188 lines
10 KiB
Bash
Executable File
188 lines
10 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
: "${HOMER_DB_PASSWORD:?missing HOMER_DB_PASSWORD}"
|
|
: "${HOMER_UI_PASSWORD:?missing HOMER_UI_PASSWORD}"
|
|
: "${HOMER_JWT_SECRET:?missing HOMER_JWT_SECRET}"
|
|
: "${GRAFANA_ADMIN_PASSWORD:?missing GRAFANA_ADMIN_PASSWORD}"
|
|
: "${MYSQL_EXPORTER_PASSWORD:?missing MYSQL_EXPORTER_PASSWORD}"
|
|
: "${REDIS_EXPORTER_PASSWORD:?missing REDIS_EXPORTER_PASSWORD}"
|
|
: "${POSTGRES_EXPORTER_PASSWORD:?missing POSTGRES_EXPORTER_PASSWORD}"
|
|
|
|
STAGE=${STAGE:-/tmp/lisglosips-s06-stage-202606202230}
|
|
BUILD=/var/tmp/lisglosips-s06-go-20260620/bin
|
|
HOMER_SOURCE=/var/tmp/lisglosips-s06-go-20260620/pkg/mod/github.com/sipcapture/homer-app@v0.0.0-20251021161517-9b1336352aa0
|
|
|
|
test -d "$STAGE/systemd"
|
|
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
systemctl mask prometheus-postgres-exporter.service 2>/dev/null || true
|
|
apt-get install -y prometheus-postgres-exporter=0.15.0-1ubuntu0.3
|
|
apt-mark hold prometheus-postgres-exporter >/dev/null
|
|
|
|
for account in homer heplify redis-exporter; do
|
|
if ! getent passwd "$account" >/dev/null; then
|
|
useradd --system --home-dir /nonexistent --no-create-home --shell /usr/sbin/nologin "$account"
|
|
fi
|
|
done
|
|
|
|
install -o root -g root -m 0755 "$BUILD/heplify-server" /usr/local/bin/heplify-server
|
|
install -o root -g root -m 0755 "$BUILD/homer-app" /usr/local/bin/homer-app
|
|
install -o root -g root -m 0755 "$BUILD/redis_exporter" /usr/local/bin/redis_exporter
|
|
install -o root -g root -m 0644 "$STAGE/versions.env" /etc/lisglosips/monitoring-versions.env
|
|
|
|
systemctl stop postgresql.service
|
|
chown root:postgres /data/homer
|
|
chmod 0750 /data/homer
|
|
install -d -o postgres -g postgres -m 0700 /data/homer/postgresql
|
|
if [ -z "$(find /data/homer/postgresql -mindepth 1 -maxdepth 1 -print -quit)" ]; then
|
|
rsync -aHAX /var/lib/postgresql/16/main/ /data/homer/postgresql/
|
|
fi
|
|
chown -R postgres:postgres /data/homer/postgresql
|
|
chmod 0700 /data/homer/postgresql
|
|
install -d -o root -g postgres -m 0750 /etc/postgresql/16/main/conf.d
|
|
install -o root -g postgres -m 0640 "$STAGE/postgresql/lisglosips-homer.conf" /etc/postgresql/16/main/conf.d/lisglosips-homer.conf
|
|
grep -Eq "^[[:space:]]*include_dir[[:space:]]*=[[:space:]]*'conf.d'" /etc/postgresql/16/main/postgresql.conf
|
|
systemctl start postgresql.service
|
|
pg_isready -h 127.0.0.1 -p 5432
|
|
|
|
runuser -u postgres -- psql -v ON_ERROR_STOP=1 -v homer_pw="$HOMER_DB_PASSWORD" -v exporter_pw="$POSTGRES_EXPORTER_PASSWORD" <<'SQL'
|
|
SELECT format('CREATE ROLE homer_user LOGIN PASSWORD %L', :'homer_pw')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'homer_user') \gexec
|
|
SELECT format('ALTER ROLE homer_user LOGIN PASSWORD %L', :'homer_pw') \gexec
|
|
SELECT 'CREATE DATABASE homer_config OWNER homer_user'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_config') \gexec
|
|
SELECT 'CREATE DATABASE homer_data OWNER homer_user'
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'homer_data') \gexec
|
|
SELECT format('CREATE ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'postgres_exporter') \gexec
|
|
SELECT format('ALTER ROLE postgres_exporter LOGIN PASSWORD %L', :'exporter_pw') \gexec
|
|
GRANT pg_monitor TO postgres_exporter;
|
|
SQL
|
|
|
|
mysql --protocol=socket <<SQL
|
|
CREATE USER IF NOT EXISTS 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
|
|
ALTER USER 'mysqld_exporter'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '$MYSQL_EXPORTER_PASSWORD';
|
|
GRANT PROCESS, REPLICATION CLIENT ON *.* TO 'mysqld_exporter'@'127.0.0.1';
|
|
GRANT SELECT ON performance_schema.* TO 'mysqld_exporter'@'127.0.0.1';
|
|
FLUSH PRIVILEGES;
|
|
SQL
|
|
|
|
sed -i '/^user redis_exporter /d' /etc/redis/users.acl
|
|
printf 'user redis_exporter on >%s ~* -@all +ping +info +client +config|get +latency +memory +select +slowlog +scan +type +strlen +llen +scard +zcard +xlen +hscan +sscan +zscan +get\n' "$REDIS_EXPORTER_PASSWORD" >>/etc/redis/users.acl
|
|
chown root:redis /etc/redis/users.acl
|
|
chmod 0640 /etc/redis/users.acl
|
|
systemctl restart redis-server.service
|
|
|
|
install -d -o root -g root -m 0755 /etc/lisglosips/secrets
|
|
sed "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" "$STAGE/heplify/heplify.env.example" >/etc/lisglosips/secrets/heplify.env
|
|
chown root:heplify /etc/lisglosips/secrets/heplify.env
|
|
chmod 0640 /etc/lisglosips/secrets/heplify.env
|
|
|
|
cat >/etc/lisglosips/secrets/grafana.env <<EOF
|
|
GF_SECURITY_ADMIN_USER=admin
|
|
GF_SECURITY_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
|
|
GF_USERS_ALLOW_SIGN_UP=false
|
|
GF_AUTH_ANONYMOUS_ENABLED=false
|
|
GF_SERVER_HTTP_ADDR=127.0.0.1
|
|
GF_SERVER_HTTP_PORT=3001
|
|
GF_SERVER_DOMAIN=grafana.lisglosips.local
|
|
GF_SERVER_ROOT_URL=https://grafana.lisglosips.local/
|
|
GF_SECURITY_COOKIE_SECURE=true
|
|
GF_SECURITY_COOKIE_SAMESITE=strict
|
|
GF_SECURITY_DISABLE_GRAVATAR=true
|
|
GF_ANALYTICS_REPORTING_ENABLED=false
|
|
GF_ANALYTICS_CHECK_FOR_UPDATES=false
|
|
GF_PLUGINS_PREINSTALL_DISABLED=true
|
|
GF_PLUGINS_CHECK_FOR_PLUGIN_UPDATES=false
|
|
GF_PLUGINS_PLUGIN_ADMIN_ENABLED=false
|
|
HOMER_DB_PASSWORD=$HOMER_DB_PASSWORD
|
|
EOF
|
|
chown root:grafana /etc/lisglosips/secrets/grafana.env
|
|
chmod 0640 /etc/lisglosips/secrets/grafana.env
|
|
|
|
cat >/etc/prometheus/mysqld-exporter.cnf <<EOF
|
|
[client]
|
|
user=mysqld_exporter
|
|
password=$MYSQL_EXPORTER_PASSWORD
|
|
host=127.0.0.1
|
|
port=3306
|
|
EOF
|
|
chown root:prometheus /etc/prometheus/mysqld-exporter.cnf
|
|
chmod 0640 /etc/prometheus/mysqld-exporter.cnf
|
|
|
|
cat >/etc/lisglosips/secrets/postgres-exporter.env <<EOF
|
|
DATA_SOURCE_NAME=postgresql://postgres_exporter:$POSTGRES_EXPORTER_PASSWORD@127.0.0.1:5432/postgres?sslmode=disable
|
|
EOF
|
|
chown root:prometheus /etc/lisglosips/secrets/postgres-exporter.env
|
|
chmod 0640 /etc/lisglosips/secrets/postgres-exporter.env
|
|
|
|
cat >/etc/lisglosips/secrets/redis-exporter.env <<EOF
|
|
REDIS_ADDR=redis://127.0.0.1:6379
|
|
REDIS_USER=redis_exporter
|
|
REDIS_PASSWORD=$REDIS_EXPORTER_PASSWORD
|
|
REDIS_EXPORTER_WEB_LISTEN_ADDRESS=127.0.0.1:9121
|
|
EOF
|
|
chown root:redis-exporter /etc/lisglosips/secrets/redis-exporter.env
|
|
chmod 0640 /etc/lisglosips/secrets/redis-exporter.env
|
|
|
|
install -d -o root -g homer -m 0750 /etc/homer
|
|
sed -e "s/<HOMER_DB_PASSWORD>/$HOMER_DB_PASSWORD/g" -e "s/<HOMER_JWT_SECRET>/$HOMER_JWT_SECRET/g" "$STAGE/homer/webapp_config.json.example" >/etc/homer/webapp_config.json
|
|
install -o root -g homer -m 0640 "$HOMER_SOURCE/swagger.json" /etc/homer/swagger.json
|
|
chown homer:homer /etc/homer/webapp_config.json
|
|
chmod 0600 /etc/homer/webapp_config.json
|
|
install -d -o root -g homer -m 0750 /usr/local/homer/dist
|
|
install -o root -g homer -m 0640 "$STAGE/homer/index.html" /usr/local/homer/dist/index.html
|
|
install -d -o homer -g homer -m 0750 /var/log/homer
|
|
|
|
install -d -o prometheus -g prometheus -m 0750 /data/prometheus
|
|
install -d -o root -g prometheus -m 0750 /etc/prometheus/rules
|
|
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.yml" /etc/prometheus/prometheus.yml
|
|
install -o root -g prometheus -m 0640 "$STAGE/prometheus/rules/lisglosips.yml" /etc/prometheus/rules/lisglosips.yml
|
|
install -o root -g prometheus -m 0640 "$STAGE/prometheus/prometheus.env" /etc/default/lisglosips-prometheus
|
|
install -o root -g prometheus -m 0640 "$STAGE/prometheus/node-exporter-b.env" /etc/default/lisglosips-node-exporter
|
|
promtool check config /etc/prometheus/prometheus.yml
|
|
promtool check rules /etc/prometheus/rules/lisglosips.yml
|
|
|
|
install -d -o grafana -g grafana -m 0750 /data/grafana /data/grafana/plugins
|
|
install -o root -g root -m 0644 "$STAGE/grafana/grafana-server.default" /etc/default/grafana-server
|
|
install -d -o root -g grafana -m 0750 /etc/grafana/provisioning/datasources /etc/grafana/provisioning/dashboards /etc/grafana/provisioning/dashboards/lisglosips
|
|
install -o root -g grafana -m 0640 "$STAGE/grafana/datasources.yml" /etc/grafana/provisioning/datasources/lisglosips.yml
|
|
install -o root -g grafana -m 0640 "$STAGE/grafana/dashboards.yml" /etc/grafana/provisioning/dashboards/lisglosips.yml
|
|
install -o root -g grafana -m 0640 "$STAGE/grafana/lisglosips-overview.json" /etc/grafana/provisioning/dashboards/lisglosips/lisglosips-overview.json
|
|
|
|
for unit in heplify-server homer-app lisglosips-prometheus lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter; do
|
|
install -o root -g root -m 0644 "$STAGE/systemd/$unit.service" "/etc/systemd/system/$unit.service"
|
|
done
|
|
install -d -o root -g root -m 0755 /etc/systemd/system/grafana-server.service.d
|
|
install -o root -g root -m 0644 "$STAGE/systemd/grafana-override.conf" /etc/systemd/system/grafana-server.service.d/lisglosips.conf
|
|
systemctl unmask grafana-server.service
|
|
|
|
install -o root -g root -m 0644 "$STAGE/nginx/monitoring.conf" /etc/nginx/sites-available/lisglosips-monitoring.conf
|
|
ln -sfn /etc/nginx/sites-available/lisglosips-monitoring.conf /etc/nginx/sites-enabled/lisglosips-monitoring.conf
|
|
install -o root -g root -m 0755 /tmp/lisglosips-issue-dev-cert.s06 /usr/local/sbin/lisglosips-issue-dev-cert
|
|
rm -f /tmp/lisglosips-issue-dev-cert.s06
|
|
/usr/local/sbin/lisglosips-issue-dev-cert >/dev/null 2>&1
|
|
nginx -t
|
|
|
|
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -create-table-db-config >/var/log/homer/init-config.log 2>&1
|
|
runuser -u homer -- /usr/local/bin/homer-app -webapp-config-path=/etc/homer -populate-table-db-config -force-password="$HOMER_UI_PASSWORD" >>/var/log/homer/init-config.log 2>&1
|
|
chmod 0640 /var/log/homer/init-config.log
|
|
|
|
systemctl daemon-reload
|
|
systemctl disable --now prometheus-node-exporter.service prometheus-node-exporter.socket 2>/dev/null || true
|
|
systemctl mask prometheus-node-exporter.service 2>/dev/null || true
|
|
systemctl disable --now openipmi.service 2>/dev/null || true
|
|
systemctl mask openipmi.service 2>/dev/null || true
|
|
systemctl enable --now heplify-server.service homer-app.service lisglosips-node-exporter.service lisglosips-mysqld-exporter.service lisglosips-postgres-exporter.service lisglosips-redis-exporter.service lisglosips-prometheus.service grafana-server.service
|
|
systemctl reload nginx.service
|
|
|
|
sleep 5
|
|
for unit in postgresql heplify-server homer-app lisglosips-node-exporter lisglosips-mysqld-exporter lisglosips-postgres-exporter lisglosips-redis-exporter lisglosips-prometheus grafana-server nginx; do
|
|
systemctl is-active "$unit" >/dev/null
|
|
done
|
|
curl -fsS http://127.0.0.1:9090/-/ready
|
|
curl -fsS http://127.0.0.1:3001/api/health
|
|
curl -fsS http://127.0.0.1:9096/metrics >/dev/null
|
|
printf 'S06_SERVER_B_CONFIG=PASS\n'
|