server-info-kb / 7rnx.net / setup-gateway-capabilities.sh

#!/bin/bash
# Hyperident-Gateway Capability Setup Script
# Purpose: Set CAP_NET_ADMIN on bare binary for TUN device access without sudo
# Run this script ON the 7rnx.net server with: sudo ./setup-gateway-capabilities.sh

set -e

echo "=== Hyperident-Gateway Capability Setup ==="
echo ""

# Check running as root
if [ "$EUID" -ne 0 ]; then
    echo "Error: Must run as root (use sudo)"
    exit 1
fi

# Define bare binary path
BARE_BIN="/home/fleeky/.nvm/versions/node/v23.2.0/lib/node_modules/bare-runtime/node_modules/bare-runtime-linux-x64/bin/bare"

echo "Step 1: Verify bare binary exists"
if [ ! -f "$BARE_BIN" ]; then
    echo "Error: Bare binary not found at $BARE_BIN"
    exit 1
fi
echo "✓ Bare binary found: $BARE_BIN"
echo ""

echo "Step 2: Install libcap2-bin (for setcap/getcap)"
apt-get update -qq
apt-get install -y libcap2-bin
echo "✓ libcap2-bin installed"
echo ""

echo "Step 3: Set CAP_NET_ADMIN capability"
setcap cap_net_admin+eip "$BARE_BIN"
echo "✓ Capability set: cap_net_admin+eip"
echo ""

echo "Step 4: Verify capability"
CAPS=$(getcap "$BARE_BIN")
echo "Current capabilities: $CAPS"

if echo "$CAPS" | grep -q "cap_net_admin"; then
    echo "✓ CAP_NET_ADMIN verified successfully"
else
    echo "Error: CAP_NET_ADMIN not set correctly"
    exit 1
fi
echo ""

echo "Step 5: Test gateway can run without sudo"
echo "Running test as user 'fleeky'..."
cd /home/fleeky/hyperident-gateway

# Test start gateway in background
sudo -u fleeky "$BARE_BIN" gateway.js --config /home/fleeky/hyperident-config/gateway-config.json &
BARE_PID=$!
echo "Started gateway with PID: $BARE_PID"

# Wait for startup
sleep 3

# Check if still running
if ps -p $BARE_PID > /dev/null 2>&1; then
    echo "✓ Gateway running as user 'fleeky'"

    # Check TUN device
    if ip addr show tunnel0 >/dev/null 2>&1; then
        echo "✓ TUN device 'tunnel0' created successfully"
        ip addr show tunnel0 | grep "inet "
    else
        echo "Warning: TUN device not found (may take longer to initialize)"
    fi

    # Stop test process
    kill $BARE_PID 2>/dev/null || true
    sleep 1
    echo "✓ Test gateway stopped"
else
    echo "Error: Gateway failed to start"
    echo "Check logs for details"
    exit 1
fi
echo ""

echo "=== Setup Complete ==="
echo ""
echo "Next steps:"
echo "1. Create systemd service: sudo tee /etc/systemd/system/hyperident-gateway.service < service-file"
echo "2. Enable service: sudo systemctl enable hyperident-gateway"
echo "3. Start service: sudo systemctl start hyperident-gateway"
echo ""
echo "See GATEWAY_DEPLOYMENT_PROCEDURE.md for full deployment guide"