pastilhasandClaude Opus 5
3fb0e5c887
Two real defects fixed on the way across.
The sudoers write was in the wrong order. The original echoed the rule straight
into /etc/sudoers.d, validated it afterwards, and chmod'd it later still. A
malformed file there breaks sudo COMPLETELY — and you cannot sudo to repair it,
so on a remote machine that is a rescue console — and so does one with loose
permissions, because sudo refuses to read its own configuration. Both of those
windows were live in the original ordering. grant_passwordless_sudo now writes a
temp file, runs visudo -c against it, and only then places it with install(1),
which applies the content and the 0440 mode in one step. Nothing reaches
/etc/sudoers.d that has not already been validated.
The .tmux.conf copy overwrote whatever was in the home on every run. lib/files.sh
adds the two shapes that stop this whole class of thing:
install_config installs when absent, does nothing when identical, and keeps
what the user wrote when it differs — printing the cp to take
ours, so the choice stays theirs
append_once wraps a block in named markers so a second run recognises its
own work; also lets a human see which lines came from this
script and remove them as a unit
append_once is what the five unguarded `cat >>` into .zshrc need when those
sections are ported — a second pass currently duplicates the starship init, the
nvim PATH, bun, deno and the aliases.
Passwordless sudo is asked separately from creating the account, because it is a
security posture rather than part of making a user, and the cost is stated: a key
that can log into this account is root without a further step. Officer's actual
requirement is stated too — os-user-shell.ts runs `sudo -n`, and a prompt it
cannot answer surfaces as a permissions error rather than a question — and
refusing records that consequence in the summary instead of a bare "skipped".
Verified: all three install_config outcomes, append_once writing exactly once
across two runs, visudo rejecting junk before anything is installed, and the
section reporting correctly against this host's existing account.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
389 lines
14 KiB
Bash
389 lines
14 KiB
Bash
#!/bin/bash
|
|
# =============================================================================
|
|
# machine-setup — shared foundation
|
|
# =============================================================================
|
|
#
|
|
# Sourced by machine-setup.sh before anything runs. DEFINITIONS ONLY: this file
|
|
# declares state and functions and must never install, write or restart
|
|
# anything. Sourcing it has to be safe at any point, including from a step that
|
|
# is only being read for its variables.
|
|
#
|
|
# The one thing it expects from its caller, because they are facts about the
|
|
# entry point rather than about this library:
|
|
#
|
|
# SCRIPT_DIR directory of the script being run
|
|
# PROGRESS_FILE where completed step names are recorded
|
|
#
|
|
# Everything else below is owned here.
|
|
|
|
# Guard against being sourced twice — steps will eventually source this
|
|
# directly so they can be run on their own, and re-running it would reset
|
|
# SUMMARY and lose everything recorded so far.
|
|
[[ -n "${MACHINE_SETUP_BASE_LOADED:-}" ]] && return 0
|
|
MACHINE_SETUP_BASE_LOADED=1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Shared state
|
|
# -----------------------------------------------------------------------------
|
|
|
|
SUMMARY=() # what was done, printed at the end
|
|
ERRORS=() # non-fatal failures, printed at the end
|
|
CURRENT_STEP=""
|
|
SKIP_STEP=false
|
|
|
|
# What machine this is. Filled in by detect_os() before any step runs; every step
|
|
# after that branches on these rather than assuming apt on x86_64.
|
|
OS="" # os-release ID: ubuntu | debian | arch | fedora | macos | …
|
|
OS_NAME="" # pretty name, for the banner
|
|
OS_VERSION="" # version id; empty on rolling releases
|
|
PM="" # apt | pacman | dnf | brew
|
|
ARCH="" # amd64 | arm64, normalised — upstream tarballs disagree on spelling
|
|
IS_WSL=false
|
|
|
|
# What this box is FOR. Asked once in pre-flight and consulted by the steps
|
|
# afterwards, because several of them have a different right answer per role and
|
|
# no way to work it out on their own:
|
|
#
|
|
# homelab a machine you physically control on a network you own
|
|
# vps rented, public IP, someone else's DHCP and console
|
|
# dev a laptop or desktop you sit at
|
|
#
|
|
# Set MACHINE_ROLE in the environment to answer it ahead of time — hence the
|
|
# :- default rather than a plain assignment, which would wipe what the caller
|
|
# passed in before ask_machine_role ever looked at it.
|
|
MACHINE_ROLE="${MACHINE_ROLE:-}"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Output
|
|
# -----------------------------------------------------------------------------
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
CYAN='\033[0;36m'
|
|
BOLD='\033[1m'
|
|
NC='\033[0m'
|
|
|
|
info() { echo -e "${CYAN}::${NC} $*"; }
|
|
ok() { echo -e " ${GREEN}OK${NC}: $*"; }
|
|
warn() { echo -e " ${YELLOW}WARN${NC}: $*"; }
|
|
fail() {
|
|
echo -e " ${RED}FAIL${NC}: $*"
|
|
exit 1
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Steps and resume
|
|
# -----------------------------------------------------------------------------
|
|
#
|
|
# A step announces itself, and is skipped when its name is already in the
|
|
# progress file. step_ok records it. The pattern at each call site is:
|
|
#
|
|
# step "Name"
|
|
# if ! skip; then
|
|
# …
|
|
# step_ok
|
|
# fi
|
|
|
|
step() {
|
|
CURRENT_STEP="$1"
|
|
if grep -qxF "$1" "$PROGRESS_FILE" 2>/dev/null; then
|
|
echo -e " ${GREEN}SKIP${NC}: $1 (already done)"
|
|
SKIP_STEP=true
|
|
return
|
|
fi
|
|
SKIP_STEP=false
|
|
echo ""
|
|
echo -e "${BOLD}── $1 ──${NC}"
|
|
}
|
|
|
|
skip() { [[ "$SKIP_STEP" == true ]]; }
|
|
|
|
step_ok() {
|
|
echo "$CURRENT_STEP" >>"$PROGRESS_FILE"
|
|
}
|
|
|
|
# Try a command, log error but don't exit
|
|
try() {
|
|
local label="$1"
|
|
shift
|
|
if "$@" 2>&1; then
|
|
ok "$label"
|
|
else
|
|
warn "$label — failed (non-critical, continuing)"
|
|
ERRORS+=("$label")
|
|
fi
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Input
|
|
# -----------------------------------------------------------------------------
|
|
|
|
prompt_value() {
|
|
local varname="$1" message="$2" default="$3"
|
|
# If env var already set, use it silently
|
|
if [[ -n "${!varname:-}" ]]; then
|
|
return
|
|
fi
|
|
local input
|
|
if [[ -n "$default" ]]; then
|
|
read -rp "$message [$default]: " input
|
|
eval "$varname=\"\${input:-$default}\""
|
|
else
|
|
read -rp "$message: " input
|
|
eval "$varname=\"\$input\""
|
|
fi
|
|
}
|
|
|
|
# Ask before acting. Every section that changes the machine goes through this, so
|
|
# a run is a sequence of things you agreed to rather than a wall of output you
|
|
# read afterwards to find out what happened.
|
|
#
|
|
# Enter means yes — unlike the machine-role question, which has no default. These
|
|
# are "do the thing you already asked for", and making twenty of them require a
|
|
# deliberate keystroke would train people to hold the y key down.
|
|
#
|
|
# ASSUME_YES=1 answers all of them, for an unattended run.
|
|
confirm() {
|
|
local message="${1:-Proceed?}" answer
|
|
[[ "${ASSUME_YES:-}" == "1" ]] && return 0
|
|
|
|
while true; do
|
|
# EOF is not a yes. Without this an unattended run without ASSUME_YES would
|
|
# spin here forever.
|
|
if ! read -rp " ${message} [Y/n]: " answer; then
|
|
echo ""
|
|
fail "No answer. Set ASSUME_YES=1 to run without prompts."
|
|
fi
|
|
case "$answer" in
|
|
"" | y | Y | yes | Yes) return 0 ;;
|
|
n | N | no | No) return 1 ;;
|
|
*) warn "Answer y or n." ;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
# Where Officer will live.
|
|
#
|
|
# Asked in pre-flight with the rest of the questions rather than at the point it
|
|
# is first needed, because it decides the shape of several later steps — the
|
|
# directory the repository is cloned into, where DATA_PATH sits beside it, and
|
|
# which filesystem the app store's containers bind-mount out of. Answering it
|
|
# once at the start also means the run can be described before it begins.
|
|
#
|
|
# One directory holding four, per docs/sidecar-app-store.md:
|
|
#
|
|
# <root>/platform/ the app
|
|
# <root>/data/ DATA_PATH
|
|
# <root>/dockers/ services the app store provisioned
|
|
# <root>/capabilities/ the file-based item store
|
|
#
|
|
# OFFICER_ROOT in the environment answers it ahead of time.
|
|
ask_officer_root() {
|
|
local default="${USER_HOME}/officerdev" answer
|
|
|
|
if [[ -n "${OFFICER_ROOT:-}" ]]; then
|
|
answer="$OFFICER_ROOT"
|
|
else
|
|
echo ""
|
|
info "Where should Officer be installed?"
|
|
echo " One directory holding the app, its data, the item store and any"
|
|
echo " containers the app store provisions — so it can be moved, backed"
|
|
echo " up or deleted as a unit."
|
|
echo ""
|
|
if ! read -rp " Path [${default}]: " answer; then
|
|
echo ""
|
|
fail "No answer. Set OFFICER_ROOT=<path> to answer this ahead of time."
|
|
fi
|
|
answer="${answer:-$default}"
|
|
fi
|
|
|
|
# A leading ~ arrives as a literal when it comes from a read or an environment
|
|
# variable — nothing expands it there — and would create a directory named "~".
|
|
answer="${answer/#\~/$USER_HOME}"
|
|
|
|
[[ "$answer" == /* ]] || fail "That needs to be an absolute path, starting with / — got '${answer}'"
|
|
|
|
OFFICER_ROOT="${answer%/}"
|
|
}
|
|
|
|
# Run a block as the created user (login shell, inherits HOME)
|
|
as_user() {
|
|
sudo -u "$USERNAME" -i bash -c "$1"
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# sudoers
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Grant an account passwordless sudo, safely.
|
|
#
|
|
# A malformed file in /etc/sudoers.d breaks sudo COMPLETELY — and you cannot sudo
|
|
# to repair it, so on a remote machine that is unrecoverable short of a rescue
|
|
# console. The same is true of one with loose permissions: sudo refuses to read
|
|
# its own configuration and every sudo on the box fails.
|
|
#
|
|
# The original wrote the file into /etc/sudoers.d first and validated it after,
|
|
# with a chmod later still. Both of those leave a window where a broken or
|
|
# world-readable sudoers file is live. This validates a temp file first and then
|
|
# places it with its mode in a single install(1) — so what lands in /etc is
|
|
# already known good and already 0440.
|
|
grant_passwordless_sudo() {
|
|
local user="$1" dest="/etc/sudoers.d/99-${user}-nopasswd" tmp
|
|
tmp="$(mktemp)"
|
|
|
|
echo "${user} ALL=(ALL) NOPASSWD: ALL" >"$tmp"
|
|
|
|
if ! visudo -c -f "$tmp" >/dev/null 2>&1; then
|
|
rm -f "$tmp"
|
|
fail "visudo rejected the sudoers entry for '${user}' — not installing it"
|
|
fi
|
|
|
|
install -m 0440 -o root -g root "$tmp" "$dest"
|
|
rm -f "$tmp"
|
|
}
|
|
|
|
has_passwordless_sudo() {
|
|
local user="$1"
|
|
[[ -f "/etc/sudoers.d/99-${user}-nopasswd" ]] ||
|
|
grep -rqsE "^${user}[[:space:]]+ALL=\(ALL\)[[:space:]]+NOPASSWD" /etc/sudoers /etc/sudoers.d 2>/dev/null
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Operating system detection
|
|
# -----------------------------------------------------------------------------
|
|
#
|
|
# Read one key out of /etc/os-release without leaking the rest of it into this
|
|
# script. That file defines NAME, VERSION and ID — all generic enough to collide
|
|
# with something here — so it is sourced in a subshell and only the one value
|
|
# asked for comes back.
|
|
os_release() {
|
|
[[ -r /etc/os-release ]] || return 1
|
|
# shellcheck disable=SC1091
|
|
(
|
|
. /etc/os-release 2>/dev/null
|
|
printf '%s' "${!1:-}"
|
|
)
|
|
}
|
|
|
|
# Identify the machine, or refuse to guess.
|
|
#
|
|
# /etc/os-release rather than probing for a binary: a box can have more than one
|
|
# package manager on PATH (a Homebrew install on Linux, a leftover apt on a
|
|
# converted box), and only os-release can say which distribution the machine
|
|
# actually IS, or give a version worth reporting.
|
|
#
|
|
# ID_LIKE is the fallback so derivatives resolve without being listed by name —
|
|
# Pop!_OS, Mint and EndeavourOS all answer correctly without appearing below.
|
|
detect_os() {
|
|
local kernel like
|
|
kernel="$(uname -s)"
|
|
|
|
case "$kernel" in
|
|
Darwin)
|
|
OS="macos"
|
|
OS_VERSION="$(sw_vers -productVersion 2>/dev/null || true)"
|
|
OS_NAME="macOS ${OS_VERSION}"
|
|
PM="brew"
|
|
;;
|
|
Linux)
|
|
OS="$(os_release ID || true)"
|
|
OS_NAME="$(os_release PRETTY_NAME || true)"
|
|
OS_VERSION="$(os_release VERSION_ID || true)"
|
|
like="$(os_release ID_LIKE || true)"
|
|
|
|
case "$OS" in
|
|
ubuntu | debian | linuxmint | pop | raspbian | elementary) PM="apt" ;;
|
|
arch | manjaro | endeavouros | cachyos | garuda) PM="pacman" ;;
|
|
fedora | rhel | centos | rocky | almalinux) PM="dnf" ;;
|
|
*)
|
|
case " $like " in
|
|
*" debian "* | *" ubuntu "*) PM="apt" ;;
|
|
*" arch "*) PM="pacman" ;;
|
|
*" fedora "* | *" rhel "*) PM="dnf" ;;
|
|
esac
|
|
;;
|
|
esac
|
|
|
|
# WSL reports itself as Linux, but has no real systemd session: masking
|
|
# sleep targets, restarting logind and anything touching the boot path
|
|
# either fail or silently do nothing. Worth knowing before those steps run.
|
|
if grep -qi microsoft /proc/version 2>/dev/null; then IS_WSL=true; fi
|
|
;;
|
|
MINGW* | MSYS* | CYGWIN*)
|
|
fail "Windows is not supported. Run this inside WSL2 with an Ubuntu image instead."
|
|
;;
|
|
*)
|
|
fail "Unrecognised kernel '$kernel' — cannot tell what this machine is."
|
|
;;
|
|
esac
|
|
|
|
# Normalised once here because upstream projects spell it differently:
|
|
# Neovim ships aarch64, Go and Docker ship arm64, and lazygit ships x86_64.
|
|
case "$(uname -m)" in
|
|
x86_64 | amd64) ARCH="amd64" ;;
|
|
aarch64 | arm64) ARCH="arm64" ;;
|
|
*) fail "Unsupported CPU architecture '$(uname -m)' — this script installs amd64/arm64 binaries only." ;;
|
|
esac
|
|
|
|
[[ -n "$OS" ]] || fail "Could not identify this distribution (no readable /etc/os-release)."
|
|
[[ -n "$OS_NAME" ]] || OS_NAME="$OS${OS_VERSION:+ $OS_VERSION}"
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Machine role
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# The interface packets actually leave by, which is not always the first one up.
|
|
default_iface() {
|
|
ip route get 8.8.8.8 2>/dev/null | awk '{for (i = 1; i <= NF; i++) if ($i == "dev") {print $(i + 1); exit}}'
|
|
}
|
|
|
|
# Ask what this machine is, unless the environment already said.
|
|
#
|
|
# Asked in pre-flight rather than at the point of use so that the run knows its
|
|
# own shape before it starts: the steps that care are spread from swap through to
|
|
# the firewall, and being asked "is this a VPS?" for the fourth time halfway down
|
|
# a provisioning run is how people start answering without reading.
|
|
#
|
|
# NO DEFAULT, deliberately, and it is the only question in the script like that.
|
|
# A guessed default is right often enough to be trusted and wrong in exactly the
|
|
# case that costs the most: pinning a static IP on a rented box, or leaving the
|
|
# firewall open on one. Every branch downstream is about what this machine is
|
|
# exposed to, so it is worth one deliberate keystroke rather than an Enter.
|
|
ask_machine_role() {
|
|
if [[ -n "$MACHINE_ROLE" ]]; then
|
|
case "$MACHINE_ROLE" in
|
|
homelab | vps | dev) return ;;
|
|
*) fail "MACHINE_ROLE must be homelab, vps or dev — got '$MACHINE_ROLE'" ;;
|
|
esac
|
|
fi
|
|
|
|
echo ""
|
|
info "What is this machine? Several later steps depend on the answer."
|
|
echo " [1] homelab — yours, on a network you control"
|
|
echo " [2] vps — rented, public IP, provider's DHCP and console"
|
|
echo " [3] dev — a laptop or desktop you sit at"
|
|
echo ""
|
|
|
|
local choice
|
|
while [[ -z "$MACHINE_ROLE" ]]; do
|
|
# A failed read means EOF, not a wrong answer — without this the loop would
|
|
# spin forever when stdin is closed, which is how an unattended run hangs.
|
|
if ! read -rp " Which one? (1/2/3): " choice; then
|
|
fail "No answer, and this question has no default. Set MACHINE_ROLE=homelab|vps|dev to answer it ahead of time."
|
|
fi
|
|
case "$choice" in
|
|
1 | homelab) MACHINE_ROLE=homelab ;;
|
|
2 | vps) MACHINE_ROLE=vps ;;
|
|
3 | dev) MACHINE_ROLE=dev ;;
|
|
"") warn "There is no default here — pick 1, 2 or 3." ;;
|
|
*) warn "Not one of the options: '$choice'" ;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
# Convenience for the steps that branch on it.
|
|
is_role() { [[ "$MACHINE_ROLE" == "$1" ]]; }
|
|
is_server() { [[ "$MACHINE_ROLE" == "homelab" || "$MACHINE_ROLE" == "vps" ]]; }
|