234 lines
9.4 KiB
Bash
234 lines
9.4 KiB
Bash
#!/bin/sh
|
||
# =============================================================================
|
||
# NetBird-Installer für GL.iNet Slate 7 (GL-BE3600 / aarch64 / OpenWrt)
|
||
# Zielserver (self-hosted): https://nb.digiflo.at:443
|
||
# -----------------------------------------------------------------------------
|
||
# Holt das aktuelle statische NetBird-Binary (matcht den :latest-Server),
|
||
# richtet einen reboot-festen procd-Dienst ein und enrollt optional gleich.
|
||
#
|
||
# AUSFÜHRUNG (als root auf dem Router):
|
||
# sh install-netbird-slate7.sh # nur installieren
|
||
# sh install-netbird-slate7.sh <SETUP_KEY> # installieren + enrollen
|
||
# sh install-netbird-slate7.sh status # Status anzeigen
|
||
# sh install-netbird-slate7.sh uninstall # restlos entfernen
|
||
#
|
||
# Persistenz: Profil/Key liegen in /etc/netbird/ -> übersteht Reboot UND
|
||
# Firmware-Upgrade (sysupgrade behält /etc). NICHT bei Werks-Reset.
|
||
# =============================================================================
|
||
|
||
set -e
|
||
|
||
# ---- Konfiguration ----------------------------------------------------------
|
||
MGMT_URL="https://nb.digiflo.at:443" # self-hosted Management
|
||
GITEA="https://gitea.digiflo.at" # eigener Deploy-Server (Primärquelle)
|
||
GITEA_REPO="digiflo/netbird-slate7" # Repo mit den gespiegelten Releases
|
||
FALLBACK_VER="0.73.1" # falls weder Gitea noch GitHub antworten
|
||
CONF_DIR="/etc/netbird" # persistent (überlebt Reboot+Upgrade)
|
||
PROFILE="${CONF_DIR}/default.json" # hier liegt PrivateKey/ManagementURL
|
||
SOCK="unix:///var/run/netbird.sock"
|
||
BIN="/usr/bin/netbird"
|
||
INIT="/etc/init.d/netbird"
|
||
# -----------------------------------------------------------------------------
|
||
|
||
log() { echo ">>> $*"; }
|
||
warn() { echo "!!! $*" >&2; }
|
||
die() { echo "FEHLER: $*" >&2; exit 1; }
|
||
|
||
[ "$(id -u)" = "0" ] || die "Bitte als root ausführen."
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# UNINSTALL
|
||
# ---------------------------------------------------------------------------
|
||
if [ "$1" = "uninstall" ]; then
|
||
log "Entferne NetBird ..."
|
||
[ -x "$INIT" ] && { "$INIT" stop 2>/dev/null || true; "$INIT" disable 2>/dev/null || true; }
|
||
"$BIN" down 2>/dev/null || true
|
||
rm -f "$INIT" "$BIN"
|
||
rm -rf "$CONF_DIR" /var/lib/netbird /var/run/netbird.sock /var/log/netbird
|
||
log "NetBird entfernt. (WireGuard-Interface wt0 verschwindet beim nächsten Reboot bzw. ist schon weg.)"
|
||
exit 0
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# STATUS
|
||
# ---------------------------------------------------------------------------
|
||
if [ "$1" = "status" ]; then
|
||
[ -x "$BIN" ] || die "NetBird ist nicht installiert."
|
||
"$BIN" version
|
||
echo
|
||
"$BIN" status -d 2>/dev/null || "$BIN" status 2>/dev/null || warn "Daemon läuft nicht. Start: $INIT start"
|
||
exit 0
|
||
fi
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# INSTALL (+ optional Enroll)
|
||
# ---------------------------------------------------------------------------
|
||
SETUP_KEY="$1"
|
||
|
||
# 1) Architektur ------------------------------------------------------------
|
||
ARCH="$(uname -m)"
|
||
case "$ARCH" in
|
||
aarch64|arm64) NBARCH="arm64" ;;
|
||
armv7l|armv7) NBARCH="armv6" ;;
|
||
armv6l) NBARCH="armv6" ;;
|
||
x86_64) NBARCH="amd64" ;;
|
||
mips) NBARCH="mips_softfloat" ;;
|
||
*) warn "Unbekannte Architektur '$ARCH' – versuche arm64."; NBARCH="arm64" ;;
|
||
esac
|
||
log "Architektur: $ARCH -> NetBird-Build linux_${NBARCH}"
|
||
|
||
# 2) Speicherplatz prüfen (Binary ~45 MB) -----------------------------------
|
||
log "Freier Speicher:"
|
||
df -h / /overlay 2>/dev/null | grep -viE 'tmpfs|^Filesystem' | sed 's/^/ /' || true
|
||
|
||
# 3) Abhängigkeiten (Kernel-WireGuard) – auf GL-Firmware i.d.R. schon da -----
|
||
log "Prüfe Abhängigkeiten (Kernel-WireGuard, CA-Zertifikate) ..."
|
||
opkg update >/dev/null 2>&1 || warn "opkg update fehlgeschlagen (offline?) – fahre fort."
|
||
for p in kmod-wireguard wireguard-tools ca-bundle kmod-tun; do
|
||
if opkg list-installed 2>/dev/null | grep -q "^$p "; then
|
||
:
|
||
else
|
||
opkg install "$p" >/dev/null 2>&1 \
|
||
&& log " installiert: $p" \
|
||
|| warn " '$p' nicht via opkg verfügbar – auf GL-Firmware meist bereits enthalten."
|
||
fi
|
||
done
|
||
# WireGuard-Kernelmodul laden (falls vorhanden, nicht geladen)
|
||
modprobe wireguard 2>/dev/null || true
|
||
|
||
# 4) Versionsquelle: PRIMÄR eigenes Gitea-Release, sonst GitHub --------------
|
||
log "Ermittle NetBird-Version ..."
|
||
VER=""; SRC=""; URL=""; SHAURL=""
|
||
|
||
# Primär: gespiegeltes Gitea-Release (der „Deploy"; nur arm64 wird gespiegelt)
|
||
if [ "$NBARCH" = "arm64" ]; then
|
||
TAG="$(wget -q -O - "$GITEA/api/v1/repos/$GITEA_REPO/releases/latest" 2>/dev/null \
|
||
| grep -o '"tag_name":"[^"]*"' | head -1 | sed 's/.*"tag_name":"\([^"]*\)".*/\1/')"
|
||
if [ -n "$TAG" ]; then
|
||
VER="${TAG#v}"
|
||
URL="$GITEA/$GITEA_REPO/releases/download/$TAG/netbird_${VER}_linux_arm64.tar.gz"
|
||
SHAURL="${URL}.sha256"
|
||
SRC="Gitea ($GITEA)"
|
||
fi
|
||
fi
|
||
|
||
# Fallback: direkt GitHub-Release (latest)
|
||
if [ -z "$VER" ]; then
|
||
VER="$(wget -q -O - "https://api.github.com/repos/netbirdio/netbird/releases/latest" 2>/dev/null \
|
||
| grep -o '"tag_name":[^,]*' | head -1 | grep -o '[0-9][0-9.]*' | head -1)"
|
||
[ -n "$VER" ] || { VER="$FALLBACK_VER"; warn "Weder Gitea noch GitHub-API erreichbar – Fallback $VER."; }
|
||
URL="https://github.com/netbirdio/netbird/releases/download/v${VER}/netbird_${VER}_linux_${NBARCH}.tar.gz"
|
||
SHAURL=""
|
||
SRC="GitHub"
|
||
fi
|
||
log "Zielversion: $VER (Quelle: $SRC)"
|
||
|
||
# 5) Download + (optional) SHA256-Verifikation + Installation -----------------
|
||
TARBALL="netbird_${VER}_linux_${NBARCH}.tar.gz"
|
||
TMP="/tmp/nb-install.$$"
|
||
rm -rf "$TMP"; mkdir -p "$TMP"
|
||
log "Lade $URL ..."
|
||
wget -q -O "$TMP/$TARBALL" "$URL" || die "Download fehlgeschlagen ($URL)"
|
||
|
||
# SHA256 prüfen, wenn eine Prüfsumme verfügbar ist und sha256sum existiert
|
||
if [ -n "$SHAURL" ] && command -v sha256sum >/dev/null 2>&1 && wget -q -O "$TMP/sha" "$SHAURL" 2>/dev/null; then
|
||
EXP="$(awk '{print $1}' "$TMP/sha" 2>/dev/null)"
|
||
GOT="$(sha256sum "$TMP/$TARBALL" 2>/dev/null | awk '{print $1}')"
|
||
if [ -n "$EXP" ] && [ -n "$GOT" ]; then
|
||
[ "$EXP" = "$GOT" ] && log "SHA256 ok ($GOT)" || die "SHA256-Mismatch! erwartet=$EXP bekommen=$GOT"
|
||
fi
|
||
fi
|
||
|
||
tar -xzf "$TMP/$TARBALL" -C "$TMP" || die "Entpacken fehlgeschlagen."
|
||
[ -f "$TMP/netbird" ] || die "netbird-Binary nicht im Archiv gefunden."
|
||
|
||
# laufenden Dienst vor dem Überschreiben stoppen (= Upgrade)
|
||
[ -x "$INIT" ] && "$INIT" stop 2>/dev/null || true
|
||
|
||
install -m 0755 "$TMP/netbird" "$BIN" || die "Konnte $BIN nicht schreiben (Speicher voll?)."
|
||
rm -rf "$TMP"
|
||
log "Installiert: $("$BIN" version 2>/dev/null || echo '?')"
|
||
|
||
# 6) Persistente Verzeichnisse ----------------------------------------------
|
||
mkdir -p "$CONF_DIR" /var/lib/netbird /var/log/netbird
|
||
chmod 700 "$CONF_DIR"
|
||
|
||
# 7) procd-Init-Script ------------------------------------------------------
|
||
# --config zeigt auf das PERSISTENTE Profil (/etc), --disable-profiles
|
||
# hält es als Single-Config simpel. NB_DISABLE_SSH_CONFIG schützt das
|
||
# Router-SSH davor, von NetBird umgeschrieben zu werden.
|
||
log "Schreibe procd-Service $INIT ..."
|
||
cat > "$INIT" <<INITEOF
|
||
#!/bin/sh /etc/rc.common
|
||
# NetBird (self-hosted) – procd service
|
||
USE_PROCD=1
|
||
START=99
|
||
STOP=10
|
||
|
||
CONF="${PROFILE}"
|
||
SOCK="${SOCK}"
|
||
|
||
start_service() {
|
||
mkdir -p /var/lib/netbird /var/run /var/log/netbird
|
||
procd_open_instance netbird
|
||
procd_set_param command ${BIN} service run \\
|
||
--config "\$CONF" \\
|
||
--disable-profiles \\
|
||
--daemon-addr "\$SOCK" \\
|
||
--log-level info
|
||
procd_set_param env NB_DISABLE_SSH_CONFIG=1
|
||
procd_set_param pidfile /var/run/netbird.pid
|
||
procd_set_param respawn 3600 5 0
|
||
procd_set_param stdout 1
|
||
procd_set_param stderr 1
|
||
procd_close_instance
|
||
}
|
||
|
||
stop_service() {
|
||
${BIN} down 2>/dev/null || true
|
||
}
|
||
INITEOF
|
||
chmod +x "$INIT"
|
||
|
||
# 8) Dienst aktivieren + starten -------------------------------------------
|
||
log "Aktiviere + starte Dienst ..."
|
||
"$INIT" enable
|
||
"$INIT" start
|
||
sleep 3
|
||
|
||
# 9) Enrollment -------------------------------------------------------------
|
||
echo
|
||
if [ -n "$SETUP_KEY" ] && [ "$SETUP_KEY" != "install" ]; then
|
||
log "Enrolle gegen $MGMT_URL ..."
|
||
if "$BIN" up --config "$PROFILE" --management-url "$MGMT_URL" --setup-key "$SETUP_KEY"; then
|
||
sleep 3
|
||
echo
|
||
"$BIN" status 2>/dev/null | grep -iE 'Management|Signal|Relay|FQDN|NetBird IP' || true
|
||
echo
|
||
log "FERTIG ✓ Router ist im NetBird-Netz."
|
||
else
|
||
warn "Enroll fehlgeschlagen. Manuell nachholen:"
|
||
echo " $BIN up --management-url $MGMT_URL --setup-key <SETUP_KEY>"
|
||
fi
|
||
else
|
||
log "Installation fertig. Zum Verbinden noch enrollen (Setup-Key aus dem NetBird-Dashboard):"
|
||
echo
|
||
echo " netbird up --management-url $MGMT_URL --setup-key <DEIN_SETUP_KEY>"
|
||
fi
|
||
|
||
# 10) Hinweise --------------------------------------------------------------
|
||
cat <<NOTES
|
||
|
||
------------------------------------------------------------------------
|
||
Befehle:
|
||
netbird status Verbindungsstatus
|
||
netbird status -d Details (Peers, Routen)
|
||
/etc/init.d/netbird restart Dienst neu starten
|
||
sh $0 status Versions-/Statuscheck
|
||
sh $0 uninstall restlos entfernen
|
||
|
||
Persistenz: Profil/Key in $CONF_DIR (Reboot- und Upgrade-fest)
|
||
Interface: wt0 Version: $VER
|
||
------------------------------------------------------------------------
|
||
NOTES
|