feat: use emissary v2023.6.23-4a58847

Jenkinsfile

@@ -0,0 +1,102 @@
+pipeline {
+    agent {
+        dockerfile {
+            filename 'Dockerfile'
+            dir 'misc/jenkins'
+        }
+    }
+
+    parameters {
+        persistentText(name: 'emissaryRelease', defaultValue: 'latest', description: 'Numéro de release Emissary', successfulOnly: false)
+    }
+
+    stages {
+        stage('Cancel older jobs') {
+            steps {
+                script {
+                    def buildNumber = env.BUILD_NUMBER as int
+                    if (buildNumber > 1) milestone(buildNumber - 1)
+                    milestone(buildNumber)
+                }
+            }
+        }
+
+        stage('Update emissary release') {
+            when {
+                expression {
+                    return params.emissaryRelease != 'latest'
+                }
+            }
+            steps {
+                script {
+                    currentEmissaryRelease = readFile('emissary_release.txt').trim()
+
+                    if (currentEmissaryRelease == params.emissaryRelease) {
+                        currentBuild.result = 'SUCCESS'
+                        return
+                    }
+
+                    withCredentials([
+                        usernamePassword([
+                        credentialsId: 'forge-jenkins',
+                        usernameVariable: 'GIT_USERNAME',
+                        passwordVariable: 'GIT_PASSWORD'
+                        ])
+                    ]) {
+                        sh """
+                        git config user.email "jenkins@cadoles.com"
+                        git config user.name "Jenkins"
+                        git config credential.https://forge.cadoles.com.username "\$GIT_USERNAME"
+                        git config credential.https://forge.cadoles.com.helper '!f() { test "\$1" = get && echo "password=\$GIT_PASSWORD"; }; f'
+
+                        echo '${params.emissaryRelease}' > emissary_release.txt
+                        git add emissary_release.txt
+                        git commit -m "feat: use emissary ${params.emissaryRelease}"
+                        git pull --rebase
+                        git push origin \$(git rev-parse HEAD):${env.GIT_BRANCH}
+                        """
+                    }
+                }
+            }
+        }
+
+        stage('Build and release') {
+            steps {
+                script {
+                    withCredentials([
+                            usernamePassword([
+                            credentialsId: 'forge-jenkins',
+                            usernameVariable: 'GITEA_DOWNLOAD_USERNAME',
+                            passwordVariable: 'GITEA_DOWNLOAD_PASSWORD'
+                        ])
+                    ]) {
+                        sh '''
+                        make download-emissary-release
+                        make all
+                        '''
+                    }
+                }
+            }
+        }
+
+        stage('Release') {
+            steps {
+                withCredentials([
+                        usernamePassword([
+                        credentialsId: 'forge-jenkins',
+                        usernameVariable: 'GITEA_RELEASE_USERNAME',
+                        passwordVariable: 'GITEA_RELEASE_PASSWORD'
+                    ])
+                ]) {
+                    sh 'make gitea-release'
+                }
+            }
+        }
+    }
+
+    post {
+        always {
+            cleanWs()
+        }
+    }
+}

Makefile

@@ -22,7 +22,7 @@ IMAGEBUILDER_CUSTOM_FILES_DIR_PATH := $(IMAGEBUILDER_DIR_PATH)/files
 
 BIN_DIR := "$(shell readlink -f bin)/$(OPENWRT_VERSION)/$(OPENWRT_TARGET)/$(OPENWRT_PROFILE)$(BIN_DIR_NAME_SUFFIX)"
 
-GITEA_DOWNLOAD_RELEASE_NAME ?= latest
+EMISSARY_RELEASE ?= $(shell cat emissary_release.txt)
 EMISSARY_ARCH ?= armv6
 
 EMISSARY_RECONCILIATION_INTERVAL ?=
@@ -77,9 +77,8 @@ $(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH):
 	rm -rf "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)"
 	mkdir -p "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc"
 	
-	echo "# Firmware built with https://forge.cadoles.com/Cadoles/emissary-firmware" > "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc/emissary_firmware"
-	echo "BUILD_DATE=$(shell date --iso-8601=seconds)" >> "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc/emissary_firmware"
-	echo "GIT_VERSION=$(GIT_VERSION)" >> "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc/emissary_firmware"
+	echo "# Firmware built with https://forge.cadoles.com/arcad/emissary-firmware" > "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc/emissary_firmware"
+	echo "FIRMWARE_VERSION=$(FULL_VERSION)" >> "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc/emissary_firmware"
 	echo "OPENWRT_PROFILE=$(OPENWRT_PROFILE)" >> "$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)/etc/emissary_firmware"
 
 	rm -rf files/*
@@ -110,8 +109,8 @@ gitea-release: tools/gitea-release/bin/gitea-release.sh
 		GITEA_RELEASE_NAME="$(FULL_VERSION)" \
 		GITEA_RELEASE_COMMITISH_TARGET="$(GIT_VERSION)" \
 		GITEA_RELEASE_IS_DRAFT="false" \
-		GITEA_RELEASE_BODY="" \
-		GITEA_RELEASE_ATTACHMENTS="$(shell find .gitea-release/* -type f)" \
+		GITEA_RELEASE_BODY="With Emissary $(EMISSARY_RELEASE)" \
+		GITEA_RELEASE_ATTACHMENTS="$$(find .gitea-release/* -type f)" \
 		tools/gitea-release/bin/gitea-release.sh
 
 .PHONY: download-emissary-release
@@ -120,7 +119,8 @@ download-emissary-release: tools/gitea-download/bin/gitea-download.sh
 	GITEA_DOWNLOAD_PROJECT="emissary" \
 		GITEA_DOWNLOAD_ORG="arcad" \
 		GITEA_DOWNLOAD_BASE_URL="https://forge.cadoles.com" \
-		GITEA_DOWNLOAD_RELEASE_NAME="$(GITEA_DOWNLOAD_RELEASE_NAME)" \
+		GITEA_DOWNLOAD_RELEASE_NAME="$(EMISSARY_RELEASE)" \
+		GITEA_DOWNLOAD_ATTACHMENTS_FILTER="\.tar\.gz$$" \
 		tools/gitea-download/bin/gitea-download.sh
 
 tools/gitea-release/bin/gitea-release.sh:
@@ -143,5 +143,5 @@ UPX_VERSION := 4.0.2
 tools/upx/bin/upx:
 	mkdir -p tools/upx/bin
 	curl -L --output tools/upx/upx-$(UPX_VERSION)-amd64_linux.tar.xz https://github.com/upx/upx/releases/download/v$(UPX_VERSION)/upx-$(UPX_VERSION)-amd64_linux.tar.xz
-	cd tools/upx && tar -xJf upx-$(UPX_VERSION)-amd64_linux.tar.xz
-	ln -s $(shell readlink -f tools/upx/upx-$(UPX_VERSION)-amd64_linux/upx) tools/upx/bin/upx
+	cd tools/upx && tar -xJf upx-$(UPX_VERSION)-amd64_linux.tar.xz && wait $$!
+	$(SHELL) -c 'ln -s $$(readlink -f tools/upx/upx-$(UPX_VERSION)-amd64_linux/upx) tools/upx/bin/upx'

emissary_release.txt

@@ -0,0 +1 @@
+v2023.6.23-4a58847

install/emissary-files.mk

@@ -1,4 +1,4 @@
-install-emissary-files:
+install-emissary-files: tools/yq/bin/yq tools/upx/bin/upx
 	mkdir -p files/etc/config
 	cp -r misc/emissary/config/* files/etc/config/
 
@@ -8,6 +8,14 @@ install-emissary-files:
 	mkdir -p files/etc/uci-defaults
 	cp -r misc/emissary/uci-defaults/* files/etc/uci-defaults/
 
+	# Copy keep.d files
+	mkdir -p files/lib/upgrade/keep.d
+	cp -r misc/emissary/keep.d/* files/lib/upgrade/keep.d/
+
+	# Copy profile.d files
+	mkdir -p files/etc/profile.d
+	cp -r misc/emissary/profile.d/* files/etc/profile.d/
+
 	mkdir -p gitea-dl/emissary-agent_linux_$(EMISSARY_ARCH)
 	cd gitea-dl && tar -xzf emissary-agent_*_linux_$(EMISSARY_ARCH).tar.gz -C emissary-agent_linux_$(EMISSARY_ARCH)
 	
@@ -18,6 +26,11 @@ install-emissary-files:
 	# Patch agent config
 	tools/yq/bin/yq -i '.agent.serverUrl = "$${EMISSARY_SERVER_URL}"' files/etc/emissary/agent.yml
 	tools/yq/bin/yq -i '.agent.reconciliationInterval = "$${EMISSARY_RECONCILIATION_INTERVAL}"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.privateKeyPath = "/data/emissary/agent-key.json"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.controllers.persistence.stateFile = "/data/emissary/agent-state.json"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.controllers.sysupgrade.firmwareVersionCommand = ["sh", "-c", "source /etc/emissary_firmware && echo \"$$FIRMWARE_VERSION\""]' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.controllers.app.dataDir = "/data/emissary/apps/data"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.controllers.app.downloadDir = "/data/emissary/apps/bundles"' files/etc/emissary/agent.yml
 
 	# Copy emissary binary
 	mkdir -p files/usr/local/bin
@@ -25,10 +38,10 @@ install-emissary-files:
 	chmod +x files/usr/local/bin/emissary
 
 	# Set defaults
-	mkdir -p files/etc/emissary
-	rm -rf files/etc/emissary/default.conf
-	echo "EMISSARY_RECONCILIATION_INTERVAL='$(EMISSARY_RECONCILIATION_INTERVAL)'" > files/etc/emissary/default.conf
-	echo "EMISSARY_SERVER_URL='$(EMISSARY_SERVER_URL)'" >> files/etc/emissary/default.conf
+	mkdir -p files/data/emissary
+	rm -rf files/data/emissary/default.conf
+	echo "EMISSARY_RECONCILIATION_INTERVAL='$(EMISSARY_RECONCILIATION_INTERVAL)'" > files/data/emissary/default.conf
+	echo "EMISSARY_SERVER_URL='$(EMISSARY_SERVER_URL)'" >> files/data/emissary/default.conf
 
 	# Compress emissary binary
 	tools/upx/bin/upx -9 files/usr/local/bin/emissary

install/raspberrypi.mk

@@ -0,0 +1,7 @@
+install-rpi-network-config:
+	mkdir -p files/etc/config
+	cp misc/rpi/uci/network files/etc/config/network
+
+install-rpi-uci-defaults:
+	mkdir -p files/etc/uci-defaults
+	cp misc/rpi/uci-defaults/* files/etc/uci-defaults/

install/turris-omnia.mk

@@ -0,0 +1,3 @@
+install-turris-omnia-uci-defaults:
+	mkdir -p files/etc/uci-defaults
+	cp misc/turris/omnia/uci-defaults/* files/etc/uci-defaults/

misc/emissary/keep.d/emissary

@@ -0,0 +1,3 @@
+/etc/machine-id
+/data/emissary/agent-key.json
+/data/emissary/apps/data

misc/emissary/profile.d/99-emissary.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+export PATH="${PATH}:/usr/local/bin"

misc/emissary/uci-defaults/99-emissary.sh

@@ -3,7 +3,7 @@
 set -e
 
 main() {
-    local default_config="/etc/emissary/default.conf"
+    local default_config="/data/emissary/default.conf"
     
     if [ ! -f "${default_config}" ]; then
         exit 0

misc/jenkins/Dockerfile

@@ -0,0 +1,14 @@
+FROM reg.cadoles.com/proxy_cache/library/ubuntu:22.04
+
+ARG HTTP_PROXY=
+ARG HTTPS_PROXY=
+ARG http_proxy=
+ARG https_proxy=
+
+# Install dev environment dependencies
+RUN export DEBIAN_FRONTEND=noninteractive &&\
+    apt-get update -y &&\
+    apt-get install -y --no-install-recommends curl ca-certificates build-essential wget unzip tar git jq gawk python3 rsync file
+
+# Add LetsEncrypt certificates
+RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash

misc/rpi/uci-defaults/99-x86-uci-custom.sh

@@ -0,0 +1,37 @@
+#/bin/sh
+
+set -e
+
+main() {
+    # Update default firewall ruleset
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow SSH on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='22'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='80'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='443'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci commit firewall
+    
+    # Disable DNS-rebind protection
+    uci set dhcp.@dnsmasq[0].rebind_protection='0'
+    uci commit dhcp
+
+    reload_config
+}
+
+main

misc/rpi/uci/network

@@ -0,0 +1,9 @@
+config interface 'loopback'
+	option ifname 'lo'
+	option proto 'static'
+	option ipaddr '127.0.0.1'
+	option netmask '255.0.0.0'
+
+config interface 'wan'
+	option ifname 'eth0'
+	option proto 'dhcp'

misc/script/flash.sh

@@ -6,24 +6,14 @@ ssh-copy-id root@${OPENWRT_DEVICE}
 
 TARGET_ARCH=$(ssh root@${OPENWRT_DEVICE} source /etc/os-release \&\& echo \${OPENWRT_BOARD:-\$LEDE_BOARD})
 
-FIRMWARE_FILE=bin/${OPENWRT_VERSION}/${TARGET_ARCH}/${OPENWRT_PROFILE}/openwrt-*-squashfs-factory.img
+FIRMWARE_FILENAME=${FIRMWARE_FILENAME:-openwrt-*-sysupgrade.img*}
+FIRMWARE_FILE=bin/${OPENWRT_VERSION}/${TARGET_ARCH}/${OPENWRT_PROFILE}/${FIRMWARE_FILENAME}
 FIRMWARE_FILE=${CUSTOM_FIRMWARE_FILE:-$FIRMWARE_FILE}
 
-NOW=$(date +%Y-%m-%d)
-BACKUP_FILENAME="backup_${OPENWRT_DEVICE}_${NOW}.tar.gz"
-
-ssh root@${OPENWRT_DEVICE} \
-    rm -f "/tmp/${BACKUP_FILENAME}" \
-    \&\& sysupgrade -b "/tmp/${BACKUP_FILENAME}"
-
-mkdir -p tmp/backups
-
-scp "root@${OPENWRT_DEVICE}:/tmp/${BACKUP_FILENAME}" ./tmp/backups/
-
 ssh root@${OPENWRT_DEVICE} \
     mkdir -p /tmp/firmwares \
     \&\& rm /tmp/firmwares/* \|\| exit 0;
 
 scp $FIRMWARE_FILE root@${OPENWRT_DEVICE}:/tmp/firmwares/
 
-ssh root@${OPENWRT_DEVICE} sysupgrade --force -p -v -n "/tmp/firmwares/$(basename $FIRMWARE_FILE)"
+ssh root@${OPENWRT_DEVICE} sysupgrade --force -v -u "/tmp/firmwares/$(basename $FIRMWARE_FILE)"

misc/script/restore.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-set -o pipefail
-
-NOW=$(date +%Y-%m-%d)
-BACKUP_DATE=${BACKUP_DATE:-${NOW}}
-BACKUP_FILENAME="backup_${OPENWRT_DEVICE}_${NOW}.tar.gz"
-
-printf "%s" "Waiting for ${OPENWRT_DEVICE} ..."
-while ! ping -c 1 -n -w 1 ${OPENWRT_DEVICE} &> /dev/null
-do
-    printf "%c" "."
-done
-printf "\n%s\n"  "Server is back online"
-
-scp "./tmp/backups/${BACKUP_FILENAME}" root@${OPENWRT_DEVICE}:/tmp/
-
-ssh root@${OPENWRT_DEVICE} sysupgrade -r "/tmp/${BACKUP_FILENAME}"

misc/turris/omnia/uci-defaults/98-turris-omnia-uci-custom.sh

@@ -0,0 +1,37 @@
+#/bin/sh
+
+set -e
+
+main() {
+    # Update default firewall ruleset
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow SSH on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='22'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='80'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci add firewall rule
+    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
+    uci set firewall.@rule[-1].src='wan'
+    uci set firewall.@rule[-1].proto='tcp'
+    uci set firewall.@rule[-1].dest_port='443'
+    uci set firewall.@rule[-1].target='ACCEPT'
+
+    uci commit firewall
+    
+    # Disable DNS-rebind protection
+    uci set dhcp.@dnsmasq[0].rebind_protection='0'
+    uci commit dhcp
+
+    reload_config
+}
+
+main

misc/turris/omnia/uci-defaults/99-resize-disk.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+set -eo pipefail
+
+block info
+
+DISK=/dev/mmcblk0
+PARTITION="${DISK}p2"
+
+parted -s -a opt "$DISK" "resizepart 2 100%"
+
+FS_SIZE="$(unsquashfs -s "$PARTITION" | grep -o 'Filesystem size [0-9]* bytes' | grep -o '[0-9][0-9]*')"
+FS_OFFSET="$(expr '(' "$FS_SIZE" + 65535 ')' / 65536 '*' 65536)"
+LOOP_DEVICE="$(losetup -f --show -o "$FS_OFFSET" "$PARTITION")"
+
+e2fsck -y -f "$LOOP_DEVICE"
+resize2fs "$LOOP_DEVICE"
+
+rm -f /etc/uci-defaults/99-resize-disk.sh
+
+reboot

targets/linksys-wrt.mk

@@ -0,0 +1,24 @@
+all: linksys-wrtXXXXac
+
+linksys-wrtXXXXac: linksys-wrt1200ac linksys-wrt1900ac linksys-wrt3200acm
+
+linksys-wrt1200ac:
+	$(MAKE) \
+		OPENWRT_TARGET="mvebu/cortexa9" \
+		EMISSARY_ARCH="armv6" \
+		OPENWRT_PROFILE="linksys_wrt1200ac" \
+		build
+
+linksys-wrt1900ac:
+	$(MAKE) \
+		OPENWRT_TARGET="mvebu/cortexa9" \
+		EMISSARY_ARCH="armv7" \
+		OPENWRT_PROFILE="linksys_wrt1900ac-v2" \
+		build
+
+linksys-wrt3200acm:
+	$(MAKE) \
+		OPENWRT_TARGET="mvebu/cortexa9" \
+		EMISSARY_ARCH="armv7" \
+		OPENWRT_PROFILE="linksys_wrt3200acm" \
+		build

targets/linksys-wrtXXXXac.mk

@@ -1,12 +0,0 @@
-all: linksys-wrtXXXXac
-
-linksys-wrtXXXXac: linksys-wrt1200ac linksys-wrt1900ac linksys-wrt3200acm
-
-linksys-wrt1200ac:
-	$(MAKE) OPENWRT_TARGET="mvebu/cortexa9" EMISSARY_ARCH="armv6" OPENWRT_PROFILE="linksys_wrt1200ac" build
-
-linksys-wrt1900ac:
-	$(MAKE) OPENWRT_TARGET="mvebu/cortexa9" EMISSARY_ARCH="armv6" OPENWRT_PROFILE="linksys_wrt1900ac-v2" build
-
-linksys-wrt3200acm:
-	$(MAKE) OPENWRT_TARGET="mvebu/cortexa9" EMISSARY_ARCH="armv6" OPENWRT_PROFILE="linksys_wrt3200acm" build

targets/raspberrypi.mk

@@ -2,7 +2,7 @@ all: rpi-4 rpi-3
 
 rpi-4:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="" \
+		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
 		OPENWRT_TARGET="bcm27xx/bcm2711" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-4" \
@@ -10,7 +10,7 @@ rpi-4:
 
 rpi-3:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="" \
+		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
 		OPENWRT_TARGET="bcm27xx/bcm2710" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-3" \

targets/turris.mk

@@ -1,9 +1,12 @@
-all: omnia
+all: turris
+
+turris: omnia
 
 omnia:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="" \
+		ADDITIONAL_INSTALL="install-turris-omnia-uci-defaults" \
+		ADDITIONAL_OPENWRT_PACKAGES="losetup squashfs-tools-unsquashfs resize2fs e2fsprogs parted block-mount" \
 		OPENWRT_TARGET="mvebu/cortexa9" \
-		EMISSARY_ARCH="arm64" \
+		EMISSARY_ARCH="armv7" \
 		OPENWRT_PROFILE="cznic_turris-omnia" \
 		build