spb/internetpressure

1#!/usr/bin/env bash2# InternetPressure.io probe agent installer (idempotent).3#4#   sudo deploy/install.sh <probe_id> <key> [ingest_url]5#6# - picks dist/ip-probe-<os>-<arch> (or $IP_PROBE_BINARY) and installs it to /usr/local/bin/ip-probe7# - writes /etc/internetpressure/probe.yaml (0600) — existing file is kept unless probe_id/key/url differ8# - creates /var/lib/internetpressure (0700, owned by the service user)9# - macOS: installs the LaunchDaemon (UserName = $IP_PROBE_USER, default: the invoking user) and bootstraps it10# - Linux: creates the ip-probe system user, sets net.ipv4.ping_group_range, installs + enables the unit11# Re-running upgrades the binary and restarts the service.12set -euo pipefail1314PROBE_ID="${1:-}"15KEY="${2:-}"16INGEST_URL="${3:-https://www.internetpressure.io/ingest/v1}"1718if [[ -z "$PROBE_ID" || -z "$KEY" ]]; then19  echo "usage: sudo $0 <probe_id> <key> [ingest_url]" >&220  exit 221fi22if [[ ! "$PROBE_ID" =~ ^[a-z0-9][a-z0-9-]{1,63}$ ]]; then23  echo "probe_id must be lowercase letters/digits/dashes" >&2; exit 224fi25if [[ ! "$KEY" =~ ^[0-9a-fA-F]{64}$ ]]; then26  echo "key must be 64 hex characters" >&2; exit 227fi28if [[ "$(id -u)" -ne 0 ]]; then29  echo "run as root (sudo)" >&2; exit 130fi3132HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"33OS="$(uname -s | tr '[:upper:]' '[:lower:]')"34ARCH="$(uname -m)"35case "$ARCH" in36  arm64|aarch64) ARCH=arm64 ;;37  x86_64|amd64)  ARCH=amd64 ;;38esac39BIN_SRC="${IP_PROBE_BINARY:-$HERE/dist/ip-probe-$OS-$ARCH}"40if [[ ! -x "$BIN_SRC" ]]; then41  echo "binary not found: $BIN_SRC (run 'make build' first or set IP_PROBE_BINARY)" >&2; exit 142fi4344BIN_DST=/usr/local/bin/ip-probe45CONF_DIR=/etc/internetpressure46CONF="$CONF_DIR/probe.yaml"47DATA_DIR=/var/lib/internetpressure48LOG=/var/log/internetpressure-probe.log4950if [[ "$OS" == "darwin" ]]; then51  SVC_USER="${IP_PROBE_USER:-${SUDO_USER:-root}}"52  SVC_GROUP="$(id -gn "$SVC_USER")"53else54  SVC_USER="${IP_PROBE_USER:-ip-probe}"55  if ! id "$SVC_USER" >/dev/null 2>&1; then56    useradd --system --home-dir "$DATA_DIR" --shell /usr/sbin/nologin --user-group "$SVC_USER" 2>/dev/null \57      || adduser --system --home "$DATA_DIR" --no-create-home --group "$SVC_USER"58    echo "created system user $SVC_USER"59  fi60  SVC_GROUP="$(id -gn "$SVC_USER")"61fi6263# --- binary ---------------------------------------------------------------------------------------------------64NEW_VERSION="$("$BIN_SRC" --version | awk '{print $2}')"65OLD_VERSION="$([[ -x "$BIN_DST" ]] && "$BIN_DST" --version 2>/dev/null | awk '{print $2}' || echo none)"66install -d -m 0755 /usr/local/bin67install -m 0755 "$BIN_SRC" "$BIN_DST.new"68mv -f "$BIN_DST.new" "$BIN_DST"69echo "binary: $OLD_VERSION → $NEW_VERSION at $BIN_DST"7071# --- config ---------------------------------------------------------------------------------------------------72install -d -m 0755 "$CONF_DIR"73TMP_CONF="$(mktemp)"74cat > "$TMP_CONF" <<EOF75# Written by deploy/install.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ). Edit freely; re-running the installer with the76# same probe_id/key/url keeps your changes.77probe_id: $PROBE_ID78key: $(echo "$KEY" | tr '[:upper:]' '[:lower:]')79ingest_url: $INGEST_URL80data_dir: $DATA_DIR81listen: 127.0.0.1:938182log_level: info83allow_self_update: true84resolvers_override: []85max_concurrency: 4886EOF87if [[ -f "$CONF" ]] && diff -q <(grep -v '^#' "$CONF") <(grep -v '^#' "$TMP_CONF") >/dev/null 2>&1; then88  echo "config: unchanged ($CONF)"89  rm -f "$TMP_CONF"90else91  install -m 0600 -o "$SVC_USER" -g "$SVC_GROUP" "$TMP_CONF" "$CONF"92  rm -f "$TMP_CONF"93  echo "config: written $CONF"94fi95"$BIN_DST" check-config --config "$CONF" >/dev/null9697# --- data dir + log --------------------------------------------------------------------------------------------98install -d -m 0700 -o "$SVC_USER" -g "$SVC_GROUP" "$DATA_DIR"99touch "$LOG"; chown "$SVC_USER:$SVC_GROUP" "$LOG"; chmod 0640 "$LOG"100101# --- service --------------------------------------------------------------------------------------------------102if [[ "$OS" == "darwin" ]]; then103  PLIST=/Library/LaunchDaemons/io.internetpressure.probe.plist104  sed "s/__USER__/$SVC_USER/" "$HERE/deploy/launchd/io.internetpressure.probe.plist" > "$PLIST.new"105  chown root:wheel "$PLIST.new"; chmod 0644 "$PLIST.new"106  if launchctl print system/io.internetpressure.probe >/dev/null 2>&1; then107    launchctl bootout system/io.internetpressure.probe || true108    sleep 1109  fi110  mv -f "$PLIST.new" "$PLIST"111  launchctl bootstrap system "$PLIST"112  launchctl kickstart -k system/io.internetpressure.probe113  echo "service: launchd io.internetpressure.probe running as $SVC_USER"114  echo "logs:    tail -f $LOG"115else116  if [[ ! -x /usr/bin/traceroute && ! -x /usr/sbin/traceroute ]]; then117    echo "warning: traceroute not installed (apt install traceroute) — traceroute checks disabled" >&2118  fi119  install -d -m 0755 /etc/sysctl.d120  echo 'net.ipv4.ping_group_range = 0 2147483647' > /etc/sysctl.d/60-ip-probe.conf121  sysctl -q -p /etc/sysctl.d/60-ip-probe.conf || sysctl -q -w net.ipv4.ping_group_range="0 2147483647" || true122  install -m 0644 "$HERE/deploy/systemd/ip-probe.service" /etc/systemd/system/ip-probe.service123  if [[ "$SVC_USER" != "ip-probe" ]]; then124    sed -i "s/^User=.*/User=$SVC_USER/; s/^Group=.*/Group=$SVC_GROUP/" /etc/systemd/system/ip-probe.service125  fi126  systemctl daemon-reload127  systemctl enable --now ip-probe.service128  systemctl restart ip-probe.service129  echo "service: systemd ip-probe.service running as $SVC_USER"130  echo "logs:    journalctl -u ip-probe -f"131fi132133sleep 2134if curl -fsS http://127.0.0.1:9381/healthz >/dev/null 2>&1; then135  echo "health:  $(curl -fsS http://127.0.0.1:9381/healthz)"136else137  echo "health:  endpoint not answering yet (check the logs)"138fi139