From 07186f3d22de2f2ee1c08f37d62aad2676096b6e Mon Sep 17 00:00:00 2001 From: Wanjohi Date: Fri, 16 Oct 2026 18:14:04 +0000 Subject: [PATCH] feat(install): the install token is optional; host agent 0.2.20 (#418) Releases the install.sh half of #416 now that host agent 0.2.20 can sign in. --- apps/api/install/install.sh | 39 ++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/apps/api/install/install.sh b/apps/api/install/install.sh index ff3e3c71..8aa4d2e0 100755 --- a/apps/api/install/install.sh +++ b/apps/api/install/install.sh @@ -4,6 +4,7 @@ # This file is the source of what that URL serves, kept in the public # repository so anyone about to pipe it into a shell can read it first. # +# bash <(curl -fsSL https://api.nestri.io/install.sh) # bash <(curl -fsSL https://api.nestri.io/install.sh) # bash <(curl -fsSL https://api.nestri.io/install.sh) -u # @@ -12,18 +13,21 @@ # What it does, in order: check this is 64-bit Linux, ask where box images # should live, download the host agent for this platform, verify it against the # published SHA256SUMS, install it to /usr/local/bin, and hand over to the -# agent's own onboarding, which checks the machine, registers it with the token -# and starts the agent as a systemd service. +# agent's own onboarding, which checks the machine, registers it and starts the +# agent as a systemd service. # # It runs as root because the agent does: each box's VMM is jailed under a uid # of its own, which only root can give it, and a box's network needs # CAP_NET_ADMIN. The agent keeps its state in /var/lib/nestri. Started as # anyone else, it asks sudo for root once, before it changes anything. # -# The token comes from the dashboard's Installation page. It registers one -# machine, works once and lapses after an hour. +# The token is optional. Without one, the agent signs in instead: it shows a +# code and a link, and the machine is registered once somebody approves that +# code in a browser, on any device. A token from the dashboard's Installation +# page skips the browser; it registers one machine, works once and lapses after +# an hour. # -# `-u` (`--update`) needs no token: on a machine that is already a host, it installs +# `-u` (`--update`) registers nothing: on a machine that is already a host, it installs # the current agent and restarts it, and the agent picks up whatever a new # release changed about its images on its own. It touches nothing else -- the # machine keeps its registration, its box store and its Steam sign-ins. @@ -33,7 +37,7 @@ set -eu API="${NESTRI_API:-https://api.nestri.io}" # Pinned, not "latest", so the script and the binary it installs are a pair # somebody chose. Bump when cutting a release; NESTRI_HOST_VERSION overrides it. -DEFAULT_VERSION="0.2.19" +DEFAULT_VERSION="0.2.20" VERSION="${NESTRI_HOST_VERSION:-$DEFAULT_VERSION}" BIN_DIR="${NESTRI_BIN_DIR:-/usr/local/bin}" STATE_DIR=/var/lib/nestri @@ -45,7 +49,8 @@ usage() { cat >&2 < make this machine a host + bash <(curl -fsSL $API/install.sh) make this machine a host, approving it in a browser + bash <(curl -fsSL $API/install.sh) make this machine a host with a token from the dashboard bash <(curl -fsSL $API/install.sh) -u update the host agent here -u, --update install the current host agent on a machine that is already a host @@ -65,11 +70,6 @@ while [ $# -gt 0 ]; do esac shift done -if [ "$MODE" = install ] && [ -z "$TOKEN" ]; then - usage - die "no install token. Copy the full command from the dashboard's Installation page." -fi - # --- fetch ------------------------------------------------------------------ if command -v curl >/dev/null 2>&1; then get() { curl -fsSL "$1" -o "$2"; } @@ -95,7 +95,9 @@ if [ "$(id -u)" -ne 0 ]; then command -v sudo >/dev/null 2>&1 || die "this needs root and there is no sudo here. Run it as root." self="$(mktemp)" get "$API/install.sh" "$self" || die "could not fetch $API/install.sh to run it as root" - if [ "$MODE" = update ]; then set -- -u; else set -- "$TOKEN"; fi + if [ "$MODE" = update ]; then set -- -u + elif [ -n "$TOKEN" ]; then set -- "$TOKEN" + else set --; fi say "The host agent runs as root, so this needs sudo." exec sudo env NESTRI_SELF="$self" NESTRI_API="$API" \ ${NESTRI_HOST_VERSION:+NESTRI_HOST_VERSION="$NESTRI_HOST_VERSION"} \ @@ -228,9 +230,14 @@ fi # --- onboard ---------------------------------------------------------------- # The token goes through the environment rather than argv, so it is not in -# `ps` for the length of the run. -export NESTRI_INSTALL_TOKEN="$TOKEN" NESTRI_BOX_STORE="$BOX_STORE" NESTRI_API="$API" \ - NESLET_STATE_DIR="$STATE_DIR" +# `ps` for the length of the run. With none, it is left out altogether, and +# onboarding signs in through the browser instead. +if [ -n "$TOKEN" ]; then + export NESTRI_INSTALL_TOKEN="$TOKEN" +else + unset NESTRI_INSTALL_TOKEN +fi +export NESTRI_BOX_STORE="$BOX_STORE" NESTRI_API="$API" NESLET_STATE_DIR="$STATE_DIR" if tty_ok; then exec "$BIN_DIR/nestri-host" onboard