mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 05:36:15 +00:00
feat: monky-deployd v0.1.0 — pull agent over the mesh (ADR-0028)
Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.
Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.
Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
This commit is contained in:
Executable
+222
@@ -0,0 +1,222 @@
|
||||
#!/usr/bin/env bash
|
||||
# monky-deployd installer — Ubuntu 26.04 (verified target).
|
||||
#
|
||||
# curl -fsSL https://gitea.cbs.tikali.net/mdella/monky-deployd/raw/branch/main/packaging/install.sh \
|
||||
# | sudo bash -s -- --env env-qa-02 --site cbs [--transport sdk|proxy|system] [--version 0.1.0] \
|
||||
# [--enrol-jwt /path/monky-host.env-qa-02.jwt] [--laptop] < bootstrap.jwt
|
||||
#
|
||||
# stdin (or --bootstrap-file): the ONE-TIME bootstrap deploy grant from the install kit
|
||||
# (GET /v1/backends/{id}/agent/install). The enrolment JWT is read from --enrol-jwt or
|
||||
# /etc/monky-deployd/enrol.jwt and is only needed when the host identity is not enrolled yet.
|
||||
#
|
||||
# What it does (idempotent):
|
||||
# 1. apt: ziti-edge-tunnel (OpenZiti `jammy` suite) if absent, docker-compose-plugin, acl
|
||||
# 2. downloads the pinned monky-deployd_<ver>_amd64.deb + .sha256 from the Gitea release, verifies, installs
|
||||
# 3. enrols /opt/openziti/etc/identities/monky-host.<env>.json if absent (ziti-edge-tunnel enroll),
|
||||
# chown ziti:ziti 0600, switches ziti-edge-tunnel.service to `run-host` via a drop-in
|
||||
# 4. writes /etc/monky-deployd/config.yaml, ACLs so user monky-deployd can read the identity,
|
||||
# the bootstrap grant 0600, (proxy transport: proxy.env + monky-deployd-proxy.service)
|
||||
# 5. enables monky-deployd.timer, runs one tick, deletes the enrol JWT, prints the checklist
|
||||
set -euo pipefail
|
||||
umask 077
|
||||
|
||||
DEFAULT_VERSION="0.1.0"
|
||||
BASE_URL="${MONKY_DEPLOYD_BASE_URL:-https://gitea.cbs.tikali.net/mdella/monky-deployd}"
|
||||
OPENZITI_SUITE="${OPENZITI_SUITE:-jammy}"
|
||||
IDENTITY_DIR="/opt/openziti/etc/identities"
|
||||
ETC="/etc/monky-deployd"
|
||||
ENV_ID="" SITE="" TRANSPORT="sdk" VERSION="$DEFAULT_VERSION" ENROL_JWT="" BOOTSTRAP_FILE="" NO_RUN="" FORCE_CONFIG="" BAO_CA="" LAPTOP="false"
|
||||
|
||||
usage() { sed -n '2,20p' "$0"; exit "${1:-0}"; }
|
||||
die() { echo "install.sh: $*" >&2; exit 1; }
|
||||
log() { echo "==> $*"; }
|
||||
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--env) ENV_ID="$2"; shift 2 ;;
|
||||
--site) SITE="$2"; shift 2 ;;
|
||||
--transport) TRANSPORT="$2"; shift 2 ;;
|
||||
--version) VERSION="$2"; shift 2 ;;
|
||||
--enrol-jwt) ENROL_JWT="$2"; shift 2 ;;
|
||||
--bootstrap-file) BOOTSTRAP_FILE="$2"; shift 2 ;;
|
||||
--bao-ca) BAO_CA="$2"; shift 2 ;;
|
||||
--base-url) BASE_URL="$2"; shift 2 ;;
|
||||
--laptop) LAPTOP="true"; shift ;;
|
||||
--no-run) NO_RUN=1; shift ;;
|
||||
--force-config) FORCE_CONFIG=1; shift ;;
|
||||
-h|--help) usage 0 ;;
|
||||
*) die "unknown argument $1 (see --help)" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
[ "$(id -u)" = 0 ] || die "run as root (sudo)"
|
||||
[ -n "$ENV_ID" ] || die "--env is required"
|
||||
[ -n "$SITE" ] || die "--site is required"
|
||||
[[ "$ENV_ID" =~ ^env-(dev|qa|stage|prod)-[0-9]{2,3}$|^(dev-env-2|prod-cedar)$ ]] || die "env id $ENV_ID is not env-<tier>-<nn>"
|
||||
SITE="${SITE,,}"
|
||||
[[ "$SITE" =~ ^(cbs|pdx)$ ]] || die "site must be cbs|pdx"
|
||||
[[ "$TRANSPORT" =~ ^(sdk|proxy|system)$ ]] || die "transport must be sdk|proxy|system"
|
||||
IDENTITY="$IDENTITY_DIR/monky-host.$ENV_ID.json"
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
if [ -r /etc/os-release ]; then
|
||||
. /etc/os-release
|
||||
if [ "${ID:-}" != "ubuntu" ] || [ "${VERSION_ID:-}" != "26.04" ]; then
|
||||
echo "WARNING: verified on Ubuntu 26.04; this is ${PRETTY_NAME:-unknown}. Continuing." >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
# --- 1. packages -------------------------------------------------------------------------------------
|
||||
apt_updated=""
|
||||
apt_update_once() { [ -n "$apt_updated" ] || { apt-get update -qq; apt_updated=1; }; }
|
||||
need_pkgs=(acl curl ca-certificates gnupg)
|
||||
if ! command -v ziti-edge-tunnel >/dev/null 2>&1; then
|
||||
log "adding the OpenZiti apt repository ($OPENZITI_SUITE suite)"
|
||||
install -d -m 0755 /usr/share/keyrings
|
||||
curl -fsSL https://get.openziti.io/tun/package-repos.gpg | gpg --dearmor -o /usr/share/keyrings/openziti.gpg
|
||||
chmod 0644 /usr/share/keyrings/openziti.gpg
|
||||
echo "deb [signed-by=/usr/share/keyrings/openziti.gpg] https://packages.openziti.org/zitipax-openziti-deb-stable $OPENZITI_SUITE main" \
|
||||
> /etc/apt/sources.list.d/openziti.list
|
||||
need_pkgs+=(ziti-edge-tunnel)
|
||||
fi
|
||||
if [ "$TRANSPORT" = "proxy" ] && ! command -v ziti >/dev/null 2>&1; then
|
||||
need_pkgs+=(openziti) # the `ziti` CLI (ziti tunnel proxy) from the same repo
|
||||
fi
|
||||
command -v docker >/dev/null 2>&1 || die "docker is not installed; install Docker Engine first (https://docs.docker.com/engine/install/ubuntu/)"
|
||||
docker compose version >/dev/null 2>&1 || need_pkgs+=(docker-compose-plugin)
|
||||
python3 -c 'import sys; sys.exit(0 if sys.version_info >= (3, 12) else 1)' 2>/dev/null || die "python3 >= 3.12 is required"
|
||||
if [ "${#need_pkgs[@]}" -gt 0 ]; then
|
||||
log "apt install: ${need_pkgs[*]}"
|
||||
apt_update_once
|
||||
apt-get install -y -qq --no-install-recommends "${need_pkgs[@]}"
|
||||
fi
|
||||
|
||||
# --- 2. the pinned .deb -----------------------------------------------------------------------------
|
||||
installed="$(dpkg-query -W -f='${Version}' monky-deployd 2>/dev/null || true)"
|
||||
if [ "$installed" = "$VERSION" ]; then
|
||||
log "monky-deployd $VERSION already installed"
|
||||
else
|
||||
tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
|
||||
deb="monky-deployd_${VERSION}_amd64.deb"
|
||||
url="$BASE_URL/releases/download/v${VERSION}"
|
||||
log "downloading $deb from $url"
|
||||
curl -fsSL -o "$tmp/$deb" "$url/$deb"
|
||||
curl -fsSL -o "$tmp/$deb.sha256" "$url/$deb.sha256"
|
||||
(cd "$tmp" && sha256sum -c "$deb.sha256") || die "sha256 mismatch on $deb"
|
||||
apt_update_once || true
|
||||
apt-get install -y -qq "$tmp/$deb"
|
||||
fi
|
||||
command -v monky-deployd >/dev/null || die "monky-deployd not on PATH after install"
|
||||
|
||||
# --- 3. host identity -------------------------------------------------------------------------------
|
||||
install -d -m 0750 "$IDENTITY_DIR"
|
||||
[ -n "$ENROL_JWT" ] || { [ -f "$ETC/enrol.jwt" ] && ENROL_JWT="$ETC/enrol.jwt"; } || true
|
||||
if [ -s "$IDENTITY" ]; then
|
||||
log "host identity present: $IDENTITY"
|
||||
else
|
||||
[ -n "$ENROL_JWT" ] && [ -s "$ENROL_JWT" ] || die "no identity at $IDENTITY and no enrol JWT (--enrol-jwt or $ETC/enrol.jwt)"
|
||||
log "enrolling monky-host.$ENV_ID"
|
||||
ziti-edge-tunnel enroll -j "$ENROL_JWT" -i "$IDENTITY"
|
||||
fi
|
||||
getent passwd ziti >/dev/null && chown ziti:ziti "$IDENTITY" || true
|
||||
chmod 0600 "$IDENTITY"
|
||||
# ziti-edge-tunnel as a HOST (bind side, no tun/DNS) — the agent dials with the SDK or the proxy
|
||||
install -d /etc/systemd/system/ziti-edge-tunnel.service.d
|
||||
cat > /etc/systemd/system/ziti-edge-tunnel.service.d/run-host.conf <<'DROPIN'
|
||||
# monky-deployd: run-host mode (no tun, no DNS); identities from the standard directory
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/opt/openziti/bin/ziti-edge-tunnel run-host --identity-dir=/opt/openziti/etc/identities
|
||||
DROPIN
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now ziti-edge-tunnel.service
|
||||
systemctl restart ziti-edge-tunnel.service || true
|
||||
|
||||
# --- 4. config, ACLs, bootstrap grant -----------------------------------------------------------------
|
||||
install -d -m 0750 -o root -g monky-deployd "$ETC"
|
||||
install -d -m 0700 -o monky-deployd -g monky-deployd /var/lib/monky-deployd
|
||||
setfacl -m u:monky-deployd:r "$IDENTITY"
|
||||
setfacl -m u:monky-deployd:rx "$IDENTITY_DIR"
|
||||
setfacl -m u:monky-deployd:x /opt/openziti/etc 2>/dev/null || true
|
||||
if [ -n "$BAO_CA" ]; then
|
||||
install -m 0644 "$BAO_CA" "$ETC/openbao-ca.pem"
|
||||
fi
|
||||
ca_line="ca_bundle: $ETC/openbao-ca.pem"
|
||||
[ -s "$ETC/openbao-ca.pem" ] || { ca_line="ca_bundle: none # TODO: install the openbao-ca certificate (see docs/OPERATIONS.md)"; echo "WARNING: $ETC/openbao-ca.pem missing; TLS to OpenBao will use the system store" >&2; }
|
||||
if [ -s "$ETC/config.yaml" ] && [ -z "$FORCE_CONFIG" ]; then
|
||||
log "keeping existing $ETC/config.yaml (use --force-config to rewrite)"
|
||||
else
|
||||
cat > "$ETC/config.yaml" <<CFG
|
||||
# written by install.sh $(date -u +%FT%TZ) — monky-deployd $VERSION
|
||||
env_id: $ENV_ID
|
||||
site: $SITE
|
||||
transport: $TRANSPORT
|
||||
identity: $IDENTITY
|
||||
tenancy:
|
||||
service: monky.tenancy.deploy
|
||||
host: monky.tenancy.deploy
|
||||
port: 8081
|
||||
scheme: http
|
||||
proxy_addr: 127.0.0.1:18443
|
||||
bao:
|
||||
service: openbao
|
||||
addr: https://bao.cbs.tikali.net:8200
|
||||
proxy_addr: 127.0.0.1:18200
|
||||
$ca_line
|
||||
mount: jwt-tenancy
|
||||
role: see-env
|
||||
kv_mount: monky
|
||||
state_dir: /var/lib/monky-deployd
|
||||
deploy_dir: /var/lib/monky-deployd/$ENV_ID
|
||||
bootstrap_path: $ETC/bootstrap.jwt
|
||||
interval_s: 60
|
||||
volumes_on_absent: keep
|
||||
laptop_mode: $LAPTOP
|
||||
CFG
|
||||
chmod 0640 "$ETC/config.yaml"; chgrp monky-deployd "$ETC/config.yaml"
|
||||
fi
|
||||
if [ "$TRANSPORT" = "proxy" ]; then
|
||||
printf 'ZITI_IDENTITY=%s\n' "$IDENTITY" > "$ETC/proxy.env"; chmod 0644 "$ETC/proxy.env"
|
||||
systemctl enable --now monky-deployd-proxy.service
|
||||
fi
|
||||
# bootstrap grant: stdin (the kit pipes it) or --bootstrap-file; 0600, owned by the agent so it can consume it
|
||||
grant=""
|
||||
if [ -n "$BOOTSTRAP_FILE" ]; then grant="$(tr -d '[:space:]' < "$BOOTSTRAP_FILE")"
|
||||
elif [ ! -t 0 ]; then grant="$(tr -d '[:space:]' </dev/stdin || true)"; fi
|
||||
if [ -n "$grant" ]; then
|
||||
printf '%s\n' "$grant" > "$ETC/bootstrap.jwt"
|
||||
chown monky-deployd:monky-deployd "$ETC/bootstrap.jwt"; chmod 0600 "$ETC/bootstrap.jwt"
|
||||
log "bootstrap grant staged at $ETC/bootstrap.jwt (consumed on first tick)"
|
||||
elif [ -s /var/lib/monky-deployd/bao.token ]; then
|
||||
log "no bootstrap grant given; existing bao.token kept"
|
||||
else
|
||||
echo "WARNING: no bootstrap grant on stdin and no bao.token: the agent cannot check in until you provide one" >&2
|
||||
fi
|
||||
unset grant
|
||||
|
||||
# --- 5. timer + first tick ----------------------------------------------------------------------------------
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now monky-deployd.timer
|
||||
if [ -z "$NO_RUN" ]; then
|
||||
log "first tick"
|
||||
systemctl start monky-deployd.service || true
|
||||
fi
|
||||
[ -n "$ENROL_JWT" ] && rm -f "$ENROL_JWT" || true
|
||||
rm -f "$ETC/enrol.jwt"
|
||||
|
||||
cat <<CHECK
|
||||
|
||||
monky-deployd $VERSION installed for $ENV_ID ($SITE, transport $TRANSPORT). Verification checklist (Ubuntu 26.04):
|
||||
python3 --version # >= 3.12
|
||||
docker compose version # compose plugin present
|
||||
systemctl is-active ziti-edge-tunnel # run-host mode (drop-in run-host.conf)
|
||||
$( [ "$TRANSPORT" = proxy ] && echo "systemctl is-active monky-deployd-proxy # ziti tunnel proxy on 18443/18200" || echo "ziti tunnel proxy --help >/dev/null # fallback transport available" )
|
||||
/opt/monky-deployd/venv/bin/python -c 'import openziti' # SDK import (transport sdk)
|
||||
monky-deployd status # token present, applied == desired
|
||||
journalctl -u monky-deployd -n 50 # 'checkin:' and 'applied' lines
|
||||
df -h \$(docker info -f '{{.DockerRootDir}}') # free space >= bundle need x 1.5 + headroom
|
||||
docker compose -p monky-$ENV_ID ps # healthy
|
||||
# from another mesh member: curl monky.percept.$ENV_ID:47283/health -> 200
|
||||
CHECK
|
||||
CHECK_STATUS="$(monky-deployd status 2>&1 || true)"
|
||||
echo "$CHECK_STATUS" | sed 's/^/ | /'
|
||||
Reference in New Issue
Block a user