140 lines
3.9 KiB
Bash
Executable File
140 lines
3.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
# Colors
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
NC='\033[0m' # No Color
|
|
|
|
log_info() { echo -e "${YELLOW}[INFO]${NC} $1"; }
|
|
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
|
|
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
|
|
|
# Check for required tools
|
|
check_command() {
|
|
if ! command -v "$1" &> /dev/null; then
|
|
log_error "$1 is required but not installed."
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
check_command step
|
|
check_command curl
|
|
check_command wget
|
|
check_command bunzip2
|
|
|
|
# 1. Setup Step Certificates
|
|
log_info "Setting up Step Certificates..."
|
|
|
|
STEP_PATH="$(step path)"
|
|
CERTS_DIR="$STEP_PATH/certs"
|
|
|
|
if [ ! -d "$CERTS_DIR" ]; then
|
|
log_info "Creating directory $CERTS_DIR"
|
|
mkdir -p "$CERTS_DIR"
|
|
fi
|
|
|
|
# Prompt for secret securely (reading from /dev/tty to support pipe execution)
|
|
echo -e "${YELLOW}Please enter the provisioner password for 'admin':${NC}"
|
|
read -s secret < /dev/tty
|
|
echo ""
|
|
|
|
if [ -z "$secret" ]; then
|
|
log_error "Password cannot be empty."
|
|
exit 1
|
|
fi
|
|
|
|
# Prompt for Repo Name
|
|
DEFAULT_REPO_NAME=$(hostnamectl hostname 2>/dev/null || hostname)
|
|
echo -e "${YELLOW}Please enter the Restic Repository Name (default: $DEFAULT_REPO_NAME):${NC}"
|
|
read repo_name < /dev/tty
|
|
|
|
if [ -z "$repo_name" ]; then
|
|
repo_name="$DEFAULT_REPO_NAME"
|
|
fi
|
|
|
|
# Save secret temporarily
|
|
SECRET_FILE="$CERTS_DIR/secret.txt"
|
|
(umask 077; echo "$secret" > "$SECRET_FILE")
|
|
log_success "Secret saved to $SECRET_FILE"
|
|
|
|
# Generate Certificates
|
|
log_info "Generating certificates for repo/client: $repo_name"
|
|
|
|
cd "$CERTS_DIR"
|
|
|
|
if step ca certificate \
|
|
--provisioner admin --password-file secret.txt \
|
|
"$repo_name" restic.crt restic.key; then
|
|
|
|
# Combine into PEM
|
|
(umask 077; cat restic.crt restic.key > restic.pem)
|
|
log_success "Certificates generated and combined into restic.pem"
|
|
|
|
# Clean up secret? The README keeps it, but usually it's good to ask.
|
|
# The README implies keeping it for renewal maybe?
|
|
# But for client certs, renewal might need the password again if using the same provisioner.
|
|
# I'll leave it as per README instructions.
|
|
else
|
|
log_error "Failed to generate certificates. Check your password and connection to the CA."
|
|
rm -f "$SECRET_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
# 2. Install Restic
|
|
log_info "Checking for Restic..."
|
|
|
|
if ! command -v restic &> /dev/null; then
|
|
log_info "Restic not found. Installing latest version..."
|
|
|
|
RESTIC_VERSION="0.18.1"
|
|
DOWNLOAD_URL="https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2"
|
|
|
|
TMP_DIR=$(mktemp -d)
|
|
pushd "$TMP_DIR" > /dev/null
|
|
|
|
wget -q -O restic.bz2 "$DOWNLOAD_URL"
|
|
bunzip2 restic.bz2
|
|
chmod +x restic
|
|
|
|
log_info "Installing restic to /usr/local/bin (requires sudo)..."
|
|
if sudo mv restic /usr/local/bin/; then
|
|
log_success "Restic installed successfully."
|
|
else
|
|
log_error "Failed to move restic to /usr/local/bin"
|
|
popd > /dev/null
|
|
rm -rf "$TMP_DIR"
|
|
exit 1
|
|
fi
|
|
|
|
popd > /dev/null
|
|
rm -rf "$TMP_DIR"
|
|
else
|
|
CURRENT_VERSION=$(restic version | awk '{print $2}')
|
|
log_success "Restic is already installed (version $CURRENT_VERSION)"
|
|
fi
|
|
|
|
# 3. Final Instructions
|
|
ROOT_CA="$CERTS_DIR/root_ca.crt"
|
|
CLIENT_PEM="$CERTS_DIR/restic.pem"
|
|
|
|
# Ensure root_ca exists (it should if step is bootstrapped)
|
|
if [ ! -f "$ROOT_CA" ]; then
|
|
log_info "Downloading Root CA..."
|
|
step ca root "$ROOT_CA"
|
|
fi
|
|
|
|
log_success "Setup complete!"
|
|
echo ""
|
|
echo -e "${GREEN}=== Environment Configuration ===${NC}"
|
|
echo "Add the following lines to your shell configuration (.bashrc, .zshrc, etc) or script:"
|
|
echo ""
|
|
echo "export RESTIC_CACERT=$ROOT_CA"
|
|
echo "export RESTIC_TLS_CLIENT_CERT=$CLIENT_PEM"
|
|
echo "export RESTIC_REPOSITORY=rest:https://soteria.john-stream.com/$repo_name"
|
|
echo "export RESTIC_PASSWORD_FILE=~/.config/resticprofile/password.txt"
|
|
echo ""
|
|
echo -e "${YELLOW}Note: Adjust RESTIC_REPOSITORY and RESTIC_PASSWORD_FILE as needed.${NC}"
|