feat(install): unattended setup for package-manager installs#980
Open
geodro wants to merge 1 commit into
Open
Conversation
Debian and Ubuntu users install lerd from a Launchpad PPA, where a maintainer script runs as root and cannot answer the interactive sudo prompts a normal lerd install relies on. This adds the pieces that let a package finish setup without prompting, while leaving the interactive install path unchanged. lerd bootstrap --system performs the root-level, machine-global steps: the unprivileged-port sysctl, systemd linger, and the DNS sudoers rule. lerd install --unattended runs the rest non-interactively, defaults to managed .test, and generates the mkcert CA with TRUST_STORES=nss so it needs no sudo. lerd bootstrap --trust-ca then installs that CA into the system trust store as root. The postinst runs bootstrap --system, the per-user install, then bootstrap --trust-ca, so managed DNS and HTTPS come up with no password. Every unattended-only step is gated behind the flag, so an ordinary lerd install behaves exactly as before. The systemd unit templates hardcoded ~/.local/bin/lerd, which cannot resolve for a package that installs the binary to /usr/bin. The unit ExecStart is now filled in with the running binary's real path, so the daemon starts from wherever lerd actually lives. lerd update self-replaces a ~/.local/bin binary, which would fight apt on a packaged install, so it now recognises a binary under /usr and points the user at their package manager instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Debian and Ubuntu users install lerd from a Launchpad PPA (ppa:lerd/lerd), where a maintainer script runs as root and cannot answer the interactive sudo prompts a normal lerd install relies on. This adds the pieces that let a package finish setup without prompting, and teaches lerd to cooperate with a system-managed binary, while leaving the interactive install untouched.
lerd bootstrap --system does the root-level machine-global steps, the unprivileged-port sysctl, systemd linger, and the DNS sudoers rule. lerd install --unattended runs the rest non-interactively, defaults to managed .test, and generates the mkcert CA with TRUST_STORES=nss so it needs no sudo. lerd bootstrap --trust-ca installs that CA into the system trust store as root afterward. The companion lerd-deb package runs bootstrap --system, the per-user install, then bootstrap --trust-ca, so managed DNS and HTTPS come up with no password. Every unattended-only branch is gated behind the flag, so an ordinary lerd install behaves exactly as before.
The systemd unit templates hardcoded ~/.local/bin/lerd, which cannot resolve for a package that installs the binary to /usr/bin, so the unit ExecStart now carries the running binary's real path.
lerd update self-replaces a ~/.local/bin binary, which would fight apt on a packaged install, so it now recognises a binary under /usr and defers to the package manager.
Closes #979