@atriumchat/install 0.7.0 → 0.7.2

package/README.md

@@ -1,4 +1,4 @@
-# Atrium 0.7.0
+# Atrium 0.7.2
 
 Установщик Atrium и архив релиза, который он распаковывает.
 
@@ -13,7 +13,7 @@ npx @atriumchat/install
 Без Node:
 
 ```sh
-curl -fsSL https://cdn.jsdelivr.net/npm/@atriumchat/install@0.7.0/install.sh | sh
+curl -fsSL https://cdn.jsdelivr.net/npm/@atriumchat/install@0.7.2/install.sh | sh
 ```
 
 Основной адрес и исходники: https://github.com/atriumchat/atrium

package/install.sh

@@ -52,13 +52,13 @@ shopt -u patsub_replacement 2>/dev/null || true
 umask 022
 
 # == The release this installer puts on the server. deploy/release.sh rewrites these lines.
-RELEASE_VERSION=0.7.0
-RELEASE_SHA256=bdcf551ad4a4bef983bc8892a5016469514a9d31c5e9b5d69d7e4faf811384b2
+RELEASE_VERSION=0.7.2
+RELEASE_SHA256=36f0ee977dc5bc784b541d270830179e924eefe691a5164463a302f896d04907
 RELEASE_REPO=atriumchat/atrium
 # The npm package that mirrors each release's install.sh and tarball (deploy/release.sh publishes it).
 RELEASE_NPM=@atriumchat/install
 RELEASE_REGISTRY=ghcr.io/atriumchat
-RELEASE_APP_DIGEST=sha256:1d4e6b5773fdbe7594487528c73b12feb8919caf86265bdfa8f330b55beeae0f
+RELEASE_APP_DIGEST=sha256:7e0aa37b22725f7cd1ce91b882a0c0611fdc214cb2c2b1937363ea398c9b15e1
 RELEASE_CADDY_DIGEST=sha256:cd2cf5a7985bb21afa94786e9779dcf972b89e7e281a0a9b616acc659ce30bbf
 
 # == gum, for this run only.
@@ -411,12 +411,26 @@ add_app_key() {
   chmod 700 /root/.ssh
   touch /root/.ssh/authorized_keys
   chmod 600 /root/.ssh/authorized_keys
-  grep -qxF "$key" /root/.ssh/authorized_keys || printf '%s\n' "$key" >>/root/.ssh/authorized_keys
+  # Already there (a run again from the app), maybe already pinned to the agent: once is enough.
+  grep -qF "${key#ssh-ed25519 }" /root/.ssh/authorized_keys || printf '%s\n' "$key" >>/root/.ssh/authorized_keys
   log "desktop app key added for root"
 }
 
+# Once Atrium runs, the desktop app's key (the line with the comment atrium-app) stops being root: it is pinned to
+# deploy/atrium-agent, which only understands status, update, backup and logs, and loses forwarding and a terminal.
+# The install itself still had the full key (it may need running again); an update pins servers installed before.
+lock_app_key() {
+  local f=/root/.ssh/authorized_keys agent=$ATRIUM_DIR/deploy/atrium-agent
+  [[ -f $f && -x $agent ]] || return 0
+  grep -Eq '^ssh-ed25519 [^ ]+ atrium-app[[:space:]]*$' "$f" || return 0
+  sed -i -E "s|^(ssh-ed25519 [^ ]+ atrium-app)[[:space:]]*\$|restrict,command=\"$agent\" \\1|" "$f"
+  log "desktop app key pinned to $agent"
+}
+
 # The desktop app sets the address up just before it installs (a free name on dedyn.io, or the person's own
-# records), so the installer waits for the names to answer here: the certificates can then come at once.
+# records), and a new name can take minutes to reach every resolver. Only the start and the certificates need it, so
+# the installer waits here after everything else is done (install_all): the wait mostly hides behind Docker and the
+# images instead of holding the install up from its second step.
 wait_dns() {
   [[ ${ATRIUM_PROGRESS:-} == 1 ]] || return 0
   local i
@@ -424,12 +438,27 @@ wait_dns() {
   for i in $(seq 1 60); do
     check_dns
     progress sub "Записей на месте: $DNS_HITS из 3"
-    (( DNS_OK )) && break
+    (( DNS_OK )) && dns_everywhere && break
+    (( DNS_OK )) && progress sub "Адрес расходится по интернету"
     sleep 3
   done
   progress "done" address
 }
 
+# Every name answers from both Cloudflare and Google with this server's address. Let's Encrypt asks from its own
+# resolvers, and a name one big resolver has while another still fails it (dedyn.io's delegation shows up a little
+# later in some) can fail the certificate; Caddy then waits longer and longer before it tries again (step_https).
+dns_everywhere() {
+  local host url out
+  for host in "$DOMAIN" "app.$DOMAIN" "$TURN_HOST.$DOMAIN"; do
+    for url in "https://cloudflare-dns.com/dns-query?name=$host&type=A" "https://dns.google/resolve?name=$host&type=A"; do
+      out=$(curl -fsS --max-time 5 -H 'accept: application/dns-json' "$url" 2>/dev/null) || return 1
+      [[ $out == *'"Status":0'* || $out == *'"Status": 0'* ]] || return 1
+      [[ -z ${SERVER_IP:-} || $out == *"\"$SERVER_IP\""* ]] || return 1
+    done
+  done
+}
+
 print_checks() {
   local item
   for item in "${CHECK_LINES[@]}"; do
@@ -810,7 +839,7 @@ step_files() {
   progress sub "Раскладываем файлы"
   mkdir -p "$stage" || return
   tar -xzf "$tgz" -C "$stage" --strip-components=1 --no-same-owner || return
-  for f in deploy/docker-compose.yml deploy/Caddyfile deploy/backup.sh deploy/livekit.yaml.tmpl; do
+  for f in deploy/docker-compose.yml deploy/Caddyfile deploy/backup.sh deploy/atrium-agent deploy/livekit.yaml.tmpl; do
     [[ -f $stage/$f ]] || { echo "Release has no $f"; return 1; }
   done
   mkdir -p "$ATRIUM_DIR/deploy" "$ATRIUM_DIR/landing" || return
@@ -819,7 +848,7 @@ step_files() {
     touch "$ATRIUM_TMP/caddyfile-changed" || return
   fi
   install -m 644 "$stage/deploy/docker-compose.yml" "$stage/deploy/Caddyfile" "$stage/deploy/livekit.yaml.tmpl" "$ATRIUM_DIR/deploy/" || return
-  install -m 755 "$stage/deploy/backup.sh" "$ATRIUM_DIR/deploy/" || return
+  install -m 755 "$stage/deploy/backup.sh" "$stage/deploy/atrium-agent" "$ATRIUM_DIR/deploy/" || return
   return 0
 }
 
@@ -1062,11 +1091,20 @@ step_up() {
   docker image prune -f
 }
 
+# The certificate. Caddy asks for it as it starts; when that first try fails (the name not seen everywhere yet), it
+# waits a minute, then two, four… before the next. A minute without one, Caddy is started again, which asks at once:
+# the certificate comes within a minute of the name being everywhere instead of after Caddy's next turn. Four minutes
+# in all; past that it's left to Caddy and the install still ends (screen_done says so).
 step_https() {
   local i
+  cd "$ATRIUM_DIR/deploy" || return
   progress sub "Ждём сертификат от Let's Encrypt"
-  for i in $(seq 1 30); do
+  for i in $(seq 1 80); do
     curl -fsS --max-time 5 -o /dev/null --resolve "app.$DOMAIN:443:127.0.0.1" "https://app.$DOMAIN/api/setup" && return 0
+    if (( i % 20 == 0 )); then
+      progress sub "Просим сертификат ещё раз"
+      docker compose restart caddy >/dev/null 2>&1 || true
+    fi
     sleep 3
   done
   return 1
@@ -1120,6 +1158,10 @@ install_all() {
   run "Настройки и ключи" step_config
   if [[ -d /run/systemd/system ]]; then run "Ночные бэкапы" step_backups; fi
   run "Скачиваем образы" step_pull
+  if [[ ${ATRIUM_PROGRESS:-} == 1 ]]; then
+    wait_dns
+    check_dns
+  fi
   run "Запуск" step_up
   HTTPS_OK=0
   if (( DNS_OK )); then
@@ -1387,14 +1429,15 @@ run_quiet() {
     die "Сервер не готов."
   fi
   progress "done" check
-  wait_dns
+  # From the desktop app the address is waited for later, right before the start (install_all).
   check_dns
-  if (( ! DNS_OK )); then
+  if (( ! DNS_OK )) && [[ ${ATRIUM_PROGRESS:-} != 1 ]]; then
     say
     warn "DNS ещё не готов:"
     print_dns
   fi
   install_all
+  lock_app_key
   screen_done
 }
 
@@ -1432,6 +1475,7 @@ wizard() {
         header 4
         title "Установка"
         install_all
+        lock_app_key
         screen_done
         return
         ;;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@atriumchat/install",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Atrium installer and release files: npx @atriumchat/install, or curl -fsSL https://cdn.jsdelivr.net/npm/@atriumchat/install/install.sh | sh",
   "homepage": "https://github.com/atriumchat/atrium",
   "repository": { "type": "git", "url": "git+https://github.com/atriumchat/atrium.git" },
   "license": "AGPL-3.0-only",
   "bin": { "atrium-install": "install.sh" },
-  "files": ["install.sh", "atrium-0.7.0.tar.gz", "LICENSE"]
+  "files": ["install.sh", "atrium-0.7.2.tar.gz", "LICENSE"]
 }