platform-admin/bootstrap-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(host): add guarded Debian baseline and SSH transactions

Browse Source
This commit is contained in:
kaka
2026-11-04 16:55:00 +08:00
parent 62ef4b458c
commit 873933af35
6 changed files with 471 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
host-init.sh
View File

@@ -5,7 +5,7 @@ export LC_ALL=C
fail() { printf 'ERROR: %s\n' "$*" >&2; return 1; }
ensure_baseline_packages() {
local package missing=()
for package in ca-certificates curl jq git openssl openssh-client iproute2 nftables; do
for package in ca-certificates curl jq git openssl openssh-client openssh-server iproute2 nftables procps kmod util-linux; do
if [[ $(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null) != installed ]]; then
missing+=("$package")
fi
@@ -27,10 +27,11 @@ check_existing_binding() {
[[ "$bound" == "$expected" ]] || { fail 'Existing bootstrap binding belongs to another hostname'; return 1; }
}
main() {
local action='' name='' packages='' public_key='' argument
local action='' name='' packages='' public_key='' argument docker_mode=required
while (($#)); do
case "$1" in
--help|-h) echo 'Usage: bash host-init.sh --check|--apply --hostname NAME [--docker-dir VERIFIED_DEB_DIRECTORY] [--ssh-key-file SHARED_PUBLIC_KEY]'; return 0;;
--help|-h) echo 'Usage: bash host-init.sh --check|--apply --hostname NAME [--docker-dir VERIFIED_DEB_DIRECTORY] [--ssh-key-file SHARED_PUBLIC_KEY] [--without-docker]'; return 0;;
--without-docker) docker_mode=none; shift;;
--check|--apply) [[ -z "$action" ]] || return 1; action=$1; shift;;
--hostname|--docker-dir|--ssh-key-file)
(($# >= 2)) || return 1
@@ -46,6 +47,7 @@ main() {
grep -Eq '^ID="?debian"?$' /etc/os-release && grep -Eq '^VERSION_ID="?13"?$' /etc/os-release || { fail 'Debian 13 required; upgrade is a separate human-run task'; return 1; }
check_existing_binding /var/lib/platform-bootstrap "$name"
local debs=() file package version architecture installed seen=' ' sha extra
[[ "$docker_mode" != none || -z "$packages" ]] || { fail 'Docker directory conflicts with --without-docker'; return 1; }
if [[ -n "$packages" ]]; then
[[ "$packages" == /* && -d "$packages" && ! -L "$packages" && -f "$packages/SHA256SUMS" && ! -L "$packages/SHA256SUMS" ]] || { fail 'Prepared package directory and manifest required'; return 1; }
while read -r sha file extra; do
@@ -60,7 +62,7 @@ main() {
debs+=("$packages/$file")
done < "$packages/SHA256SUMS"
[[ ${#debs[@]} == 5 ]] || { fail 'All five pinned official Docker packages required'; return 1; }
else
elif [[ "$docker_mode" == required ]]; then
command -v docker >/dev/null && docker compose version >/dev/null || { fail 'Prepare the five pinned Docker DEBs through our resource publication first'; return 1; }
fi
if [[ -n "$public_key" ]]; then
@@ -81,10 +83,12 @@ main() {
touch /root/.ssh/authorized_keys; chmod 0600 /root/.ssh/authorized_keys
if ! grep -Fqx -- "$(cat "$public_key")" /root/.ssh/authorized_keys; then printf '\n' >> /root/.ssh/authorized_keys; cat "$public_key" >> /root/.ssh/authorized_keys; fi
fi
systemctl enable --now docker
docker --host unix:///var/run/docker.sock info >/dev/null
docker --host unix:///var/run/docker.sock compose version
if [[ "$docker_mode" == required ]]; then
systemctl enable --now docker
docker --host unix:///var/run/docker.sock info >/dev/null
docker --host unix:///var/run/docker.sock compose version
fi
[[ $(hostname) == "$name" ]]
echo 'Baseline and local Docker checked. Verify a fresh SSH connection; firewall/SSH port and network acceptance are separate tasks.'
echo 'Prerequisites prepared; full host baseline NOT verified. Continue host-baseline.sh and the SSH/firewall transaction; verify a fresh external SSH connection.'
}
if [[ ${BASH_SOURCE[0]:-} == "$0" || -z ${BASH_SOURCE[0]:-} ]]; then main "$@"; fi