Linus Gasser
e27e8b7b4f
This allows you to run an always-on node for your radicle projects and then synchronise with other nodes. It offers the node and a web-frontend, which is read-only.
54 lines
1.7 KiB
Cheetah
54 lines
1.7 KiB
Cheetah
#!/bin/sh
|
|
# Radicle seed node entrypoint. Idempotent: generates the node identity and
|
|
# writes an initial config.json on first run only. On later deploys the key and
|
|
# config persist in the RAD_HOME volume and are left untouched.
|
|
set -eu
|
|
|
|
: "${RAD_HOME:=/var/lib/radicle}"
|
|
export RAD_HOME
|
|
export PATH="/usr/local/bin:${PATH}"
|
|
|
|
# Key passphrase from the mounted secret. An empty value produces an
|
|
# unencrypted key (acceptable: the volume is the trust boundary).
|
|
if [ -f /run/secrets/keypass ]; then
|
|
RAD_PASSPHRASE="$(cat /run/secrets/keypass)"
|
|
else
|
|
RAD_PASSPHRASE=""
|
|
fi
|
|
export RAD_PASSPHRASE
|
|
|
|
mkdir -p "$RAD_HOME"
|
|
|
|
# First run: generate the Ed25519 node identity non-interactively.
|
|
if [ ! -f "$RAD_HOME/keys/radicle" ]; then
|
|
echo "radicle: generating node identity (alias=${RAD_ALIAS:-seed})"
|
|
rad auth --alias "${RAD_ALIAS:-seed}"
|
|
fi
|
|
|
|
# First run: write the seed configuration. Guarded by a sentinel so operators
|
|
# can edit config.json in the volume afterwards without it being overwritten.
|
|
if [ ! -f "$RAD_HOME/.seed-configured" ]; then
|
|
echo "radicle: writing seed config.json"
|
|
if [ "${RAD_SEEDING_POLICY:-allow}" = "allow" ]; then
|
|
SEEDING_POLICY="{ \"default\": \"allow\", \"scope\": \"${RAD_SEEDING_SCOPE:-all}\" }"
|
|
else
|
|
SEEDING_POLICY="{ \"default\": \"block\" }"
|
|
fi
|
|
cat > "$RAD_HOME/config.json" <<EOF
|
|
{
|
|
"node": {
|
|
"alias": "${RAD_ALIAS:-seed}",
|
|
"listen": ["0.0.0.0:${RAD_P2P_PORT:-8776}"],
|
|
"externalAddresses": ["${RAD_EXTERNAL_ADDRESS}"],
|
|
"seedingPolicy": ${SEEDING_POLICY}
|
|
}
|
|
}
|
|
EOF
|
|
touch "$RAD_HOME/.seed-configured"
|
|
fi
|
|
|
|
echo "radicle: node id $(rad self --nid 2>/dev/null || echo '<unknown>')"
|
|
|
|
# Canonical launch (mirrors the upstream systemd unit).
|
|
exec radicle-node --listen "0.0.0.0:${RAD_P2P_PORT:-8776}" --force
|