kindred/silo
1
1
Fork 0
Code Issues 30 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(scripts): parameterize hostnames in deployment scripts

Browse Source 
- setup-host.sh: add SILO_DB_HOST and SILO_MINIO_HOST env var
  overrides, update Go version from 1.23 to 1.24, expand generated
  silod.env template with session secret and admin password fields
- deploy.sh: add SILO_DEPLOY_TARGET and SILO_DB_HOST env var
  overrides for target host and database host
- setup-ipa-nginx.sh: replace hardcoded hostname with SILO_HOSTNAME
  env var (default: silo.example.internal), parameterize SILO_PORT,
  use variable substitution in nginx config template

All scripts retain backward-compatible defaults.
This commit is contained in:
forbes-0023
2026-02-12 08:59:01 -06:00
parent fb13795ef7
commit 3d9ef9e99e
3 changed files with 57 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
scripts/deploy.sh
View File

@@ -1,18 +1,23 @@
#!/bin/bash #!/bin/bash
# Deploy Silo to silo.example.internal # Deploy Silo to a target host
# #
# Usage: ./scripts/deploy.sh [host] # Usage: ./scripts/deploy.sh [host]
# host defaults to silo.example.internal # host defaults to SILO_DEPLOY_TARGET env var, or silo.example.internal
# #
# Prerequisites: # Prerequisites:
# - SSH access to the target host # - SSH access to the target host
# - /etc/silo/silod.env must exist on target with credentials filled in # - /etc/silo/silod.env must exist on target with credentials filled in
# - PostgreSQL reachable from target at psql.example.internal # - PostgreSQL reachable from target (set SILO_DB_HOST to override)
# - MinIO reachable from target at minio.example.internal # - MinIO reachable from target (set SILO_MINIO_HOST to override)
#
# Environment variables:
# SILO_DEPLOY_TARGET - target host (default: silo.example.internal)
# SILO_DB_HOST - PostgreSQL host (default: psql.example.internal)
set -euo pipefail set -euo pipefail
TARGET="${1:-silo.example.internal}" TARGET="${1:-${SILO_DEPLOY_TARGET:-silo.example.internal}}"
DB_HOST="${SILO_DB_HOST:-psql.example.internal}"
DEPLOY_DIR="/opt/silo" DEPLOY_DIR="/opt/silo"
CONFIG_DIR="/etc/silo" CONFIG_DIR="/etc/silo"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -104,7 +109,7 @@ echo " Files installed to $DEPLOY_DIR"
REMOTE REMOTE
echo "[6/6] Running migrations and starting service..." echo "[6/6] Running migrations and starting service..."
ssh "$TARGET" bash -s <<'REMOTE' ssh "$TARGET" DB_HOST="$DB_HOST" bash -s <<'REMOTE'
set -euo pipefail set -euo pipefail
DEPLOY_DIR="/opt/silo" DEPLOY_DIR="/opt/silo"
@@ -123,14 +128,14 @@ if command -v psql &>/dev/null && [ -n "${SILO_DB_PASSWORD:-}" ]; then
for f in "$DEPLOY_DIR/migrations/"*.sql; do for f in "$DEPLOY_DIR/migrations/"*.sql; do
echo " $(basename "$f")" echo " $(basename "$f")"
PGPASSWORD="$SILO_DB_PASSWORD" psql \ PGPASSWORD="$SILO_DB_PASSWORD" psql \
-h psql.example.internal -p 5432 \ -h "$DB_HOST" -p 5432 \
-U silo -d silo \ -U silo -d silo \
-f "$f" -q 2>&1 | grep -v "already exists" || true -f "$f" -q 2>&1 | grep -v "already exists" || true
done done
echo " Migrations complete." echo " Migrations complete."
else else
echo " WARNING: psql not available or SILO_DB_PASSWORD not set, skipping migrations." echo " WARNING: psql not available or SILO_DB_PASSWORD not set, skipping migrations."
echo " Run migrations manually: PGPASSWORD=... psql -h psql.example.internal -U silo -d silo -f /opt/silo/migrations/NNN_name.sql" echo " Run migrations manually: PGPASSWORD=... psql -h $DB_HOST -U silo -d silo -f /opt/silo/migrations/NNN_name.sql"
fi fi
# Start service # Start service

23
scripts/setup-host.sh
View File

@@ -28,7 +28,9 @@ REPO_URL="${SILO_REPO_URL:-https://git.kindred-systems.com/kindred/silo.git}"
REPO_BRANCH="${SILO_BRANCH:-main}" REPO_BRANCH="${SILO_BRANCH:-main}"
INSTALL_DIR="/opt/silo" INSTALL_DIR="/opt/silo"
CONFIG_DIR="/etc/silo" CONFIG_DIR="/etc/silo"
GO_VERSION="1.23.0" GO_VERSION="1.24.0"
DB_HOST="${SILO_DB_HOST:-psql.example.internal}"
MINIO_HOST="${SILO_MINIO_HOST:-minio.example.internal}"
log_info() { echo -e "${BLUE}[INFO]${NC} $*"; } log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
log_success() { echo -e "${GREEN}[OK]${NC} $*"; } log_success() { echo -e "${GREEN}[OK]${NC} $*"; }
@@ -155,21 +157,28 @@ log_success "Directories created"
ENV_FILE="${CONFIG_DIR}/silod.env" ENV_FILE="${CONFIG_DIR}/silod.env"
if [[ ! -f "${ENV_FILE}" ]]; then if [[ ! -f "${ENV_FILE}" ]]; then
log_info "Creating environment file..." log_info "Creating environment file..."
cat > "${ENV_FILE}" << 'EOF' cat > "${ENV_FILE}" << EOF
# Silo daemon environment variables # Silo daemon environment variables
# Fill in the values below # Fill in the values below
# Database credentials (psql.example.internal) # Database credentials (${DB_HOST})
# Database: silo, User: silo # Database: silo, User: silo
SILO_DB_PASSWORD= SILO_DB_PASSWORD=
# MinIO credentials (minio.example.internal) # MinIO credentials (${MINIO_HOST})
# User: silouser # User: silouser
SILO_MINIO_ACCESS_KEY=silouser SILO_MINIO_ACCESS_KEY=silouser
SILO_MINIO_SECRET_KEY= SILO_MINIO_SECRET_KEY=
# Authentication
# Session secret (required when auth is enabled)
SILO_SESSION_SECRET=
# Default admin account (created on first startup if both are set)
SILO_ADMIN_USERNAME=admin
SILO_ADMIN_PASSWORD=
# Optional overrides # Optional overrides
# SILO_SERVER_BASE_URL=http://silo.example.internal:8080 # SILO_SERVER_BASE_URL=http://\$(hostname -f):8080
EOF EOF
chmod 600 "${ENV_FILE}" chmod 600 "${ENV_FILE}"
chown root:silo "${ENV_FILE}" chown root:silo "${ENV_FILE}"
@@ -214,10 +223,10 @@ echo "1. Edit ${ENV_FILE} and fill in credentials:"
echo " sudo nano ${ENV_FILE}" echo " sudo nano ${ENV_FILE}"
echo "" echo ""
echo "2. Verify database connectivity:" echo "2. Verify database connectivity:"
echo " psql -h psql.example.internal -U silo -d silo -c 'SELECT 1'" echo " psql -h ${DB_HOST} -U silo -d silo -c 'SELECT 1'"
echo "" echo ""
echo "3. Verify MinIO connectivity:" echo "3. Verify MinIO connectivity:"
echo " curl -I http://minio.example.internal:9000/minio/health/live" echo " curl -I http://${MINIO_HOST}:9000/minio/health/live"
echo "" echo ""
echo "4. Run the deployment:" echo "4. Run the deployment:"
echo " sudo ${INSTALL_DIR}/src/scripts/deploy.sh" echo " sudo ${INSTALL_DIR}/src/scripts/deploy.sh"

56
scripts/setup-ipa-nginx.sh
View File

@@ -8,7 +8,7 @@
# #
# Prerequisites: # Prerequisites:
# - FreeIPA server at ipa.example.internal # - FreeIPA server at ipa.example.internal
# - DNS configured for silo.example.internal # - DNS configured for the silo host (set SILO_HOSTNAME to override default)
# - Admin credentials for IPA enrollment # - Admin credentials for IPA enrollment
set -euo pipefail set -euo pipefail
@@ -24,9 +24,9 @@ NC='\033[0m'
IPA_SERVER="${IPA_SERVER:-ipa.example.internal}" IPA_SERVER="${IPA_SERVER:-ipa.example.internal}"
IPA_DOMAIN="${IPA_DOMAIN:-example.internal}" IPA_DOMAIN="${IPA_DOMAIN:-example.internal}"
IPA_REALM="${IPA_REALM:-KINDRED.INTERNAL}" IPA_REALM="${IPA_REALM:-KINDRED.INTERNAL}"
HOSTNAME="silo.example.internal" SILO_HOSTNAME="${SILO_HOSTNAME:-silo.example.internal}"
CERT_DIR="/etc/ssl/silo" CERT_DIR="/etc/ssl/silo"
SILO_PORT=8080 SILO_PORT="${SILO_PORT:-8080}"
log_info() { echo -e "${BLUE}[INFO]${NC} $*"; } log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
log_success() { echo -e "${GREEN}[OK]${NC} $*"; } log_success() { echo -e "${GREEN}[OK]${NC} $*"; }
@@ -77,8 +77,8 @@ log_success "Packages installed"
# #
# Step 2: Set hostname # Step 2: Set hostname
# #
log_info "Setting hostname to ${HOSTNAME}..." log_info "Setting hostname to ${SILO_HOSTNAME}..."
hostnamectl set-hostname "${HOSTNAME}" hostnamectl set-hostname "${SILO_HOSTNAME}"
log_success "Hostname set" log_success "Hostname set"
# #
@@ -95,7 +95,7 @@ else
--server="${IPA_SERVER}" \ --server="${IPA_SERVER}" \
--domain="${IPA_DOMAIN}" \ --domain="${IPA_DOMAIN}" \
--realm="${IPA_REALM}" \ --realm="${IPA_REALM}" \
--hostname="${HOSTNAME}" \ --hostname="${SILO_HOSTNAME}" \
--mkhomedir \ --mkhomedir \
--enable-dns-updates \ --enable-dns-updates \
--unattended \ --unattended \
@@ -105,7 +105,7 @@ else
--server="${IPA_SERVER}" \ --server="${IPA_SERVER}" \
--domain="${IPA_DOMAIN}" \ --domain="${IPA_DOMAIN}" \
--realm="${IPA_REALM}" \ --realm="${IPA_REALM}" \
--hostname="${HOSTNAME}" \ --hostname="${SILO_HOSTNAME}" \
--mkhomedir \ --mkhomedir \
--enable-dns-updates --enable-dns-updates
} }
@@ -135,9 +135,9 @@ else
ipa-getcert request \ ipa-getcert request \
-f "${CERT_DIR}/silo.crt" \ -f "${CERT_DIR}/silo.crt" \
-k "${CERT_DIR}/silo.key" \ -k "${CERT_DIR}/silo.key" \
-K "HTTP/${HOSTNAME}" \ -K "HTTP/${SILO_HOSTNAME}" \
-D "${HOSTNAME}" \ -D "${SILO_HOSTNAME}" \
-N "CN=${HOSTNAME}" \ -N "CN=${SILO_HOSTNAME}" \
-C "systemctl reload nginx" -C "systemctl reload nginx"
log_info "Waiting for certificate to be issued..." log_info "Waiting for certificate to be issued..."
@@ -186,14 +186,14 @@ if [[ -f /etc/nginx/sites-enabled/default ]]; then
fi fi
# Create silo nginx config # Create silo nginx config
cat > /etc/nginx/sites-available/silo << 'NGINX_EOF' cat > /etc/nginx/sites-available/silo << NGINX_EOF
# Silo API Server - Nginx Reverse Proxy Configuration # Silo API Server - Nginx Reverse Proxy Configuration
# Redirect HTTP to HTTPS # Redirect HTTP to HTTPS
server { server {
listen 80; listen 80;
listen [::]:80; listen [::]:80;
server_name silo.example.internal; server_name ${SILO_HOSTNAME};
# Allow certmonger/ACME challenges # Allow certmonger/ACME challenges
location /.well-known/ { location /.well-known/ {
@@ -201,7 +201,7 @@ server {
} }
location / { location / {
return 301 https://$server_name$request_uri; return 301 https://\\$server_name\\$request_uri;
} }
} }
@@ -209,11 +209,11 @@ server {
server { server {
listen 443 ssl http2; listen 443 ssl http2;
listen [::]:443 ssl http2; listen [::]:443 ssl http2;
server_name silo.example.internal; server_name ${SILO_HOSTNAME};
# SSL certificates (managed by certmonger/IPA) # SSL certificates (managed by certmonger/IPA)
ssl_certificate /etc/ssl/silo/silo.crt; ssl_certificate ${CERT_DIR}/silo.crt;
ssl_certificate_key /etc/ssl/silo/silo.key; ssl_certificate_key ${CERT_DIR}/silo.key;
# SSL configuration # SSL configuration
ssl_protocols TLSv1.2 TLSv1.3; ssl_protocols TLSv1.2 TLSv1.3;
@@ -226,7 +226,7 @@ server {
# OCSP stapling # OCSP stapling
ssl_stapling on; ssl_stapling on;
ssl_stapling_verify on; ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/silo/ca.crt; ssl_trusted_certificate ${CERT_DIR}/ca.crt;
# Security headers # Security headers
add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Frame-Options "SAMEORIGIN" always;
@@ -240,19 +240,19 @@ server {
# Proxy settings # Proxy settings
location / { location / {
proxy_pass http://127.0.0.1:8080; proxy_pass http://127.0.0.1:${SILO_PORT};
proxy_http_version 1.1; proxy_http_version 1.1;
# Headers # Headers
proxy_set_header Host $host; proxy_set_header Host \\$host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP \\$remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For \\$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto \\$scheme;
proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Host \\$host;
proxy_set_header X-Forwarded-Port $server_port; proxy_set_header X-Forwarded-Port \\$server_port;
# WebSocket support (for future use) # WebSocket support (for future use)
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade \\$http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
# Timeouts # Timeouts
@@ -343,14 +343,14 @@ echo " getcert list"
echo "" echo ""
echo "2. Update silo config to use correct base URL:" echo "2. Update silo config to use correct base URL:"
echo " sudo nano /etc/silo/config.yaml" echo " sudo nano /etc/silo/config.yaml"
echo " # Change base_url to: https://silo.example.internal" echo " # Change base_url to: https://${SILO_HOSTNAME}"
echo "" echo ""
echo "3. Restart silo service:" echo "3. Restart silo service:"
echo " sudo systemctl restart silod" echo " sudo systemctl restart silod"
echo "" echo ""
echo "4. Test the setup:" echo "4. Test the setup:"
echo " curl -k https://silo.example.internal/health" echo " curl -k https://${SILO_HOSTNAME}/health"
echo " curl https://silo.example.internal/health # after trusting IPA CA" echo " curl https://${SILO_HOSTNAME}/health # after trusting IPA CA"
echo "" echo ""
echo "5. Trust IPA CA on client machines:" echo "5. Trust IPA CA on client machines:"
echo " # The CA cert is at: ${CERT_DIR}/ca.crt" echo " # The CA cert is at: ${CERT_DIR}/ca.crt"