Initial commit

setup-oracle.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Dedicated Ubuntu 24.04 OCI VM. DNS is never changed by this installer.
+set -Eeuo pipefail
+umask 077
+[[ $EUID -eq 0 ]] || { echo 'Run with sudo, preserving SSH_CONNECTION.' >&2; exit 1; }
+. /etc/os-release
+[[ ${ID:-} == ubuntu && ${VERSION_ID:-} == 24.04 ]] || { echo 'Requires Ubuntu 24.04.' >&2; exit 1; }
+[[ -n ${SSH_CONNECTION:-} ]] || { echo 'Use: sudo env "SSH_CONNECTION=$SSH_CONNECTION" bash setup-oracle.sh' >&2; exit 1; }
+admin_ip=$(python3 - "$SSH_CONNECTION" <<'PY'
+import ipaddress, sys
+fields = sys.argv[1].split()
+if len(fields) != 4 or fields[3] != '22':
+    raise SystemExit('Requires an existing IPv4 SSH session on port 22.')
+address = ipaddress.ip_address(fields[0])
+if address.version != 4:
+    raise SystemExit('Use an IPv4 SSH connection for this IPv4-only profile.')
+print(address)
+PY
+)
+for manager in ufw firewalld nftables docker; do
+    if systemctl is-active --quiet "$manager.service"; then
+        echo "Existing $manager manager is active. Use its existing policy or a clean dedicated VM." >&2
+        exit 1
+    fi
+done
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+[[ -f runtime/haproxy.cfg ]] || { echo 'First run: python3 configure-oracle.py' >&2; exit 1; }
+bash ./preflight-oracle.sh
+systemctl mask nftables.service
+apt-get update
+apt-get --no-remove install -y haproxy ca-certificates curl iptables iptables-persistent nftables unattended-upgrades
+backup_dir=$(mktemp -d /root/tls-edge-failover-config-backup.XXXXXXXX)
+cp -a /etc/haproxy "$backup_dir/"
+printf 'Existing HAProxy configuration saved to %s\n' "$backup_dir"
+haproxy -c -f runtime/haproxy.cfg
+install -o root -g root -m 644 runtime/haproxy.cfg /etc/haproxy/haproxy.cfg
+install -d -m 755 /etc/systemd/system/haproxy.service.d
+install -o root -g root -m 644 haproxy-systemd.conf /etc/systemd/system/haproxy.service.d/limits.conf
+haproxy -c -f /etc/haproxy/haproxy.cfg
+systemctl daemon-reload
+systemctl enable --now haproxy
+systemctl reload haproxy
+bash ./install-firewall.sh "$admin_ip/32"
+printf '\nOracle relay uses runtime/haproxy.cfg. Cloudflare DNS is unchanged.\n'
+printf 'Complete the NEW SSH and HTTPS tests before the firewall rollback timer expires.\n'