kitadmin
14d46d96a4
SPK daemon fixes (x5925 testing feedback): - register_with_hub: added --max-time 15 to prevent indefinite hang - Removed bash 'local' keyword for busybox ash compatibility - postinst: mkdir -p /usr/local/bin before copying Tailscale binaries - postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug) - Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed) Hub security hardening: - Added POST /api/authorize-key endpoint with device_id + pubkey - Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>" - No shell access allowed — only tunnel forwarding to assigned port - Server.py updated with input validation on key format - register.sh --authorize-key subcommand for secure key management GL daemon: same --max-time fix applied for curl timeout Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
54 lines
2.2 KiB
Bash
Executable File
54 lines
2.2 KiB
Bash
Executable File
#!/bin/sh
|
|
# kit-connect postinst — run setup wizard, register with hub, set up config.
|
|
# Idempotent — safe to run on upgrades too.
|
|
|
|
PKG_DIR="/var/packages/kit-connect/target"
|
|
LOG_TAG="kit-connect"
|
|
|
|
log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
|
|
|
|
mkdir -p /etc/kit-connect /etc/busrouter "$PKG_DIR/var"
|
|
|
|
# ── Fix permissions (synopkg doesn't preserve +x from tar) ──────
|
|
chmod +x "$PKG_DIR/bin/"*.sh 2>/dev/null || true
|
|
chmod +x "$PKG_DIR/bin/tailscale" "$PKG_DIR/bin/tailscaled" 2>/dev/null || true
|
|
chmod +x "$PKG_DIR/wizard.sh" 2>/dev/null || true
|
|
chmod 600 "$PKG_DIR/bin/connect_id_ed25519" 2>/dev/null || true
|
|
|
|
# ── Install bundled Tailscale binaries if system doesn't have them ──
|
|
# SRM doesn't have /usr/local/bin by default — create it first.
|
|
mkdir -p /usr/local/bin
|
|
if [ ! -f /usr/local/bin/tailscale ] && [ -f "$PKG_DIR/bin/tailscale" ]; then
|
|
log "Installing bundled Tailscale binaries (1.98.9 ARM)..."
|
|
cp "$PKG_DIR/bin/tailscale" /usr/local/bin/tailscale
|
|
cp "$PKG_DIR/bin/tailscaled" /usr/local/bin/tailscaled
|
|
chmod +x /usr/local/bin/tailscale /usr/local/bin/tailscaled
|
|
log "Tailscale binaries installed to /usr/local/bin"
|
|
elif [ -f /usr/local/bin/tailscale ]; then
|
|
log "Tailscale already present at /usr/local/bin/tailscale"
|
|
fi
|
|
|
|
# Run the Keylink IT setup wizard (non-interactive)
|
|
# This detects device ID, writes config, registers with hub, starts Tailscale.
|
|
if [ -x "$PKG_DIR/wizard.sh" ]; then
|
|
log "Running Keylink IT fleet setup wizard..."
|
|
"$PKG_DIR/wizard.sh" --auto 2>&1 | while read -r line; do log "$line"; done
|
|
else
|
|
# Fallback: minimal config
|
|
DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname 2>/dev/null || echo "unknown")
|
|
echo "$DEVICE_ID" > /etc/busrouter/device-id
|
|
|
|
CONF="/etc/kit-connect/connect.conf"
|
|
if [ ! -f "$CONF" ]; then
|
|
cp "$PKG_DIR/conf/connect.conf" "$CONF" 2>/dev/null || touch "$CONF"
|
|
fi
|
|
sed -i "s/^DEVICE_ID=.*/DEVICE_ID=${DEVICE_ID}/" "$CONF" 2>/dev/null
|
|
sed -i "s/^TAILSCALE_HOSTNAME=.*/TAILSCALE_HOSTNAME=${DEVICE_ID}/" "$CONF" 2>/dev/null
|
|
|
|
# Try hub registration
|
|
curl -s --connect-timeout 10 "http://162.243.83.36:8080/api/register/${DEVICE_ID}" 2>/dev/null || true
|
|
fi
|
|
|
|
log "postinst complete — device_id=$(cat /etc/busrouter/device-id 2>/dev/null || echo unknown)"
|
|
exit 0
|