dongarandClaude Opus 5.5
bf98445fcb
The operator chose single-space mode: the vault is mounted at /data, with memory/ read-only over it, and there are no accounts or setup wizard; Authelia in the operator's Caddy is the login. SB_NAME forces the mode, so an empty vault can't boot the wizard. SilverBullet's own data folder is gone. check now fails if the wizard could be open. The README says how to make memory/ writable for a while and back. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
50 lines
1.9 KiB
Bash
Executable File
50 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Set up the agent host's vault and SilverBullet (M5.4). Run as root on the
|
|
# host, from this folder's copy (scripts/agent-host.sh install does that).
|
|
# Safe to run again: it changes only what differs.
|
|
set -euo pipefail
|
|
|
|
here=$(cd "$(dirname "$0")" && pwd)
|
|
|
|
# The only address allowed to reach SilverBullet: the operator's Caddy
|
|
# (docker.garrett-hall.com), which serves nisse-memory.dongar.net behind
|
|
# Authelia.
|
|
CADDY_ADDR=192.168.6.13
|
|
SB_PORT=3000
|
|
SB_UID=1000 # the image's PUID/PGID: the operator's side of the vault
|
|
|
|
# The vault. Its root and everything in it belong to the operator, except
|
|
# memory/, where each agent gets a folder of its own when it moves in. memory/
|
|
# is root's, and SilverBullet mounts it read-only besides.
|
|
install -d -m 0755 /srv/nisse
|
|
install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault
|
|
install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault/infrastructure
|
|
install -d -o root -g root -m 0755 /srv/nisse/vault/memory
|
|
|
|
# SilverBullet's stack, where the docker role keeps stacks.
|
|
install -d -m 0755 /opt/stacks/silverbullet
|
|
install -m 0644 "$here/silverbullet/compose.yaml" /opt/stacks/silverbullet/compose.yaml
|
|
|
|
# Only Caddy may reach SilverBullet's port, re-applied whenever Docker starts.
|
|
install -m 0755 "$here/nisse-firewall" /usr/local/sbin/nisse-firewall
|
|
cat > /etc/systemd/system/nisse-firewall.service <<EOF
|
|
[Unit]
|
|
Description=Only the operator's Caddy reaches SilverBullet (deploy/agent-host)
|
|
After=docker.service
|
|
BindsTo=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/nisse-firewall $CADDY_ADDR $SB_PORT
|
|
|
|
[Install]
|
|
WantedBy=docker.service
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl enable --now nisse-firewall.service
|
|
systemctl restart nisse-firewall.service # picks up a changed rule
|
|
|
|
docker compose -f /opt/stacks/silverbullet/compose.yaml up -d
|
|
echo "SilverBullet is up on port $SB_PORT, reachable from $CADDY_ADDR only"
|