git.iko.soy/vibebox
on 57798d2 help sign in
vibebox/src/ssh.sh
194 lines 5.1 kB history raw
1#!/bin/sh
2set -eu
4SSH_USER="__SSH_USER__"
5PROJECT_NAME="__PROJECT_NAME__"
6KEY_PATH="__KEY_PATH__"
8diag() { echo "[vibebox][diag] $*" >&2; }
10# Extract default route facts (no hardcode)
11default_route_line() { ip -4 route show default 2>/dev/null | head -n 1 || true; }
12default_dev() {
13 default_route_line | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}'
15default_gw() {
16 default_route_line | awk '{for(i=1;i<=NF;i++) if($i=="via"){print $(i+1); exit}}'
19dump_diag() {
20 diag "=== default route ==="
21 default_route_line >&2 || true
23 diag "=== systemctl status ssh ==="
24 systemctl status ssh --no-pager >&2 || true
26 diag "=== journalctl -u ssh (tail) ==="
27 journalctl -u ssh -n 120 --no-pager >&2 || true
29 diag "=== sshd -t ==="
30 sshd -t >&2 || true
32 diag "=== sshd -T (listen/addressfamily) ==="
33 sshd -T 2>/dev/null | egrep -i '^(listenaddress|addressfamily|port|permitrootlogin|allowusers)\b' >&2 || true
35 diag "=== listeners on :22 ==="
36 ss -lntp 2>/dev/null | awk 'NR==1 || $4 ~ /:22$/' >&2 || true
38 diag "=== ip -br addr ==="
39 ip -br addr >&2 || true
41 diag "=== ip route ==="
42 ip route >&2 || true
44 gw="$(default_gw || true)"
45 if [ -n "$gw" ]; then
46 diag "=== ping default gateway ($gw) ==="
47 ping -c1 -W1 "$gw" >/dev/null 2>&1 && diag "ping gw OK" || diag "ping gw FAIL"
48 fi
51# 1) tmpfs mount
52TARGET="/root/${PROJECT_NAME}/.vibebox"
53if [ -d "$TARGET" ] && ! mountpoint -q "$TARGET"; then
54 mount -t tmpfs tmpfs "$TARGET"
55fi
57# 2) user + authorized_keys
58if ! id -u "$SSH_USER" >/dev/null 2>&1; then
59 useradd -m -s /bin/bash -U "$SSH_USER"
60 usermod -aG sudo "$SSH_USER" || true
61fi
63install -d -m 700 -o "$SSH_USER" -g "$SSH_USER" "/home/${SSH_USER}/.ssh"
64install -m 600 -o "$SSH_USER" -g "$SSH_USER" "$KEY_PATH" "/home/${SSH_USER}/.ssh/authorized_keys"
66# Ensure codex/claude are visible in the user's HOME
67USER_HOME="$(getent passwd "$SSH_USER" | cut -d: -f6 2>/dev/null || true)"
68if [ -z "$USER_HOME" ]; then
69 USER_HOME="/home/${SSH_USER}"
70fi
71install -d -m 755 /usr/local/codex /usr/local/claude
72if [ ! -e "${USER_HOME}/.codex" ]; then
73 ln -s /usr/local/codex "${USER_HOME}/.codex"
74fi
75if [ ! -e "${USER_HOME}/.claude" ]; then
76 ln -s /usr/local/claude "${USER_HOME}/.claude"
77fi
78chown -h "${SSH_USER}:${SSH_USER}" "${USER_HOME}/.codex" "${USER_HOME}/.claude" 2>/dev/null || true
80# Vibebox shell commands
81install -d -m 755 /etc/profile.d
82cat > /etc/profile.d/vibebox.sh <<'VIBEBOX_SHELL_EOF'
83__VIBEBOX_SHELL_SCRIPT__
84VIBEBOX_SHELL_EOF
85chmod 644 /etc/profile.d/vibebox.sh
87if ! grep -q "vibebox-aliases" "${USER_HOME}/.bashrc" 2>/dev/null; then
88 {
89 echo ""
90 echo "# vibebox-aliases"
91 echo ". /etc/profile.d/vibebox.sh"
92 } >> "${USER_HOME}/.bashrc"
93fi
95# Install Mise
96MISE_BIN="${USER_HOME}/.local/bin/mise"
97if [ ! -x "$MISE_BIN" ] && ! command -v mise >/dev/null 2>&1; then
98 curl https://mise.run | HOME="$USER_HOME" sh
99fi
100echo 'eval "$(~/.local/bin/mise activate bash)"' >> "${USER_HOME}/.bashrc"
102export PATH="${USER_HOME}/.local/bin:/usr/local/bin:$PATH"
104mkdir -p "${USER_HOME}/.config/mise"
106cat > "${USER_HOME}/.config/mise/config.toml" <<MISE
107 [settings]
108 # Always use the venv created by uv, if available in directory
109 python.uv_venv_auto = true
110 experimental = true
111 idiomatic_version_file_enable_tools = ["rust"]
113 [tools]
114 uv = "0.9.25"
115 node = "24.13.0"
116 "npm:@openai/codex" = "latest"
117 "npm:@anthropic-ai/claude-code" = "latest"
118MISE
120touch "${USER_HOME}/.config/mise/mise.lock"
121if [ -x "$MISE_BIN" ]; then
122 HOME="$USER_HOME" "$MISE_BIN" install
123else
124 HOME="$USER_HOME" mise install
125fi
127# 3) start ssh (don't swallow failures)
128# If ssh is already active, don't force start/restart.
129if ! systemctl is-active --quiet ssh; then
130 if ! systemctl start ssh; then
131 diag "systemctl start ssh failed"
132 dump_diag
133 exit 1
134 fi
135fi
137# 4) obtain stable IPv4 on the default-route interface (wait up to ~30s)
138ip_on_dev() {
139 dev="$1"
140 ip -4 -o addr show dev "$dev" scope global 2>/dev/null \
141 | awk '{print $4}' | cut -d/ -f1 | head -n 1 || true
144ip=""
145dev=""
146gw=""
147t=0
148while [ "$t" -lt 60 ]; do
149 dev="$(default_dev || true)"
150 gw="$(default_gw || true)"
151 if [ -n "$dev" ]; then
152 ip="$(ip_on_dev "$dev")"
153 else
154 ip=""
155 fi
157 if [ -n "$dev" ] && [ -n "$ip" ]; then
158 # optional: if a gateway exists, require it to answer to avoid "ip exists but link dead"
159 if [ -z "$gw" ] || ping -c1 -W1 "$gw" >/dev/null 2>&1; then
160 break
161 fi
162 fi
164 t=$((t+1))
165 sleep 0.5
166done
168if [ -z "$dev" ] || [ -z "$ip" ]; then
169 diag "no stable IPv4 on default route interface"
170 dump_diag
171 exit 1
172fi
174# 5) strong verify: ssh must listen externally (0.0.0.0:22 or $ip:22 or [::]:22)
175listens_ok() {
176 ss -lnt 2>/dev/null \
177 | awk 'NR>1 {print $4}' \
178 | grep -Eq "^(0\.0\.0\.0:22|\\[::\\]:22|${ip}:22)$"
181i=0
182while ! listens_ok && [ "$i" -lt 80 ]; do # ~8s
183 i=$((i+1))
184 sleep 0.1
185done
187if ! listens_ok; then
188 diag "sshd not listening on 0.0.0.0:22 / ${ip}:22"
189 dump_diag
190 exit 1
191fi
193echo VIBEBOX_SSH_READY
194echo "VIBEBOX_IPV4=$ip"