feat: use emissary 2024.3.13-stable.821.cec5c78

ref arcad/emissary#21

Makefile

@@ -5,7 +5,7 @@ GIT_VERSION := $(shell git describe --always)
 DATE_VERSION := $(shell date +%Y.%m.%d)
 FULL_VERSION := v$(DATE_VERSION)-$(GIT_VERSION)
 
-OPENWRT_VERSION ?= 22.03.2
+OPENWRT_VERSION ?= 23.05.2
 OPENWRT_TARGET ?= mvebu/cortexa9
 OPENWRT_TARGET_DASHED ?= $(shell echo $(OPENWRT_TARGET) | sed 's|/|-|')
 OPENWRT_PROFILE ?= linksys_wrt1200ac
@@ -28,7 +28,7 @@ EMISSARY_ARCH ?= armv6
 EMISSARY_RECONCILIATION_INTERVAL ?=
 EMISSARY_SERVER_URL ?=
 
-BASE_INSTALL ?= install-emissary-files
+BASE_INSTALL ?= install-emissary-files install-common-uci-defaults install-common-additional-agent-collectors
 ADDITIONAL_INSTALL ?=
 ADDITIONAL_OPENWRT_PACKAGES ?=
 
@@ -46,7 +46,7 @@ build: $(IMAGEBUILDER_DIR_PATH) $(IMAGEBUILDER_CUSTOM_PACKAGES_DIR_PATH) $(IMAGE
 
 	# Cleanup old packages signature
 	rm -f $(IMAGEBUILDER_DIR_PATH)/Packages $(IMAGEBUILDER_DIR_PATH)/Packages.gz $(IMAGEBUILDER_DIR_PATH)/Packages.sig
-	
+
 	# Build firmware
 	$(MAKE) \
 		-C "$(IMAGEBUILDER_DIR_PATH)" \
@@ -56,6 +56,7 @@ build: $(IMAGEBUILDER_DIR_PATH) $(IMAGEBUILDER_CUSTOM_PACKAGES_DIR_PATH) $(IMAGE
 		CONFIG_IPV6=n \
 		FILES="$(IMAGEBUILDER_CUSTOM_FILES_DIR_PATH)" \
 		BIN_DIR="$(BIN_DIR)" \
+		ROOTFS_PARTSIZE="$(ROOTFS_PARTSIZE)" \
 		clean image
 
 $(IMAGEBUILDER_DIR_PATH): $(IMAGEBUILDER_ARCHIVE_PATH)
@@ -100,6 +101,7 @@ gitea-release: tools/gitea-release/bin/gitea-release.sh
 		\( 	-name '*.img.gz' \
 			-or -name '*.bin' \
 			-or -name '*.img' \
+			-or -name '*.itb' \
 		\) -exec cp {} .gitea-release/ \;
 
 	GITEA_RELEASE_PROJECT="emissary-firmware" \
@@ -109,7 +111,7 @@ gitea-release: tools/gitea-release/bin/gitea-release.sh
 		GITEA_RELEASE_NAME="$(FULL_VERSION)" \
 		GITEA_RELEASE_COMMITISH_TARGET="$(GIT_VERSION)" \
 		GITEA_RELEASE_IS_DRAFT="false" \
-		GITEA_RELEASE_BODY="With Emissary $(EMISSARY_RELEASE)" \
+		GITEA_RELEASE_BODY='Based on OpenWRT [`$(OPENWRT_VERSION)`](https://downloads.openwrt.org/releases/$(OPENWRT_VERSION)/targets/) and with Emissary [`$(EMISSARY_RELEASE)`](https://forge.cadoles.com/arcad/emissary/releases/tag/$(EMISSARY_RELEASE))' \
 		GITEA_RELEASE_ATTACHMENTS="$$(find .gitea-release/* -type f)" \
 		tools/gitea-release/bin/gitea-release.sh
 

emissary_release.txt

@@ -1 +1 @@
-2023.8.25-stable.1853.3d7a094
+2024.3.13-stable.821.cec5c78

install/bananapi.mk

@@ -1,3 +1,3 @@
 install-bpi-r3-network-config:
 	mkdir -p files/etc/config
-	cp misc/bpi-r3/uci/network files/etc/config/network
+	cp misc/bpi-r3/uci/network files/etc/config/network

install/common.mk

@@ -0,0 +1,6 @@
+install-common-uci-defaults:
+	mkdir -p files/etc/uci-defaults
+	cp misc/common/uci-defaults/* files/etc/uci-defaults/
+
+install-common-additional-agent-collectors: tools/yq/bin/yq
+	tools/yq/bin/yq -i '.agent.collectors += load("misc/common/agent/collectors.yml")' files/etc/emissary/agent.yml

install/emissary-files.mk

@@ -31,6 +31,10 @@ install-emissary-files: tools/yq/bin/yq tools/upx/bin/upx
 	tools/yq/bin/yq -i '.agent.controllers.sysupgrade.firmwareVersionCommand = ["sh", "-c", "source /etc/emissary_firmware && echo \"$$FIRMWARE_VERSION\""]' files/etc/emissary/agent.yml
 	tools/yq/bin/yq -i '.agent.controllers.app.dataDir = "/data/emissary/apps/data"' files/etc/emissary/agent.yml
 	tools/yq/bin/yq -i '.agent.controllers.app.downloadDir = "/data/emissary/apps/bundles"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.sentry.dsn = "$${EMISSARY_SENTRY_DSN}"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.sentry.environment = "$${EMISSARY_SENTRY_ENVIRONMENT}"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.controllers.status.claimURL = "$${EMISSARY_CONTROLLERS_STATUS_CLAIM_URL}"' files/etc/emissary/agent.yml
+	tools/yq/bin/yq -i '.agent.controllers.status.agentURL = "$${EMISSARY_CONTROLLERS_STATUS_AGENT_URL}"' files/etc/emissary/agent.yml
 
 	# Copy emissary binary
 	mkdir -p files/usr/local/bin

install/raspberrypi.mk

@@ -1,7 +1,3 @@
 install-rpi-network-config:
 	mkdir -p files/etc/config
-	cp misc/rpi/uci/network files/etc/config/network
-
-install-rpi-uci-defaults:
-	mkdir -p files/etc/uci-defaults
-	cp misc/rpi/uci-defaults/* files/etc/uci-defaults/
+	cp misc/rpi/uci/network files/etc/config/network

misc/common/agent/collectors.yml

@@ -0,0 +1,9 @@
+- name: network-interfaces
+  command: ip
+  args:
+    - addr
+    - show
+- name: emissary-firmware
+  command: cat
+  args:
+    - /etc/emissary_firmware

misc/common/uci-defaults/20-emissary-create-data-partition.sh

@@ -0,0 +1,79 @@
+#!/bin/sh
+
+MIN_DISK_SPACE_MB=1000
+
+list_disks() {
+    lsblk -o NAME -r -d -n
+}
+
+main() {
+    local disks=$(list_disks)
+
+    local found_free_space=0
+    local found_device=""
+
+    for device_name in ${disks}; do
+        local device="/dev/${device_name}"
+        echo "Checking disk '$device'..."
+        
+        local disk_free_space="$(parted $device unit MB print free 2>/dev/null | grep 'Free Space' | tail -n1 | awk '{ print $3 }')"
+        disk_free_space=${disk_free_space%MB}
+        disk_free_space=$(printf '%.0f' "${disk_free_space:-0}")
+        
+        echo "Free space on disk: ${disk_free_space}"
+
+        if [ ! -z "${disk_free_space}" ]; then
+            if [ ${disk_free_space} -gt ${found_free_space} ]; then
+                found_free_space=${disk_free_space}
+                found_device=${device}
+            fi
+        fi
+    done
+
+    if [ -z "${found_device}" ] || [ ${MIN_DISK_SPACE_MB} -gt ${found_free_space} ]; then
+        echo "No device with sufficient remaining disk space, exiting."
+        exit 1
+    fi
+
+    echo "Creating new partition on '${found_device}' with remaining disk free space"
+
+    local last_partition_end_mb=$(parted "$found_device" unit MB print | awk '/^ [0-9]+ / {start=$3} END {print int(start)}')
+    
+    if [ "${last_partition_end_mb}" != "0" ]; then
+        parted -s "${found_device}" -f -a opt mkpart primary "${last_partition_end_mb}MB" '100%'
+    else
+        parted -s "${found_device}" -f -a opt mkpart primary '0%' '100%'
+    fi
+
+    sync
+
+    local last_partition_number=$(parted ${found_device} print | grep -o -e '^ [0-9]*' | awk '{print $1}' | tail -n 1)
+    local new_partition_device=$(lsblk -r -n -o PARTN,NAME ${found_device} | awk -v partition_number="${last_partition_number}" '$1 == partition_number {print $2}')
+
+    mkfs.ext4 -F /dev/${new_partition_device}
+    if [ $? -ne 0 ]; then
+        echo "Could not initialize filesystem on new partition !"
+        exit 1
+    fi
+    
+    local new_partition_uuid=$(lsblk -r -n -o PARTN,UUID ${found_device} | awk -v partition_number="${last_partition_number}" '$1 == partition_number {print $2}')
+
+    if [ -z "${new_partition_uuid}" ]; then
+        echo "Could not find partition with number '${last_partition_number}' !"
+        exit 1
+    fi
+
+    umount -f /data
+    rm -rf /data
+    mkdir -p /data
+
+    uci add fstab mount
+    uci set fstab.@mount[-1].target='/data'
+    uci set fstab.@mount[-1].uuid=${new_partition_uuid}
+    uci set fstab.@mount[-1].enabled='1'
+    uci commit fstab
+
+    reload_config
+}
+
+main

misc/emissary/config/emissary

@@ -2,4 +2,8 @@ package emissary
 
 config main 'agent'
     option reconciliation_interval '60'
-    option server_url 'https://emissary.cadol.es'
+    option server_url 'https://emissary.cadol.es'
+    option claim_url 'https://emissary.cadol.es/hq/claim/%v'
+    option agent_url 'https://emissary.cadol.es/hq/agents/%v'
+    option sentry_dsn ''
+    option sentry_environment ''

misc/emissary/init.d/emissary-agent

@@ -1,26 +1,30 @@
 #!/bin/sh /etc/rc.common
 
 USE_PROCD=1
-START=50
+START=99
 STOP=50
 
 start_service() {
   config_load emissary
 
   mkdir -p /usr/share/emissary
-  mkdir -p /var/lib/emissary
+  mkdir -p /data/emissary
 
   config_get emissary_reconciliation_interval agent 'reconciliation_interval' "60"
   config_get emissary_server_url agent 'server_url' "https://emissary.cadol.es"
+  config_get emissary_agent_claim_url agent 'claim_url' "https://emissary.cadol.es/hq/claim/%v"
+  config_get emissary_agent_url agent 'agent_url' "https://emissary.cadol.es/hq/agents/%v"
+  config_get emissary_sentry_dsn agent 'sentry_dsn' ""
+  config_get emissary_sentry_environment agent 'sentry_environment' ""
 
   local config_file="/etc/emissary/agent.yml"
   procd_open_instance emissary-agent
-  procd_set_param env EMISSARY_SERVER_URL="$emissary_server_url" EMISSARY_RECONCILIATION_INTERVAL="$emissary_reconciliation_interval"
+  procd_set_param env EMISSARY_SERVER_URL="$emissary_server_url" EMISSARY_RECONCILIATION_INTERVAL="$emissary_reconciliation_interval" EMISSARY_SENTRY_DSN="$emissary_sentry_dsn" EMISSARY_SENTRY_ENVIRONMENT="$emissary_sentry_environment" EMISSARY_CONTROLLERS_STATUS_CLAIM_URL="$emissary_agent_claim_url" EMISSARY_CONTROLLERS_STATUS_AGENT_URL="$emissary_agent_url"
   procd_set_param command /usr/local/bin/emissary
   procd_append_param command --workdir /usr/share/emissary
   procd_append_param command --config "$config_file"
   procd_append_param command agent run
-  procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
+  procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-17280}
   procd_set_param file "$config_file"
   procd_set_param stdout 1
   procd_set_param stderr 1

misc/emissary/uci-defaults/99-emissary.sh

@@ -17,6 +17,12 @@ main() {
     if [ ! -z "${EMISSARY_SERVER_URL}" ]; then
         uci set "emissary.agent.server_url=${EMISSARY_SERVER_URL}"
     fi
+    if [ ! -z "${EMISSARY_SENTRY_DSN}" ]; then
+        uci set "emissary.agent.sentry_dsn=${EMISSARY_SENTRY_DSN}"
+    fi
+    if [ ! -z "${EMISSARY_SENTRY_ENVIRONMENT}" ]; then
+        uci set "emissary.agent.sentry_environment=${EMISSARY_SENTRY_ENVIRONMENT}"
+    fi
 
     # Commit modifications
     uci commit

misc/turris/omnia/uci-defaults/98-turris-omnia-uci-custom.sh

@@ -1,37 +0,0 @@
-#/bin/sh
-
-set -e
-
-main() {
-    # Update default firewall ruleset
-    uci add firewall rule
-    uci set firewall.@rule[-1].name='Allow SSH on WAN'
-    uci set firewall.@rule[-1].src='wan'
-    uci set firewall.@rule[-1].proto='tcp'
-    uci set firewall.@rule[-1].dest_port='22'
-    uci set firewall.@rule[-1].target='ACCEPT'
-
-    uci add firewall rule
-    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
-    uci set firewall.@rule[-1].src='wan'
-    uci set firewall.@rule[-1].proto='tcp'
-    uci set firewall.@rule[-1].dest_port='80'
-    uci set firewall.@rule[-1].target='ACCEPT'
-
-    uci add firewall rule
-    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
-    uci set firewall.@rule[-1].src='wan'
-    uci set firewall.@rule[-1].proto='tcp'
-    uci set firewall.@rule[-1].dest_port='443'
-    uci set firewall.@rule[-1].target='ACCEPT'
-
-    uci commit firewall
-    
-    # Disable DNS-rebind protection
-    uci set dhcp.@dnsmasq[0].rebind_protection='0'
-    uci commit dhcp
-
-    reload_config
-}
-
-main

misc/x86/uci-defaults/99-machine-id.sh

@@ -11,14 +11,13 @@ main() {
     fi
 
     # Accumulate data to create unique machine id
-    local mac_addresses=$(cat /sys/class/net/*/address | uniq | sort)
-    local device_uuid=$(dmidecode | grep UUID)
+    local random_uuid=$(cat /proc/sys/kernel/random/uuid)
 
     # Ensure destination directory
     mkdir -p "$(dirname "$machine_id_file")"
 
     # Generate SHA256 hash of data and save it to $machine_id_file
-    echo "$mac_adresses $device_uuid" | sha256sum | cut -d ' ' -f1 > "$machine_id_file"
+    echo "$random_uuid" | sha256sum | cut -d ' ' -f1 > "$machine_id_file"
 }
 
 main

misc/x86/uci-defaults/99-x86-uci-custom.sh

@@ -1,37 +0,0 @@
-#/bin/sh
-
-set -e
-
-main() {
-    # Update default firewall ruleset
-    uci add firewall rule
-    uci set firewall.@rule[-1].name='Allow SSH on WAN'
-    uci set firewall.@rule[-1].src='wan'
-    uci set firewall.@rule[-1].proto='tcp'
-    uci set firewall.@rule[-1].dest_port='22'
-    uci set firewall.@rule[-1].target='ACCEPT'
-
-    uci add firewall rule
-    uci set firewall.@rule[-1].name='Allow HTTP on WAN'
-    uci set firewall.@rule[-1].src='wan'
-    uci set firewall.@rule[-1].proto='tcp'
-    uci set firewall.@rule[-1].dest_port='80'
-    uci set firewall.@rule[-1].target='ACCEPT'
-
-    uci add firewall rule
-    uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
-    uci set firewall.@rule[-1].src='wan'
-    uci set firewall.@rule[-1].proto='tcp'
-    uci set firewall.@rule[-1].dest_port='443'
-    uci set firewall.@rule[-1].target='ACCEPT'
-
-    uci commit firewall
-    
-    # Disable DNS-rebind protection
-    uci set dhcp.@dnsmasq[0].rebind_protection='0'
-    uci commit dhcp
-
-    reload_config
-}
-
-main

packages.txt

@@ -1,3 +1,8 @@
 luci 
 openssh-server
-openssh-sftp-server
+openssh-sftp-server
+parted
+lsblk
+e2fsprogs
+block-mount
+kmod-fs-ext4

targets/bananapi.mk

@@ -2,8 +2,6 @@ all: bpi-r3
 
 bpi-r3:
 	$(MAKE) \
-		OPENWRT_VERSION="23.05.0-rc3" \
-		IMAGEBUILDER_URL=https://downloads.openwrt.org/releases/23.05.0-rc3/targets/mediatek/filogic/openwrt-imagebuilder-23.05.0-rc3-mediatek-filogic.Linux-x86_64.tar.xz \
 		ADDITIONAL_INSTALL="install-bpi-r3-network-config" \
 		ADDITIONAL_OPENWRT_PACKAGES="block-mount kmod-fs-ext4 kmod-usb-storage kmod-usb2" \
 		OPENWRT_TARGET="mediatek/filogic" \

targets/generic.mk

@@ -2,7 +2,7 @@ all: x86-generic
 
 x86-generic:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="install-x86-network-config install-x86-uci-defaults" \
+		ADDITIONAL_INSTALL="install-x86-network-config" \
 		ADDITIONAL_OPENWRT_PACKAGES="dmidecode" \
 		OPENWRT_TARGET="x86/generic" \
 		EMISSARY_ARCH="386" \

targets/raspberrypi.mk

@@ -2,7 +2,7 @@ all: rpi-4 rpi-3
 
 rpi-4:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
+		ADDITIONAL_INSTALL="install-rpi-network-config" \
 		OPENWRT_TARGET="bcm27xx/bcm2711" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-4" \
@@ -10,7 +10,7 @@ rpi-4:
 
 rpi-3:
 	$(MAKE) \
-		ADDITIONAL_INSTALL="install-rpi-network-config install-rpi-uci-defaults" \
+		ADDITIONAL_INSTALL="install-rpi-network-config" \
 		OPENWRT_TARGET="bcm27xx/bcm2710" \
 		EMISSARY_ARCH="arm64" \
 		OPENWRT_PROFILE="rpi-3" \