patrickandClaude Sonnet 5.5
15676a3600
deploy/lib/preflight.sh prüft Python, venv, Platz, Betriebssystem, Umgebung (VM/Container), pypi und optional Checkmk/Ollama per TCP. first-run.sh und setup-lxc.sh rufen ihn auf (--skip-preflight, --preflight-only). LXC-Teile nur bei erkanntem Container; Texte neutral; README um VM-Abschnitt ergänzt. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
116 lines
4.4 KiB
Bash
116 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Caddy installieren und Caddyfile aus der Vorlage rendern (wird von setup-lxc.sh gesourced).
|
|
|
|
CADDY_KEY_URL=https://dl.cloudsmith.io/public/caddy/stable/gpg.key
|
|
CADDY_KEYRING=/usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
CADDY_REPO_LIST=/etc/apt/sources.list.d/caddy-stable.list
|
|
CADDY_REPO_LINE="deb [signed-by=$CADDY_KEYRING] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main"
|
|
CADDY_CONFIG=/etc/caddy/Caddyfile
|
|
CADDY_CERT_DIR=/etc/caddy/certs
|
|
CADDY_CERT_FILE=$CADDY_CERT_DIR/checkbot.crt
|
|
CADDY_CERT_KEY=$CADDY_CERT_DIR/checkbot.key
|
|
CADDY_GROUP=caddy
|
|
CADDYFILE_TEMPLATE=$DEPLOY_DIR/Caddyfile.template
|
|
CADDY_MANUAL_HINT="Manuell: https://caddyserver.com/docs/install#debian-ubuntu-raspbian ausführen, danach setup-lxc.sh erneut starten."
|
|
|
|
apt_install() {
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
|
|
}
|
|
|
|
caddy_candidate() {
|
|
apt-cache policy caddy 2>/dev/null | awk '/Candidate:/ {print $2}'
|
|
}
|
|
|
|
install_caddy_official_repo() {
|
|
local tmp fprs fpr expected
|
|
apt_install gnupg || return 1
|
|
tmp=$(mktemp) || return 1
|
|
curl -fsSL --proto '=https' --tlsv1.2 "$CADDY_KEY_URL" -o "$tmp" || { rm -f "$tmp"; return 1; }
|
|
fprs=$(gpg --batch --show-keys --with-colons "$tmp" 2>/dev/null | awk -F: '$1 == "fpr" {print $10}')
|
|
if [[ -z $fprs ]]; then rm -f "$tmp"; return 1; fi
|
|
if [[ -n ${CHECKBOT_CADDY_KEY_FPR:-} ]]; then
|
|
expected=$(printf '%s' "$CHECKBOT_CADDY_KEY_FPR" | tr -d ' ' | tr '[:lower:]' '[:upper:]')
|
|
if ! grep -qx "$expected" <<<"$fprs"; then
|
|
warn "Fingerabdruck des Caddy-Schlüssels stimmt nicht mit CHECKBOT_CADDY_KEY_FPR überein."
|
|
rm -f "$tmp"
|
|
return 1
|
|
fi
|
|
else
|
|
for fpr in $fprs; do log "Caddy-Repo-Schlüssel Fingerabdruck: $fpr (gegen die Caddy-Doku prüfen oder CHECKBOT_CADDY_KEY_FPR setzen)."; done
|
|
fi
|
|
gpg --batch --yes --dearmor -o "$CADDY_KEYRING" "$tmp" || { rm -f "$tmp"; return 1; }
|
|
rm -f "$tmp"
|
|
chmod 0644 "$CADDY_KEYRING"
|
|
printf '%s\n' "$CADDY_REPO_LINE" > "$CADDY_REPO_LIST"
|
|
apt-get update -qq || return 1
|
|
apt_install caddy || return 1
|
|
}
|
|
|
|
ensure_caddy() {
|
|
local candidate
|
|
if command -v caddy >/dev/null 2>&1; then
|
|
return 0
|
|
fi
|
|
candidate=$(caddy_candidate)
|
|
if [[ -n $candidate && $candidate != "(none)" ]]; then
|
|
log "Installiere Caddy aus dem Distributions-Repository."
|
|
apt_install caddy || die "Installation von Caddy fehlgeschlagen. $CADDY_MANUAL_HINT"
|
|
return 0
|
|
fi
|
|
log "Caddy ist im Distributions-Repository nicht verfügbar, richte das offizielle Caddy-Repository ein."
|
|
install_caddy_official_repo || die "Caddy konnte nicht installiert werden. $CADDY_MANUAL_HINT"
|
|
}
|
|
|
|
install_tls_files() {
|
|
local src_cert=$1 src_key=$2
|
|
install -d -m 0750 -o root -g "$CADDY_GROUP" "$CADDY_CERT_DIR"
|
|
if [[ $(realpath "$src_cert") != "$(realpath -m "$CADDY_CERT_FILE")" ]]; then
|
|
install -m 0644 -o root -g root "$src_cert" "$CADDY_CERT_FILE"
|
|
fi
|
|
if [[ $(realpath "$src_key") != "$(realpath -m "$CADDY_CERT_KEY")" ]]; then
|
|
install -m 0640 -o root -g "$CADDY_GROUP" "$src_key" "$CADDY_CERT_KEY"
|
|
fi
|
|
}
|
|
|
|
render_caddyfile() {
|
|
local fqdn=$1 tls_mode=$2 monitor_ips=$3 upstream=$4 content tls_directive
|
|
case $tls_mode in
|
|
internal) tls_directive="tls internal" ;;
|
|
files) tls_directive="tls $CADDY_CERT_FILE $CADDY_CERT_KEY" ;;
|
|
*) die "Unbekannter TLS-Modus: $tls_mode" ;;
|
|
esac
|
|
content=$(cat "$CADDYFILE_TEMPLATE")
|
|
content=${content//@@FQDN@@/$fqdn}
|
|
content=${content//@@TLS_DIRECTIVE@@/$tls_directive}
|
|
content=${content//@@HEALTH_IPS@@/$monitor_ips}
|
|
content=${content//@@UPSTREAM@@/$upstream}
|
|
if grep -q '@@' <<<"$content"; then
|
|
die "Caddyfile-Vorlage enthält nicht ersetzte Platzhalter."
|
|
fi
|
|
printf '%s\n' "$content"
|
|
}
|
|
|
|
apply_caddyfile() {
|
|
local rendered=$1 tmp backup=""
|
|
tmp=$(mktemp)
|
|
printf '%s' "$rendered" > "$tmp"
|
|
if [[ -f $CADDY_CONFIG ]] && cmp -s "$tmp" "$CADDY_CONFIG"; then
|
|
rm -f "$tmp"
|
|
log "Caddyfile unverändert."
|
|
else
|
|
if [[ -f $CADDY_CONFIG ]]; then
|
|
backup=$CADDY_CONFIG.bak
|
|
cp -p "$CADDY_CONFIG" "$backup"
|
|
fi
|
|
install -m 0644 -o root -g root "$tmp" "$CADDY_CONFIG"
|
|
rm -f "$tmp"
|
|
fi
|
|
systemctl enable caddy >/dev/null 2>&1 || true
|
|
if ! systemctl reload-or-restart caddy; then
|
|
if [[ -n $backup ]]; then
|
|
cp -p "$backup" "$CADDY_CONFIG"
|
|
fi
|
|
die "Caddy konnte die neue Konfiguration nicht laden (alte Datei wiederhergestellt). journalctl -u caddy -n 50 --no-pager"
|
|
fi
|
|
}
|