server-info-kb / 7rnx.net / deploy-gateway-service.sh

#!/bin/bash
# Hyperident-Gateway Service Deployment Script
# Purpose: Complete deployment of gateway as systemd service
# Run this script ON the 7rnx.net server with: sudo ./deploy-gateway-service.sh

set -e

echo "=== Hyperident-Gateway Service Deployment ==="
echo ""

# Check running as root
if [ "$EUID" -ne 0 ]; then
    echo "Error: Must run as root (use sudo)"
    exit 1
fi

# Define paths
BARE_BIN="/home/fleeky/.nvm/versions/node/v23.2.0/lib/node_modules/bare-runtime/node_modules/bare-runtime-linux-x64/bin/bare"
GATEWAY_DIR="/home/fleeky/hyperident-gateway"
CONFIG_FILE="/home/fleeky/hyperident-config/gateway-config.json"
SERVICE_FILE="/etc/systemd/system/hyperident-gateway.service"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

success() {
    echo -e "${GREEN}✓${NC} $1"
}

error() {
    echo -e "${RED}✗${NC} $1"
}

warning() {
    echo -e "${YELLOW}⚠${NC} $1"
}

# Phase 1: Verify Prerequisites
echo "Phase 1: Verifying prerequisites..."
echo ""

# Check bare binary
if [ ! -f "$BARE_BIN" ]; then
    error "Bare binary not found at $BARE_BIN"
    exit 1
fi
success "Bare binary found"

# Check gateway directory
if [ ! -d "$GATEWAY_DIR" ]; then
    error "Gateway directory not found at $GATEWAY_DIR"
    exit 1
fi
success "Gateway directory found"

# Check config file
if [ ! -f "$CONFIG_FILE" ]; then
    error "Config file not found at $CONFIG_FILE"
    exit 1
fi
success "Config file found"

# Check gateway.js exists
if [ ! -f "$GATEWAY_DIR/gateway.js" ]; then
    error "gateway.js not found in $GATEWAY_DIR"
    exit 1
fi
success "gateway.js found"

echo ""

# Phase 2: Install Required Packages
echo "Phase 2: Installing required packages..."
echo ""

apt-get update -qq
apt-get install -y libcap2-bin
success "libcap2-bin installed"

echo ""

# Phase 3: Set Capabilities
echo "Phase 3: Setting CAP_NET_ADMIN capability..."
echo ""

# Remove existing capabilities first
setcap -r "$BARE_BIN" 2>/dev/null || true

# Set new capability
setcap cap_net_admin+eip "$BARE_BIN"
success "Capability set: cap_net_admin+eip"

# Verify
CAPS=$(getcap "$BARE_BIN")
if echo "$CAPS" | grep -q "cap_net_admin"; then
    success "Capability verified: $CAPS"
else
    error "Capability verification failed"
    exit 1
fi

echo ""

# Phase 4: Stop Existing Service (if running)
echo "Phase 4: Checking for existing service..."
echo ""

if systemctl is-active --quiet hyperident-gateway; then
    warning "Stopping existing hyperident-gateway service"
    systemctl stop hyperident-gateway
    success "Service stopped"
fi

echo ""

# Phase 5: Install Systemd Service
echo "Phase 5: Installing systemd service..."
echo ""

# Check if service file exists in script directory
if [ -f "$SCRIPT_DIR/hyperident-gateway.service" ]; then
    cp "$SCRIPT_DIR/hyperident-gateway.service" "$SERVICE_FILE"
    success "Service file installed from script directory"
else
    # Create service file inline
    cat > "$SERVICE_FILE" << 'EOF'
[Unit]
Description=Hyperident Gateway - P2P VPN
Documentation=/home/fleeky/hyperident-gateway/README.md
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=fleeky
Group=fleeky
WorkingDirectory=/home/fleeky/hyperident-gateway

# Full path to bare binary (with CAP_NET_ADMIN capability)
ExecStart=/home/fleeky/.nvm/versions/node/v23.2.0/lib/node_modules/bare-runtime/node_modules/bare-runtime-linux-x64/bin/bare gateway.js --config /home/fleeky/hyperident-config/gateway-config.json

# Restart policy
Restart=always
RestartSec=10

# Security settings
NoNewPrivileges=true
PrivateTmp=true

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=hyperident-gateway

[Install]
WantedBy=multi-user.target
EOF
    success "Service file created"
fi

# Reload systemd
systemctl daemon-reload
success "Systemd reloaded"

echo ""

# Phase 6: Enable and Start Service
echo "Phase 6: Enabling and starting service..."
echo ""

systemctl enable hyperident-gateway
success "Service enabled (will start on boot)"

systemctl start hyperident-gateway
success "Service started"

# Wait for startup
sleep 3

echo ""

# Phase 7: Verify Service
echo "Phase 7: Verifying service status..."
echo ""

if systemctl is-active --quiet hyperident-gateway; then
    success "Service is running"

    # Check process
    GATEWAY_PID=$(systemctl show -p MainPID --value hyperident-gateway)
    if [ "$GATEWAY_PID" != "0" ]; then
        success "Gateway process PID: $GATEWAY_PID"

        # Verify running as user fleeky
        PROC_USER=$(ps -o user= -p "$GATEWAY_PID")
        if [ "$PROC_USER" = "fleeky" ]; then
            success "Running as user: fleeky"
        else
            warning "Running as user: $PROC_USER (expected fleeky)"
        fi
    fi

    # Check TUN device
    if ip addr show tunnel0 >/dev/null 2>&1; then
        success "TUN device 'tunnel0' created"
        TUNNEL_IP=$(ip addr show tunnel0 | grep "inet " | awk '{print $2}')
        if [ -n "$TUNNEL_IP" ]; then
            success "Tunnel IP: $TUNNEL_IP"
        fi
    else
        warning "TUN device not found (may still be initializing)"
    fi

    # Show recent logs
    echo ""
    echo "Recent logs:"
    journalctl -u hyperident-gateway -n 10 --no-pager

else
    error "Service failed to start"
    echo ""
    echo "Recent logs:"
    journalctl -u hyperident-gateway -n 20 --no-pager
    exit 1
fi

echo ""
echo "=== Deployment Complete ==="
echo ""
echo "Service status: $(systemctl is-active hyperident-gateway)"
echo ""
echo "Useful commands:"
echo "  View logs:    sudo journalctl -u hyperident-gateway -f"
echo "  Stop service: sudo systemctl stop hyperident-gateway"
echo "  Restart:      sudo systemctl restart hyperident-gateway"
echo "  Status:       sudo systemctl status hyperident-gateway"
echo ""