From 7e47294448a1c5a05af8df4a8d34eeeceea03ef4 Mon Sep 17 00:00:00 2001 From: Wanjohi Date: Fri, 16 Oct 2026 01:03:02 +0300 Subject: [PATCH] feat(install): the install token is optional `bash <(curl -fsSL https://api.nestri.io/install.sh)` with nothing after it now installs the host agent and hands over to onboarding without a token, and the agent signs in instead: it shows a code, and the machine is registered once that code is approved in a browser on any device. That removes the step of copying a command with a secret in it from the dashboard, and keeps a secret out of shell history. A token still works exactly as before and skips the browser; `-u`, `-h` and asking sudo for root are unchanged. With no token, NESTRI_INSTALL_TOKEN is left unset rather than set empty, and the re-run under sudo is passed no argument rather than an empty one. --- apps/api/install/install.sh | 37 ++++++++++++++++++++++--------------- apps/auth/WIP-installer.md | 1 + 2 files changed, 23 insertions(+), 15 deletions(-) diff --git a/apps/api/install/install.sh b/apps/api/install/install.sh index 1955cded..85ebb68d 100755 --- a/apps/api/install/install.sh +++ b/apps/api/install/install.sh @@ -4,6 +4,7 @@ # This file is the source of what that URL serves, kept in the public # repository so anyone about to pipe it into a shell can read it first. # +# bash <(curl -fsSL https://api.nestri.io/install.sh) # bash <(curl -fsSL https://api.nestri.io/install.sh) # bash <(curl -fsSL https://api.nestri.io/install.sh) -u # @@ -12,18 +13,21 @@ # What it does, in order: check this is 64-bit Linux, ask where box images # should live, download the host agent for this platform, verify it against the # published SHA256SUMS, install it to /usr/local/bin, and hand over to the -# agent's own onboarding, which checks the machine, registers it with the token -# and starts the agent as a systemd service. +# agent's own onboarding, which checks the machine, registers it and starts the +# agent as a systemd service. # # It runs as root because the agent does: each box's VMM is jailed under a uid # of its own, which only root can give it, and a box's network needs # CAP_NET_ADMIN. The agent keeps its state in /var/lib/nestri. Started as # anyone else, it asks sudo for root once, before it changes anything. # -# The token comes from the dashboard's Installation page. It registers one -# machine, works once and lapses after an hour. +# The token is optional. Without one, the agent signs in instead: it shows a +# code and a link, and the machine is registered once somebody approves that +# code in a browser, on any device. A token from the dashboard's Installation +# page skips the browser; it registers one machine, works once and lapses after +# an hour. # -# `-u` (`--update`) needs no token: on a machine that is already a host, it installs +# `-u` (`--update`) registers nothing: on a machine that is already a host, it installs # the current agent and restarts it, and the agent picks up whatever a new # release changed about its images on its own. It touches nothing else -- the # machine keeps its registration, its box store and its Steam sign-ins. @@ -45,7 +49,8 @@ usage() { cat >&2 < make this machine a host + bash <(curl -fsSL $API/install.sh) make this machine a host, approving it in a browser + bash <(curl -fsSL $API/install.sh) make this machine a host with a token from the dashboard bash <(curl -fsSL $API/install.sh) -u update the host agent here -u, --update install the current host agent on a machine that is already a host @@ -65,11 +70,6 @@ while [ $# -gt 0 ]; do esac shift done -if [ "$MODE" = install ] && [ -z "$TOKEN" ]; then - usage - die "no install token. Copy the full command from the dashboard's Installation page." -fi - # --- fetch ------------------------------------------------------------------ if command -v curl >/dev/null 2>&1; then get() { curl -fsSL "$1" -o "$2"; } @@ -95,7 +95,9 @@ if [ "$(id -u)" -ne 0 ]; then command -v sudo >/dev/null 2>&1 || die "this needs root and there is no sudo here. Run it as root." self="$(mktemp)" get "$API/install.sh" "$self" || die "could not fetch $API/install.sh to run it as root" - if [ "$MODE" = update ]; then set -- -u; else set -- "$TOKEN"; fi + if [ "$MODE" = update ]; then set -- -u + elif [ -n "$TOKEN" ]; then set -- "$TOKEN" + else set --; fi say "The host agent runs as root, so this needs sudo." exec sudo env NESTRI_SELF="$self" NESTRI_API="$API" \ ${NESTRI_HOST_VERSION:+NESTRI_HOST_VERSION="$NESTRI_HOST_VERSION"} \ @@ -228,9 +230,14 @@ fi # --- onboard ---------------------------------------------------------------- # The token goes through the environment rather than argv, so it is not in -# `ps` for the length of the run. -export NESTRI_INSTALL_TOKEN="$TOKEN" NESTRI_BOX_STORE="$BOX_STORE" NESTRI_API="$API" \ - NESLET_STATE_DIR="$STATE_DIR" +# `ps` for the length of the run. With none, it is left out altogether, and +# onboarding signs in through the browser instead. +if [ -n "$TOKEN" ]; then + export NESTRI_INSTALL_TOKEN="$TOKEN" +else + unset NESTRI_INSTALL_TOKEN +fi +export NESTRI_BOX_STORE="$BOX_STORE" NESTRI_API="$API" NESLET_STATE_DIR="$STATE_DIR" if tty_ok; then exec "$BIN_DIR/nestri-host" onboard