dongarandClaude Opus 5.5
e287eea2d3
The operator renamed the site from vault.dongar.net. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
50 lines
2.0 KiB
Bash
Executable File
50 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Set up the agent host's vault and SilverBullet (M5.4). Run as root on the
|
|
# host, from this folder's copy (scripts/agent-host.sh install does that).
|
|
# Safe to run again: it changes only what differs.
|
|
set -euo pipefail
|
|
|
|
here=$(cd "$(dirname "$0")" && pwd)
|
|
|
|
# The only address allowed to reach SilverBullet: the operator's Caddy
|
|
# (docker.garrett-hall.com), which serves nisse-memory.dongar.net inside garrett-hall.com.
|
|
CADDY_ADDR=192.168.6.13
|
|
SB_PORT=3000
|
|
SB_UID=1000 # the image's PUID/PGID: the operator's side of the vault
|
|
|
|
# The vault. Its root and everything in it belong to the operator, except
|
|
# memory/, where each agent gets a folder of its own when it moves in. memory/
|
|
# is root's, and SilverBullet mounts it read-only besides.
|
|
install -d -m 0755 /srv/nisse
|
|
install -d -o "$SB_UID" -g "$SB_UID" -m 0750 /srv/nisse/silverbullet
|
|
install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault
|
|
install -d -o "$SB_UID" -g "$SB_UID" -m 0755 /srv/nisse/vault/infrastructure
|
|
install -d -o root -g root -m 0755 /srv/nisse/vault/memory
|
|
|
|
# SilverBullet's stack, where the docker role keeps stacks.
|
|
install -d -m 0755 /opt/stacks/silverbullet
|
|
install -m 0644 "$here/silverbullet/compose.yaml" /opt/stacks/silverbullet/compose.yaml
|
|
|
|
# Only Caddy may reach SilverBullet's port, re-applied whenever Docker starts.
|
|
install -m 0755 "$here/nisse-firewall" /usr/local/sbin/nisse-firewall
|
|
cat > /etc/systemd/system/nisse-firewall.service <<EOF
|
|
[Unit]
|
|
Description=Only the operator's Caddy reaches SilverBullet (deploy/agent-host)
|
|
After=docker.service
|
|
BindsTo=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/usr/local/sbin/nisse-firewall $CADDY_ADDR $SB_PORT
|
|
|
|
[Install]
|
|
WantedBy=docker.service
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl enable --now nisse-firewall.service
|
|
systemctl restart nisse-firewall.service # picks up a changed rule
|
|
|
|
docker compose -f /opt/stacks/silverbullet/compose.yaml up -d
|
|
echo "SilverBullet is up on port $SB_PORT, reachable from $CADDY_ADDR only"
|