78 lines
4.6 KiB
Python
78 lines
4.6 KiB
Python
"""Receives a source-only JSON bundle on stdin over SSH. No secrets in argv/logs.
|
|
Creates only /opt/athena-deck and the separately named Deck container.
|
|
"""
|
|
import base64
|
|
import ipaddress
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import socket
|
|
import subprocess
|
|
import sys
|
|
|
|
NAME = 'athena-deck-network'
|
|
BASE = Path('/opt/athena-deck')
|
|
FILES = {'deploy/tts-requirements.lock','stt.py','stt-ui.js','api_compat.py','execution_setup.py','tts_runtime.py','tts_test.py','tts_worker.py','tts-ui.js','auto_test.py','auto-test-ui.js','chat_test.py','chat-test-ui.js','endpoint.py','inference.py','endpoint-ui.js','image_runtime.py','image_encoder_node.py','docker_support.py','docker-ui.js','deploy/image-requirements.lock','image_test.py','image-test-ui.js','profiles.py','profiles-ui.js','capacity.py','runtime.py', 'runtime-ui.js', 'catalog.py','hub_auth.py', 'catalog-ui.js', 'studio.js', 'auth.py', 'access-ui.js', 'server.py', 'collect_hardware.py', 'index.html', 'app.js', 'style.css', 'network-ui.js', 'login.html', 'login.js', 'network/__init__.py', 'network/config.py', 'network/policy.py', 'network/rpc.py', 'network/agent.py', 'network/client.py', 'network/Dockerfile', '.dockerignore'}
|
|
|
|
def run(*args, **kwargs):
|
|
return subprocess.run(args, capture_output=True, timeout=600, **kwargs)
|
|
|
|
|
|
def main():
|
|
payload = json.load(sys.stdin)
|
|
if set(payload['files']) != FILES:
|
|
raise ValueError()
|
|
if not Path('/sys/module/wireguard').exists():
|
|
raise ValueError('WireGuard-Kernelunterstützung fehlt. Es werden keine Host-Pakete oder Kernel installiert.')
|
|
if run('docker', 'version').returncode:
|
|
raise ValueError('Docker ist nicht verfügbar. Host-Installation erfolgt nicht automatisch.')
|
|
if not run('docker', 'inspect', NAME).returncode:
|
|
raise ValueError('Deck-Container existiert bereits; keine Überschreibung.')
|
|
routes = json.loads(run('ip', '-j', '-4', 'route', 'get', '1.1.1.1').stdout)
|
|
lan = routes[0].get('prefsrc')
|
|
address = ipaddress.ip_address(lan)
|
|
if not address.is_private or address.is_loopback:
|
|
raise ValueError('Keine private LAN-Adresse ermittelt; Installation abgebrochen.')
|
|
# Preflight host port; Docker performs the definitive collision check.
|
|
for addr in ('127.0.0.1', lan):
|
|
with socket.socket() as sock:
|
|
sock.bind((addr, 8110))
|
|
BASE.mkdir(mode=0o700, exist_ok=True)
|
|
if (BASE/'state/auth.json').exists():
|
|
raise ValueError('Vorhandene Deck-Zugangsdaten werden nicht überschrieben.')
|
|
source = BASE/'source'
|
|
source.mkdir(mode=0o755, exist_ok=True)
|
|
for name, encoded in payload['files'].items():
|
|
target = source/name
|
|
target.parent.mkdir(parents=True, exist_ok=True)
|
|
target.write_bytes(base64.b64decode(encoded, validate=True))
|
|
target.chmod(0o644)
|
|
result = run('docker', 'build', '-t', 'athena-deck-network:0.3', '-f', str(source/'network/Dockerfile'), str(source))
|
|
if result.returncode:
|
|
raise ValueError('Container-Build fehlgeschlagen. Docker benötigt Zugriff auf die Paketquellen.')
|
|
state = BASE/'state'
|
|
state.mkdir(mode=0o700, exist_ok=True)
|
|
sys.path.insert(0,str(source))
|
|
from auth import validate_record
|
|
auth = validate_record(payload['auth'])
|
|
fd = os.open(state/'auth.json', os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
|
|
with os.fdopen(fd, 'w') as stream:
|
|
json.dump(auth, stream)
|
|
result = run('docker', 'run', '-d', '--name', NAME, '--restart', 'unless-stopped',
|
|
'--gpus', 'all', '-e', 'NVIDIA_DRIVER_CAPABILITIES=utility', '--read-only', '--cap-drop', 'ALL', '--cap-add', 'NET_ADMIN', '--cap-add', 'NET_RAW', '--cap-add', 'SETUID', '--cap-add', 'SETGID', '--cap-add', 'CHOWN',
|
|
'--security-opt', 'no-new-privileges:true', '--pids-limit', '128', '--memory', '256m', '--cpus', '0.5',
|
|
'--tmpfs', '/run:rw,nosuid,nodev,size=8m', '--tmpfs', '/tmp:rw,nosuid,nodev,size=8m',
|
|
'-v', str(state)+':/data:rw', '-e', 'DECK_LAN_IP='+lan,
|
|
'-p', '127.0.0.1:8110:8110', '-p', lan+':8110:8110', 'athena-deck-network:0.3')
|
|
if result.returncode:
|
|
# Auth remains protected for manual recovery; never delete an existing container.
|
|
raise ValueError('Containerstart fehlgeschlagen. Gesicherter Installationsstand liegt unter /opt/athena-deck.')
|
|
print(json.dumps({'installed':True, 'lan_url':f'http://{lan}:8110'}))
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
main()
|
|
except Exception as exc:
|
|
print(json.dumps({'error':str(exc) if isinstance(exc, ValueError) and str(exc) else 'Installation fehlgeschlagen; keine produktiven Dienste wurden verändert.'}))
|
|
sys.exit(1)
|