fuzzyworld-tools / files / runner / install.sh
install.sh
| 1 | #!/bin/bash |
| 2 | # Install or update the CI runner on TrueNAS. Run from the laptop: |
| 3 | # |
| 4 | # runner/install.sh copy the runner, make its ssh key, add the cron job |
| 5 | # runner/install.sh --authorize ...and allow that key on DreamHost (restricted to server/runner-api) |
| 6 | # |
| 7 | # Settings (environment): FW_RUNNER_SSH (default: truenas), FW_RUNNER_DIR (default: |
| 8 | # /mnt/main-2025/fw-runner), FW_HOST (DreamHost ssh alias, default: dh). |
| 9 | # The runner needs Docker and Python 3 with PyYAML on TrueNAS (both are part of TrueNAS SCALE). |
| 10 | set -euo pipefail |
| 11 | cd "$(dirname "$0")" |
| 12 | NAS=${FW_RUNNER_SSH:-truenas} |
| 13 | DIR=${FW_RUNNER_DIR:-/mnt/main-2025/fw-runner} |
| 14 | HOST=${FW_HOST:-dh} |
| 15 | |
| 16 | ssh "$NAS" "mkdir -p '$DIR/.ssh' '$DIR/secrets' '$DIR/work' && chmod 700 '$DIR/.ssh' '$DIR/secrets'" |
| 17 | rsync -rlpt fw-runner.py shoot.py "$NAS:$DIR/" |
| 18 | ssh "$NAS" "chmod +x '$DIR/fw-runner.py'; [ -f '$DIR/.ssh/id_ed25519' ] || ssh-keygen -q -t ed25519 -N '' -C 'fw-runner (CI only on DreamHost)' -f '$DIR/.ssh/id_ed25519'" |
| 19 | pub=$(ssh "$NAS" "cat '$DIR/.ssh/id_ed25519.pub'") |
| 20 | line="restrict,command=\"/home/fuzzygamer/fw/tools/server/runner-api\" $pub" |
| 21 | |
| 22 | # Cron job every 2 minutes, through TrueNAS's own cron settings so it survives updates. |
| 23 | # flock: a run that is still busy with a long job makes the next one exit at once. |
| 24 | cmd="flock -n $DIR/.lock python3 $DIR/fw-runner.py >> $DIR/runner.log 2>&1" |
| 25 | ssh "$NAS" "midclt call cronjob.query '[[\"description\",\"=\",\"fw-runner\"]]'" | grep -q '"id"' || \ |
| 26 | ssh "$NAS" "midclt call cronjob.create '$(python3 -c 'import json,sys; print(json.dumps({ |
| 27 | "description": "fw-runner", "user": "root", "command": sys.argv[1], "enabled": True, |
| 28 | "stdout": False, "stderr": False, # True would make TrueNAS append "> /dev/null", undoing the redirect to runner.log |
| 29 | "schedule": {"minute": "*/2", "hour": "*", "dom": "*", "month": "*", "dow": "*"}}))' "$cmd")'" >/dev/null |
| 30 | echo "runner installed in $NAS:$DIR (cron: every 2 minutes)" |
| 31 | |
| 32 | if [ "${1:-}" = --authorize ]; then |
| 33 | ssh "$HOST" "grep -qF '$pub' ~/.ssh/authorized_keys || echo '$line' >> ~/.ssh/authorized_keys" |
| 34 | echo "key allowed on $HOST (runner-api only)" |
| 35 | else |
| 36 | echo "To let it take jobs, add this line to ~/.ssh/authorized_keys on DreamHost (or rerun with --authorize):" |
| 37 | echo " $line" |
| 38 | fi |