From 24429ee8b5df54d5c16d6a20369ceebf03d5b82f Mon Sep 17 00:00:00 2001 From: tomnewton-mulga Date: Wed, 15 Apr 2026 13:36:07 +1000 Subject: [PATCH] =?UTF-8?q?fix:=20simplify=20firstboot=20=E2=80=94=20deleg?= =?UTF-8?q?ate=20setup=20to=20setup.sh=20with=20embedded=20tarball?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove the duplicated chown/ownership/symlink block from the firstboot script. setup.sh (called with INSTALL_SPINIFEX_TARBALL) already handles service users, directory ownership, sudoers, systemd unit installation, and enabling spinifex.target — the same steps as the online curl|bash install. Firstboot now follows the documented install flow directly: 1. setup.sh --tarball (air-gapped equivalent of curl|bash) 2. setup-ovn.sh --management 3. spx admin init 4. systemctl start spinifex.target Also reduce wait-for-nats.sh timeout from 90s to 30s per reviewer feedback. --- build/scripts/wait-for-nats.sh | 2 +- cmd/installer/firstboot/firstboot.go | 30 ++++++++++------------------ 2 files changed, 11 insertions(+), 21 deletions(-) diff --git a/build/scripts/wait-for-nats.sh b/build/scripts/wait-for-nats.sh index 70424faa8..40322cc77 100755 --- a/build/scripts/wait-for-nats.sh +++ b/build/scripts/wait-for-nats.sh @@ -7,7 +7,7 @@ CONF=/etc/spinifex/spinifex.toml NATS_CONF=/etc/spinifex/nats/nats.conf NATS_HOST="" NATS_PORT="4222" -TIMEOUT=90 +TIMEOUT=30 # Try spinifex.toml first if [ -f "$CONF" ]; then diff --git a/cmd/installer/firstboot/firstboot.go b/cmd/installer/firstboot/firstboot.go index d5d13218c..365eb3567 100644 --- a/cmd/installer/firstboot/firstboot.go +++ b/cmd/installer/firstboot/firstboot.go @@ -80,6 +80,16 @@ trap 'systemctl disable spinifex-firstboot.service' EXIT # Set hostname hostnamectl set-hostname %s +# Run setup.sh with the embedded tarball (air-gapped, idempotent). +# This creates service users, directories, sudoers rules, installs and enables +# the systemd units — the same path as the online curl|bash installer. +# Apt deps and AWS CLI are pre-installed in the squashfs so both are skipped. +INSTALL_SPINIFEX_TARBALL=/opt/spinifex/spinifex.tar.gz \ +INSTALL_SPINIFEX_SKIP_APT=1 \ +INSTALL_SPINIFEX_SKIP_AWS=1 \ +INSTALL_SPINIFEX_SKIP_NEWGRP=1 \ +bash /usr/local/share/spinifex/setup.sh + # Pre-start OVS and OVN central so their databases are initialised before # setup-ovn.sh runs. On physical hardware, first-boot DB initialisation takes # longer than setup-ovn.sh's internal 15-second timeout allows. Starting them @@ -119,26 +129,6 @@ if [ -f /root/.aws/credentials ]; then [ -f /home/spinifex/.aws/config ] && chmod 600 /home/spinifex/.aws/config fi -# Fix ownership: spx admin init runs as root (no SUDO_USER in systemd context) -# so config and data files land as root:root. Fix up per-service ownership so -# each service user can read/write only its own directory. -chown root:spinifex /etc/spinifex && chmod 750 /etc/spinifex -find /etc/spinifex -type f -exec chmod 640 {} \; -chown root:spinifex /var/lib/spinifex && chmod 750 /var/lib/spinifex -chown -R spinifex-gw:spinifex /var/lib/spinifex/awsgw -chown -R spinifex-daemon:spinifex /var/lib/spinifex/spinifex -chown -R spinifex-nats:spinifex /var/lib/spinifex/nats -chown -R spinifex-storage:spinifex /var/lib/spinifex/predastore -chown -R spinifex-viperblock:spinifex /var/lib/spinifex/viperblock -chown -R spinifex-vpcd:spinifex /var/lib/spinifex/vpcd -mkdir -p /var/log/spinifex && chown root:spinifex /var/log/spinifex && chmod 775 /var/log/spinifex - -# awsgw looks for master.key at /config/master.key. In production -# BaseDir is /var/lib/spinifex/awsgw/ (set by SPINIFEX_BASE_DIR), but the key -# lives in /etc/spinifex/. Symlink so both paths resolve to the same file. -mkdir -p /var/lib/spinifex/awsgw/config -ln -sf /etc/spinifex/master.key /var/lib/spinifex/awsgw/config/master.key - # Start services systemctl start spinifex.target `, cfg.Hostname, setupOVN, clusterCmd)