Installer: Gitea-Release-Quelle + SHA256 + GitHub-Fallback
This commit is contained in:
@@ -0,0 +1,233 @@
|
||||
#!/bin/sh
|
||||
# =============================================================================
|
||||
# NetBird-Installer für GL.iNet Slate 7 (GL-BE3600 / aarch64 / OpenWrt)
|
||||
# Zielserver (self-hosted): https://nb.digiflo.at:443
|
||||
# -----------------------------------------------------------------------------
|
||||
# Holt das aktuelle statische NetBird-Binary (matcht den :latest-Server),
|
||||
# richtet einen reboot-festen procd-Dienst ein und enrollt optional gleich.
|
||||
#
|
||||
# AUSFÜHRUNG (als root auf dem Router):
|
||||
# sh install-netbird-slate7.sh # nur installieren
|
||||
# sh install-netbird-slate7.sh <SETUP_KEY> # installieren + enrollen
|
||||
# sh install-netbird-slate7.sh status # Status anzeigen
|
||||
# sh install-netbird-slate7.sh uninstall # restlos entfernen
|
||||
#
|
||||
# Persistenz: Profil/Key liegen in /etc/netbird/ -> übersteht Reboot UND
|
||||
# Firmware-Upgrade (sysupgrade behält /etc). NICHT bei Werks-Reset.
|
||||
# =============================================================================
|
||||
|
||||
set -e
|
||||
|
||||
# ---- Konfiguration ----------------------------------------------------------
|
||||
MGMT_URL="https://nb.digiflo.at:443" # self-hosted Management
|
||||
GITEA="https://gitea.digiflo.at" # eigener Deploy-Server (Primärquelle)
|
||||
GITEA_REPO="digiflo/netbird-slate7" # Repo mit den gespiegelten Releases
|
||||
FALLBACK_VER="0.73.1" # falls weder Gitea noch GitHub antworten
|
||||
CONF_DIR="/etc/netbird" # persistent (überlebt Reboot+Upgrade)
|
||||
PROFILE="${CONF_DIR}/default.json" # hier liegt PrivateKey/ManagementURL
|
||||
SOCK="unix:///var/run/netbird.sock"
|
||||
BIN="/usr/bin/netbird"
|
||||
INIT="/etc/init.d/netbird"
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
log() { echo ">>> $*"; }
|
||||
warn() { echo "!!! $*" >&2; }
|
||||
die() { echo "FEHLER: $*" >&2; exit 1; }
|
||||
|
||||
[ "$(id -u)" = "0" ] || die "Bitte als root ausführen."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# UNINSTALL
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ "$1" = "uninstall" ]; then
|
||||
log "Entferne NetBird ..."
|
||||
[ -x "$INIT" ] && { "$INIT" stop 2>/dev/null || true; "$INIT" disable 2>/dev/null || true; }
|
||||
"$BIN" down 2>/dev/null || true
|
||||
rm -f "$INIT" "$BIN"
|
||||
rm -rf "$CONF_DIR" /var/lib/netbird /var/run/netbird.sock /var/log/netbird
|
||||
log "NetBird entfernt. (WireGuard-Interface wt0 verschwindet beim nächsten Reboot bzw. ist schon weg.)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# STATUS
|
||||
# ---------------------------------------------------------------------------
|
||||
if [ "$1" = "status" ]; then
|
||||
[ -x "$BIN" ] || die "NetBird ist nicht installiert."
|
||||
"$BIN" version
|
||||
echo
|
||||
"$BIN" status -d 2>/dev/null || "$BIN" status 2>/dev/null || warn "Daemon läuft nicht. Start: $INIT start"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# INSTALL (+ optional Enroll)
|
||||
# ---------------------------------------------------------------------------
|
||||
SETUP_KEY="$1"
|
||||
|
||||
# 1) Architektur ------------------------------------------------------------
|
||||
ARCH="$(uname -m)"
|
||||
case "$ARCH" in
|
||||
aarch64|arm64) NBARCH="arm64" ;;
|
||||
armv7l|armv7) NBARCH="armv6" ;;
|
||||
armv6l) NBARCH="armv6" ;;
|
||||
x86_64) NBARCH="amd64" ;;
|
||||
mips) NBARCH="mips_softfloat" ;;
|
||||
*) warn "Unbekannte Architektur '$ARCH' – versuche arm64."; NBARCH="arm64" ;;
|
||||
esac
|
||||
log "Architektur: $ARCH -> NetBird-Build linux_${NBARCH}"
|
||||
|
||||
# 2) Speicherplatz prüfen (Binary ~45 MB) -----------------------------------
|
||||
log "Freier Speicher:"
|
||||
df -h / /overlay 2>/dev/null | grep -viE 'tmpfs|^Filesystem' | sed 's/^/ /' || true
|
||||
|
||||
# 3) Abhängigkeiten (Kernel-WireGuard) – auf GL-Firmware i.d.R. schon da -----
|
||||
log "Prüfe Abhängigkeiten (Kernel-WireGuard, CA-Zertifikate) ..."
|
||||
opkg update >/dev/null 2>&1 || warn "opkg update fehlgeschlagen (offline?) – fahre fort."
|
||||
for p in kmod-wireguard wireguard-tools ca-bundle kmod-tun; do
|
||||
if opkg list-installed 2>/dev/null | grep -q "^$p "; then
|
||||
:
|
||||
else
|
||||
opkg install "$p" >/dev/null 2>&1 \
|
||||
&& log " installiert: $p" \
|
||||
|| warn " '$p' nicht via opkg verfügbar – auf GL-Firmware meist bereits enthalten."
|
||||
fi
|
||||
done
|
||||
# WireGuard-Kernelmodul laden (falls vorhanden, nicht geladen)
|
||||
modprobe wireguard 2>/dev/null || true
|
||||
|
||||
# 4) Versionsquelle: PRIMÄR eigenes Gitea-Release, sonst GitHub --------------
|
||||
log "Ermittle NetBird-Version ..."
|
||||
VER=""; SRC=""; URL=""; SHAURL=""
|
||||
|
||||
# Primär: gespiegeltes Gitea-Release (der „Deploy"; nur arm64 wird gespiegelt)
|
||||
if [ "$NBARCH" = "arm64" ]; then
|
||||
TAG="$(wget -q -O - "$GITEA/api/v1/repos/$GITEA_REPO/releases/latest" 2>/dev/null \
|
||||
| grep -o '"tag_name":"[^"]*"' | head -1 | sed 's/.*"tag_name":"\([^"]*\)".*/\1/')"
|
||||
if [ -n "$TAG" ]; then
|
||||
VER="${TAG#v}"
|
||||
URL="$GITEA/$GITEA_REPO/releases/download/$TAG/netbird_${VER}_linux_arm64.tar.gz"
|
||||
SHAURL="${URL}.sha256"
|
||||
SRC="Gitea ($GITEA)"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Fallback: direkt GitHub-Release (latest)
|
||||
if [ -z "$VER" ]; then
|
||||
VER="$(wget -q -O - "https://api.github.com/repos/netbirdio/netbird/releases/latest" 2>/dev/null \
|
||||
| grep -o '"tag_name":[^,]*' | head -1 | grep -o '[0-9][0-9.]*' | head -1)"
|
||||
[ -n "$VER" ] || { VER="$FALLBACK_VER"; warn "Weder Gitea noch GitHub-API erreichbar – Fallback $VER."; }
|
||||
URL="https://github.com/netbirdio/netbird/releases/download/v${VER}/netbird_${VER}_linux_${NBARCH}.tar.gz"
|
||||
SHAURL=""
|
||||
SRC="GitHub"
|
||||
fi
|
||||
log "Zielversion: $VER (Quelle: $SRC)"
|
||||
|
||||
# 5) Download + (optional) SHA256-Verifikation + Installation -----------------
|
||||
TARBALL="netbird_${VER}_linux_${NBARCH}.tar.gz"
|
||||
TMP="/tmp/nb-install.$$"
|
||||
rm -rf "$TMP"; mkdir -p "$TMP"
|
||||
log "Lade $URL ..."
|
||||
wget -q -O "$TMP/$TARBALL" "$URL" || die "Download fehlgeschlagen ($URL)"
|
||||
|
||||
# SHA256 prüfen, wenn eine Prüfsumme verfügbar ist und sha256sum existiert
|
||||
if [ -n "$SHAURL" ] && command -v sha256sum >/dev/null 2>&1 && wget -q -O "$TMP/sha" "$SHAURL" 2>/dev/null; then
|
||||
EXP="$(awk '{print $1}' "$TMP/sha" 2>/dev/null)"
|
||||
GOT="$(sha256sum "$TMP/$TARBALL" 2>/dev/null | awk '{print $1}')"
|
||||
if [ -n "$EXP" ] && [ -n "$GOT" ]; then
|
||||
[ "$EXP" = "$GOT" ] && log "SHA256 ok ($GOT)" || die "SHA256-Mismatch! erwartet=$EXP bekommen=$GOT"
|
||||
fi
|
||||
fi
|
||||
|
||||
tar -xzf "$TMP/$TARBALL" -C "$TMP" || die "Entpacken fehlgeschlagen."
|
||||
[ -f "$TMP/netbird" ] || die "netbird-Binary nicht im Archiv gefunden."
|
||||
|
||||
# laufenden Dienst vor dem Überschreiben stoppen (= Upgrade)
|
||||
[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true
|
||||
|
||||
install -m 0755 "$TMP/netbird" "$BIN" || die "Konnte $BIN nicht schreiben (Speicher voll?)."
|
||||
rm -rf "$TMP"
|
||||
log "Installiert: $("$BIN" version 2>/dev/null || echo '?')"
|
||||
|
||||
# 6) Persistente Verzeichnisse ----------------------------------------------
|
||||
mkdir -p "$CONF_DIR" /var/lib/netbird /var/log/netbird
|
||||
chmod 700 "$CONF_DIR"
|
||||
|
||||
# 7) procd-Init-Script ------------------------------------------------------
|
||||
# --config zeigt auf das PERSISTENTE Profil (/etc), --disable-profiles
|
||||
# hält es als Single-Config simpel. NB_DISABLE_SSH_CONFIG schützt das
|
||||
# Router-SSH davor, von NetBird umgeschrieben zu werden.
|
||||
log "Schreibe procd-Service $INIT ..."
|
||||
cat > "$INIT" <<INITEOF
|
||||
#!/bin/sh /etc/rc.common
|
||||
# NetBird (self-hosted) – procd service
|
||||
USE_PROCD=1
|
||||
START=99
|
||||
STOP=10
|
||||
|
||||
CONF="${PROFILE}"
|
||||
SOCK="${SOCK}"
|
||||
|
||||
start_service() {
|
||||
mkdir -p /var/lib/netbird /var/run /var/log/netbird
|
||||
procd_open_instance netbird
|
||||
procd_set_param command ${BIN} service run \\
|
||||
--config "\$CONF" \\
|
||||
--disable-profiles \\
|
||||
--daemon-addr "\$SOCK" \\
|
||||
--log-level info
|
||||
procd_set_param env NB_DISABLE_SSH_CONFIG=1
|
||||
procd_set_param pidfile /var/run/netbird.pid
|
||||
procd_set_param respawn 3600 5 0
|
||||
procd_set_param stdout 1
|
||||
procd_set_param stderr 1
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
${BIN} down 2>/dev/null || true
|
||||
}
|
||||
INITEOF
|
||||
chmod +x "$INIT"
|
||||
|
||||
# 8) Dienst aktivieren + starten -------------------------------------------
|
||||
log "Aktiviere + starte Dienst ..."
|
||||
"$INIT" enable
|
||||
"$INIT" start
|
||||
sleep 3
|
||||
|
||||
# 9) Enrollment -------------------------------------------------------------
|
||||
echo
|
||||
if [ -n "$SETUP_KEY" ] && [ "$SETUP_KEY" != "install" ]; then
|
||||
log "Enrolle gegen $MGMT_URL ..."
|
||||
if "$BIN" up --config "$PROFILE" --management-url "$MGMT_URL" --setup-key "$SETUP_KEY"; then
|
||||
sleep 3
|
||||
echo
|
||||
"$BIN" status 2>/dev/null | grep -iE 'Management|Signal|Relay|FQDN|NetBird IP' || true
|
||||
echo
|
||||
log "FERTIG ✓ Router ist im NetBird-Netz."
|
||||
else
|
||||
warn "Enroll fehlgeschlagen. Manuell nachholen:"
|
||||
echo " $BIN up --management-url $MGMT_URL --setup-key <SETUP_KEY>"
|
||||
fi
|
||||
else
|
||||
log "Installation fertig. Zum Verbinden noch enrollen (Setup-Key aus dem NetBird-Dashboard):"
|
||||
echo
|
||||
echo " netbird up --management-url $MGMT_URL --setup-key <DEIN_SETUP_KEY>"
|
||||
fi
|
||||
|
||||
# 10) Hinweise --------------------------------------------------------------
|
||||
cat <<NOTES
|
||||
|
||||
------------------------------------------------------------------------
|
||||
Befehle:
|
||||
netbird status Verbindungsstatus
|
||||
netbird status -d Details (Peers, Routen)
|
||||
/etc/init.d/netbird restart Dienst neu starten
|
||||
sh $0 status Versions-/Statuscheck
|
||||
sh $0 uninstall restlos entfernen
|
||||
|
||||
Persistenz: Profil/Key in $CONF_DIR (Reboot- und Upgrade-fest)
|
||||
Interface: wt0 Version: $VER
|
||||
------------------------------------------------------------------------
|
||||
NOTES
|
||||
Reference in New Issue
Block a user