ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-07-29 03:38:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

Lab cluster: deploy WG/RSSH on cast01 + compose remote_access from secrets.

Browse Source 
Add deploy-remote-access-lab.sh, wire WG/RSSH into compose-lab-backend.php,
and run RA deploy during populate app phase on primary.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyev
2026-06-24 22:57:28 +02:00
committed by Anton Afanasyeu
parent b47f91b1ab
commit 4d2db29b8b
4 changed files with 129 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
sim/cluster0/scripts/deploy-remote-access-lab.sh Executable file
View File

@@ -0,0 +1,79 @@
#!/bin/sh
# Lab WireGuard + RSSH bastion on cast01 primary (ac/* cluster).
set -eu
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
# shellcheck source=/dev/null
. "$ROOT/scripts/lib/common.sh"
load_cluster_env
load_secrets_lab 2>/dev/null || true
is_primary_node || { log "deploy-remote-access-lab: skip (not primary)"; exit 0; }
WG_EXAMPLES="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}/ac-ms-remote-access/examples/wireguard"
[ -d "$WG_EXAMPLES" ] || die "missing $WG_EXAMPLES (init ac-ms-remote-access submodule)"
WG_IF="${WG_INTERFACE:-wg0}"
WG_PORT="${WG_LISTEN_PORT:-51820}"
WG_NET_PREFIX="${WG_CLIENT_IP_PREFIX:-172.200.2.}"
WG_DIR="/etc/wireguard"
WG_CONF="${WG_DIR}/${WG_IF}.conf"
SUDOERS_DST="/etc/sudoers.d/androidcast-wg"
mkdir -p "$WG_DIR" "${WG_DIR}/keys"
chmod 700 "${WG_DIR}/keys"
if [ -z "${WG_SERVER_PRIVATE_KEY:-}" ] || [ -z "${WG_SERVER_PUBLIC_KEY:-}" ]; then
if [ ! -f "${WG_DIR}/keys/server.privatekey" ]; then
log "generating lab WG server keys"
wg genkey | tee "${WG_DIR}/keys/server.privatekey" | wg pubkey > "${WG_DIR}/keys/server.publickey"
chmod 600 "${WG_DIR}/keys/server.privatekey"
fi
WG_SERVER_PRIVATE_KEY="$(cat "${WG_DIR}/keys/server.privatekey")"
WG_SERVER_PUBLIC_KEY="$(cat "${WG_DIR}/keys/server.publickey")"
fi
if [ ! -f "$WG_CONF" ] || [ "${FORCE_WG_CONF:-0}" = "1" ]; then
log "writing ${WG_CONF} listen=${WG_PORT}"
cat > "$WG_CONF" <<EOF
[Interface]
Address = ${WG_NET_PREFIX}1/16
ListenPort = ${WG_PORT}
PrivateKey = ${WG_SERVER_PRIVATE_KEY}
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
EOF
chmod 600 "$WG_CONF"
fi
if [ -f "${WG_EXAMPLES}/alpine-be-sudoers-wg" ]; then
install -m 440 "${WG_EXAMPLES}/alpine-be-sudoers-wg" "$SUDOERS_DST"
visudo -cf "$SUDOERS_DST"
fi
rc-service "wg-quick@${WG_IF}" start 2>/dev/null || wg-quick up "$WG_IF" 2>/dev/null || true
rc-update add "wg-quick@${WG_IF}" default 2>/dev/null || true
# RSSH: ephemeral ra-* users via sshd snippet (lab — port 22 on cast01)
RSSH_SSHD="/etc/ssh/sshd_config.d/90-androidcast-ra.conf"
if [ ! -f "$RSSH_SSHD" ] || [ "${FORCE_RSSH_SSHD:-0}" = "1" ]; then
log "install ${RSSH_SSHD}"
cat > "$RSSH_SSHD" <<'EOF'
# Android Cast lab RSSH bastion — Match User ra-*
Match User ra-*
PasswordAuthentication yes
PubkeyAuthentication no
AllowTcpForwarding yes
GatewayPorts no
X11Forwarding no
PermitTTY no
EOF
rc-service sshd reload 2>/dev/null || rc-service sshd restart 2>/dev/null || true
fi
BASTION_SCRIPT="${COMPOSE_BACKEND:-/var/www/ac/composed/backend}/scripts/rssh_bastion_user.sh"
if [ -f "$ROOT/lab-seeds/backend/scripts/rssh_bastion_user.sh" ] && [ ! -x "$BASTION_SCRIPT" ]; then
mkdir -p "$(dirname "$BASTION_SCRIPT")"
install -m 755 "$ROOT/lab-seeds/backend/scripts/rssh_bastion_user.sh" "$BASTION_SCRIPT"
fi
log "deploy-remote-access-lab_ok pub=${WG_SERVER_PUBLIC_KEY} endpoint=${WG_ENDPOINT:-cast01:${WG_PORT}}"