166 lines
4.6 KiB
Bash
166 lines
4.6 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
config=/etc/remotedesk-edge/edge.env
|
|
start_service=false
|
|
force=false
|
|
public_relay_address=
|
|
pop_id=
|
|
region=
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: remotedesk-edge-setup --public-relay-address HOST:PORT --pop-id ID --region ID [options]
|
|
|
|
Options:
|
|
--config PATH Write a different environment file
|
|
--start Enable and start remotedesk-edge.service after setup
|
|
--force Replace an already configured environment file
|
|
-h, --help Show this help
|
|
EOF
|
|
}
|
|
|
|
while [ "$#" -gt 0 ]; do
|
|
case "$1" in
|
|
--public-relay-address)
|
|
[ "$#" -ge 2 ] || { usage >&2; exit 2; }
|
|
public_relay_address=$2
|
|
shift 2
|
|
;;
|
|
--pop-id)
|
|
[ "$#" -ge 2 ] || { usage >&2; exit 2; }
|
|
pop_id=$2
|
|
shift 2
|
|
;;
|
|
--region)
|
|
[ "$#" -ge 2 ] || { usage >&2; exit 2; }
|
|
region=$2
|
|
shift 2
|
|
;;
|
|
--config)
|
|
[ "$#" -ge 2 ] || { usage >&2; exit 2; }
|
|
config=$2
|
|
shift 2
|
|
;;
|
|
--start)
|
|
start_service=true
|
|
shift
|
|
;;
|
|
--force)
|
|
force=true
|
|
shift
|
|
;;
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Unknown argument: $1" >&2
|
|
usage >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "remotedesk-edge-setup must run as root" >&2
|
|
exit 1
|
|
fi
|
|
if ! getent group remotedesk-edge >/dev/null 2>&1; then
|
|
echo "the remotedesk-edge service account is missing; install the Edge package first" >&2
|
|
exit 1
|
|
fi
|
|
|
|
valid_identifier() {
|
|
value=$1
|
|
maximum=$2
|
|
[ -n "$value" ] && [ "${#value}" -le "$maximum" ] &&
|
|
! printf '%s' "$value" | grep -q '[^A-Za-z0-9._-]'
|
|
}
|
|
|
|
if ! valid_identifier "$pop_id" 128; then
|
|
echo "--pop-id must use 1-128 ASCII letters, digits, dot, underscore, or hyphen" >&2
|
|
exit 2
|
|
fi
|
|
if ! valid_identifier "$region" 64; then
|
|
echo "--region must use 1-64 ASCII letters, digits, dot, underscore, or hyphen" >&2
|
|
exit 2
|
|
fi
|
|
case "$public_relay_address" in
|
|
\[*\]:*)
|
|
relay_host=${public_relay_address%:*}
|
|
relay_host=${relay_host#\[}
|
|
relay_host=${relay_host%\]}
|
|
relay_port=${public_relay_address##*:}
|
|
if [ -z "$relay_host" ] || printf '%s' "$relay_host" | grep -q '[^A-Fa-f0-9:.]'; then
|
|
echo "--public-relay-address contains an invalid IPv6 host" >&2
|
|
exit 2
|
|
fi
|
|
;;
|
|
*:*)
|
|
relay_host=${public_relay_address%:*}
|
|
relay_port=${public_relay_address##*:}
|
|
if [ -z "$relay_host" ] || printf '%s' "$relay_host" | grep -q '[^A-Za-z0-9._-]'; then
|
|
echo "--public-relay-address contains an invalid host" >&2
|
|
exit 2
|
|
fi
|
|
;;
|
|
*)
|
|
echo "--public-relay-address must include a port" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
case "$relay_port" in
|
|
''|*[!0-9]*)
|
|
echo "--public-relay-address must include a numeric port" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
if [ "${#relay_port}" -gt 5 ] || [ "$relay_port" -lt 1 ] || [ "$relay_port" -gt 65535 ]; then
|
|
echo "--public-relay-address port must be between 1 and 65535" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if [ -f "$config" ] && grep -Eq '^REMOTEDESK_EDGE_(API_TOKEN|PRESENCE_TOKEN|TICKET_SECRET)=.{32,}$' "$config"; then
|
|
if [ "$force" != true ]; then
|
|
echo "$config already contains Edge credentials; use --force to rotate them" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
config_dir=$(dirname -- "$config")
|
|
install -d -m 0750 -o root -g remotedesk-edge "$config_dir"
|
|
temporary=$(mktemp "$config_dir/.edge.env.XXXXXX")
|
|
trap 'rm -f -- "$temporary"' EXIT HUP INT TERM
|
|
|
|
random_secret() {
|
|
od -An -N48 -tx1 /dev/urandom | tr -d ' \n'
|
|
}
|
|
|
|
umask 0077
|
|
api_token=$(random_secret)
|
|
presence_token=$(random_secret)
|
|
ticket_secret=$(random_secret)
|
|
cat >"$temporary" <<EOF
|
|
REMOTEDESK_EDGE_API_TOKEN=$api_token
|
|
REMOTEDESK_EDGE_PRESENCE_TOKEN=$presence_token
|
|
REMOTEDESK_EDGE_TICKET_SECRET=$ticket_secret
|
|
REMOTEDESK_EDGE_PUBLIC_RELAY_ADDRESS=$public_relay_address
|
|
REMOTEDESK_EDGE_POP_ID=$pop_id
|
|
REMOTEDESK_EDGE_REGION=$region
|
|
EOF
|
|
chown root:remotedesk-edge "$temporary"
|
|
chmod 0640 "$temporary"
|
|
mv -f -- "$temporary" "$config"
|
|
trap - EXIT HUP INT TERM
|
|
|
|
echo "RemoteDesk Edge configuration written to $config"
|
|
echo "Publish the API with HTTPS and the relay with TLS before distributing client settings."
|
|
echo "Agents need REMOTEDESK_EDGE_API_URL plus REMOTEDESK_EDGE_PRESENCE_TOKEN from this file."
|
|
|
|
if [ "$start_service" = true ]; then
|
|
systemctl daemon-reload
|
|
systemctl enable --now remotedesk-edge.service
|
|
echo "remotedesk-edge.service is running"
|
|
fi
|