direxio-deployer 0.1.0

package/scripts/aws-credentials.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+# aws-credentials.sh - import/verify AWS deployment credentials.
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+# shellcheck disable=SC1090
+source "$HERE/lib/aws.sh"
+
+usage() {
+  cat >&2 <<'EOF'
+Usage:
+  scripts/aws-credentials.sh import-csv <aws-access-key.csv> [profile] [region]
+  scripts/aws-credentials.sh verify [profile]
+
+Default profile: direxio-deployer
+Root identities are allowed when the operator explicitly chooses them.
+EOF
+}
+
+aws_credentials_file() {
+  printf '%s\n' "${AWS_SHARED_CREDENTIALS_FILE:-$HOME/.aws/credentials}"
+}
+
+aws_config_file() {
+  printf '%s\n' "${AWS_CONFIG_FILE:-$HOME/.aws/config}"
+}
+
+ensure_aws_file() {
+  local file=$1
+  mkdir -p "$(dirname "$file")"
+  chmod 700 "$(dirname "$file")" 2>/dev/null || true
+  [ -f "$file" ] || : > "$file"
+  chmod 600 "$file" 2>/dev/null || true
+}
+
+csv_column_index() {
+  local header=$1 wanted=$2
+  awk -v header="$header" -v wanted="$wanted" '
+    BEGIN {
+      n = split(header, cols, ",")
+      for (i = 1; i <= n; i++) {
+        gsub(/^"|"$/, "", cols[i])
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", cols[i])
+        if (tolower(cols[i]) == tolower(wanted)) {
+          print i
+          exit
+        }
+      }
+    }
+  '
+}
+
+csv_field() {
+  local row=$1 index=$2
+  awk -v row="$row" -v idx="$index" '
+    BEGIN {
+      n = split(row, cols, ",")
+      value = cols[idx]
+      gsub(/^"|"$/, "", value)
+      gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+      print value
+    }
+  '
+}
+
+read_csv_credentials() {
+  local csv=$1 header row ak_i sk_i token_i access_key secret_key session_token
+  [ -f "$csv" ] || {
+    echo "CSV file not found: $csv" >&2
+    return 1
+  }
+  IFS= read -r header < "$csv" || return 1
+  row=$(tail -n +2 "$csv" | sed '/^[[:space:]]*$/d' | head -n 1)
+  [ -n "$row" ] || {
+    echo "CSV has no credential row: $csv" >&2
+    return 1
+  }
+  ak_i=$(csv_column_index "$header" "Access key ID")
+  [ -n "$ak_i" ] || ak_i=$(csv_column_index "$header" "Access key id")
+  sk_i=$(csv_column_index "$header" "Secret access key")
+  token_i=$(csv_column_index "$header" "Session token")
+  [ -n "$ak_i" ] && [ -n "$sk_i" ] || {
+    echo "CSV must contain Access key ID and Secret access key columns" >&2
+    return 1
+  }
+  access_key=$(csv_field "$row" "$ak_i")
+  secret_key=$(csv_field "$row" "$sk_i")
+  session_token=""
+  [ -n "$token_i" ] && session_token=$(csv_field "$row" "$token_i")
+  [ -n "$access_key" ] && [ -n "$secret_key" ] || {
+    echo "CSV credential values are incomplete" >&2
+    return 1
+  }
+  printf '%s\t%s\t%s\n' "$access_key" "$secret_key" "$session_token"
+}
+
+profile_header() {
+  local profile=$1 config=${2:-0}
+  if [ "$config" = "1" ] && [ "$profile" != "default" ]; then
+    printf 'profile %s\n' "$profile"
+  else
+    printf '%s\n' "$profile"
+  fi
+}
+
+remove_profile_section() {
+  local file=$1 header=$2 tmp
+  tmp="$file.tmp.$$"
+  awk -v target="[$header]" '
+    /^\[/ {
+      skip = ($0 == target)
+    }
+    !skip { print }
+  ' "$file" > "$tmp"
+  mv "$tmp" "$file"
+  chmod 600 "$file" 2>/dev/null || true
+}
+
+write_profile() {
+  local profile=$1 region=$2 access_key=$3 secret_key=$4 session_token=${5:-}
+  local credentials config cred_header config_header
+  credentials=$(aws_credentials_file)
+  config=$(aws_config_file)
+  ensure_aws_file "$credentials"
+  ensure_aws_file "$config"
+  cred_header=$(profile_header "$profile" 0)
+  config_header=$(profile_header "$profile" 1)
+  remove_profile_section "$credentials" "$cred_header"
+  remove_profile_section "$config" "$config_header"
+  {
+    printf '[%s]\n' "$cred_header"
+    printf 'aws_access_key_id = %s\n' "$access_key"
+    printf 'aws_secret_access_key = %s\n' "$secret_key"
+    [ -n "$session_token" ] && printf 'aws_session_token = %s\n' "$session_token"
+    printf '\n'
+  } >> "$credentials"
+  {
+    printf '[%s]\n' "$config_header"
+    printf 'region = %s\n' "$region"
+    printf 'output = json\n\n'
+  } >> "$config"
+  chmod 600 "$credentials" "$config" 2>/dev/null || true
+}
+
+verify_env_identity() {
+  local access_key=$1 secret_key=$2 session_token=${3:-} arn
+  arn=$(AWS_ACCESS_KEY_ID="$access_key" AWS_SECRET_ACCESS_KEY="$secret_key" AWS_SESSION_TOKEN="$session_token" aws_identity_arn)
+  [ -n "$arn" ] && [ "$arn" != "None" ] || {
+    echo "AWS credentials could not be verified with sts get-caller-identity" >&2
+    return 1
+  }
+  printf '%s\n' "$arn"
+}
+
+verify_profile() {
+  local profile=$1 arn root_identity=false
+  arn=$(AWS_PROFILE="$profile" aws_identity_arn)
+  [ -n "$arn" ] && [ "$arn" != "None" ] || {
+    echo "AWS profile could not be verified with sts get-caller-identity: $profile" >&2
+    return 1
+  }
+  aws_arn_is_root "$arn" && root_identity=true
+  printf 'AWS identity verified: profile=%s root=%s arn=%s\n' "$profile" "$root_identity" "$(aws_redact_arn "$arn")"
+}
+
+cmd_import_csv() {
+  local csv=${1:-} profile=${2:-direxio-deployer} region=${3:-${AWS_DEFAULT_REGION:-${AWS_REGION:-us-east-1}}}
+  local access_key secret_key session_token arn root_identity=false
+  [ -n "$csv" ] || {
+    usage
+    return 1
+  }
+  IFS=$'\t' read -r access_key secret_key session_token < <(read_csv_credentials "$csv")
+  arn=$(verify_env_identity "$access_key" "$secret_key" "$session_token")
+  aws_arn_is_root "$arn" && root_identity=true
+  write_profile "$profile" "$region" "$access_key" "$secret_key" "$session_token"
+  printf 'AWS credentials imported: profile=%s region=%s root=%s arn=%s\n' "$profile" "$region" "$root_identity" "$(aws_redact_arn "$arn")"
+  printf 'Credentials file: %s (0600)\n' "$(aws_credentials_file)"
+  printf 'Config file: %s (0600)\n' "$(aws_config_file)"
+}
+
+case "${1:-}" in
+  import-csv)
+    shift
+    cmd_import_csv "$@"
+    ;;
+  verify)
+    shift
+    verify_profile "${1:-${AWS_PROFILE:-direxio-deployer}}"
+    ;;
+  *)
+    usage
+    exit 1
+    ;;
+esac

package/scripts/cloud-init/Caddyfile

@@ -0,0 +1,48 @@
+# Caddyfile - automatic TLS reverse proxy for the Direxio message server.
+#
+# Public exposure is limited to 443 and 80 for ACME redirects. The message
+# server listens only inside the compose network on port 8008.
+
+{$DOMAIN} {
+	handle /.well-known/matrix/server {
+		header Content-Type application/json
+		respond `{"m.server":"{$DOMAIN}:443"}` 200
+	}
+	handle /.well-known/matrix/client {
+		header Content-Type application/json
+		header Access-Control-Allow-Origin *
+		respond `{"m.homeserver":{"base_url":"https://{$DOMAIN}"}}` 200
+	}
+
+	handle_path /.well-known/portal/* {
+		header Access-Control-Allow-Origin *
+		header Access-Control-Allow-Methods "GET, OPTIONS"
+		header Access-Control-Allow-Headers "Content-Type"
+		@portal_options method OPTIONS
+		respond @portal_options 204
+		root * /srv/p2p/wellknown
+		file_server
+	}
+
+	handle /healthz {
+		rewrite * /_p2p/health
+		reverse_proxy message-server:8008
+	}
+
+	handle /_matrix/* {
+		reverse_proxy message-server:8008
+	}
+	handle /_dendrite/* {
+		reverse_proxy message-server:8008
+	}
+	handle /_synapse/* {
+		reverse_proxy message-server:8008
+	}
+	handle /_p2p/* {
+		reverse_proxy message-server:8008
+	}
+
+	handle {
+		reverse_proxy message-server:8008
+	}
+}

package/scripts/cloud-init/docker-compose.yml

@@ -0,0 +1,125 @@
+# docker-compose.yml - cloud-side Direxio message-server stack.
+#
+# Layers: Caddy (public 443/TLS) -> Direxio message-server (Matrix + P2P API).
+# PostgreSQL 18 persists Matrix and P2P business tables. The local agent bridge
+# process is not started in the cloud by default.
+
+networks:
+  p2p-net:
+
+volumes:
+  postgres-data:
+  message-config:
+  message-data:
+  caddy-data:
+  caddy-config:
+
+services:
+  postgres:
+    image: postgres:18-alpine
+    networks: [p2p-net]
+    environment:
+      POSTGRES_USER: direxio_message_server
+      POSTGRES_PASSWORD: direxio_message_server
+      POSTGRES_DB: direxio_message_server
+    volumes:
+      - postgres-data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U direxio_message_server -d direxio_message_server"]
+      interval: 5s
+      timeout: 3s
+      retries: 30
+    restart: unless-stopped
+
+  message-init:
+    image: ${MESSAGE_SERVER_IMAGE}
+    networks: [p2p-net]
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      TURN_SECRET: ${TURN_SECRET}
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        set -eu
+        mkdir -p /etc/direxio-message-server /var/direxio-message-server /var/direxio-message-server/p2p
+        if [ ! -f /etc/direxio-message-server/matrix_key.pem ]; then
+          /usr/bin/generate-keys -private-key /etc/direxio-message-server/matrix_key.pem
+        fi
+        CFG=/etc/direxio-message-server/message-server.yaml
+        DB="postgres://direxio_message_server:direxio_message_server@postgres/direxio_message_server?sslmode=disable"
+        /usr/bin/generate-config -dir /var/direxio-message-server -db "$$DB" -server "${DOMAIN}" > "$$CFG"
+        printf '\nclient_api:\n  turn:\n    turn_shared_secret: "%s"\n    turn_user_lifetime: "24h"\n    turn_uris:\n      - "turn:%s:3478?transport=udp"\n      - "turn:%s:3478?transport=tcp"\n' "$$TURN_SECRET" "${DOMAIN}" "${DOMAIN}" >> "$$CFG"
+    volumes:
+      - message-config:/etc/direxio-message-server
+      - message-data:/var/direxio-message-server
+    restart: "no"
+
+  message-server:
+    image: ${MESSAGE_SERVER_IMAGE}
+    networks: [p2p-net]
+    depends_on:
+      postgres:
+        condition: service_healthy
+      message-init:
+        condition: service_completed_successfully
+    environment:
+      P2P_PORTAL_CREDENTIALS_FILE: /var/direxio-message-server/p2p/bootstrap.json
+      P2P_PORTAL_PASSWORD: ${P2P_PORTAL_PASSWORD}
+    command:
+      - --config
+      - /etc/direxio-message-server/message-server.yaml
+      - --http-bind-address
+      - :8008
+    volumes:
+      - message-config:/etc/direxio-message-server
+      - message-data:/var/direxio-message-server
+      - /opt/p2p:/opt/p2p
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1:8008/_p2p/health >/dev/null"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 15s
+    restart: unless-stopped
+
+  caddy:
+    image: caddy:2
+    networks: [p2p-net]
+    depends_on:
+      message-server:
+        condition: service_healthy
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - DOMAIN=${DOMAIN}
+      - ACME_EMAIL=${ACME_EMAIL}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+      - /opt/p2p:/srv/p2p:ro
+    restart: unless-stopped
+
+  coturn:
+    image: coturn/coturn:latest
+    network_mode: host
+    restart: unless-stopped
+    command:
+      - -n
+      - --realm=${DOMAIN}
+      - --listening-port=3478
+      - --min-port=49160
+      - --max-port=49200
+      - --external-ip=${PUBLIC_IP}
+      - --use-auth-secret
+      - --static-auth-secret=${TURN_SECRET}
+      - --no-cli
+      - --no-tls
+      - --no-dtls
+      - --no-multicast-peers
+      - --denied-peer-ip=10.0.0.0-10.255.255.255
+      - --denied-peer-ip=172.16.0.0-172.31.255.255
+      - --denied-peer-ip=192.168.0.0-192.168.255.255

package/scripts/cloud-init/init-tokens.sh

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+# init-tokens.sh - wait for message-server bootstrap credentials after compose is up.
+set -euo pipefail
+
+P2P_DIR=${P2P_DIR:-/opt/p2p}
+COMPOSE="docker compose -f ${P2P_DIR}/docker-compose.yml --env-file ${P2P_DIR}/.env"
+DOMAIN=${DOMAIN:?DOMAIN is required (e.g. __DOMAIN__)}
+CONTAINER_BOOTSTRAP_FILE=${CONTAINER_BOOTSTRAP_FILE:-/var/direxio-message-server/p2p/bootstrap.json}
+BOOTSTRAP_FILE=${BOOTSTRAP_FILE:-/opt/p2p/bootstrap.json}
+WELLKNOWN_DIR=${WELLKNOWN_DIR:-/opt/p2p/wellknown}
+
+log() { echo "[init-tokens] $*" >&2; }
+
+env_string() {
+  local key=$1
+  grep -E "^${key}=" "${P2P_DIR}/.env" 2>/dev/null \
+    | tail -1 \
+    | cut -d= -f2- \
+    || true
+}
+
+json_string() {
+  local key=$1 file=$2
+  grep -oE '"'"$key"'"[[:space:]]*:[[:space:]]*"[^"]+"' "$file" 2>/dev/null \
+    | head -1 \
+    | sed -E 's/.*:[[:space:]]*"([^"]+)".*/\1/' \
+    || true
+}
+
+matrix_room_path() {
+  printf '%s' "$1" | sed 's/%/%25/g; s/!/%21/g; s/:/%3A/g'
+}
+
+container_post_json() {
+  local path=$1 json=$2 token=${3:-}
+  if [ -n "$token" ]; then
+    $COMPOSE exec -T message-server wget -q -O - \
+      --header='Content-Type: application/json' \
+      --header="Authorization: Bearer ${token}" \
+      --post-data="$json" \
+      "http://127.0.0.1:8008${path}"
+  else
+    $COMPOSE exec -T message-server wget -q -O - \
+      --header='Content-Type: application/json' \
+      --post-data="$json" \
+      "http://127.0.0.1:8008${path}"
+  fi
+}
+
+wait_for_message_server() {
+  log "waiting for message-server /_p2p/health ..."
+  for i in $(seq 1 90); do
+    if $COMPOSE exec -T message-server wget -q -O - http://127.0.0.1:8008/_p2p/health >/dev/null 2>&1; then
+      log "message-server is healthy."
+      return 0
+    fi
+    sleep 5
+  done
+  log "message-server did not become healthy in time"
+  return 1
+}
+
+copy_bootstrap_file() {
+  local tmp
+  tmp=$(mktemp)
+  if ! $COMPOSE exec -T message-server sh -c "test -s '$CONTAINER_BOOTSTRAP_FILE' && cat '$CONTAINER_BOOTSTRAP_FILE'" > "$tmp" 2>/dev/null; then
+    rm -f "$tmp"
+    return 1
+  fi
+  install -m 0600 "$tmp" "$BOOTSTRAP_FILE"
+  rm -f "$tmp"
+}
+
+bootstrap_has_core_credentials() {
+  local password agent_token access_token file=$1
+  password=$(json_string password "$file")
+  agent_token=$(json_string agent_token "$file")
+  access_token=$(json_string access_token "$file")
+  [ -n "$password" ] && [ -n "$agent_token" ] && [ -n "$access_token" ]
+}
+
+bootstrap_has_real_agent_room() {
+  local room file=$1
+  room=$(json_string agent_room_id "$file")
+  case "$room" in
+    !agent:*|"") return 1 ;;
+    !*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+bootstrap_portal() {
+  local password tmp
+  password=${P2P_PORTAL_PASSWORD:-}
+  [ -n "$password" ] || password=$(env_string P2P_PORTAL_PASSWORD)
+  if [ -z "$password" ]; then
+    log "FATAL: P2P_PORTAL_PASSWORD is missing from environment and ${P2P_DIR}/.env"
+    return 1
+  fi
+  tmp=$(mktemp)
+  if container_post_json "/_p2p/command" "{\"action\":\"portal.bootstrap\",\"params\":{\"password\":\"${password}\"}}" > "$tmp" 2>/dev/null; then
+    log "portal.bootstrap accepted."
+    rm -f "$tmp"
+    return 0
+  fi
+  log "portal.bootstrap failed: $(head -c 160 "$tmp" 2>/dev/null)"
+  rm -f "$tmp"
+  return 1
+}
+
+wait_for_core_bootstrap_file() {
+  local password agent_token access_token
+  log "waiting for ${CONTAINER_BOOTSTRAP_FILE} ..."
+  for i in $(seq 1 90); do
+    if copy_bootstrap_file; then
+      if bootstrap_has_core_credentials "$BOOTSTRAP_FILE"; then
+        log "credentials file is ready."
+        return 0
+      fi
+      log "credentials file exists but is missing password/access/agent token"
+    fi
+    sleep 5
+  done
+  log "FATAL: ${CONTAINER_BOOTSTRAP_FILE} was not written with complete credentials in time."
+  return 1
+}
+
+copy_host_bootstrap_to_container() {
+  $COMPOSE exec -T message-server sh -c "mkdir -p '$(dirname "$CONTAINER_BOOTSTRAP_FILE")' && cat > '$CONTAINER_BOOTSTRAP_FILE' && chmod 600 '$CONTAINER_BOOTSTRAP_FILE'" < "$BOOTSTRAP_FILE"
+}
+
+write_agent_room_to_bootstrap() {
+  local room_id=$1
+  python3 - "$BOOTSTRAP_FILE" "$room_id" "$DOMAIN" <<'PY'
+import json
+import sys
+
+path, room_id, domain = sys.argv[1], sys.argv[2], sys.argv[3]
+with open(path, "r", encoding="utf-8") as fh:
+    data = json.load(fh)
+data["agent_room_id"] = room_id
+data.setdefault("domain", domain)
+with open(path, "w", encoding="utf-8") as fh:
+    json.dump(data, fh, separators=(",", ":"))
+    fh.write("\n")
+PY
+  chmod 0600 "$BOOTSTRAP_FILE"
+  copy_host_bootstrap_to_container
+}
+
+ensure_agent_room() {
+  local owner_token agent_user session room_resp join_resp agent_token room_id room_path
+  if copy_bootstrap_file && bootstrap_has_real_agent_room "$BOOTSTRAP_FILE"; then
+    log "agent_room_id is already present."
+    return 0
+  fi
+
+  owner_token=$(json_string access_token "$BOOTSTRAP_FILE")
+  if [ -z "$owner_token" ]; then
+    log "FATAL: access_token is missing; cannot create agent room"
+    return 1
+  fi
+  agent_user="@agent:${DOMAIN}"
+  session=$(mktemp)
+  if ! container_post_json "/_p2p/command" '{"action":"agent.matrix_session.create","params":{"device_id":"DIREXIO_DEPLOY_BOOTSTRAP"}}' "$owner_token" > "$session" 2>/dev/null; then
+    log "FATAL: agent.matrix_session.create failed: $(head -c 160 "$session" 2>/dev/null)"
+    rm -f "$session"
+    return 1
+  fi
+  agent_token=$(json_string access_token "$session")
+  if [ -z "$agent_token" ]; then
+    log "FATAL: agent.matrix_session.create did not return access_token: $(head -c 160 "$session" 2>/dev/null)"
+    rm -f "$session"
+    return 1
+  fi
+  rm -f "$session"
+
+  room_resp=$(mktemp)
+  if ! container_post_json "/_matrix/client/v3/createRoom" "{\"preset\":\"private_chat\",\"visibility\":\"private\",\"name\":\"Direxio Agent\",\"invite\":[\"${agent_user}\"],\"is_direct\":false}" "$owner_token" > "$room_resp" 2>/dev/null; then
+    log "FATAL: Matrix createRoom failed: $(head -c 160 "$room_resp" 2>/dev/null)"
+    rm -f "$room_resp"
+    return 1
+  fi
+  room_id=$(json_string room_id "$room_resp")
+  rm -f "$room_resp"
+  if [ -z "$room_id" ]; then
+    log "FATAL: Matrix createRoom did not return room_id"
+    return 1
+  fi
+
+  room_path=$(matrix_room_path "$room_id")
+  join_resp=$(mktemp)
+  if ! container_post_json "/_matrix/client/v3/rooms/${room_path}/join" '{}' "$agent_token" > "$join_resp" 2>/dev/null; then
+    log "FATAL: agent join failed for ${room_id}: $(head -c 160 "$join_resp" 2>/dev/null)"
+    rm -f "$join_resp"
+    return 1
+  fi
+  rm -f "$join_resp"
+
+  write_agent_room_to_bootstrap "$room_id"
+  log "created and persisted agent_room_id=${room_id}"
+}
+
+wait_for_complete_bootstrap_file() {
+  log "waiting for complete bootstrap credentials with agent_room_id ..."
+  for i in $(seq 1 30); do
+    if copy_bootstrap_file && bootstrap_has_core_credentials "$BOOTSTRAP_FILE" && bootstrap_has_real_agent_room "$BOOTSTRAP_FILE"; then
+      log "complete credentials file is ready."
+      return 0
+    fi
+    sleep 2
+  done
+  log "FATAL: bootstrap credentials never contained a real agent_room_id."
+  return 1
+}
+
+write_owner_json() {
+  local user_id homeserver
+  mkdir -p "$WELLKNOWN_DIR"
+  user_id=$(json_string user_id "$BOOTSTRAP_FILE")
+  [ -n "$user_id" ] || user_id=$(json_string owner_user_id "$BOOTSTRAP_FILE")
+  [ -n "$user_id" ] || user_id="@owner:${DOMAIN}"
+  homeserver=$(json_string homeserver "$BOOTSTRAP_FILE")
+  [ -n "$homeserver" ] || homeserver="https://${DOMAIN}"
+  cat > "${WELLKNOWN_DIR}/owner.json" <<EOF
+{"user_id":"${user_id}","owner_user_id":"${user_id}","display_name":"owner","domain":"${DOMAIN}","homeserver":"${homeserver}"}
+EOF
+  chmod 0644 "${WELLKNOWN_DIR}/owner.json"
+}
+
+mkdir -p "$(dirname "$BOOTSTRAP_FILE")" "$WELLKNOWN_DIR"
+wait_for_message_server
+bootstrap_portal
+wait_for_core_bootstrap_file
+ensure_agent_room
+wait_for_complete_bootstrap_file
+write_owner_json
+echo "$BOOTSTRAP_FILE"

package/scripts/cloud-init/user-data.yaml

@@ -0,0 +1,40 @@
+#cloud-config
+# user-data.yaml - runs once on first EC2 boot as cloud-init user-data.
+#
+# Flow: install Docker -> write deployment files -> generate local secrets ->
+# docker compose up -> wait for message-server bootstrap credentials.
+
+package_update: true
+package_upgrade: false
+
+write_files:
+  - path: /opt/p2p/.env
+    permissions: '0600'
+    content: |
+      DOMAIN=__DOMAIN__
+      ACME_EMAIL=__ACME_EMAIL__
+      MESSAGE_SERVER_IMAGE=__MESSAGE_SERVER_IMAGE__
+
+runcmd:
+  - |
+    TOK=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
+          -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
+    IP=$(curl -s -H "X-aws-ec2-metadata-token: $TOK" \
+           http://169.254.169.254/latest/meta-data/public-ipv4)
+    [ -n "$IP" ] || IP=$(curl -s https://api.ipify.org || curl -s https://ifconfig.me)
+    grep -q '^PUBLIC_IP=' /opt/p2p/.env || echo "PUBLIC_IP=$IP" >> /opt/p2p/.env
+    grep -q '^TURN_SECRET=' /opt/p2p/.env || \
+      echo "TURN_SECRET=$(head -c 32 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 40)" >> /opt/p2p/.env
+    grep -q '^P2P_PORTAL_PASSWORD=' /opt/p2p/.env || \
+      echo "P2P_PORTAL_PASSWORD=$(od -An -N4 -tu4 /dev/urandom | awk '{printf "%08d", $1 % 100000000}')" >> /opt/p2p/.env
+  - export DOMAIN=$(grep '^DOMAIN=' /opt/p2p/.env | cut -d= -f2)
+  - curl -fsSL https://get.docker.com | sh
+  - systemctl enable --now docker
+  - mkdir -p /opt/p2p/wellknown
+  - chmod 700 /opt/p2p
+  - |
+    set -e
+    cd /opt/p2p
+    docker compose --env-file .env up -d
+    DOMAIN=$(grep '^DOMAIN=' .env | cut -d= -f2) bash init-tokens.sh
+    touch /opt/p2p/.deploy-done