Add isolated WireGuard module with guarded access modes and server setup

2026-09-28 14:50:02 +02:00
parent b7b2506272
commit e86e540ae4
21 changed files with 1278 additions and 8 deletions
@@ -0,0 +1,79 @@
+"""Receives a source-only JSON bundle on stdin over SSH. No secrets in argv/logs.
+Creates only /opt/athena-deck and the separately named Deck container.
+"""
+import base64
+import ipaddress
+import json
+import os
+from pathlib import Path
+import socket
+import subprocess
+import sys
+
+NAME = 'athena-deck-network'
+BASE = Path('/opt/athena-deck')
+FILES = {'server.py', 'demo.py', 'collect_hardware.py', 'index.html', 'app.js', 'style.css', 'network-ui.js', 'login.html', 'login.js', 'network/__init__.py', 'network/config.py', 'network/policy.py', 'network/rpc.py', 'network/agent.py', 'network/client.py', 'network/Dockerfile', '.dockerignore'}
+
+def run(*args, **kwargs):
+    return subprocess.run(args, capture_output=True, timeout=600, **kwargs)
+
+
+def main():
+    payload = json.load(sys.stdin)
+    if set(payload['files']) != FILES:
+        raise ValueError()
+    if not Path('/sys/module/wireguard').exists():
+        raise ValueError('WireGuard-Kernelunterstützung fehlt. Es werden keine Host-Pakete oder Kernel installiert.')
+    if run('docker', 'version').returncode:
+        raise ValueError('Docker ist nicht verfügbar. Host-Installation erfolgt nicht automatisch.')
+    if not run('docker', 'inspect', NAME).returncode:
+        raise ValueError('Deck-Container existiert bereits; keine Überschreibung.')
+    routes = json.loads(run('ip', '-j', '-4', 'route', 'get', '1.1.1.1').stdout)
+    lan = routes[0].get('prefsrc')
+    address = ipaddress.ip_address(lan)
+    if not address.is_private or address.is_loopback:
+        raise ValueError('Keine private LAN-Adresse ermittelt; Installation abgebrochen.')
+    # Preflight host port; Docker performs the definitive collision check.
+    for addr in ('127.0.0.1', lan):
+        with socket.socket() as sock:
+            sock.bind((addr, 8110))
+    BASE.mkdir(mode=0o700, exist_ok=True)
+    if (BASE/'state/auth.json').exists():
+        raise ValueError('Vorhandene Deck-Zugangsdaten werden nicht überschrieben.')
+    source = BASE/'source'
+    source.mkdir(mode=0o755, exist_ok=True)
+    for name, encoded in payload['files'].items():
+        target = source/name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(base64.b64decode(encoded, validate=True))
+        target.chmod(0o644)
+    result = run('docker', 'build', '-t', 'athena-deck-network:0.2', '-f', str(source/'network/Dockerfile'), str(source))
+    if result.returncode:
+        raise ValueError('Container-Build fehlgeschlagen. Docker benötigt Zugriff auf die Paketquellen.')
+    state = BASE/'state'
+    state.mkdir(mode=0o700, exist_ok=True)
+    auth = payload['auth']
+    if set(auth) != {'salt', 'hash'} or len(auth['salt']) != 32 or len(auth['hash']) != 64:
+        raise ValueError('Ungültige Zugangsdaten.')
+    int(auth['salt'], 16)
+    int(auth['hash'], 16)
+    fd = os.open(state/'auth.json', os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, 'w') as stream:
+        json.dump(auth, stream)
+    result = run('docker', 'run', '-d', '--name', NAME, '--restart', 'unless-stopped',
+                 '--gpus', 'all', '-e', 'NVIDIA_DRIVER_CAPABILITIES=utility', '--read-only', '--cap-drop', 'ALL', '--cap-add', 'NET_ADMIN', '--cap-add', 'NET_RAW', '--cap-add', 'SETUID', '--cap-add', 'SETGID', '--cap-add', 'CHOWN',
+                 '--security-opt', 'no-new-privileges:true', '--pids-limit', '128', '--memory', '256m', '--cpus', '0.5',
+                 '--tmpfs', '/run:rw,nosuid,nodev,size=8m', '--tmpfs', '/tmp:rw,nosuid,nodev,size=8m',
+                 '-v', str(state)+':/data:rw', '-e', 'DECK_LAN_IP='+lan,
+                 '-p', '127.0.0.1:8110:8110', '-p', lan+':8110:8110', 'athena-deck-network:0.2')
+    if result.returncode:
+        # Auth remains protected for manual recovery; never delete an existing container.
+        raise ValueError('Containerstart fehlgeschlagen. Gesicherter Installationsstand liegt unter /opt/athena-deck.')
+    print(json.dumps({'installed':True, 'lan_url':f'http://{lan}:8110'}))
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception as exc:
+        print(json.dumps({'error':str(exc) if isinstance(exc, ValueError) and str(exc) else 'Installation fehlgeschlagen; keine produktiven Dienste wurden verändert.'}))
+        sys.exit(1)