@atriumchat/install 0.7.0 → 0.7.1

package/README.md

@@ -1,4 +1,4 @@
-# Atrium 0.7.0
+# Atrium 0.7.1
 
 Установщик Atrium и архив релиза, который он распаковывает.
 
@@ -13,7 +13,7 @@ npx @atriumchat/install
 Без Node:
 
 ```sh
-curl -fsSL https://cdn.jsdelivr.net/npm/@atriumchat/install@0.7.0/install.sh | sh
+curl -fsSL https://cdn.jsdelivr.net/npm/@atriumchat/install@0.7.1/install.sh | sh
 ```
 
 Основной адрес и исходники: https://github.com/atriumchat/atrium

package/install.sh

@@ -52,13 +52,13 @@ shopt -u patsub_replacement 2>/dev/null || true
 umask 022
 
 # == The release this installer puts on the server. deploy/release.sh rewrites these lines.
-RELEASE_VERSION=0.7.0
-RELEASE_SHA256=bdcf551ad4a4bef983bc8892a5016469514a9d31c5e9b5d69d7e4faf811384b2
+RELEASE_VERSION=0.7.1
+RELEASE_SHA256=a731cb23ffd5a273796c3ffffde28ea9da6b62a5abeb80e3ca9b571fbc16b90b
 RELEASE_REPO=atriumchat/atrium
 # The npm package that mirrors each release's install.sh and tarball (deploy/release.sh publishes it).
 RELEASE_NPM=@atriumchat/install
 RELEASE_REGISTRY=ghcr.io/atriumchat
-RELEASE_APP_DIGEST=sha256:1d4e6b5773fdbe7594487528c73b12feb8919caf86265bdfa8f330b55beeae0f
+RELEASE_APP_DIGEST=sha256:d4f63d2b370a9fe686e2f01c92092fa7730b2baef045c42b1f3d4cbce0463f24
 RELEASE_CADDY_DIGEST=sha256:cd2cf5a7985bb21afa94786e9779dcf972b89e7e281a0a9b616acc659ce30bbf
 
 # == gum, for this run only.
@@ -411,12 +411,26 @@ add_app_key() {
   chmod 700 /root/.ssh
   touch /root/.ssh/authorized_keys
   chmod 600 /root/.ssh/authorized_keys
-  grep -qxF "$key" /root/.ssh/authorized_keys || printf '%s\n' "$key" >>/root/.ssh/authorized_keys
+  # Already there (a run again from the app), maybe already pinned to the agent: once is enough.
+  grep -qF "${key#ssh-ed25519 }" /root/.ssh/authorized_keys || printf '%s\n' "$key" >>/root/.ssh/authorized_keys
   log "desktop app key added for root"
 }
 
+# Once Atrium runs, the desktop app's key (the line with the comment atrium-app) stops being root: it is pinned to
+# deploy/atrium-agent, which only understands status, update, backup and logs, and loses forwarding and a terminal.
+# The install itself still had the full key (it may need running again); an update pins servers installed before.
+lock_app_key() {
+  local f=/root/.ssh/authorized_keys agent=$ATRIUM_DIR/deploy/atrium-agent
+  [[ -f $f && -x $agent ]] || return 0
+  grep -Eq '^ssh-ed25519 [^ ]+ atrium-app[[:space:]]*$' "$f" || return 0
+  sed -i -E "s|^(ssh-ed25519 [^ ]+ atrium-app)[[:space:]]*\$|restrict,command=\"$agent\" \\1|" "$f"
+  log "desktop app key pinned to $agent"
+}
+
 # The desktop app sets the address up just before it installs (a free name on dedyn.io, or the person's own
-# records), so the installer waits for the names to answer here: the certificates can then come at once.
+# records), and a new name can take minutes to reach every resolver. Only the start and the certificates need it, so
+# the installer waits here after everything else is done (install_all): the wait mostly hides behind Docker and the
+# images instead of holding the install up from its second step.
 wait_dns() {
   [[ ${ATRIUM_PROGRESS:-} == 1 ]] || return 0
   local i
@@ -810,7 +824,7 @@ step_files() {
   progress sub "Раскладываем файлы"
   mkdir -p "$stage" || return
   tar -xzf "$tgz" -C "$stage" --strip-components=1 --no-same-owner || return
-  for f in deploy/docker-compose.yml deploy/Caddyfile deploy/backup.sh deploy/livekit.yaml.tmpl; do
+  for f in deploy/docker-compose.yml deploy/Caddyfile deploy/backup.sh deploy/atrium-agent deploy/livekit.yaml.tmpl; do
     [[ -f $stage/$f ]] || { echo "Release has no $f"; return 1; }
   done
   mkdir -p "$ATRIUM_DIR/deploy" "$ATRIUM_DIR/landing" || return
@@ -819,7 +833,7 @@ step_files() {
     touch "$ATRIUM_TMP/caddyfile-changed" || return
   fi
   install -m 644 "$stage/deploy/docker-compose.yml" "$stage/deploy/Caddyfile" "$stage/deploy/livekit.yaml.tmpl" "$ATRIUM_DIR/deploy/" || return
-  install -m 755 "$stage/deploy/backup.sh" "$ATRIUM_DIR/deploy/" || return
+  install -m 755 "$stage/deploy/backup.sh" "$stage/deploy/atrium-agent" "$ATRIUM_DIR/deploy/" || return
   return 0
 }
 
@@ -1120,6 +1134,10 @@ install_all() {
   run "Настройки и ключи" step_config
   if [[ -d /run/systemd/system ]]; then run "Ночные бэкапы" step_backups; fi
   run "Скачиваем образы" step_pull
+  if [[ ${ATRIUM_PROGRESS:-} == 1 ]]; then
+    wait_dns
+    check_dns
+  fi
   run "Запуск" step_up
   HTTPS_OK=0
   if (( DNS_OK )); then
@@ -1387,14 +1405,15 @@ run_quiet() {
     die "Сервер не готов."
   fi
   progress "done" check
-  wait_dns
+  # From the desktop app the address is waited for later, right before the start (install_all).
   check_dns
-  if (( ! DNS_OK )); then
+  if (( ! DNS_OK )) && [[ ${ATRIUM_PROGRESS:-} != 1 ]]; then
     say
     warn "DNS ещё не готов:"
     print_dns
   fi
   install_all
+  lock_app_key
   screen_done
 }
 
@@ -1432,6 +1451,7 @@ wizard() {
         header 4
         title "Установка"
         install_all
+        lock_app_key
         screen_done
         return
         ;;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@atriumchat/install",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Atrium installer and release files: npx @atriumchat/install, or curl -fsSL https://cdn.jsdelivr.net/npm/@atriumchat/install/install.sh | sh",
   "homepage": "https://github.com/atriumchat/atrium",
   "repository": { "type": "git", "url": "git+https://github.com/atriumchat/atrium.git" },
   "license": "AGPL-3.0-only",
   "bin": { "atrium-install": "install.sh" },
-  "files": ["install.sh", "atrium-0.7.0.tar.gz", "LICENSE"]
+  "files": ["install.sh", "atrium-0.7.1.tar.gz", "LICENSE"]
 }