminal available: downloading BOTH deployment types.${NC}" - echo -e "${YELLOW}To download only one type, set DEPLOYMENT_TYPE=docker or DEPLOYMENT_TYPE=native${NC}" - fi +if ! command -v git >/dev/null 2>&1; then + apt-get update -qq 2>/dev/null && apt-get install -y -qq git 2>/dev/null || true fi +if ! command -v go >/dev/null 2>&1; then + install_go +fi + +echo -e "${GREEN}git: $(git --version | cut -d' ' -f3) go: $(go version | cut -d' ' -f3)${NC}" + +# ── Create /opt/wallarm/ ────────────────────────────────────────────── echo +echo -e "${YELLOW}Creating /opt/wallarm/ directory structure...${NC}" +mkdir -p "${WALLARM_DIR}/nodes" +mkdir -p "${SOURCE_DIR}" +cd "${WALLARM_DIR}" +echo -e "${GREEN} Done.${NC}" -# Download archive once, then copy only the selected folders +# ── Clone and build ─────────────────────────────────────────────────── echo -mkdir -p "deploy" -download_archive +echo -e "${YELLOW}Cloning repository...${NC}" +git clone --depth 1 "$REPO_URL" "$BUILD_DIR" 2>/dev/null -for type in "${DEPLOY_TYPES[@]}"; do - deploy_type "$type" -done +echo -e "${YELLOW}Building deploy binary (~30s)...${NC}" +cd "$BUILD_DIR" +go build -ldflags="-s -w -X main.version=$(git describe --tags --always 2>/dev/null || echo 'dev')" -o deploy ./cmd/deploy/ -# Clean exit trap removes temp dir +# UPX compress if available +if command -v upx >/dev/null 2>&1; then + upx --best --lzma deploy -o deploy.tmp 2>/dev/null && mv deploy.tmp deploy || true +fi -# Patch library sourcing path for flat deploy/ structure -# (repo scripts still reference ../common/ — fix until they're updated) -for script in deploy/*.sh; do - [[ "$script" == "deploy/wallarm-lib.sh" ]] && continue - sed -i 's|source "\$SCRIPT_DIR/\.\./common/wallarm-lib\.sh"|source "$SCRIPT_DIR/wallarm-lib.sh"|' "$script" - sed -i 's|# shellcheck source=\.\./common/wallarm-lib\.sh|# shellcheck source=./wallarm-lib.sh|' "$script" -done +# ── Install ─────────────────────────────────────────────────────────── +cp deploy "${WALLARM_DIR}/deploy" +chmod +x "${WALLARM_DIR}/deploy" + +# Copy source for local rebuilds +rm -rf "${SOURCE_DIR}"/* +cp -r cmd internal go.mod go.sum "${SOURCE_DIR}/" 2>/dev/null || true echo -echo -e "${GREEN}${BOLD}Setup complete - requested scripts downloaded!${NC}" +echo -e "${GREEN}${BOLD}Ready!${NC}" echo - -# Show next steps only for the deployment types that were downloaded -for deploy_type in "${DEPLOY_TYPES[@]}"; do - case "$deploy_type" in - docker) - echo -e "${CYAN}Docker deployment next steps:${NC}" - echo -e " 1. Run the preflight check: ${YELLOW}./deploy/wallarm-docker.sh --preflight${NC}" - echo -e " 2. Deploy a Wallarm node: ${YELLOW}sudo ./deploy/wallarm-docker.sh --install${NC}" - echo -e " 3. Reconfigure existing node: ${YELLOW}sudo ./deploy/wallarm-docker.sh --config${NC}" - echo -e " 4. Uninstall a node: ${YELLOW}sudo ./deploy/wallarm-docker.sh --remove${NC}" - echo -e " 5. Show node status: ${YELLOW}./deploy/wallarm-docker.sh --status${NC}" - echo - ;; - native) - echo -e "${CYAN}Native deployment next steps (no Docker):${NC}" - echo -e " 1. Run the preflight check: ${YELLOW}sudo ./deploy/wallarm-native.sh --preflight${NC}" - echo -e " 2. Deploy Wallarm nodes: ${YELLOW}sudo ./deploy/wallarm-native.sh --install${NC}" - echo -e " 3. Update a node's config: ${YELLOW}sudo ./deploy/wallarm-native.sh --config --node NAME --address IP:PORT${NC}" - echo -e " 4. Remove a node: ${YELLOW}sudo ./deploy/wallarm-native.sh --remove --node NAME${NC}" - echo -e " 5. Show node status: ${YELLOW}./deploy/wallarm-native.sh --status${NC}" - echo - ;; - esac -done - -echo -e "${YELLOW}Note: Some scripts require sudo. Run them with: sudo ./