Initial LisgloSIPS V2 implementation
This commit is contained in:
hectorzhao
Executable
+187
@@ -0,0 +1,187 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
: "${HOMER_DB_PASSWORD:?missing HOMER_DB_PASSWORD}"
|
||||
: "${HOMER_UI_PASSWORD:?missing HOMER_UI_PASSWORD}"
|
||||
: "${HOMER_JWT_SECRET:?missing HOMER_JWT_SECRET}"
|
||||
: "${GRAFANA_ADMIN_PASSWORD:?missing GRAFANA_ADMIN_PASSWORD}"
|
||||
: "${MYSQL_EXPORTER_PASSWORD:?missing MYSQL_EXPORTER_PASSWORD}"
|
||||
: "${REDIS_EXPORTER_PASSWORD:?missing REDIS_EXPORTER_PASSWORD}"
|
||||
: "${POSTGRES_EXPORTER_PASSWORD:?missing POSTGRES_EXPORTER_PASSWORD}"
|
||||
|
||||
STAGE=${STAGE:-/tmp/lisglosips-s06-stage-202606202230}
|
||||
BUILD=/var/tmp/lisglosips-s06-go-20260620/bin
|
||||
HOMER_SOURCE=/var/tmp/lisglosips-s06-go-20260620/pkg/mod/github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0
|
||||
|
||||
test -d "$STAGE/systemd"
|
||||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
systemctl mask prometheus-postgres-exporter.service 2>/dev/null || true
|
||||
apt-get install -y prometheus-postgres-exporter=0.15.0-1ubuntu0.3
|
||||
apt-mark hold prometheus-postgres-exporter >/dev/null
|
||||
|
||||
for account in homer heplify redis-exporter; do
|
||||
if ! getent passwd "$account" >/dev/null; then
|
||||
useradd --system --home-dir /nonexistent --no-create-home --shell /usr/sbin/nologin "$account"
|
||||
fi
|
||||
done
|
||||
|
||||
install -o root -g root -m 0755 "$BUILD/heplify-server" /usr/local/bin/heplify-server
|
||||
install -o root -g root -m 0755 "$BUILD/homer-app" /usr/local/bin/homer-app
|
||||
install -o root -g root -m 0755 "$BUILD/redis_exporter" /usr/local/bin/redis_exporter
|
||||
install -o root -g root -m 0644 "$STAGE/versions.env" /etc/lisglosips/monitoring-versions.env
|
||||
|
||||
systemctl stop postgresql.service
|
||||
chown root:postgres /data/homer
|
||||
chmod 0750 /data/homer
|
||||
install -d -o postgres -g postgres -m 0700 /data/homer/postgresql
|
||||
if [ -z "$(find /data/homer/postgresql -mindepth 1 -maxdepth 1 -print -quit)" ]; then
|
||||
rsync -aHAX /var/lib/postgresql/16/main/ /data/homer/postgresql/
|
||||
fi
|
||||
chown -R postgres:postgres /data/homer/postgresql
|
||||
chmod 0700 /data/homer/postgresql
|
||||
install -d -o root -g postgres -m 0750 /etc/postgresql/16/main/conf.d
|
||||
install -o root -g postgres -m 0640 "$STAGE/postgresql/lisglosips-homer.conf" /etc/postgresql/16/main/conf.d/lisglosips-homer.conf
|
||||
grep -Eq "^[[:space:]]*include_dir[[:space:]]*=[[:space:]]*'conf.d'" /etc/postgresql/16/main/postgresql.conf
|
||||
systemctl start postgresql.service
|
||||
pg_isready -h 127.0.0.1 -p 5432
|
||||
|
||||
runuser -u postgres -- psql -v ON_ERROR_STOP=1 -v homer_pw="$HOMER_DB_PASSWORD" -v exporter_pw="$POSTGRES_EXPORTER_PASSWORD" <<'SQL'
|
||||
SELECT format('CREATE ROLE homer_user LOGIN PASSWORD %L', :'homer_pw')
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'homer_user') \gexec
|
||||
SELECT format('ALTER ROLE homer_user LOGIN PASSWORD %L', :'homer_pw') \gexec
|
||||
SELECT 'CREATE DATABASE homer_config OWNER homer_user'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_config') \gexec
|
||||
SELECT 'CREATE DATABASE homer_data OWNER homer_user'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_data') \gexec
|
||||
SELECT format('CREATE ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw')
|
||||
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'postgres_exporter') \gexec
|
||||
SELECT format('ALTER ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw') \gexec
|
||||
GRANT pg_monitor TO postgres_exporter;
|
||||
SQL
|
||||
|
||||
mysql --protocol=socket <<SQL
|
||||
CREATE USER IF NOT EXISTS 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
|
||||
ALTER USER 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
|
||||
GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'mysqld_exporter'@'127.0.0.1';
|
||||
GRANT SELECT ON performance_schema.* TO 'mysqld_exporter'@'127.0.0.1';
|
||||
FLUSH PRIVILEGES;
|
||||
SQL
|
||||
|
||||
sed -i '/^user redis_exporter /d' /etc/redis/users.acl
|
||||
printf 'user redis_exporter on >%s ~* -@all +ping +info +client +config|get +latency +memory +select +slowlog +scan +type +strlen +llen +scard +zcard +xlen +hscan +sscan +zscan +get\n' "$REDIS_EXPORTER_PASSWORD" >>/etc/redis/users.acl
|
||||
chown root:redis /etc/redis/users.acl
|
||||
chmod 0640 /etc/redis/users.acl
|
||||
systemctl restart redis-server.service
|
||||
|
||||
install -d -o root -g root -m 0755 /etc/lisglosips/secrets
|
||||
sed "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" "$STAGE/heplify/heplify.env.example" >/etc/lisglosips/secrets/heplify.env
|
||||
chown root:heplify /etc/lisglosips/secrets/heplify.env
|
||||
chmod 0640 /etc/lisglosips/secrets/heplify.env
|
||||
|
||||
cat >/etc/lisglosips/secrets/grafana.env <<EOF
|
||||
GF_SECURITY_ADMIN_USER=admin
|
||||
GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
|
||||
GF_USERS_ALLOW_SIGN_UP=false
|
||||
GF_AUTH_ANONYMOUS_ENABLED=false
|
||||
GF_SERVER_HTTP_ADDR=127.0.0.1
|
||||
GF_SERVER_HTTP_PORT=3001
|
||||
GF_SERVER_DOMAIN=grafana.lisglosips.local
|
||||
GF_SERVER_ROOT_URL=https://grafana.lisglosips.local/
|
||||
GF_SECURITY_COOKIE_SECURE=true
|
||||
GF_SECURITY_COOKIE_SAMESITE=strict
|
||||
GF_SECURITY_DISABLE_GRAVATAR=true
|
||||
GF_ANALYTICS_REPORTING_ENABLED=false
|
||||
GF_ANALYTICS_CHECK_FOR_UPDATES=false
|
||||
GF_PLUGINS_PREINSTALL_DISABLED=true
|
||||
GF_PLUGINS_CHECK_FOR_PLUGIN_UPDATES=false
|
||||
GF_PLUGINS_PLUGIN_ADMIN_ENABLED=false
|
||||
HOMER_DB_PASSWORD=$HOMER_DB_PASSWORD
|
||||
EOF
|
||||
chown root:grafana /etc/lisglosips/secrets/grafana.env
|
||||
chmod 0640 /etc/lisglosips/secrets/grafana.env
|
||||
|
||||
cat >/etc/prometheus/mysqld-exporter.cnf <<EOF
|
||||
[client]
|
||||
user=mysqld_exporter
|
||||
password=$MYSQL_EXPORTER_PASSWORD
|
||||
host=127.0.0.1
|
||||
port=3306
|
||||
EOF
|
||||
chown root:prometheus /etc/prometheus/mysqld-exporter.cnf
|
||||
chmod 0640 /etc/prometheus/mysqld-exporter.cnf
|
||||
|
||||
cat >/etc/lisglosips/secrets/postgres-exporter.env <<EOF
|
||||
DATA_SOURCE_NAME=postgresql://postgres_exporter:$POSTGRES_EXPORTER_PASSWORD@127.0.0.1:5432/postgres?sslmode=disable
|
||||
EOF
|
||||
chown root:prometheus /etc/lisglosips/secrets/postgres-exporter.env
|
||||
chmod 0640 /etc/lisglosips/secrets/postgres-exporter.env
|
||||
|
||||
cat >/etc/lisglosips/secrets/redis-exporter.env <<EOF
|
||||
REDIS_ADDR=redis://127.0.0.1:6379
|
||||
REDIS_USER=redis_exporter
|
||||
REDIS_PASSWORD=$REDIS_EXPORTER_PASSWORD
|
||||
REDIS_EXPORTER_WEB_LISTEN_ADDRESS=127.0.0.1:9121
|
||||
EOF
|
||||
chown root:redis-exporter /etc/lisglosips/secrets/redis-exporter.env
|
||||
chmod 0640 /etc/lisglosips/secrets/redis-exporter.env
|
||||
|
||||
install -d -o root -g homer -m 0750 /etc/homer
|
||||
sed -e "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" -e "s/<HOMER_JWT_SECRET>/$HOMER_JWT_SECRET/g" "$STAGE/homer/webapp_config.json.example" >/etc/homer/webapp_config.json
|
||||
install -o root -g homer -m 0640 "$HOMER_SOURCE/swagger.json" /etc/homer/swagger.json
|
||||
chown homer:homer /etc/homer/webapp_config.json
|
||||
chmod 0600 /etc/homer/webapp_config.json
|
||||
install -d -o root -g homer -m 0750 /usr/local/homer/dist
|
||||
install -o root -g homer -m 0640 "$STAGE/homer/index.html" /usr/local/homer/dist/index.html
|
||||
install -d -o homer -g homer -m 0750 /var/log/homer
|
||||
|
||||
install -d -o prometheus -g prometheus -m 0750 /data/prometheus
|
||||
install -d -o root -g prometheus -m 0750 /etc/prometheus/rules
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.yml" /etc/prometheus/prometheus.yml
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/rules/lisglosips.yml" /etc/prometheus/rules/lisglosips.yml
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.env" /etc/default/lisglosips-prometheus
|
||||
install -o root -g prometheus -m 0640 "$STAGE/prometheus/node-exporter-b.env" /etc/default/lisglosips-node-exporter
|
||||
promtool check config /etc/prometheus/prometheus.yml
|
||||
promtool check rules /etc/prometheus/rules/lisglosips.yml
|
||||
|
||||
install -d -o grafana -g grafana -m 0750 /data/grafana /data/grafana/plugins
|
||||
install -o root -g root -m 0644 "$STAGE/grafana/grafana-server.default" /etc/default/grafana-server
|
||||
install -d -o root -g grafana -m 0750 /etc/grafana/provisioning/datasources /etc/grafana/provisioning/dashboards /etc/grafana/provisioning/dashboards/lisglosips
|
||||
install -o root -g grafana -m 0640 "$STAGE/grafana/datasources.yml" /etc/grafana/provisioning/datasources/lisglosips.yml
|
||||
install -o root -g grafana -m 0640 "$STAGE/grafana/dashboards.yml" /etc/grafana/provisioning/dashboards/lisglosips.yml
|
||||
install -o root -g grafana -m 0640 "$STAGE/grafana/lisglosips-overview.json" /etc/grafana/provisioning/dashboards/lisglosips/lisglosips-overview.json
|
||||
|
||||
for unit in heplify-server homer-app lisglosips-prometheus lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter; do
|
||||
install -o root -g root -m 0644 "$STAGE/systemd/$unit.service" "/etc/systemd/system/$unit.service"
|
||||
done
|
||||
install -d -o root -g root -m 0755 /etc/systemd/system/grafana-server.service.d
|
||||
install -o root -g root -m 0644 "$STAGE/systemd/grafana-override.conf" /etc/systemd/system/grafana-server.service.d/lisglosips.conf
|
||||
systemctl unmask grafana-server.service
|
||||
|
||||
install -o root -g root -m 0644 "$STAGE/nginx/monitoring.conf" /etc/nginx/sites-available/lisglosips-monitoring.conf
|
||||
ln -sfn /etc/nginx/sites-available/lisglosips-monitoring.conf /etc/nginx/sites-enabled/lisglosips-monitoring.conf
|
||||
install -o root -g root -m 0755 /tmp/lisglosips-issue-dev-cert.s06 /usr/local/sbin/lisglosips-issue-dev-cert
|
||||
rm -f /tmp/lisglosips-issue-dev-cert.s06
|
||||
/usr/local/sbin/lisglosips-issue-dev-cert >/dev/null 2>&1
|
||||
nginx -t
|
||||
|
||||
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -create-table-db-config >/var/log/homer/init-config.log 2>&1
|
||||
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -populate-table-db-config -force-password="$HOMER_UI_PASSWORD" >>/var/log/homer/init-config.log 2>&1
|
||||
chmod 0640 /var/log/homer/init-config.log
|
||||
|
||||
systemctl daemon-reload
|
||||
systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
|
||||
systemctl mask prometheus-node-exporter.service 2>/dev/null || true
|
||||
systemctl disable --now openipmi.service 2>/dev/null || true
|
||||
systemctl mask openipmi.service 2>/dev/null || true
|
||||
systemctl enable --now heplify-server.service homer-app.service lisglosips-node-exporter.service lisglosips-mysqld-exporter.service lisglosips-postgres-exporter.service lisglosips-redis-exporter.service lisglosips-prometheus.service grafana-server.service
|
||||
systemctl reload nginx.service
|
||||
|
||||
sleep 5
|
||||
for unit in postgresql heplify-server homer-app lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter lisglosips-prometheus grafana-server nginx; do
|
||||
systemctl is-active "$unit" >/dev/null
|
||||
done
|
||||
curl -fsS http://127.0.0.1:9090/-/ready
|
||||
curl -fsS http://127.0.0.1:3001/api/health
|
||||
curl -fsS http://127.0.0.1:9096/metrics >/dev/null
|
||||
printf 'S06_SERVER_B_CONFIG=PASS\n'
|
||||
Reference in New Issue
Block a user