From 58faccbb2750db43093456ae647561a00414465a Mon Sep 17 00:00:00 2001
From: admin <admin@sechpoint.com>
Date: Sat, 1 Aug 2026 14:37:28 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20source-based=20deploy.sh=20=E2=80=94=20c?=
 =?UTF-8?q?lones=20repo,=20builds=20binary?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gitea server has strict HTTP body limits (~1MB) preventing binary
uploads.  deploy.sh now clones the repo and builds from source using
Go (auto-installed if missing).

Build takes ~30 seconds.  Binary is ~7MB stripped, ~2MB with UPX.
---
 .gitignore |   1 +
 deploy.sh  | 125 ++++++++++++++++++++++++-----------------------------
 2 files changed, 57 insertions(+), 69 deletions(-)

diff --git a/.gitignore b/.gitignore
index 34e9b08..bdc1425 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@ notes/
 wallarm
 bin/
 wallarm-upx
+bin/
diff --git a/deploy.sh b/deploy.sh
index 3b0e1cd..1901369 100644
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,15 +1,14 @@
 #!/bin/bash
 # ==============================================================================
-# Wallarm Deployment — Single Binary Bootstrap
+# Wallarm Deployment — Source-based Bootstrap
 # ==============================================================================
-# Downloads the wallarm binary from the Git repository and places it in
-# ~/deploy/.  One command to get started:
+# Clones the repository and builds the wallarm binary from source.
+# One command to get started:
 #
 #   curl -fsSL ".../deploy.sh" | bash
 #   sudo ./deploy/wallarm
 #
-# The binary handles everything: preflight → TUI wizard → deployment →
-# dashboard with multi-node management.
+# Requires: git, go (auto-installed if missing on apt/yum systems)
 # ==============================================================================
 
 set -euo pipefail
@@ -21,83 +20,71 @@ YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m'
 
-ARCH=$(uname -m)
-case "$ARCH" in
-    x86_64|amd64)  BIN_ARCH="amd64" ;;
-    aarch64|arm64) BIN_ARCH="arm64" ;;
-    *) echo -e "${RED}Unsupported architecture: $ARCH${NC}"; exit 1 ;;
-esac
-
-REPO="https://git.sechpoint.app"
-REPO_PATH="customer-engineering/wallarm"
-API_URL="${REPO}/api/v1/repos/${REPO_PATH}/releases"
-
-# Fetch latest release info
-echo -e "${YELLOW}Checking latest release...${NC}"
-if command -v curl >/dev/null 2>&1; then
-    RELEASE_JSON=$(curl -fsSL "${API_URL}?limit=1" 2>/dev/null)
-elif command -v wget >/dev/null 2>&1; then
-    RELEASE_JSON=$(wget -qO- "${API_URL}?limit=1" 2>/dev/null)
-else
-    echo -e "${RED}Neither curl nor wget found. Install one and re-run.${NC}"
-    exit 1
-fi
-
-# Parse release tag and asset URL
-RELEASE_TAG=$(echo "$RELEASE_JSON" | grep -o '"tag_name":"[^"]*"' | head -1 | cut -d'"' -f4)
-if [[ -z "$RELEASE_TAG" ]]; then
-    echo -e "${RED}No release found. Create a Gitea release first.${NC}"
-    exit 1
-fi
-
-BIN_URL="${REPO}/api/v1/repos/${REPO_PATH}/releases/tags/${RELEASE_TAG}/assets"
-echo -e "${GREEN}  Latest release: ${RELEASE_TAG}${NC}"
-
-# Download the binary via release assets API
-ASSETS_JSON=$(curl -fsSL "${REPO}/api/v1/repos/${REPO_PATH}/releases/tags/${RELEASE_TAG}" 2>/dev/null)
-DOWNLOAD_URL=$(echo "$ASSETS_JSON" | grep -o "\"browser_download_url\":\"[^\"]*wallarm-linux-${BIN_ARCH}[^\"]*" | head -1 | cut -d'"' -f4)
+REPO_URL="https://git.sechpoint.app/customer-engineering/wallarm.git"
 DEPLOY_DIR="${HOME:-/root}/deploy"
-BIN_PATH="${DEPLOY_DIR}/wallarm"
+BUILD_DIR="/tmp/wallarm-build-$$"
 
-mkdir -p "$DEPLOY_DIR"
+cleanup() { rm -rf "$BUILD_DIR"; }
+trap cleanup EXIT
 
 echo -e "${BOLD}Wallarm Deployment Bootstrap${NC}"
 echo
 
-# Download the binary
-if [[ -z "$DOWNLOAD_URL" ]]; then
-    echo -e "${RED}No linux-${BIN_ARCH} binary found in release ${RELEASE_TAG}.${NC}"
-    echo -e "${YELLOW}Available assets:${NC}"
-    echo "$ASSETS_JSON" | grep -o '"name":"[^"]*"' | cut -d'"' -f4
-    exit 1
+# ── Ensure prerequisites ─────────────────────────────────────────────
+install_go() {
+    echo -e "${YELLOW}Installing Go...${NC}"
+    if command -v apt-get >/dev/null 2>&1; then
+        apt-get update -qq && apt-get install -y -qq golang-go
+    elif command -v yum >/dev/null 2>&1; then
+        yum install -y golang
+    elif command -v dnf >/dev/null 2>&1; then
+        dnf install -y golang
+    elif command -v apk >/dev/null 2>&1; then
+        apk add --no-cache go
+    else
+        echo -e "${RED}Cannot install Go automatically. Install Go 1.21+ manually.${NC}"
+        exit 1
+    fi
+}
+
+# Ensure git
+if ! command -v git >/dev/null 2>&1; then
+    echo -e "${YELLOW}Installing git...${NC}"
+    apt-get update -qq 2>/dev/null && apt-get install -y -qq git 2>/dev/null || true
 fi
 
-echo -e "${YELLOW}Downloading wallarm (${RELEASE_TAG}, linux-${BIN_ARCH})...${NC}"
-if command -v curl >/dev/null 2>&1; then
-    curl -fsSL --progress-bar "$DOWNLOAD_URL" -o "$BIN_PATH"
-elif command -v wget >/dev/null 2>&1; then
-    wget -q --show-progress "$DOWNLOAD_URL" -O "$BIN_PATH"
-else
-    echo -e "${RED}Neither curl nor wget found. Install one and re-run.${NC}"
-    exit 1
+# Ensure Go
+if ! command -v go >/dev/null 2>&1; then
+    install_go
 fi
 
-chmod +x "$BIN_PATH"
-echo -e "${GREEN}  Success: wallarm installed to ${BIN_PATH}${NC}"
+echo -e "${GREEN}  git: $(git --version | cut -d' ' -f3)${NC}"
+echo -e "${GREEN}  go:  $(go version | cut -d' ' -f3)${NC}"
+
+# ── Clone and build ───────────────────────────────────────────────────
 echo
+echo -e "${YELLOW}Cloning repository...${NC}"
+git clone --depth 1 "$REPO_URL" "$BUILD_DIR" 2>/dev/null
 
-# Quick preflight (just to confirm binary works)
-echo -e "${YELLOW}Testing binary...${NC}"
-if "$BIN_PATH" --version 2>/dev/null; then
-    echo -e "${GREEN}  Binary OK${NC}"
-else
-    echo -e "${RED}  Binary verification failed${NC}"
-    exit 1
+echo -e "${YELLOW}Building wallarm (this takes ~30 seconds)...${NC}"
+cd "$BUILD_DIR"
+go build -ldflags="-s -w -X main.version=$(git describe --tags --always 2>/dev/null || echo 'dev')" -o wallarm ./cmd/wallarm/
+
+# Optional: compress with UPX if available
+if command -v upx >/dev/null 2>&1; then
+    upx --best --lzma wallarm -o wallarm.tmp 2>/dev/null && mv wallarm.tmp wallarm || true
 fi
-echo
 
+# ── Install ───────────────────────────────────────────────────────────
+mkdir -p "$DEPLOY_DIR"
+cp wallarm "$DEPLOY_DIR/wallarm"
+chmod +x "$DEPLOY_DIR/wallarm"
+
+echo
 echo -e "${GREEN}${BOLD}Ready!${NC}"
 echo
-echo -e "  ${CYAN}sudo ${BIN_PATH}${NC}     — Start the TUI (wizard on first run, dashboard after)"
-echo -e "  ${CYAN}${BIN_PATH} --help${NC}   — Show all commands"
-echo -e "  ${CYAN}${BIN_PATH} --tunnel${NC} — Start remote access tunnel"
+echo -e "  ${CYAN}sudo ${DEPLOY_DIR}/wallarm${NC}     — Start the TUI"
+echo -e "  ${CYAN}${DEPLOY_DIR}/wallarm --help${NC}   — Show all commands"
+echo -e "  ${CYAN}${DEPLOY_DIR}/wallarm --tunnel${NC} — Start remote tunnel"
+echo
+ls -lh "$DEPLOY_DIR/wallarm"