86 lines
3.6 KiB
Bash
Executable File
86 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
|
|
STACK_DIR=${STACK_DIR:-/opt/mike-ai/stack}
|
|
DATA_DIR=${HERMES_WEBUI_DATA_DIR:-/data/hermes-webui}
|
|
HERMES_ENV=${HERMES_ENV:-/data/hermes/.env}
|
|
SECRETS_DIR=${SECRETS_DIR:-/etc/mike-ai}
|
|
STACK_ENV=$SECRETS_DIR/stack.env
|
|
WEBUI_IMAGE_DEFAULT=mike-ai/hermes-webui:0.52.113-hermes-source-v1
|
|
|
|
die() { printf 'FEHLER: %s\n' "$*" >&2; exit 1; }
|
|
[[ $EUID -eq 0 ]] || die "Bitte als root ausführen."
|
|
[[ -s $HERMES_ENV ]] || die "Hermes-Umgebung fehlt: $HERMES_ENV"
|
|
[[ -s $STACK_ENV ]] || die "Stack-Umgebung fehlt: $STACK_ENV"
|
|
[[ $(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \
|
|
mike-ai-hermes 2>/dev/null || true) == healthy ]] || \
|
|
die "Hermes-Gateway ist nicht gesund; WebUI wird nicht gestartet."
|
|
[[ $(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \
|
|
mike-ai-wireguard-gateway 2>/dev/null || true) == healthy ]] || \
|
|
die "WireGuard-Gateway ist nicht gesund; WebUI-VPN-Proxy wird nicht gestartet."
|
|
|
|
read_env() {
|
|
local key=$1
|
|
sed -n "s/^${key}=//p" "$HERMES_ENV" | head -n 1
|
|
}
|
|
|
|
gateway_key=$(read_env API_SERVER_KEY)
|
|
router_key=$(read_env ROUTER_API_KEY)
|
|
[[ ${#gateway_key} -ge 16 ]] || die "Hermes-Gateway-Key fehlt oder ist zu kurz."
|
|
[[ -n $router_key ]] || die "Router-Key fehlt in der Hermes-Umgebung."
|
|
|
|
install -d -m 0700 "$DATA_DIR" "$DATA_DIR/state"
|
|
|
|
hermes_image=$(sed -n 's/^HERMES_IMAGE=//p' "$STACK_ENV" | head -n 1)
|
|
if [[ -z $hermes_image ]]; then
|
|
hermes_image=$(docker inspect --format '{{.Config.Image}}' mike-ai-hermes 2>/dev/null || true)
|
|
fi
|
|
[[ -n $hermes_image ]] || die "Hermes-Image fehlt in $STACK_ENV und im laufenden Container."
|
|
image_id=$(docker image inspect --format '{{.Id}}' "$hermes_image" 2>/dev/null) || \
|
|
die "Hermes-Image ist lokal nicht verfügbar: $hermes_image"
|
|
webui_image=$(sed -n 's/^HERMES_WEBUI_IMAGE=//p' "$STACK_ENV" | head -n 1)
|
|
webui_image=${webui_image:-$WEBUI_IMAGE_DEFAULT}
|
|
docker build --pull=false --tag "$webui_image" "$STACK_DIR/platform/docker/hermes-webui"
|
|
|
|
agent_dir=$DATA_DIR/hermes-agent
|
|
agent_marker=$DATA_DIR/hermes-agent-image-id
|
|
if [[ ! -s $agent_marker || $(<"$agent_marker") != "$image_id" || ! -s $agent_dir/cli.py ]]; then
|
|
source_tmp=$(mktemp -d "$DATA_DIR/hermes-agent.new.XXXXXX")
|
|
source_container=$(docker create "$hermes_image")
|
|
cleanup_source_container() {
|
|
[[ -z ${source_container:-} ]] || docker rm -f "$source_container" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup_source_container EXIT
|
|
docker cp "$source_container:/opt/hermes/." "$source_tmp/"
|
|
docker rm "$source_container" >/dev/null
|
|
source_container=
|
|
chown -R 10000:10000 "$source_tmp"
|
|
if [[ -e $agent_dir ]]; then
|
|
mv "$agent_dir" "$DATA_DIR/hermes-agent.previous-$(date +%Y%m%d-%H%M%S)"
|
|
fi
|
|
mv "$source_tmp" "$agent_dir"
|
|
printf '%s\n' "$image_id" >"$agent_marker"
|
|
chmod 0600 "$agent_marker"
|
|
trap - EXIT
|
|
fi
|
|
|
|
[[ -s $SECRETS_DIR/hermes-webui-password ]] || \
|
|
openssl rand -base64 24 >"$SECRETS_DIR/hermes-webui-password"
|
|
chmod 0600 "$SECRETS_DIR/hermes-webui-password"
|
|
|
|
cat >"$DATA_DIR/.env" <<EOF
|
|
HERMES_WEBUI_PASSWORD=$(<"$SECRETS_DIR/hermes-webui-password")
|
|
HERMES_WEBUI_GATEWAY_API_KEY=$gateway_key
|
|
ROUTER_API_KEY=$router_key
|
|
EOF
|
|
chmod 0600 "$DATA_DIR/.env"
|
|
chown 10000:10000 "$DATA_DIR" "$DATA_DIR/.env" "$agent_marker"
|
|
chown -R 10000:10000 "$DATA_DIR/state"
|
|
|
|
cd "$STACK_DIR"
|
|
HERMES_WEBUI_IMAGE=$webui_image docker compose --env-file "$STACK_ENV" --profile hermes-webui \
|
|
up -d --no-deps hermes-webui hermes-webui-vpn-proxy
|
|
printf 'HERMES_WEBUI_OK http://192.168.1.212:8787\n'
|
|
printf 'Passwort lokal: %s\n' "$SECRETS_DIR/hermes-webui-password"
|