82 lines
2.0 KiB
Bash
Executable File
82 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================
|
|
# 04-start-fips.sh
|
|
#
|
|
# Start a single FIPS node in sys-fips, wait for fips0, and set route.
|
|
#
|
|
# Usage:
|
|
# sudo bash 04-start-fips.sh
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
CONFIG_FILE="/etc/fips/fips.yaml"
|
|
ENV_FILE="/etc/fips/node.env"
|
|
|
|
echo "=== Starting FIPS (single node) ==="
|
|
echo ""
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "✗ This script must be run as root (sudo)"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "$CONFIG_FILE" ]; then
|
|
echo "✗ $CONFIG_FILE not found"
|
|
echo " Run: sudo bash 02-install-fips.sh"
|
|
exit 1
|
|
fi
|
|
|
|
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1 || true
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1 || true
|
|
echo "✓ IPv6 + forwarding enabled"
|
|
|
|
systemctl daemon-reload
|
|
systemctl restart fips
|
|
sleep 1
|
|
|
|
if ! systemctl is-active --quiet fips; then
|
|
echo "✗ fips service is not active"
|
|
echo " Check: journalctl -u fips -n 100 --no-pager"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✓ fips service active"
|
|
|
|
echo "Waiting for fips0..."
|
|
for i in $(seq 1 30); do
|
|
if ip link show fips0 >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
if ! ip link show fips0 >/dev/null 2>&1; then
|
|
echo "✗ fips0 did not appear within 30s"
|
|
echo " Check: journalctl -u fips -n 100 --no-pager"
|
|
exit 1
|
|
fi
|
|
|
|
IPV6=$(ip -6 addr show fips0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
|
|
NPUB=""
|
|
|
|
if [ -f /etc/fips/fips.pub ]; then
|
|
NPUB=$(cat /etc/fips/fips.pub)
|
|
elif command -v fipsctl >/dev/null 2>&1; then
|
|
NPUB=$(fipsctl show status 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin).get("npub",""))' 2>/dev/null || true)
|
|
fi
|
|
|
|
ip -6 route replace fd00::/8 dev fips0 2>/dev/null || true
|
|
|
|
cat > "$ENV_FILE" << EOF
|
|
NPUB=${NPUB}
|
|
IPV6=${IPV6}
|
|
EOF
|
|
|
|
echo ""
|
|
echo "✓ fips0 is up"
|
|
echo " npub: ${NPUB:-unknown}"
|
|
echo " ipv6: ${IPV6:-unknown}"
|
|
echo " route: fd00::/8 -> fips0"
|
|
echo ""
|
|
echo "Next: sudo bash 06-configure-dns.sh"
|