Installer: Gitea-Release-Quelle + SHA256 + GitHub-Fallback
This commit is contained in:
@@ -0,0 +1,233 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
# =============================================================================
|
||||||
|
# NetBird-Installer für GL.iNet Slate 7 (GL-BE3600 / aarch64 / OpenWrt)
|
||||||
|
# Zielserver (self-hosted): https://nb.digiflo.at:443
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# Holt das aktuelle statische NetBird-Binary (matcht den :latest-Server),
|
||||||
|
# richtet einen reboot-festen procd-Dienst ein und enrollt optional gleich.
|
||||||
|
#
|
||||||
|
# AUSFÜHRUNG (als root auf dem Router):
|
||||||
|
# sh install-netbird-slate7.sh # nur installieren
|
||||||
|
# sh install-netbird-slate7.sh <SETUP_KEY> # installieren + enrollen
|
||||||
|
# sh install-netbird-slate7.sh status # Status anzeigen
|
||||||
|
# sh install-netbird-slate7.sh uninstall # restlos entfernen
|
||||||
|
#
|
||||||
|
# Persistenz: Profil/Key liegen in /etc/netbird/ -> übersteht Reboot UND
|
||||||
|
# Firmware-Upgrade (sysupgrade behält /etc). NICHT bei Werks-Reset.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# ---- Konfiguration ----------------------------------------------------------
|
||||||
|
MGMT_URL="https://nb.digiflo.at:443" # self-hosted Management
|
||||||
|
GITEA="https://gitea.digiflo.at" # eigener Deploy-Server (Primärquelle)
|
||||||
|
GITEA_REPO="digiflo/netbird-slate7" # Repo mit den gespiegelten Releases
|
||||||
|
FALLBACK_VER="0.73.1" # falls weder Gitea noch GitHub antworten
|
||||||
|
CONF_DIR="/etc/netbird" # persistent (überlebt Reboot+Upgrade)
|
||||||
|
PROFILE="${CONF_DIR}/default.json" # hier liegt PrivateKey/ManagementURL
|
||||||
|
SOCK="unix:///var/run/netbird.sock"
|
||||||
|
BIN="/usr/bin/netbird"
|
||||||
|
INIT="/etc/init.d/netbird"
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
|
||||||
|
log() { echo ">>> $*"; }
|
||||||
|
warn() { echo "!!! $*" >&2; }
|
||||||
|
die() { echo "FEHLER: $*" >&2; exit 1; }
|
||||||
|
|
||||||
|
[ "$(id -u)" = "0" ] || die "Bitte als root ausführen."
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# UNINSTALL
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
if [ "$1" = "uninstall" ]; then
|
||||||
|
log "Entferne NetBird ..."
|
||||||
|
[ -x "$INIT" ] && { "$INIT" stop 2>/dev/null || true; "$INIT" disable 2>/dev/null || true; }
|
||||||
|
"$BIN" down 2>/dev/null || true
|
||||||
|
rm -f "$INIT" "$BIN"
|
||||||
|
rm -rf "$CONF_DIR" /var/lib/netbird /var/run/netbird.sock /var/log/netbird
|
||||||
|
log "NetBird entfernt. (WireGuard-Interface wt0 verschwindet beim nächsten Reboot bzw. ist schon weg.)"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# STATUS
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
if [ "$1" = "status" ]; then
|
||||||
|
[ -x "$BIN" ] || die "NetBird ist nicht installiert."
|
||||||
|
"$BIN" version
|
||||||
|
echo
|
||||||
|
"$BIN" status -d 2>/dev/null || "$BIN" status 2>/dev/null || warn "Daemon läuft nicht. Start: $INIT start"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# INSTALL (+ optional Enroll)
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
SETUP_KEY="$1"
|
||||||
|
|
||||||
|
# 1) Architektur ------------------------------------------------------------
|
||||||
|
ARCH="$(uname -m)"
|
||||||
|
case "$ARCH" in
|
||||||
|
aarch64|arm64) NBARCH="arm64" ;;
|
||||||
|
armv7l|armv7) NBARCH="armv6" ;;
|
||||||
|
armv6l) NBARCH="armv6" ;;
|
||||||
|
x86_64) NBARCH="amd64" ;;
|
||||||
|
mips) NBARCH="mips_softfloat" ;;
|
||||||
|
*) warn "Unbekannte Architektur '$ARCH' – versuche arm64."; NBARCH="arm64" ;;
|
||||||
|
esac
|
||||||
|
log "Architektur: $ARCH -> NetBird-Build linux_${NBARCH}"
|
||||||
|
|
||||||
|
# 2) Speicherplatz prüfen (Binary ~45 MB) -----------------------------------
|
||||||
|
log "Freier Speicher:"
|
||||||
|
df -h / /overlay 2>/dev/null | grep -viE 'tmpfs|^Filesystem' | sed 's/^/ /' || true
|
||||||
|
|
||||||
|
# 3) Abhängigkeiten (Kernel-WireGuard) – auf GL-Firmware i.d.R. schon da -----
|
||||||
|
log "Prüfe Abhängigkeiten (Kernel-WireGuard, CA-Zertifikate) ..."
|
||||||
|
opkg update >/dev/null 2>&1 || warn "opkg update fehlgeschlagen (offline?) – fahre fort."
|
||||||
|
for p in kmod-wireguard wireguard-tools ca-bundle kmod-tun; do
|
||||||
|
if opkg list-installed 2>/dev/null | grep -q "^$p "; then
|
||||||
|
:
|
||||||
|
else
|
||||||
|
opkg install "$p" >/dev/null 2>&1 \
|
||||||
|
&& log " installiert: $p" \
|
||||||
|
|| warn " '$p' nicht via opkg verfügbar – auf GL-Firmware meist bereits enthalten."
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
# WireGuard-Kernelmodul laden (falls vorhanden, nicht geladen)
|
||||||
|
modprobe wireguard 2>/dev/null || true
|
||||||
|
|
||||||
|
# 4) Versionsquelle: PRIMÄR eigenes Gitea-Release, sonst GitHub --------------
|
||||||
|
log "Ermittle NetBird-Version ..."
|
||||||
|
VER=""; SRC=""; URL=""; SHAURL=""
|
||||||
|
|
||||||
|
# Primär: gespiegeltes Gitea-Release (der „Deploy"; nur arm64 wird gespiegelt)
|
||||||
|
if [ "$NBARCH" = "arm64" ]; then
|
||||||
|
TAG="$(wget -q -O - "$GITEA/api/v1/repos/$GITEA_REPO/releases/latest" 2>/dev/null \
|
||||||
|
| grep -o '"tag_name":"[^"]*"' | head -1 | sed 's/.*"tag_name":"\([^"]*\)".*/\1/')"
|
||||||
|
if [ -n "$TAG" ]; then
|
||||||
|
VER="${TAG#v}"
|
||||||
|
URL="$GITEA/$GITEA_REPO/releases/download/$TAG/netbird_${VER}_linux_arm64.tar.gz"
|
||||||
|
SHAURL="${URL}.sha256"
|
||||||
|
SRC="Gitea ($GITEA)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Fallback: direkt GitHub-Release (latest)
|
||||||
|
if [ -z "$VER" ]; then
|
||||||
|
VER="$(wget -q -O - "https://api.github.com/repos/netbirdio/netbird/releases/latest" 2>/dev/null \
|
||||||
|
| grep -o '"tag_name":[^,]*' | head -1 | grep -o '[0-9][0-9.]*' | head -1)"
|
||||||
|
[ -n "$VER" ] || { VER="$FALLBACK_VER"; warn "Weder Gitea noch GitHub-API erreichbar – Fallback $VER."; }
|
||||||
|
URL="https://github.com/netbirdio/netbird/releases/download/v${VER}/netbird_${VER}_linux_${NBARCH}.tar.gz"
|
||||||
|
SHAURL=""
|
||||||
|
SRC="GitHub"
|
||||||
|
fi
|
||||||
|
log "Zielversion: $VER (Quelle: $SRC)"
|
||||||
|
|
||||||
|
# 5) Download + (optional) SHA256-Verifikation + Installation -----------------
|
||||||
|
TARBALL="netbird_${VER}_linux_${NBARCH}.tar.gz"
|
||||||
|
TMP="/tmp/nb-install.$$"
|
||||||
|
rm -rf "$TMP"; mkdir -p "$TMP"
|
||||||
|
log "Lade $URL ..."
|
||||||
|
wget -q -O "$TMP/$TARBALL" "$URL" || die "Download fehlgeschlagen ($URL)"
|
||||||
|
|
||||||
|
# SHA256 prüfen, wenn eine Prüfsumme verfügbar ist und sha256sum existiert
|
||||||
|
if [ -n "$SHAURL" ] && command -v sha256sum >/dev/null 2>&1 && wget -q -O "$TMP/sha" "$SHAURL" 2>/dev/null; then
|
||||||
|
EXP="$(awk '{print $1}' "$TMP/sha" 2>/dev/null)"
|
||||||
|
GOT="$(sha256sum "$TMP/$TARBALL" 2>/dev/null | awk '{print $1}')"
|
||||||
|
if [ -n "$EXP" ] && [ -n "$GOT" ]; then
|
||||||
|
[ "$EXP" = "$GOT" ] && log "SHA256 ok ($GOT)" || die "SHA256-Mismatch! erwartet=$EXP bekommen=$GOT"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
tar -xzf "$TMP/$TARBALL" -C "$TMP" || die "Entpacken fehlgeschlagen."
|
||||||
|
[ -f "$TMP/netbird" ] || die "netbird-Binary nicht im Archiv gefunden."
|
||||||
|
|
||||||
|
# laufenden Dienst vor dem Überschreiben stoppen (= Upgrade)
|
||||||
|
[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true
|
||||||
|
|
||||||
|
install -m 0755 "$TMP/netbird" "$BIN" || die "Konnte $BIN nicht schreiben (Speicher voll?)."
|
||||||
|
rm -rf "$TMP"
|
||||||
|
log "Installiert: $("$BIN" version 2>/dev/null || echo '?')"
|
||||||
|
|
||||||
|
# 6) Persistente Verzeichnisse ----------------------------------------------
|
||||||
|
mkdir -p "$CONF_DIR" /var/lib/netbird /var/log/netbird
|
||||||
|
chmod 700 "$CONF_DIR"
|
||||||
|
|
||||||
|
# 7) procd-Init-Script ------------------------------------------------------
|
||||||
|
# --config zeigt auf das PERSISTENTE Profil (/etc), --disable-profiles
|
||||||
|
# hält es als Single-Config simpel. NB_DISABLE_SSH_CONFIG schützt das
|
||||||
|
# Router-SSH davor, von NetBird umgeschrieben zu werden.
|
||||||
|
log "Schreibe procd-Service $INIT ..."
|
||||||
|
cat > "$INIT" <<INITEOF
|
||||||
|
#!/bin/sh /etc/rc.common
|
||||||
|
# NetBird (self-hosted) – procd service
|
||||||
|
USE_PROCD=1
|
||||||
|
START=99
|
||||||
|
STOP=10
|
||||||
|
|
||||||
|
CONF="${PROFILE}"
|
||||||
|
SOCK="${SOCK}"
|
||||||
|
|
||||||
|
start_service() {
|
||||||
|
mkdir -p /var/lib/netbird /var/run /var/log/netbird
|
||||||
|
procd_open_instance netbird
|
||||||
|
procd_set_param command ${BIN} service run \\
|
||||||
|
--config "\$CONF" \\
|
||||||
|
--disable-profiles \\
|
||||||
|
--daemon-addr "\$SOCK" \\
|
||||||
|
--log-level info
|
||||||
|
procd_set_param env NB_DISABLE_SSH_CONFIG=1
|
||||||
|
procd_set_param pidfile /var/run/netbird.pid
|
||||||
|
procd_set_param respawn 3600 5 0
|
||||||
|
procd_set_param stdout 1
|
||||||
|
procd_set_param stderr 1
|
||||||
|
procd_close_instance
|
||||||
|
}
|
||||||
|
|
||||||
|
stop_service() {
|
||||||
|
${BIN} down 2>/dev/null || true
|
||||||
|
}
|
||||||
|
INITEOF
|
||||||
|
chmod +x "$INIT"
|
||||||
|
|
||||||
|
# 8) Dienst aktivieren + starten -------------------------------------------
|
||||||
|
log "Aktiviere + starte Dienst ..."
|
||||||
|
"$INIT" enable
|
||||||
|
"$INIT" start
|
||||||
|
sleep 3
|
||||||
|
|
||||||
|
# 9) Enrollment -------------------------------------------------------------
|
||||||
|
echo
|
||||||
|
if [ -n "$SETUP_KEY" ] && [ "$SETUP_KEY" != "install" ]; then
|
||||||
|
log "Enrolle gegen $MGMT_URL ..."
|
||||||
|
if "$BIN" up --config "$PROFILE" --management-url "$MGMT_URL" --setup-key "$SETUP_KEY"; then
|
||||||
|
sleep 3
|
||||||
|
echo
|
||||||
|
"$BIN" status 2>/dev/null | grep -iE 'Management|Signal|Relay|FQDN|NetBird IP' || true
|
||||||
|
echo
|
||||||
|
log "FERTIG ✓ Router ist im NetBird-Netz."
|
||||||
|
else
|
||||||
|
warn "Enroll fehlgeschlagen. Manuell nachholen:"
|
||||||
|
echo " $BIN up --management-url $MGMT_URL --setup-key <SETUP_KEY>"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
log "Installation fertig. Zum Verbinden noch enrollen (Setup-Key aus dem NetBird-Dashboard):"
|
||||||
|
echo
|
||||||
|
echo " netbird up --management-url $MGMT_URL --setup-key <DEIN_SETUP_KEY>"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 10) Hinweise --------------------------------------------------------------
|
||||||
|
cat <<NOTES
|
||||||
|
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
Befehle:
|
||||||
|
netbird status Verbindungsstatus
|
||||||
|
netbird status -d Details (Peers, Routen)
|
||||||
|
/etc/init.d/netbird restart Dienst neu starten
|
||||||
|
sh $0 status Versions-/Statuscheck
|
||||||
|
sh $0 uninstall restlos entfernen
|
||||||
|
|
||||||
|
Persistenz: Profil/Key in $CONF_DIR (Reboot- und Upgrade-fest)
|
||||||
|
Interface: wt0 Version: $VER
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
NOTES
|
||||||
Reference in New Issue
Block a user