spb/internetpressure

1#!/usr/bin/env bash2# One-off preparation of BHS64b: Docker (already present), WireGuard wg1 to the BHS64 hub, ufw, directories, .env.3#   deploy/bin/prep-server.sh            (idempotent)4source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"56HUB_PUB="QrpSXW8mIJjGMuB3eiP2LQJGpFgV6lTmBG9v0Cxsiz0="   # BHS64 hub public key (see cluster-skill/maclustr-tunnel/hub-BHS64.pub)7HUB_IP="51.161.112.61"89log "packages"10rssh "sudo apt-get install -y -qq wireguard-tools traceroute >/dev/null && docker --version && docker compose version"1112log "WireGuard wg1 → BHS64 hub ($IP_WG_IP)"13rssh "sudo test -f /etc/wireguard/wg1.key || (umask 077; wg genkey | sudo tee /etc/wireguard/wg1.key >/dev/null)"14PUB=$(rssh "sudo cat /etc/wireguard/wg1.key | wg pubkey")15rssh "sudo tee /etc/wireguard/wg1.conf >/dev/null <<EOF16[Interface]17Address = $IP_WG_IP/2418PrivateKey = \$(sudo cat /etc/wireguard/wg1.key)19[Peer]20# BHS64 hub (MacLustr Tunnel public gateway)21PublicKey = $HUB_PUB22AllowedIPs = 10.67.0.1/3223Endpoint = $HUB_IP:5182024PersistentKeepalive = 2525EOF26sudo chmod 600 /etc/wireguard/wg1.conf && sudo systemctl enable --now wg-quick@wg1 >/dev/null 2>&1; sudo systemctl restart wg-quick@wg1; sudo wg show wg1 | head -3"2728log "register peer BHS64b on the gateway"29ssh -o BatchMode=yes "$IP_GATEWAY" "grep -q '^BHS64b' /etc/maclustr-tunnel/ipmap || echo 'BHS64b  $IP_WG_IP' | sudo tee -a /etc/maclustr-tunnel/ipmap >/dev/null; sudo tunnelctl peer add BHS64b $PUB; sudo tunnelctl peer ls | grep BHS64b"30sleep 331ssh -o BatchMode=yes "$IP_GATEWAY" "ping -c 2 -W 2 $IP_WG_IP | tail -1"3233log "firewall (ufw): keep 22 + wireguard; nothing else public (edge is bound to the wg address)"34rssh "sudo ufw allow 51820/udp >/dev/null; sudo ufw status | head -5"3536log "directories + env"37rssh "sudo mkdir -p $IP_REMOTE_DIR && sudo chown \$(id -un):\$(id -gn) $IP_REMOTE_DIR"38if ! rssh "test -f $IP_REMOTE_DIR/deploy/.env"; then39  warn "no deploy/.env on the server yet — generating one from deploy/.env.example with random secrets"40  PG=$(openssl rand -hex 24); CH=$(openssl rand -hex 24); AT=$(openssl rand -hex 24)41  sed -e "s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$PG/" -e "s/^CLICKHOUSE_PASSWORD=.*/CLICKHOUSE_PASSWORD=$CH/" \42      -e "s/^IP_ADMIN_TOKEN=.*/IP_ADMIN_TOKEN=$AT/" -e "s/^WG_IP=.*/WG_IP=$IP_WG_IP/" "$REPO_ROOT/deploy/.env.example" > /tmp/ip-env43  rssh "mkdir -p $IP_REMOTE_DIR/deploy" && scp -q /tmp/ip-env "$IP_SERVER:$IP_REMOTE_DIR/deploy/.env" && rm /tmp/ip-env44  mkdir -p "$HOME/.internetpressure" && rssh "cat $IP_REMOTE_DIR/deploy/.env" > "$HOME/.internetpressure/env.bhs64b" && chmod 600 "$HOME/.internetpressure/env.bhs64b"45  ok "secrets saved locally in ~/.internetpressure/env.bhs64b"46fi47ok "server prepared"48