Native VM install kit: systemd units, launcher, install and upgrade scripts; backups, restore and doctor without docker exec; DEPLOY.md VM, NPM and NFS sections

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-30 18:08:48 -06:00
parent f025479358
commit 45a1d1a42a
22 changed files with 2357 additions and 413 deletions
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Packet Station launcher on a VM. The native counterpart of docker/entrypoint.sh.
+# The systemd units and ps-run start every packetstation command through it.
+#
+# Usage: ps-launch.sh app | worker | migrate | doctor [...] | job run <name> | version | healthcheck app|worker | ...
+#
+# It runs from a release folder, /opt/packetstation/<release>/deploy/vm/ps-launch.sh, and uses that
+# release's venv and built frontend. systemd has already loaded /etc/packetstation/packetstation.env.
+#
+# Secrets: each unit hands its own secrets to the service as systemd credentials (LoadCredential=),
+# so the app never sees the VISUAL or M-Files password. When $CREDENTIALS_DIRECTORY holds a known
+# secret, the matching *_FILE setting is pointed at it. MFilesKit reads its password from the
+# environment only, so MFILES_PASSWORD is exported from MFILES_PASSWORD_FILE, as the entrypoint does.
+# No value is ever printed.
+#
+# Set here, over the env file: STATIC_DIR and PS_BUILD (from the release), WORKER_BEAT_FILE, TZ, LANG.
+set -euo pipefail
+
+self="$(readlink -f -- "${BASH_SOURCE[0]}")"
+release="$(cd -- "$(dirname -- "$self")/../.." && pwd -P)"
+venv="${PS_VENV:-$release/venv}"
+
+# secret name (the credential id and the file name in /etc/packetstation/secrets) and its setting
+cred_map='postgres_app_password PG_APP_PASSWORD_FILE
+postgres_migrate_password PG_MIGRATE_PASSWORD_FILE
+visualkit_password VISUAL_PASSWORD_FILE
+mfileskit_password MFILES_PASSWORD_FILE
+ldap_bind_password LDAP_PASSWORD_FILE
+session_key SESSION_KEY_FILE
+seal_key SEAL_KEY_FILE'
+
+if [[ -n "${CREDENTIALS_DIRECTORY:-}" ]]; then
+  while read -r name var; do
+    if [[ -r "$CREDENTIALS_DIRECTORY/$name" ]]; then
+      export "$var=$CREDENTIALS_DIRECTORY/$name"
+    fi
+  done <<< "$cred_map"
+fi
+unset cred_map name var
+
+mfiles_secret="${MFILES_PASSWORD_FILE:-}"
+if [[ -n "$mfiles_secret" && -r "$mfiles_secret" ]]; then
+  MFILES_PASSWORD="$(<"$mfiles_secret")"
+  # Drop a trailing carriage return left by an editor on Windows.
+  MFILES_PASSWORD="${MFILES_PASSWORD%$'\r'}"
+  export MFILES_PASSWORD
+fi
+unset mfiles_secret
+
+build="dev"
+if [[ -r "$release/BUILD" ]]; then
+  build="$(head -n 1 -- "$release/BUILD")"
+  build="${build%$'\r'}"
+fi
+
+export PATH="$venv/bin:/usr/local/bin:/usr/bin:/bin"
+export STATIC_DIR="$release/static"
+export PS_BUILD="$build"
+# The worker unit makes /run/packetstation (RuntimeDirectory=). The heartbeat lives there so
+# `ps-run healthcheck worker` reads the same file the worker writes.
+export WORKER_BEAT_FILE=/run/packetstation/worker.beat
+# The same as the containers: UTC process clock, UTF-8, unbuffered logs to the journal.
+export TZ=UTC
+export LANG=C.UTF-8
+export PYTHONUNBUFFERED=1
+export PYTHONDONTWRITEBYTECODE=1
+unset build self
+
+if [[ $# -eq 0 ]]; then
+  set -- app
+fi
+
+exec "$venv/bin/packetstation" "$@"