feat: self-contained /opt/fw/ — Docker runtime, offline dir, connectivity check
- setup.sh checks git.sechpoint.app reachability first - Docker installed under /opt/fw/docker/ (binaries + data) - /opt/fw/offline/ for pre-downloaded binaries (air-gapped) - /opt/fw/fw.conf — user-editable config - All self-contained, no system-wide installs
This commit is contained in:
admin
parent
e25ea0560b
commit
587aa70554
2 changed files with 72 additions and 63 deletions
|
|
@ -8,9 +8,12 @@ BASE = "/opt/fw"
|
|||
APP = f"{BASE}/app"
|
||||
CONF = f"{APP}/fw.conf"
|
||||
STATE = f"{APP}/state.json"
|
||||
WALLARM_IMAGE = os.environ.get("WALLARM_IMAGE", "wallarm/node:6.13.0")
|
||||
DOCKER_BIN_URL = os.environ.get("DOCKER_BIN_URL", "")
|
||||
DOCKER_DIR = f"{BASE}/docker"
|
||||
OFFLINE_DIR = f"{BASE}/offline"
|
||||
WALLARM_IMAGE = os.environ.get("WALLARM_IMAGE", "wallarm/node:6.13.0")
|
||||
|
||||
# Ensure Docker is in PATH
|
||||
os.environ["PATH"] = f"{DOCKER_DIR}/bin:{os.environ.get('PATH', '')}"
|
||||
|
||||
def run(cmd, timeout=120):
|
||||
return subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
|
||||
|
|
|
|||
122
setup.sh
122
setup.sh
|
|
@ -1,99 +1,105 @@
|
|||
#!/bin/bash
|
||||
# ==============================================================================
|
||||
# Wallarm Deployment Bootstrap
|
||||
# Wallarm Docker Deployment Bootstrap
|
||||
# ==============================================================================
|
||||
# Installs Python 3.12 via pyenv (cross-distro), then runs deploy.py.
|
||||
# Flow: check connectivity → install Docker → download deploy script
|
||||
# All under /opt/fw/ — self-contained, user-editable config.
|
||||
#
|
||||
# curl -fsSL ".../setup.sh" | bash
|
||||
# sudo /opt/fw/deploy.py
|
||||
# sudo /opt/fw/deploy.sh
|
||||
# ==============================================================================
|
||||
set -euo pipefail
|
||||
|
||||
BOLD='\033[1m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
|
||||
REPO="https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/python"
|
||||
REPO="https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main"
|
||||
WALLARM_DIR="/opt/fw"
|
||||
APP_DIR="${WALLARM_DIR}/app"
|
||||
OFFLINE_DIR="${WALLARM_DIR}/offline"
|
||||
|
||||
echo -e "${BOLD}Wallarm Bootstrap${NC}"
|
||||
|
||||
# ── Install curl/git if missing ───────────────────────────────────────
|
||||
if ! command -v curl >/dev/null 2>&1 && ! command -v wget >/dev/null 2>&1; then
|
||||
# ── 1. Connectivity check ─────────────────────────────────────────────
|
||||
echo -e "${YELLOW}Checking connectivity...${NC}"
|
||||
if curl -fsSL --connect-timeout 5 -o /dev/null https://git.sechpoint.app 2>/dev/null; then
|
||||
echo -e "${GREEN} git.sechpoint.app reachable${NC}"
|
||||
else
|
||||
echo -e "${RED} Cannot reach git.sechpoint.app${NC}"
|
||||
echo -e "${RED} Check network/firewall. Aborting.${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ── 2. Ensure curl (for downloads) ────────────────────────────────────
|
||||
if ! command -v curl >/dev/null 2>&1; then
|
||||
apt-get update -qq 2>/dev/null && apt-get install -y -qq curl 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# ── Ensure Python 3.10+ is available ─────────────────────────────────
|
||||
# ── 3. Ensure Python 3.10+ ────────────────────────────────────────────
|
||||
PYTHON_BIN=""
|
||||
if command -v python3 >/dev/null 2>&1 && python3 -c "import sys; exit(0 if sys.version_info >= (3,10) else 1)" 2>/dev/null; then
|
||||
PYTHON_BIN="python3"
|
||||
elif [ -f "$HOME/.pyenv/versions/3.12.0/bin/python3" ]; then
|
||||
PYTHON_BIN="$HOME/.pyenv/versions/3.12.0/bin/python3"
|
||||
else
|
||||
echo -e "${YELLOW}Installing Python 3...${NC}"
|
||||
# Try distro package first (fast)
|
||||
if command -v apt-get >/dev/null 2>&1; then
|
||||
apt-get update -qq && apt-get install -y -qq python3 2>/dev/null
|
||||
elif command -v yum >/dev/null 2>&1; then
|
||||
yum install -y -q python3 2>/dev/null
|
||||
elif command -v dnf >/dev/null 2>&1; then
|
||||
dnf install -y -q python3 2>/dev/null
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
apk add --no-cache python3 2>/dev/null
|
||||
fi
|
||||
if command -v python3 >/dev/null 2>&1; then
|
||||
apt-get update -qq 2>/dev/null && apt-get install -y -qq python3 2>/dev/null || \
|
||||
yum install -y -q python3 2>/dev/null || \
|
||||
dnf install -y -q python3 2>/dev/null || \
|
||||
apk add --no-cache python3 2>/dev/null || true
|
||||
PYTHON_BIN="python3"
|
||||
else
|
||||
# Last resort: pyenv (slow but works anywhere)
|
||||
echo -e "${YELLOW}Building Python via pyenv (3-5 min)...${NC}"
|
||||
apt-get install -y -qq make build-essential libssl-dev zlib1g-dev \
|
||||
libbz2-dev libreadline-dev libsqlite3-dev libffi-dev liblzma-dev 2>/dev/null || true
|
||||
curl -fsSL https://pyenv.run | bash 2>/dev/null
|
||||
export PYENV_ROOT="$HOME/.pyenv"
|
||||
export PATH="$PYENV_ROOT/bin:$PATH"
|
||||
eval "$(pyenv init -)" 2>/dev/null
|
||||
pyenv install 3.12.0 -s 2>/dev/null
|
||||
pyenv global 3.12.0
|
||||
PYTHON_BIN="$HOME/.pyenv/versions/3.12.0/bin/python3"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}Python: $($PYTHON_BIN --version)${NC}"
|
||||
|
||||
# ── Download deploy.py + wrapper ─────────────────────────────────────
|
||||
mkdir -p "$APP_DIR"
|
||||
if command -v curl >/dev/null 2>&1; then
|
||||
curl -fsSL "${REPO}/deploy.py" -o "${APP_DIR}/main.py"
|
||||
curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/deploy.sh" -o "${WALLARM_DIR}/deploy.sh"
|
||||
else
|
||||
wget -q "${REPO}/deploy.py" -O "${APP_DIR}/main.py"
|
||||
wget -q "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/deploy.sh" -O "${WALLARM_DIR}/deploy.sh"
|
||||
fi
|
||||
chmod +x "${APP_DIR}/main.py" "${WALLARM_DIR}/deploy.sh"
|
||||
|
||||
# ── Install Docker ───────────────────────────────────────────────────
|
||||
OFFLINE_DIR="${WALLARM_DIR}/offline"
|
||||
# ── 4. Install Docker under /opt/fw/docker/ ───────────────────────────
|
||||
DOCKER_DIR="${WALLARM_DIR}/docker"
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo -e "${YELLOW}Installing Docker...${NC}"
|
||||
echo -e "${YELLOW}Installing Docker under ${DOCKER_DIR}...${NC}"
|
||||
mkdir -p "${DOCKER_DIR}/bin" "${DOCKER_DIR}/data"
|
||||
|
||||
if [ -f "${OFFLINE_DIR}/docker-29.2.1.tgz" ]; then
|
||||
echo -e "${GREEN} Using offline binary${NC}"
|
||||
tar -xzf "${OFFLINE_DIR}/docker-29.2.1.tgz" -C /usr/local/bin/
|
||||
dockerd &>/dev/null & sleep 2
|
||||
elif [ -n "${DOCKER_BIN_URL:-}" ] && [ -f "${OFFLINE_DIR}/docker.tgz" ]; then
|
||||
tar -xzf "${OFFLINE_DIR}/docker.tgz" -C /usr/local/bin/
|
||||
dockerd &>/dev/null & sleep 2
|
||||
tar -xzf "${OFFLINE_DIR}/docker-29.2.1.tgz" -C "${DOCKER_DIR}/bin/"
|
||||
elif command -v apt-get >/dev/null 2>&1; then
|
||||
apt-get install -y -qq docker.io 2>/dev/null
|
||||
cp /usr/bin/docker* "${DOCKER_DIR}/bin/" 2>/dev/null || true
|
||||
cp /usr/bin/dockerd* "${DOCKER_DIR}/bin/" 2>/dev/null || true
|
||||
elif command -v yum >/dev/null 2>&1; then
|
||||
yum install -y -q docker 2>/dev/null
|
||||
fi
|
||||
systemctl enable docker 2>/dev/null || true
|
||||
systemctl start docker 2>/dev/null || true
|
||||
cp /usr/bin/docker* "${DOCKER_DIR}/bin/" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# ── Pre-cache Wallarm image ───────────────────────────────────────────
|
||||
# Start dockerd with custom data root
|
||||
if [ -x "${DOCKER_DIR}/bin/dockerd" ]; then
|
||||
"${DOCKER_DIR}/bin/dockerd" --data-root "${DOCKER_DIR}/data" \
|
||||
--exec-root "${DOCKER_DIR}/exec" --pidfile "${DOCKER_DIR}/docker.pid" \
|
||||
&>/dev/null &
|
||||
sleep 3
|
||||
export PATH="${DOCKER_DIR}/bin:$PATH"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── 5. Pre-load Wallarm image if available ────────────────────────────
|
||||
if command -v docker >/dev/null 2>&1; then
|
||||
if [ -f "${OFFLINE_DIR}/wallarm-node.tar" ]; then
|
||||
echo -e "${YELLOW}Loading offline Wallarm image...${NC}"
|
||||
docker load -i "${OFFLINE_DIR}/wallarm-node.tar" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── 6. Download deploy script ─────────────────────────────────────────
|
||||
APP_DIR="${WALLARM_DIR}/app"
|
||||
mkdir -p "${APP_DIR}"
|
||||
echo -e "${YELLOW}Downloading deploy script...${NC}"
|
||||
curl -fsSL "${REPO}/python/deploy.py" -o "${APP_DIR}/main.py"
|
||||
curl -fsSL "${REPO}/../deploy.sh" -o "${WALLARM_DIR}/deploy.sh" 2>/dev/null || {
|
||||
# Fallback: create wrapper
|
||||
cat > "${WALLARM_DIR}/deploy.sh" << 'WRAPPER'
|
||||
#!/bin/bash
|
||||
exec python3 /opt/fw/app/main.py "$@"
|
||||
WRAPPER
|
||||
}
|
||||
chmod +x "${APP_DIR}/main.py" "${WALLARM_DIR}/deploy.sh"
|
||||
|
||||
echo
|
||||
echo -e "${GREEN}${BOLD}Ready!${NC}"
|
||||
echo -e " ${GREEN}sudo /opt/fw/deploy.sh${NC}"
|
||||
echo
|
||||
echo -e " Config: /opt/fw/app/fw.conf"
|
||||
echo -e " Docker: /opt/fw/docker/"
|
||||
echo -e " Offline: /opt/fw/offline/ (drop binaries here for air-gapped)"
|
||||
|
|
|
|||
Loading…
Reference in a new issue