116 lines
3.8 KiB
Bash
116 lines
3.8 KiB
Bash
#!/bin/bash
|
|
# Install in-container pin script (+ systemd on exchange), hook start_base scripts,
|
|
# commit images so recreate keeps the bake.
|
|
#
|
|
# Run on koopa:
|
|
# ./bake-hosts-into-images.sh
|
|
set -euo pipefail
|
|
|
|
PIN_IP="${PIN_IP:-212.51.151.254}"
|
|
SRC_DIR="${SRC_DIR:-/tmp/taler-dns-bake}"
|
|
mkdir -p "$SRC_DIR"
|
|
|
|
# expect these next to us or in SRC_DIR
|
|
SCRIPT_IN="${SCRIPT_IN:-$SRC_DIR/pin-hacktivism-hosts.in-container.sh}"
|
|
UNIT_IN="${UNIT_IN:-$SRC_DIR/pin-hacktivism-hosts.service}"
|
|
|
|
[ -f "$SCRIPT_IN" ] || { echo "missing $SCRIPT_IN" >&2; exit 1; }
|
|
|
|
install_into() {
|
|
local C="$1"
|
|
if ! podman ps --format '{{.Names}}' | grep -qx "$C"; then
|
|
echo "SKIP $C (not running)"
|
|
return 0
|
|
fi
|
|
echo "=== install into $C ==="
|
|
podman cp "$SCRIPT_IN" "$C:/usr/local/bin/pin-hacktivism-hosts"
|
|
podman exec "$C" chmod 755 /usr/local/bin/pin-hacktivism-hosts
|
|
# run once now
|
|
podman exec -e PIN_IP="$PIN_IP" "$C" /usr/local/bin/pin-hacktivism-hosts
|
|
podman exec "$C" grep hacktivism /etc/hosts || true
|
|
}
|
|
|
|
hook_start_base() {
|
|
local C="$1" base="$2"
|
|
podman exec "$C" bash -lc "
|
|
set -e
|
|
f='$base'
|
|
if [ ! -f \"\$f\" ]; then echo \"no \$f\"; exit 0; fi
|
|
if grep -q pin-hacktivism-hosts \"\$f\"; then
|
|
echo \"already hooked: \$f\"
|
|
exit 0
|
|
fi
|
|
# insert right after shebang / first line block
|
|
cp \"\$f\" \"\$f.bak-before-pin\"
|
|
{
|
|
head -n 1 \"\$f\"
|
|
echo ''
|
|
echo '# Pin public GOA hostnames (pasta DNS). Baked by bake-hosts-into-images.sh'
|
|
echo 'if [ -x /usr/local/bin/pin-hacktivism-hosts ]; then'
|
|
echo ' PIN_IP=${PIN_IP} /usr/local/bin/pin-hacktivism-hosts || true'
|
|
echo 'fi'
|
|
tail -n +2 \"\$f\"
|
|
} > \"\$f.new\"
|
|
mv \"\$f.new\" \"\$f\"
|
|
chmod +x \"\$f\"
|
|
echo \"hooked \$f\"
|
|
"
|
|
}
|
|
|
|
# --- bank ---
|
|
install_into taler-hacktivism-bank
|
|
hook_start_base taler-hacktivism-bank /root/start_base_services_for_taler_bank.sh
|
|
|
|
# --- merchant ---
|
|
install_into taler-hacktivism
|
|
hook_start_base taler-hacktivism /root/start_base_services_for_taler.sh
|
|
|
|
# --- exchange (systemd) ---
|
|
install_into taler-hacktivism-exchange-ansible
|
|
if [ -f "$UNIT_IN" ]; then
|
|
podman cp "$UNIT_IN" taler-hacktivism-exchange-ansible:/etc/systemd/system/pin-hacktivism-hosts.service
|
|
podman exec taler-hacktivism-exchange-ansible bash -lc '
|
|
sed -i "s/PIN_IP=212.51.151.254/PIN_IP='"${PIN_IP}"'/" /etc/systemd/system/pin-hacktivism-hosts.service
|
|
systemctl daemon-reload
|
|
systemctl enable pin-hacktivism-hosts.service
|
|
systemctl start pin-hacktivism-hosts.service
|
|
systemctl is-enabled pin-hacktivism-hosts.service
|
|
# ensure wirewatch starts after pin
|
|
mkdir -p /etc/systemd/system/taler-exchange-wirewatch.service.d
|
|
cat > /etc/systemd/system/taler-exchange-wirewatch.service.d/pin-hosts.conf <<EOF
|
|
[Unit]
|
|
After=pin-hacktivism-hosts.service
|
|
Requires=pin-hacktivism-hosts.service
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl restart taler-exchange-wirewatch 2>/dev/null || true
|
|
'
|
|
fi
|
|
|
|
# --- commit images ---
|
|
echo "=== commit images ==="
|
|
podman commit taler-hacktivism-bank \
|
|
localhost/taler-hacktivism-banking:live
|
|
podman commit taler-hacktivism-bank \
|
|
localhost/taler-hacktivism-banking:hosts-pinned
|
|
|
|
podman commit taler-hacktivism \
|
|
localhost/taler-hacktivism-live:landing
|
|
podman commit taler-hacktivism \
|
|
localhost/taler-hacktivism-live:hosts-pinned
|
|
|
|
podman commit taler-hacktivism-exchange-ansible \
|
|
localhost/taler-hacktivism-exchange-ansible:landing
|
|
podman commit taler-hacktivism-exchange-ansible \
|
|
localhost/taler-hacktivism-exchange-ansible:hosts-pinned
|
|
|
|
echo
|
|
echo "Images updated:"
|
|
podman images | grep -E 'hacktivism|hosts-pinned' | head -20
|
|
echo
|
|
echo "Verify:"
|
|
for C in taler-hacktivism-bank taler-hacktivism-exchange-ansible taler-hacktivism; do
|
|
echo -n "$C: "
|
|
podman exec "$C" getent ahostsv4 bank.hacktivism.ch 2>/dev/null | head -1 || echo FAIL
|
|
done
|
|
echo "done."
|