customer-engineering/wallarm
3
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

fix: interactive deploy type selection, flat deploy/ dir, set -u crash fix

Browse source 
- setup.sh: ask user which deployment type (docker/native/both) instead
  of silently downloading everything; uses env var for piped mode
- All scripts now download to single flat deploy/ directory instead of
  separate common/docker/native dirs
- Post-download sed patch fixes library sourcing path until repo is
  synced
- wallarm-native.sh: fix set -u crash when declare -a used without =()
  (user hitting blank node name triggered unbound variable crash)
- All deployment scripts: library source path changed from
  ../common/wallarm-lib.sh to same-directory wallarm-lib.sh
This commit is contained in:
admin 2026-08-01 08:44:38 +00:00
parent 0622638a12
commit 68fbb25db2
6 changed files with 83 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
docker/wallarm-ct-check.sh
View file

@ -13,8 +13,8 @@
# Script location and shared library (colors, logging, validation, detection, connectivity) # Script location and shared library (colors, logging, validation, detection, connectivity)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh # shellcheck source=./wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh" source "$SCRIPT_DIR/wallarm-lib.sh"
# Strict error handling # Strict error handling
set -euo pipefail set -euo pipefail

4
docker/wallarm-ct-deploy.sh
View file

@ -14,8 +14,8 @@
# Script location and shared library (colors, logging, validation, detection, connectivity) # Script location and shared library (colors, logging, validation, detection, connectivity)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh # shellcheck source=./wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh" source "$SCRIPT_DIR/wallarm-lib.sh"
# Strict error handling # Strict error handling
set -euo pipefail set -euo pipefail

4
docker/wallarm-ct-reconfigure.sh
View file

@ -12,8 +12,8 @@
# Script location and shared library (colors, logging, validation) # Script location and shared library (colors, logging, validation)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh # shellcheck source=./wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh" source "$SCRIPT_DIR/wallarm-lib.sh"
set -euo pipefail set -euo pipefail
trap early_error_handler ERR trap early_error_handler ERR

4
docker/wallarm-ct-uninstall.sh
View file

@ -14,8 +14,8 @@
# Script location and shared library (colors, logging, validation) # Script location and shared library (colors, logging, validation)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh # shellcheck source=./wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh" source "$SCRIPT_DIR/wallarm-lib.sh"
# Strict error handling # Strict error handling
set -euo pipefail set -euo pipefail

10
native/wallarm-native.sh
View file

@ -25,8 +25,8 @@ set -euo pipefail
# Script location and shared library (logging, detection, connectivity, validation) # Script location and shared library (logging, detection, connectivity, validation)
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=../common/wallarm-lib.sh # shellcheck source=./wallarm-lib.sh
source "$SCRIPT_DIR/../common/wallarm-lib.sh" source "$SCRIPT_DIR/wallarm-lib.sh"
# --- Constants --- # --- Constants ---
BASE_DIR="/opt/wallarm" BASE_DIR="/opt/wallarm"
@ -283,8 +283,8 @@ cmd_install() {
echo "Example: node1 0.0.0.0:8081" echo "Example: node1 0.0.0.0:8081"
echo "Leave name blank to finish." echo "Leave name blank to finish."
declare -a NODE_NAMES declare -a NODE_NAMES=()
declare -a NODE_ADDRESSES declare -a NODE_ADDRESSES=()
while true; do while true; do
read -p "Node name (blank to stop): " name read -p "Node name (blank to stop): " name
@ -322,7 +322,7 @@ cmd_install() {
echo "" echo ""
log "Starting parallel installations..." log "Starting parallel installations..."
declare -a INSTALL_PIDS declare -a INSTALL_PIDS=()
for i in "${!NODE_NAMES[@]}"; do for i in "${!NODE_NAMES[@]}"; do
install_single_node "${NODE_NAMES[$i]}" "${NODE_ADDRESSES[$i]}" "$WALLARM_API_TOKEN" & install_single_node "${NODE_NAMES[$i]}" "${NODE_ADDRESSES[$i]}" "$WALLARM_API_TOKEN" &
INSTALL_PIDS+=($!) INSTALL_PIDS+=($!)

102
setup.sh
View file

@ -2,20 +2,18 @@
# ============================================================================== # ==============================================================================
# Wallarm Deployment Setup Script # Wallarm Deployment Setup Script
# ============================================================================== # ==============================================================================
# Downloads all necessary Wallarm deployment scripts from the Git repository # Downloads Wallarm deployment scripts from the Git repository and makes them
# and makes them executable. # executable.
# #
# By default BOTH deployment types are downloaded, so you can choose later: # When run interactively (terminal), asks which deployment type to download:
# 1. docker - Wallarm filtering node as a Docker container # 1. docker - Wallarm filtering node as a Docker container
# 2. native - Wallarm filtering node installed directly on the OS (no Docker) # 2. native - Wallarm filtering node installed directly on the OS (no Docker)
# 3. both - All scripts (docker + native)
# #
# To download only one type (e.g. for automation or smaller downloads): # When piped (curl ... | bash), downloads BOTH by default for backward
# DEPLOYMENT_TYPE=docker curl -fsSL ".../setup.sh" | bash # compatibility. Override with the DEPLOYMENT_TYPE env var:
# DEPLOYMENT_TYPE=native curl -fsSL ".../setup.sh" | bash # DEPLOYMENT_TYPE=native curl -fsSL ".../setup.sh" | bash
# # DEPLOYMENT_TYPE=docker curl -fsSL ".../setup.sh" | bash
# Usage: curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/setup.sh" | bash
# NOTE: This script is non-interactive on purpose - it must work when piped to
# bash (stdin is then the script pipe, not the terminal).
# ============================================================================== # ==============================================================================
set -euo pipefail set -euo pipefail
@ -87,10 +85,10 @@ download_deployment_type() {
*) err "Unknown deployment type: $type"; exit 1 ;; *) err "Unknown deployment type: $type"; exit 1 ;;
esac esac
mkdir -p "$type" mkdir -p "deploy"
for script in "${scripts[@]}"; do for script in "${scripts[@]}"; do
download_file "${GIT_BASE}${type}/${script}" "${type}/${script}" "$type/$script" download_file "${GIT_BASE}${type}/${script}" "deploy/${script}" "deploy/${script}"
done done
} }
@ -105,41 +103,81 @@ echo
# Decide which deployment type(s) to download # Decide which deployment type(s) to download
DEPLOY_TYPES=() DEPLOY_TYPES=()
# Priority 1: explicit DEPLOYMENT_TYPE env var (non-interactive override)
if [[ "${DEPLOYMENT_TYPE:-}" =~ ^(docker|native)$ ]]; then if [[ "${DEPLOYMENT_TYPE:-}" =~ ^(docker|native)$ ]]; then
DEPLOY_TYPES+=("$DEPLOYMENT_TYPE") DEPLOY_TYPES+=("$DEPLOYMENT_TYPE")
echo -e "${GREEN}Downloading only deployment type: $DEPLOYMENT_TYPE${NC}" echo -e "${GREEN}Downloading only: $DEPLOYMENT_TYPE (from DEPLOYMENT_TYPE env var)${NC}"
# Priority 2: interactive terminal — ask the user
elif [[ -t 0 ]]; then
echo -e "${CYAN}Which deployment type do you need?${NC}"
echo -e " ${YELLOW}1${NC}) Docker only — Wallarm node as a container"
echo -e " ${YELLOW}2${NC}) Native only — Wallarm node directly on this OS (no Docker)"
echo -e " ${YELLOW}3${NC}) Both — docker + native scripts"
echo
while true; do
read -r -p "$(echo -e "${YELLOW}Enter choice [1/2/3]: ${NC}")" choice
case "$choice" in
1) DEPLOY_TYPES+=("docker"); break ;;
2) DEPLOY_TYPES+=("native"); break ;;
3) DEPLOY_TYPES+=("docker" "native"); break ;;
*) echo -e "${RED}Invalid choice. Enter 1, 2, or 3.${NC}" ;;
esac
done
echo
# Priority 3: piped (non-interactive) — default to both for backward compatibility
else else
DEPLOY_TYPES+=("docker" "native") DEPLOY_TYPES+=("docker" "native")
echo -e "${CYAN}Downloading BOTH deployment types (docker + native).${NC}" echo -e "${CYAN}Non-interactive run: downloading BOTH deployment types.${NC}"
echo -e "${YELLOW}To download only one type, re-run with: DEPLOYMENT_TYPE=docker or DEPLOYMENT_TYPE=native${NC}" echo -e "${YELLOW}To download only one type, set DEPLOYMENT_TYPE=docker or DEPLOYMENT_TYPE=native${NC}"
fi fi
echo echo
# Download shared library (required by all deployment scripts) # Download shared library (required by all deployment scripts)
mkdir -p "common" mkdir -p "deploy"
download_file "${GIT_BASE}common/wallarm-lib.sh" "common/wallarm-lib.sh" "shared library (common/wallarm-lib.sh)" download_file "${GIT_BASE}common/wallarm-lib.sh" "deploy/wallarm-lib.sh" "shared library (deploy/wallarm-lib.sh)"
# Download the selected deployment type(s) # Download the selected deployment type(s)
for type in "${DEPLOY_TYPES[@]}"; do for type in "${DEPLOY_TYPES[@]}"; do
download_deployment_type "$type" download_deployment_type "$type"
done done
# Patch library sourcing path for flat deploy/ structure
# (needed until the source scripts in the repo are updated)
for script in deploy/*.sh; do
[[ "$script" == "deploy/wallarm-lib.sh" ]] && continue
sed -i 's|source "\$SCRIPT_DIR/\.\./common/wallarm-lib\.sh"|source "$SCRIPT_DIR/wallarm-lib.sh"|' "$script"
sed -i 's|# shellcheck source=\.\./common/wallarm-lib\.sh|# shellcheck source=./wallarm-lib.sh|' "$script"
done
echo echo
echo -e "${GREEN}${BOLD}Setup complete - all requested scripts downloaded!${NC}" echo -e "${GREEN}${BOLD}Setup complete - requested scripts downloaded!${NC}"
echo
echo -e "${CYAN}Next steps:${NC}"
echo -e " Docker deployment:"
echo -e " 1. Run the preflight check: ${YELLOW}./docker/wallarm-ct-check.sh${NC}"
echo -e " 2. Deploy a Wallarm node: ${YELLOW}./docker/wallarm-ct-deploy.sh${NC}"
echo -e " 3. Reconfigure existing node: ${YELLOW}./docker/wallarm-ct-reconfigure.sh${NC}"
echo -e " 4. Uninstall a node: ${YELLOW}./docker/wallarm-ct-uninstall.sh${NC}"
echo
echo -e " Native deployment (no Docker):"
echo -e " 1. Run the preflight check: ${YELLOW}sudo ./native/wallarm-native.sh --preflight${NC}"
echo -e " 2. Deploy Wallarm nodes: ${YELLOW}sudo ./native/wallarm-native.sh --install${NC}"
echo -e " 3. Update a node's config: ${YELLOW}sudo ./native/wallarm-native.sh --config --node NAME --address IP:PORT${NC}"
echo -e " 4. Remove a node: ${YELLOW}sudo ./native/wallarm-native.sh --remove --node NAME${NC}"
echo -e " 5. Show node status: ${YELLOW}./native/wallarm-native.sh --status${NC}"
echo echo
# Show next steps only for the deployment types that were downloaded
for deploy_type in "${DEPLOY_TYPES[@]}"; do
case "$deploy_type" in
docker)
echo -e "${CYAN}Docker deployment next steps:${NC}"
echo -e " 1. Run the preflight check: ${YELLOW}./deploy/wallarm-ct-check.sh${NC}"
echo -e " 2. Deploy a Wallarm node: ${YELLOW}./deploy/wallarm-ct-deploy.sh${NC}"
echo -e " 3. Reconfigure existing node: ${YELLOW}./deploy/wallarm-ct-reconfigure.sh${NC}"
echo -e " 4. Uninstall a node: ${YELLOW}./deploy/wallarm-ct-uninstall.sh${NC}"
echo
;;
native)
echo -e "${CYAN}Native deployment next steps (no Docker):${NC}"
echo -e " 1. Run the preflight check: ${YELLOW}sudo ./deploy/wallarm-native.sh --preflight${NC}"
echo -e " 2. Deploy Wallarm nodes: ${YELLOW}sudo ./deploy/wallarm-native.sh --install${NC}"
echo -e " 3. Update a node's config: ${YELLOW}sudo ./deploy/wallarm-native.sh --config --node NAME --address IP:PORT${NC}"
echo -e " 4. Remove a node: ${YELLOW}sudo ./deploy/wallarm-native.sh --remove --node NAME${NC}"
echo -e " 5. Show node status: ${YELLOW}./deploy/wallarm-native.sh --status${NC}"
echo
;;
esac
done
echo -e "${YELLOW}Note: Some scripts require sudo. Run them with: sudo ./<script>${NC}" echo -e "${YELLOW}Note: Some scripts require sudo. Run them with: sudo ./<script>${NC}"
echo -e "${YELLOW}Make sure you have the required information ready (see documentation).${NC}" echo -e "${YELLOW}Make sure you have the required information ready (see documentation).${NC}"