gitea-admin/gh-christianlouis-install-guac-arm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update install_guac.sh

Browse Source
This commit is contained in:
Christian Krakau-Louis
2025-09-07 13:44:36 +02:00
committed by GitHub
parent 8c4543ae94
commit e57ae55700
1 changed files with 78 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install_guac.sh
+78 -81
View File
@@ -1,7 +1,10 @@
#!/bin/bash #!/bin/bash
set -euo pipefail set -euo pipefail
# --- Defaults --- # ============================================================
# Guacamole Install Script (ARM/AMD, Ubuntu 24.04+)
# ============================================================
GUACVERSION="1.5.5" GUACVERSION="1.5.5"
GUAC_USER="guacamole_user" GUAC_USER="guacamole_user"
GUAC_DB="guacamole_db" GUAC_DB="guacamole_db"
@@ -9,63 +12,28 @@ TOMCAT_VER=9.0.109
CRED_FILE="/root/guacamole-credentials.txt" CRED_FILE="/root/guacamole-credentials.txt"
VERBOSE=false VERBOSE=false
# --- Temporary defaults (safe for reruns) --- # Temporary bootstrap passwords
MYSQL_ROOT_PWD="root" MYSQL_ROOT_PWD="root"
GUAC_PWD="guac" GUAC_PWD="guac"
# --- Colors ---
YELLOW='\033[1;33m' YELLOW='\033[1;33m'
BLUE='\033[0;34m' BLUE='\033[0;34m'
RED='\033[0;31m' RED='\033[0;31m'
GREEN='\033[0;32m' GREEN='\033[0;32m'
NC='\033[0m' NC='\033[0m'
# --- Functions --- log() { echo -e "$@"; }
usage() {
cat <<EOF
Usage: $0 [options]
Options: # ============================================================
--help Show this help and exit # Hostname detection (reverse DNS of IPv4)
-v, --verbose Enable verbose output # ============================================================
-q, --quiet Suppress most output
SERVER_NAME=... Set server FQDN (env variable)
Examples:
SERVER_NAME=guac.example.com $0
SERVER_NAME=guac.example.com $0 -v
EOF
}
log() {
if [ "$VERBOSE" = true ]; then
echo -e "$@"
fi
}
# --- Parse args ---
while [[ $# -gt 0 ]]; do
case $1 in
--help) usage; exit 0 ;;
-v|--verbose) VERBOSE=true ;;
-q|--quiet) exec >/dev/null 2>&1 ;;
*) echo -e "${RED}Unknown option: $1${NC}"; usage; exit 1 ;;
esac
shift
done
# --- Hostname detection (IPv4 only, reverse DNS via Google DNS) ---
SERVER_NAME=${SERVER_NAME:-} SERVER_NAME=${SERVER_NAME:-}
if [ -z "$SERVER_NAME" ]; then if [ -z "$SERVER_NAME" ]; then
PUBIP=$(curl -4 -s ifconfig.me || echo "") PUBIP=$(curl -4 -s ifconfig.me || echo "")
if [ -n "$PUBIP" ]; then if [ -n "$PUBIP" ]; then
apt-get install -y -qq dnsutils >/dev/null 2>&1 || true apt-get install -y -qq dnsutils >/dev/null 2>&1 || true
REVNAME=$(dig +short -x $PUBIP @8.8.8.8 | sed 's/\.$//' || true) REVNAME=$(dig +short -x $PUBIP @8.8.8.8 | sed 's/\.$//' || true)
if [ -n "$REVNAME" ]; then DEFAULT_NAME=${REVNAME:-$PUBIP}
DEFAULT_NAME=$REVNAME
else
DEFAULT_NAME=$PUBIP
fi
else else
DEFAULT_NAME="localhost" DEFAULT_NAME="localhost"
fi fi
@@ -75,37 +43,45 @@ if [ -z "$SERVER_NAME" ]; then
SERVER_NAME=${SERVER_NAME:-$DEFAULT_NAME} SERVER_NAME=${SERVER_NAME:-$DEFAULT_NAME}
else else
SERVER_NAME=$DEFAULT_NAME SERVER_NAME=$DEFAULT_NAME
echo -e "${YELLOW}No SERVER_NAME provided, using default (IPv4): ${SERVER_NAME}${NC}" log "${YELLOW}No SERVER_NAME provided, using default: ${SERVER_NAME}${NC}"
fi fi
fi fi
# --- Install base packages --- # ============================================================
# Base packages
# ============================================================
log "${BLUE}>>> Installing base packages...${NC}" log "${BLUE}>>> Installing base packages...${NC}"
apt-get update -y apt-get update -y
DEBIAN_FRONTEND=noninteractive apt-get install -yq \ DEBIAN_FRONTEND=noninteractive apt-get install -yq \
xfce4 xfce4-goodies tightvncserver ufw curl wget zsh dnsutils \ xfce4 xfce4-goodies tightvncserver ufw curl wget zsh dnsutils \
build-essential libjpeg-turbo8-dev libpng-dev libossp-uuid-dev \ build-essential libjpeg-turbo8-dev libpng-dev libossp-uuid-dev \
libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \ libavcodec-dev libavformat-dev libavutil-dev libswscale-dev \
freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \ freerdp2-dev libpango1.0-dev libssh2-1-dev libtelnet-dev \
libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \ libvncserver-dev libpulse-dev libssl-dev libvorbis-dev libwebp-dev \
libwebsockets-dev freerdp2-x11 libtool-bin ghostscript dpkg-dev crudini \ libwebsockets-dev freerdp2-x11 libtool-bin ghostscript dpkg-dev crudini \
mariadb-server mariadb-client nginx certbot python3-certbot-nginx openssl mariadb-server mariadb-client nginx certbot python3-certbot-nginx openssl
# --- Java --- # ============================================================
# Java
# ============================================================
if ! command -v java >/dev/null 2>&1; then if ! command -v java >/dev/null 2>&1; then
apt-get install -y openjdk-17-jre-headless apt-get install -y openjdk-17-jre-headless
fi fi
JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java)))) JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
log "${GREEN}JAVA_HOME detected as ${JAVA_HOME}${NC}" log "${GREEN}JAVA_HOME=${JAVA_HOME}${NC}"
# --- Firewall --- # ============================================================
# Firewall
# ============================================================
ufw --force enable ufw --force enable
ufw allow ssh ufw allow ssh
ufw allow 80/tcp ufw allow 80/tcp
ufw allow 443/tcp ufw allow 443/tcp
ufw reload ufw reload
# --- Tomcat 9 --- # ============================================================
# Tomcat
# ============================================================
if [ ! -d /opt/apache-tomcat-${TOMCAT_VER} ]; then if [ ! -d /opt/apache-tomcat-${TOMCAT_VER} ]; then
log "${BLUE}>>> Installing Tomcat ${TOMCAT_VER}...${NC}" log "${BLUE}>>> Installing Tomcat ${TOMCAT_VER}...${NC}"
cd /opt cd /opt
@@ -137,17 +113,17 @@ fi
systemctl daemon-reload systemctl daemon-reload
systemctl enable --now tomcat9 systemctl enable --now tomcat9
# --- Guacamole --- # ============================================================
# Guacamole
# ============================================================
cd /root cd /root
SERVER="https://downloads.apache.org/guacamole/${GUACVERSION}" SERVER="https://downloads.apache.org/guacamole/${GUACVERSION}"
if [ ! -d guacamole-server-${GUACVERSION} ]; then wget -q ${SERVER}/source/guacamole-server-${GUACVERSION}.tar.gz -O guacamole-server-${GUACVERSION}.tar.gz
wget -q ${SERVER}/source/guacamole-server-${GUACVERSION}.tar.gz tar -xzf guacamole-server-${GUACVERSION}.tar.gz
tar -xzf guacamole-server-${GUACVERSION}.tar.gz wget -q ${SERVER}/binary/guacamole-${GUACVERSION}.war -O /etc/guacamole.war
wget -q ${SERVER}/binary/guacamole-${GUACVERSION}.war -O /etc/guacamole.war wget -q ${SERVER}/binary/guacamole-auth-jdbc-${GUACVERSION}.tar.gz -O guacamole-auth-jdbc-${GUACVERSION}.tar.gz
wget -q ${SERVER}/binary/guacamole-auth-jdbc-${GUACVERSION}.tar.gz tar -xzf guacamole-auth-jdbc-${GUACVERSION}.tar.gz
tar -xzf guacamole-auth-jdbc-${GUACVERSION}.tar.gz
fi
if ! command -v guacd >/dev/null 2>&1; then if ! command -v guacd >/dev/null 2>&1; then
cd guacamole-server-${GUACVERSION} cd guacamole-server-${GUACVERSION}
@@ -181,8 +157,25 @@ mkdir -p /etc/guacamole/extensions /etc/guacamole/lib
cp /etc/guacamole.war /opt/tomcat9/webapps/guacamole.war cp /etc/guacamole.war /opt/tomcat9/webapps/guacamole.war
cp guacamole-auth-jdbc-${GUACVERSION}/mysql/guacamole-auth-jdbc-mysql-${GUACVERSION}.jar /etc/guacamole/extensions/ cp guacamole-auth-jdbc-${GUACVERSION}/mysql/guacamole-auth-jdbc-mysql-${GUACVERSION}.jar /etc/guacamole/extensions/
# --- MySQL setup with defaults --- # ============================================================
log "${BLUE}>>> Setting up MySQL with defaults...${NC}" # JDBC Connector
# ============================================================
log "${BLUE}>>> Installing JDBC driver for MySQL/MariaDB...${NC}"
if apt-cache show libmariadb-java 2>/dev/null | grep -q Package; then
apt-get install -y libmariadb-java
ln -sf /usr/share/java/mariadb-java-client.jar /etc/guacamole/lib/mysql-connector-java.jar
log "${GREEN}MariaDB JDBC connector installed.${NC}"
else
cd /tmp
wget -q https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-j-8.3.0.tar.gz
tar -xzf mysql-connector-j-8.3.0.tar.gz
cp mysql-connector-j-8.3.0/mysql-connector-j-8.3.0.jar /etc/guacamole/lib/mysql-connector-java.jar
log "${GREEN}MySQL Connector/J installed.${NC}"
fi
# ============================================================
# MySQL setup
# ============================================================
mysql -u root <<EOF mysql -u root <<EOF
ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PWD}'; ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PWD}';
EOF EOF
@@ -208,11 +201,14 @@ mysql-port: 3306
mysql-database: ${GUAC_DB} mysql-database: ${GUAC_DB}
mysql-username: ${GUAC_USER} mysql-username: ${GUAC_USER}
mysql-password: ${GUAC_PWD} mysql-password: ${GUAC_PWD}
mysql-ssl-mode: disabled
EOF EOF
systemctl restart tomcat9 systemctl restart tomcat9
# --- Nginx reverse proxy --- # ============================================================
# Nginx reverse proxy
# ============================================================
cat > /etc/nginx/sites-available/guacamole <<EOF cat > /etc/nginx/sites-available/guacamole <<EOF
server { server {
listen 80; listen 80;
@@ -232,9 +228,9 @@ EOF
ln -sf /etc/nginx/sites-available/guacamole /etc/nginx/sites-enabled/guacamole ln -sf /etc/nginx/sites-available/guacamole /etc/nginx/sites-enabled/guacamole
nginx -t && systemctl reload nginx nginx -t && systemctl reload nginx
# --- Let's Encrypt with fallback --- # Let's Encrypt
if certbot --nginx -d ${SERVER_NAME} --non-interactive --agree-tos -m admin@${SERVER_NAME} --redirect; then if certbot --nginx -d ${SERVER_NAME} --non-interactive --agree-tos -m admin@${SERVER_NAME} --redirect; then
log "${GREEN}Let's Encrypt certificate installed successfully.${NC}" log "${GREEN}Let's Encrypt OK.${NC}"
else else
mkdir -p /etc/ssl/selfsigned mkdir -p /etc/ssl/selfsigned
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
@@ -267,8 +263,10 @@ EOF
nginx -t && systemctl reload nginx nginx -t && systemctl reload nginx
fi fi
# --- Tailscale --- # ============================================================
echo -e "${BLUE}>>> Installing Tailscale...${NC}" # Tailscale
# ============================================================
log "${BLUE}>>> Installing Tailscale...${NC}"
curl -fsSL https://tailscale.com/install.sh | sh curl -fsSL https://tailscale.com/install.sh | sh
systemctl enable --now tailscaled systemctl enable --now tailscaled
@@ -277,32 +275,33 @@ if [ -t 0 ]; then
else else
TSKEY="" TSKEY=""
fi fi
if [ -n "${TSKEY:-}" ]; then if [ -n "${TSKEY:-}" ]; then
tailscale up --authkey=${TSKEY} --ssh tailscale up --authkey=${TSKEY} --ssh
else else
tailscale up --ssh tailscale up --ssh
fi fi
# --- Final credential rotation (MySQL only) --- # ============================================================
# Rotate MySQL passwords at the end
# ============================================================
FINAL_MYSQL_ROOT_PWD=$(openssl rand -base64 20) FINAL_MYSQL_ROOT_PWD=$(openssl rand -base64 20)
FINAL_GUAC_PWD=$(openssl rand -base64 20) FINAL_GUAC_PWD=$(openssl rand -base64 20)
mysql -u root -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '${FINAL_MYSQL_ROOT_PWD}';" mysql -u root -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '${FINAL_MYSQL_ROOT_PWD}';"
mysql -u root -p${FINAL_MYSQL_ROOT_PWD} -e "ALTER USER '${GUAC_USER}'@'localhost' IDENTIFIED BY '${FINAL_GUAC_PWD}'; FLUSH PRIVILEGES;" mysql -u root -p${FINAL_MYSQL_ROOT_PWD} -e "ALTER USER '${GUAC_USER}'@'localhost' IDENTIFIED BY '${FINAL_GUAC_PWD}'; FLUSH PRIVILEGES;"
# Update guacamole.properties with new DB password
crudini --set /etc/guacamole/guacamole.properties '' mysql-password "${FINAL_GUAC_PWD}" crudini --set /etc/guacamole/guacamole.properties '' mysql-password "${FINAL_GUAC_PWD}"
systemctl restart tomcat9 systemctl restart tomcat9
# --- Save credentials --- # ============================================================
# Save credentials
# ============================================================
cat > ${CRED_FILE} <<EOF cat > ${CRED_FILE} <<EOF
Guacamole admin login (default): Guacamole admin login (default):
User: guacadmin User: guacadmin
Pass: guacadmin Pass: guacadmin
*** IMPORTANT: Change this password immediately after login via the Guacamole UI! *** *** Change this password immediately after login! ***
MySQL root password: MySQL root password:
${FINAL_MYSQL_ROOT_PWD} ${FINAL_MYSQL_ROOT_PWD}
@@ -315,13 +314,11 @@ Server name:
EOF EOF
chmod 600 ${CRED_FILE} chmod 600 ${CRED_FILE}
# --- Final info ---
IP=$(curl -4 -s ifconfig.me || echo "localhost") IP=$(curl -4 -s ifconfig.me || echo "localhost")
echo -e "${GREEN}=========================================================${NC}" echo -e "${GREEN}=========================================================${NC}"
echo -e "Guacamole is now running behind Nginx." echo -e "Guacamole running at: https://${SERVER_NAME}/"
echo -e "URL: https://${SERVER_NAME}/" echo -e "Fallback: https://${IP}/"
echo -e "Alt: https://${IP}/" echo -e "Login: guacadmin / guacadmin"
echo -e "Login: guacadmin / guacadmin (change immediately!)"
echo -e "MySQL root password: ${FINAL_MYSQL_ROOT_PWD}" echo -e "MySQL root password: ${FINAL_MYSQL_ROOT_PWD}"
echo -e "MySQL guac user pass: ${FINAL_GUAC_PWD}" echo -e "MySQL guac user pass: ${FINAL_GUAC_PWD}"
echo -e "Credentials saved in: ${CRED_FILE}" echo -e "Credentials saved in: ${CRED_FILE}"