9f75eec756
Reverse-Proxy von Angie (eigenes APT-Repo) auf nginx (Distro) umgestellt — vereinfacht Bootstrap (kein angie.software-Repo mehr), reduziert Offene-Punkte (arm64-Verfügbarkeit entfällt). Neuer Service Unbound übernimmt zwei Rollen: Caching-Forwarder mit DNSSEC und Cluster-internes Split-Horizon (Local-Zone eg.cluster, Peer-Adressen aus PG ha_nodes, Reload via unbound-control). Architektur-Spec §7.5 dokumentiert beide Rollen + Config-Schichtung. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
1.7 KiB
Bash
Executable File
48 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# postinst for edgeguard-api — creates system user, filesystem layout,
|
|
# enables systemd units. DB init + migrations run lazily on first start
|
|
# of edgeguard-api.
|
|
set -e
|
|
|
|
export LC_ALL=C
|
|
export LANG=C
|
|
|
|
EG_USER="edgeguard"
|
|
EG_HOME="/var/lib/edgeguard"
|
|
|
|
case "$1" in
|
|
configure)
|
|
# ── System user ──────────────────────────────────────────────
|
|
if ! getent passwd "$EG_USER" >/dev/null; then
|
|
adduser --system --group --home "$EG_HOME" \
|
|
--shell /usr/sbin/nologin --no-create-home \
|
|
--gecos "EdgeGuard daemon" "$EG_USER"
|
|
fi
|
|
|
|
# ── Directories ──────────────────────────────────────────────
|
|
for d in /etc/edgeguard /var/lib/edgeguard /var/log/edgeguard \
|
|
/etc/edgeguard/haproxy /etc/edgeguard/nginx \
|
|
/etc/edgeguard/squid /etc/edgeguard/wireguard \
|
|
/etc/edgeguard/unbound /etc/edgeguard/nftables.d \
|
|
/etc/edgeguard/tls; do
|
|
install -d -m 0750 -o "$EG_USER" -g "$EG_USER" "$d"
|
|
done
|
|
|
|
# ── systemd ──────────────────────────────────────────────────
|
|
systemctl daemon-reload
|
|
systemctl enable --now edgeguard-api.service edgeguard-scheduler.service || true
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|