diff options
| -rwxr-xr-x | straper/install-base.sh | 35 | ||||
| -rwxr-xr-x | straper/restore-configs.sh | 9 |
2 files changed, 32 insertions, 12 deletions
diff --git a/straper/install-base.sh b/straper/install-base.sh index c3e62c4..819fa7a 100755 --- a/straper/install-base.sh +++ b/straper/install-base.sh @@ -84,7 +84,7 @@ BASE_PACKAGES=( ) CORE_PACKAGES=( - wireguard wireguard-tools dnsmasq unbound dns-root-data nginx mariadb-server postfix prosody + wireguard wireguard-tools dnsmasq unbound dns-root-data docker.io nginx mariadb-server postfix prosody tor i2pd pygopherd mumble-server prometheus prometheus-node-exporter loki apparmor apparmor-utils ) @@ -98,8 +98,24 @@ bootstrap_dns_prepare() { local test_host="${BOOTSTRAP_TEST_HOST:-deb.debian.org}" local backup="/etc/resolv.conf.labunix-preinstall.bak" + # Always write a static resolv.conf for bootstrap — breaks any symlink to + # systemd-resolved stub which can disappear mid-install when services restart. + if [[ -e /etc/resolv.conf && ! -e "${backup}" ]]; then + cp -a /etc/resolv.conf "${backup}" || true + fi + if getent ahostsv4 "${test_host}" >/dev/null 2>&1; then - report "${SCRIPT_NAME}" "dns" "bootstrap" "check" "ok" "resolver already working" "" + # DNS works — write static file pointing at current resolver + local current_ns + current_ns="$(grep '^nameserver' /etc/resolv.conf 2>/dev/null | head -1 | awk '{print $2}')" + current_ns="${current_ns:-1.1.1.1}" + # Don't use stub addresses — they won't survive service restarts + if [[ "$current_ns" == "127.0.0.53" || "$current_ns" == "127.0.0.54" ]]; then + current_ns="1.1.1.1" + fi + printf 'nameserver %s\nnameserver 9.9.9.9\n' "$current_ns" > /etc/resolv.conf + chmod 644 /etc/resolv.conf + report "${SCRIPT_NAME}" "dns" "bootstrap" "check" "ok" "static resolv.conf written: ${current_ns}" "" return 0 fi @@ -108,17 +124,12 @@ bootstrap_dns_prepare() { die "bootstrap DNS check failed: no outbound IP connectivity" fi - if command -v dig >/dev/null 2>&1 && dig +time=2 +tries=1 +short @1.1.1.1 "${test_host}" >/dev/null 2>&1; then - [[ -e /etc/resolv.conf && ! -e "${backup}" ]] && cp -a /etc/resolv.conf "${backup}" || true - printf 'nameserver 1.1.1.1 -nameserver 9.9.9.9 -' > /etc/resolv.conf - chmod 644 /etc/resolv.conf || true + printf 'nameserver 1.1.1.1\nnameserver 9.9.9.9\n' > /etc/resolv.conf + chmod 644 /etc/resolv.conf - if getent ahostsv4 "${test_host}" >/dev/null 2>&1; then - report "${SCRIPT_NAME}" "dns" "bootstrap" "fallback" "changed" "static resolv.conf applied" "${backup}" - return 0 - fi + if getent ahostsv4 "${test_host}" >/dev/null 2>&1; then + report "${SCRIPT_NAME}" "dns" "bootstrap" "fallback" "changed" "static fallback resolv.conf applied" "${backup}" + return 0 fi note_failure "${SCRIPT_NAME}" "dns" "bootstrap" "check" "DNS still broken after fallback attempt" diff --git a/straper/restore-configs.sh b/straper/restore-configs.sh index 9284f27..a9310cc 100755 --- a/straper/restore-configs.sh +++ b/straper/restore-configs.sh @@ -1474,6 +1474,15 @@ restore_docker() { report "${SCRIPT_NAME}" "docker" "compose-full" "manual" "manual" \ "compose files available in secret DB; restore manually per stack" "" fi + + # Ensure primary user is in docker group + if ! $DRY_RUN && id "${PRIMARY_USER:-lukasz}" >/dev/null 2>&1; then + if ! id -nG "${PRIMARY_USER:-lukasz}" | grep -qw docker; then + usermod -aG docker "${PRIMARY_USER:-lukasz}" 2>/dev/null || true + report "${SCRIPT_NAME}" "docker" "docker-group" "fix" "changed" \ + "${PRIMARY_USER:-lukasz} added to docker group — re-login required" "" + fi + fi } restore_monitoring() { |