diff --git a/dependencies/dns_evernode.sh b/dependencies/dns_evernode.sh index ca8bee2..fe619a8 100644 --- a/dependencies/dns_evernode.sh +++ b/dependencies/dns_evernode.sh @@ -5,14 +5,14 @@ # Function to ADD a DNS TXT record dns_evernode_add() { - full_domain="$1" # The full domain (e.g., _acme-challenge.example.com) - txtvalue="$2" # The TXT record value to add - apicall_success="false" # variable used to keep tabs if API call was a success + full_domain="$1" # The full domain (e.g., _acme-challenge.example.com) + txtvalue="$2" # The TXT record value to add + apicall_success="false" # variable used to keep tabs if API call was a success api_subdomain="https://dnsapi." # subdomain that API is setup on the evernode - nameserver_override="@8.8.8.8" # a nameserver to use for all the "digs", so as not to use the "host default one" + nameserver_override="@8.8.8.8" # a nameserver to use for all the "digs", so as not to use the "host default one" - _info "### Evernode DNS v.93 script running, this will collect all name servers that are held within $full_domain" - _info "### then it will poll each name server to add the TXT record, (substituting subdomain for ${api_subdomain}) as long as one works the script wil continue." + _info "### Evernode DNS v.94 script running, this will collect all name servers that are held within $full_domain" + _info "### then it will poll each name server to add the TXT record, (substituting subdomain for ${api_subdomain}) as long as one works the script will continue." # Step 1: Fetch authoritative nameservers for the parent domain (_acme-challenge.subdomain.main.com -> subdomain.main.com) parent_domain="${full_domain#*.}" @@ -23,9 +23,6 @@ dns_evernode_add() { grep -v "^;" | sed -n 's/^\([^[:space:]]\+\)[[:space:]]\+[0-9]\+[[:space:]]\+IN[[:space:]]\+NS.*/\1/p' | sort | tail -n1) - - #### v1 sed | sed -n '/^[^;]/ {/NS[[:space:]]/s/^\([^[:space:]]\+\)[[:space:]]\+[0-9]\+[[:space:]]\+IN[[:space:]]\+NS.*/\1/p}' | tail -n 1) - ## used sed instead of, | awk '/^[^;]/ && $4 == "NS" {print $1}' else zone_parent_domain="$parent_domain" fi @@ -52,7 +49,7 @@ dns_evernode_add() { # Step 3: get full list of "NS records" held for _acme-challenge subdomain for domain we want SSL for. ns_challenge_domain=$(dig +norecurse +noall +authority NS "$full_domain" @"$ns") - # process the above NS records, store in new variable, so we can check validity (using sed to comply with hook plugin environment) + # process the above NS records, store in new variable, so we can check validity (using sed to comply with acme.sh hook plugin environment) ns_records=$(echo "$ns_challenge_domain" | sed -n '/IN[[:space:]]\+NS/{s/.*[[:space:]]\([^[:space:]]\+\)$/\1/;p}') # Check if processed response is empty, if so, try next name server. @@ -112,16 +109,18 @@ dns_evernode_rm() { api_subdomain="https://dnsapi." nameserver_override="@8.8.8.8" # a nameserver to use for all the "digs", so as not to use the "host default one" - _info "### Evernode DNS v.9 script running, this will collect all name servers that are held within $full_domain" - _info "### then it will poll each name server to now remove the TXT record, (substituting subdomain for ${api_subdomain})." + _info "### Evernode DNS v.94 script running, this will collect all name servers that are held within $full_domain" + _info "### then it will poll each name server to now remove the TXT record, (substituting subdomain for ${api_subdomain})." # Step 1: Fetch authoritative nameservers for the parent domain (_acme-challenge.subdomain.main.com -> subdomain.main.com) parent_domain="${full_domain#*.}" # make sure we have zone correct dots=$(echo "$parent_domain" | tr -cd '.' | wc -c) if [ "$dots" -gt 1 ]; then - zone_parent_domain=$(dig +trace +time=1 +tries=1 "$parent_domain" $nameserver_override | sed -n '/^[^;]/ {/NS[[:space:]]/s/^\([^[:space:]]\+\)[[:space:]]\+[0-9]\+[[:space:]]\+IN[[:space:]]\+NS.*/\1/p -}' | tail -n 1) + zone_parent_domain=$(dig +trace +time=1 +tries=1 "$parent_domain" $nameserver_override | + grep -v "^;" | + sed -n 's/^\([^[:space:]]\+\)[[:space:]]\+[0-9]\+[[:space:]]\+IN[[:space:]]\+NS.*/\1/p' | + sort | tail -n1) else zone_parent_domain="$parent_domain" fi @@ -148,7 +147,7 @@ dns_evernode_rm() { # Step 3: get full list of "NS records" held for _acme-challenge subdomain for domain we want SSL for. ns_challenge_domain=$(dig +norecurse +noall +authority NS "$full_domain" @"$ns") - # process the above NS records, store in new variable, so we can check validity (using sed to comply with hook plugin environment) + # process the above NS records, store in new variable, so we can check validity (using sed to comply with acme.sh hook plugin environment) ns_records=$(echo "$ns_challenge_domain" | sed -n '/IN[[:space:]]\+NS/{s/.*[[:space:]]\([^[:space:]]\+\)$/\1/;p}') # Check if processed response is empty, if so, try next name server. diff --git a/dependencies/user-install.sh b/dependencies/user-install.sh index 5842e6b..41ed8d3 100755 --- a/dependencies/user-install.sh +++ b/dependencies/user-install.sh @@ -1,7 +1,7 @@ #!/bin/bash # Sashimono contract instance user installation script. # This is intended to be called by Sashimono agent. -version=1.1 +version=1.4 # Check for user cpu and memory quotas. cpu=$1 @@ -207,9 +207,10 @@ setquota -u "$user" "$disk" "$disk" 0 0 / && echo "Configured disk quota of $dis # Extract additional port settings if present, 1st it splits everything after :, then replaces all -- with |, and uses that to create an array echo -echo "# checking for any additional port config within image name :$docker_image" +echo "# checking for any additional port config within image name $docker_image" IFS='|' read -r -a image_array <<< "$( echo $docker_image | cut -d':' -f2 | sed 's/--/|/g' )" echo "captured additional docker settings, ${image_array[@]}" +[[ "$docker_image" == *":"* ]] || image_array[0]="latest" docker_image_version="${image_array[0]:-latest}" custom_docker_settings=false custom_docker_domain="" @@ -427,6 +428,12 @@ echo "[Service] Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns " >"$docker_service_override_conf" +# check nftables is installed (TODO, add this check to the main evernode installer) +if ! command -v nft &> /dev/null; then + echo "nftables not installed. Installing now..." + apt-get update && apt-get -y install nftables +fi + # Create nftables (aka iptables), to block traffic to the local LAN subnet (for IPv4 and IPv6) local_ip=$(hostname -I | awk '{print $1}' | xargs) public_hostname_ip=$(dig +short "$EVERNODE_HOSTNAME" | head -n 1 | xargs) @@ -574,7 +581,7 @@ echo -echo "Adding hpfs, docker_recreate and depending on recreate docker_vars services for the instance." +echo "Adding hpfs mounts, and depending on instance options, docker_recreate or docker_vars services." echo "[Unit] Description=Running and monitoring contract fs. @@ -624,8 +631,7 @@ if [[ "$TLS_TYPE" == "NPMplus" ]]; then mkdir -p $user_dir/.acme.sh/ cp /usr/bin/sashimono/acme.sh $user_dir/.acme.sh/acme.sh cp /usr/bin/sashimono/dns_evernode.sh $user_dir/.acme.sh/dns_evernode.sh - chown -R $user:$user $user_dir/.acme.sh/acme.sh - chown -R $user:$user $user_dir/.acme.sh/dns_evernode.sh + chown -R $user:$user $user_dir/.acme.sh/ fi cat > "$user_dir"/.docker/domain_ssl_update.sh < "$user_dir"/.docker/docker_recreate.sh <> "${user_dir}/.docker/docker_recreate.log"; \\ - bash "${user_dir}/.docker/domain_ssl_update.sh" 2>&1 | tee -a ${user_dir}/.docker/domain_ssl_update.log; \\ + bash "${user_dir}/.docker/docker_recreate.sh" 2>&1 | tee -a ${user_dir}/.docker/docker_recreate.log; \\ cp ${user_dir}/.docker/env.vars ${user_dir}/${contract_dir}/env.vars; \\ ${quota_crontab_entry}; \\ ${domain_ssl_update_1}; \\ @@ -1019,6 +1025,7 @@ echo "cat $user_dir/.docker/domain_ssl_update.log >> /root/domain_ssl_update.log chown -R $user:$user $cleanup_script else + echo "no user custom docker settings detected, only adding env.vars file and quota system." quota_crontab_awk_cmd="awk ''\'NR==3 {print \\\\\$2}''\'" quota_crontab_sed_cmd='sed \\"s/^DISK_USED_BYTES=.*/DISK_USED_BYTES=\\$USED_BYTES/\\"' quota_crontab_entry='echo "*/1 * * * * USED_BYTES=\\$(quota -u '${user}' 2>/dev/null | '${quota_crontab_awk_cmd}' || echo \\"0\\") && '${quota_crontab_sed_cmd}' \\"'${user_dir}'/'${contract_dir}'/env.vars\\" > \\"'${user_dir}'/'${contract_dir}'/env.vars.tmp\\" && [ -s '${user_dir}'/'${contract_dir}'/env.vars.tmp ] && mv \\"'${user_dir}'/'${contract_dir}'/env.vars.tmp\\" \\"'${user_dir}'/'${contract_dir}'/env.vars\\"" | crontab -' diff --git a/installer/prereq.sh b/installer/prereq.sh index c6defb0..a36c320 100755 --- a/installer/prereq.sh +++ b/installer/prereq.sh @@ -92,10 +92,10 @@ fi # If not add groupquota to the options. stage "Configuring fstab" updated=0 -sed -n -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ /^\S+\s+\/\s+\S+\s+\S*grpjquota=aquota.group\S*/{q100} }" "$tmpfstab" +sed -n -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ /^\S+\s+\/\s+\S+\s+\S*usrquota\S*/{q100} }" "$tmpfstab" res=$? if [ $res -eq 0 ]; then - sed -i -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ s/^\S+\s+\/\s+\S+\s+\S+/&,grpjquota=aquota.group/ }" "$tmpfstab" + sed -i -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ s/^\S+\s+\/\s+\S+\s+\S+/&,usrquota/ }" "$tmpfstab" res=$? updated=1 fi @@ -103,13 +103,13 @@ fi # If the res is not success(0) or already exist(100). [ ! $res -eq 0 ] && [ ! $res -eq 100 ] && echo "fstab update failed." && exit 1 -sed -n -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ /^\S+\s+\/\s+\S+\s+\S*jqfmt=vfsv0\S*/{q100} }" "$tmpfstab" -res=$? -if [ $res -eq 0 ]; then - sed -i -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ s/^\S+\s+\/\s+\S+\s+\S+/&,jqfmt=vfsv0/ }" "$tmpfstab" - res=$? - updated=1 -fi +# sed -n -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ /^\S+\s+\/\s+\S+\s+\S*jqfmt=vfsv0\S*/{q100} }" "$tmpfstab" +# res=$? +# if [ $res -eq 0 ]; then +# sed -i -r -e "/^[^#]\S+\s+\/\s+\S+\s+\S+\s+[0-9]+\s+[0-9]+\s*/{ s/^\S+\s+\/\s+\S+\s+\S+/&,jqfmt=vfsv0/ }" "$tmpfstab" +# res=$? +# updated=1 +# fi # If the res is not success(0) or alredy exist(100). [ ! $res -eq 0 ] && [ ! $res -eq 100 ] && echo "fstab update failed." && exit 1 @@ -130,8 +130,8 @@ fi # Check and turn on group quota if not enabled. if [ ! -f /aquota.group ]; then - quotacheck -ugm / - quotaon -v / + quotacheck -cum / + quotaon -u / fi # ------------------------------- diff --git a/src/hp_manager.cpp b/src/hp_manager.cpp index 063ef9a..6f67a2e 100644 --- a/src/hp_manager.cpp +++ b/src/hp_manager.cpp @@ -196,6 +196,11 @@ namespace hp const std::string contract_dir = util::get_user_contract_dir(username, container_name); + auto pos = image_name.find("--"); + if (pos != std::string::npos) { + image_name = image_name.substr(0, pos); + } + if (create_contract(username, owner_pubkey, contract_id, contract_dir, instance_ports, info) == -1 || create_container(username, image_name, container_name, contract_dir, instance_ports, info) == -1) {