Update install_guac.sh
This commit is contained in:
Christian Krakau-Louis
committed by
GitHub
GitHub
parent
8c4543ae94
commit
e57ae55700
+78
-81
@@ -1,7 +1,10 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# --- Defaults ---
|
||||
# ============================================================
|
||||
# Guacamole Install Script (ARM/AMD, Ubuntu 24.04+)
|
||||
# ============================================================
|
||||
|
||||
GUACVERSION="1.5.5"
|
||||
GUAC_USER="guacamole_user"
|
||||
GUAC_DB="guacamole_db"
|
||||
@@ -9,63 +12,28 @@ TOMCAT_VER=9.0.109
|
||||
CRED_FILE="/root/guacamole-credentials.txt"
|
||||
VERBOSE=false
|
||||
|
||||
# --- Temporary defaults (safe for reruns) ---
|
||||
# Temporary bootstrap passwords
|
||||
MYSQL_ROOT_PWD="root"
|
||||
GUAC_PWD="guac"
|
||||
|
||||
# --- Colors ---
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
NC='\033[0m'
|
||||
|
||||
# --- Functions ---
|
||||
usage() {
|
||||
cat <<EOF
|
||||
Usage: $0 [options]
|
||||
log() { echo -e "$@"; }
|
||||
|
||||
Options:
|
||||
--help Show this help and exit
|
||||
-v, --verbose Enable verbose output
|
||||
-q, --quiet Suppress most output
|
||||
SERVER_NAME=... Set server FQDN (env variable)
|
||||
|
||||
Examples:
|
||||
SERVER_NAME=guac.example.com $0
|
||||
SERVER_NAME=guac.example.com $0 -v
|
||||
EOF
|
||||
}
|
||||
|
||||
log() {
|
||||
if [ "$VERBOSE" = true ]; then
|
||||
echo -e "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
# --- Parse args ---
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
--help) usage; exit 0 ;;
|
||||
-v|--verbose) VERBOSE=true ;;
|
||||
-q|--quiet) exec >/dev/null 2>&1 ;;
|
||||
*) echo -e "${RED}Unknown option: $1${NC}"; usage; exit 1 ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# --- Hostname detection (IPv4 only, reverse DNS via Google DNS) ---
|
||||
# ============================================================
|
||||
# Hostname detection (reverse DNS of IPv4)
|
||||
# ============================================================
|
||||
SERVER_NAME=${SERVER_NAME:-}
|
||||
if [ -z "$SERVER_NAME" ]; then
|
||||
PUBIP=$(curl -4 -s ifconfig.me || echo "")
|
||||
if [ -n "$PUBIP" ]; then
|
||||
apt-get install -y -qq dnsutils >/dev/null 2>&1 || true
|
||||
REVNAME=$(dig +short -x $PUBIP @8.8.8.8 | sed 's/\.$//' || true)
|
||||
if [ -n "$REVNAME" ]; then
|
||||
DEFAULT_NAME=$REVNAME
|
||||
else
|
||||
DEFAULT_NAME=$PUBIP
|
||||
fi
|
||||
DEFAULT_NAME=${REVNAME:-$PUBIP}
|
||||
else
|
||||
DEFAULT_NAME="localhost"
|
||||
fi
|
||||
@@ -75,37 +43,45 @@ if [ -z "$SERVER_NAME" ]; then
|
||||
SERVER_NAME=${SERVER_NAME:-$DEFAULT_NAME}
|
||||
else
|
||||
SERVER_NAME=$DEFAULT_NAME
|
||||
echo -e "${YELLOW}No SERVER_NAME provided, using default (IPv4): ${SERVER_NAME}${NC}"
|
||||
log "${YELLOW}No SERVER_NAME provided, using default: ${SERVER_NAME}${NC}"
|
||||
fi
|
||||
fi
|
||||
|
||||
# --- Install base packages ---
|
||||
# ============================================================
|
||||
# Base packages
|
||||
# ============================================================
|
||||
log "${BLUE}>>> Installing base packages...${NC}"
|
||||
apt-get update -y
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -yq \
|
||||
xfce4 xfce4-goodies tightvncserver ufw curl wget zsh dnsutils \
|
||||
build-essential libjpeg-turbo8-dev libpng-dev libossp-uuid-dev \
|
||||
libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
|
||||
freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \
|
||||
libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \
|
||||
libwebsockets-dev freerdp2-x11 libtool-bin ghostscript dpkg-dev crudini \
|
||||
mariadb-server mariadb-client nginx certbot python3-certbot-nginx openssl
|
||||
xfce4 xfce4-goodies tightvncserver ufw curl wget zsh dnsutils \
|
||||
build-essential libjpeg-turbo8-dev libpng-dev libossp-uuid-dev \
|
||||
libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
|
||||
freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \
|
||||
libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \
|
||||
libwebsockets-dev freerdp2-x11 libtool-bin ghostscript dpkg-dev crudini \
|
||||
mariadb-server mariadb-client nginx certbot python3-certbot-nginx openssl
|
||||
|
||||
# --- Java ---
|
||||
# ============================================================
|
||||
# Java
|
||||
# ============================================================
|
||||
if ! command -v java >/dev/null 2>&1; then
|
||||
apt-get install -y openjdk-17-jre-headless
|
||||
fi
|
||||
JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
|
||||
log "${GREEN}JAVA_HOME detected as ${JAVA_HOME}${NC}"
|
||||
log "${GREEN}JAVA_HOME=${JAVA_HOME}${NC}"
|
||||
|
||||
# --- Firewall ---
|
||||
# ============================================================
|
||||
# Firewall
|
||||
# ============================================================
|
||||
ufw --force enable
|
||||
ufw allow ssh
|
||||
ufw allow 80/tcp
|
||||
ufw allow 443/tcp
|
||||
ufw reload
|
||||
|
||||
# --- Tomcat 9 ---
|
||||
# ============================================================
|
||||
# Tomcat
|
||||
# ============================================================
|
||||
if [ ! -d /opt/apache-tomcat-${TOMCAT_VER} ]; then
|
||||
log "${BLUE}>>> Installing Tomcat ${TOMCAT_VER}...${NC}"
|
||||
cd /opt
|
||||
@@ -137,17 +113,17 @@ fi
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now tomcat9
|
||||
|
||||
# --- Guacamole ---
|
||||
# ============================================================
|
||||
# Guacamole
|
||||
# ============================================================
|
||||
cd /root
|
||||
SERVER="https://downloads.apache.org/guacamole/${GUACVERSION}"
|
||||
|
||||
if [ ! -d guacamole-server-${GUACVERSION} ]; then
|
||||
wget -q ${SERVER}/source/guacamole-server-${GUACVERSION}.tar.gz
|
||||
tar -xzf guacamole-server-${GUACVERSION}.tar.gz
|
||||
wget -q ${SERVER}/binary/guacamole-${GUACVERSION}.war -O /etc/guacamole.war
|
||||
wget -q ${SERVER}/binary/guacamole-auth-jdbc-${GUACVERSION}.tar.gz
|
||||
tar -xzf guacamole-auth-jdbc-${GUACVERSION}.tar.gz
|
||||
fi
|
||||
wget -q ${SERVER}/source/guacamole-server-${GUACVERSION}.tar.gz -O guacamole-server-${GUACVERSION}.tar.gz
|
||||
tar -xzf guacamole-server-${GUACVERSION}.tar.gz
|
||||
wget -q ${SERVER}/binary/guacamole-${GUACVERSION}.war -O /etc/guacamole.war
|
||||
wget -q ${SERVER}/binary/guacamole-auth-jdbc-${GUACVERSION}.tar.gz -O guacamole-auth-jdbc-${GUACVERSION}.tar.gz
|
||||
tar -xzf guacamole-auth-jdbc-${GUACVERSION}.tar.gz
|
||||
|
||||
if ! command -v guacd >/dev/null 2>&1; then
|
||||
cd guacamole-server-${GUACVERSION}
|
||||
@@ -181,8 +157,25 @@ mkdir -p /etc/guacamole/extensions /etc/guacamole/lib
|
||||
cp /etc/guacamole.war /opt/tomcat9/webapps/guacamole.war
|
||||
cp guacamole-auth-jdbc-${GUACVERSION}/mysql/guacamole-auth-jdbc-mysql-${GUACVERSION}.jar /etc/guacamole/extensions/
|
||||
|
||||
# --- MySQL setup with defaults ---
|
||||
log "${BLUE}>>> Setting up MySQL with defaults...${NC}"
|
||||
# ============================================================
|
||||
# JDBC Connector
|
||||
# ============================================================
|
||||
log "${BLUE}>>> Installing JDBC driver for MySQL/MariaDB...${NC}"
|
||||
if apt-cache show libmariadb-java 2>/dev/null | grep -q Package; then
|
||||
apt-get install -y libmariadb-java
|
||||
ln -sf /usr/share/java/mariadb-java-client.jar /etc/guacamole/lib/mysql-connector-java.jar
|
||||
log "${GREEN}MariaDB JDBC connector installed.${NC}"
|
||||
else
|
||||
cd /tmp
|
||||
wget -q https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-8.3.0.tar.gz
|
||||
tar -xzf mysql-connector-j-8.3.0.tar.gz
|
||||
cp mysql-connector-j-8.3.0/mysql-connector-j-8.3.0.jar /etc/guacamole/lib/mysql-connector-java.jar
|
||||
log "${GREEN}MySQL Connector/J installed.${NC}"
|
||||
fi
|
||||
|
||||
# ============================================================
|
||||
# MySQL setup
|
||||
# ============================================================
|
||||
mysql -u root <<EOF
|
||||
ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PWD}';
|
||||
EOF
|
||||
@@ -208,11 +201,14 @@ mysql-port: 3306
|
||||
mysql-database: ${GUAC_DB}
|
||||
mysql-username: ${GUAC_USER}
|
||||
mysql-password: ${GUAC_PWD}
|
||||
mysql-ssl-mode: disabled
|
||||
EOF
|
||||
|
||||
systemctl restart tomcat9
|
||||
|
||||
# --- Nginx reverse proxy ---
|
||||
# ============================================================
|
||||
# Nginx reverse proxy
|
||||
# ============================================================
|
||||
cat > /etc/nginx/sites-available/guacamole <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
@@ -232,9 +228,9 @@ EOF
|
||||
ln -sf /etc/nginx/sites-available/guacamole /etc/nginx/sites-enabled/guacamole
|
||||
nginx -t && systemctl reload nginx
|
||||
|
||||
# --- Let's Encrypt with fallback ---
|
||||
# Let's Encrypt
|
||||
if certbot --nginx -d ${SERVER_NAME} --non-interactive --agree-tos -m admin@${SERVER_NAME} --redirect; then
|
||||
log "${GREEN}Let's Encrypt certificate installed successfully.${NC}"
|
||||
log "${GREEN}Let's Encrypt OK.${NC}"
|
||||
else
|
||||
mkdir -p /etc/ssl/selfsigned
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
@@ -267,8 +263,10 @@ EOF
|
||||
nginx -t && systemctl reload nginx
|
||||
fi
|
||||
|
||||
# --- Tailscale ---
|
||||
echo -e "${BLUE}>>> Installing Tailscale...${NC}"
|
||||
# ============================================================
|
||||
# Tailscale
|
||||
# ============================================================
|
||||
log "${BLUE}>>> Installing Tailscale...${NC}"
|
||||
curl -fsSL https://tailscale.com/install.sh | sh
|
||||
systemctl enable --now tailscaled
|
||||
|
||||
@@ -277,32 +275,33 @@ if [ -t 0 ]; then
|
||||
else
|
||||
TSKEY=""
|
||||
fi
|
||||
|
||||
if [ -n "${TSKEY:-}" ]; then
|
||||
tailscale up --authkey=${TSKEY} --ssh
|
||||
else
|
||||
tailscale up --ssh
|
||||
fi
|
||||
|
||||
# --- Final credential rotation (MySQL only) ---
|
||||
# ============================================================
|
||||
# Rotate MySQL passwords at the end
|
||||
# ============================================================
|
||||
FINAL_MYSQL_ROOT_PWD=$(openssl rand -base64 20)
|
||||
FINAL_GUAC_PWD=$(openssl rand -base64 20)
|
||||
|
||||
mysql -u root -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '${FINAL_MYSQL_ROOT_PWD}';"
|
||||
mysql -u root -p${FINAL_MYSQL_ROOT_PWD} -e "ALTER USER '${GUAC_USER}'@'localhost' IDENTIFIED BY '${FINAL_GUAC_PWD}'; FLUSH PRIVILEGES;"
|
||||
|
||||
# Update guacamole.properties with new DB password
|
||||
crudini --set /etc/guacamole/guacamole.properties '' mysql-password "${FINAL_GUAC_PWD}"
|
||||
|
||||
systemctl restart tomcat9
|
||||
|
||||
# --- Save credentials ---
|
||||
# ============================================================
|
||||
# Save credentials
|
||||
# ============================================================
|
||||
cat > ${CRED_FILE} <<EOF
|
||||
Guacamole admin login (default):
|
||||
User: guacadmin
|
||||
Pass: guacadmin
|
||||
|
||||
*** IMPORTANT: Change this password immediately after login via the Guacamole UI! ***
|
||||
*** Change this password immediately after login! ***
|
||||
|
||||
MySQL root password:
|
||||
${FINAL_MYSQL_ROOT_PWD}
|
||||
@@ -315,13 +314,11 @@ Server name:
|
||||
EOF
|
||||
chmod 600 ${CRED_FILE}
|
||||
|
||||
# --- Final info ---
|
||||
IP=$(curl -4 -s ifconfig.me || echo "localhost")
|
||||
echo -e "${GREEN}=========================================================${NC}"
|
||||
echo -e "Guacamole is now running behind Nginx."
|
||||
echo -e "URL: https://${SERVER_NAME}/"
|
||||
echo -e "Alt: https://${IP}/"
|
||||
echo -e "Login: guacadmin / guacadmin (change immediately!)"
|
||||
echo -e "Guacamole running at: https://${SERVER_NAME}/"
|
||||
echo -e "Fallback: https://${IP}/"
|
||||
echo -e "Login: guacadmin / guacadmin"
|
||||
echo -e "MySQL root password: ${FINAL_MYSQL_ROOT_PWD}"
|
||||
echo -e "MySQL guac user pass: ${FINAL_GUAC_PWD}"
|
||||
echo -e "Credentials saved in: ${CRED_FILE}"
|
||||
|
||||
Reference in New Issue
Block a user