1
#!/bin/sh
2
set -eu
3
 
4
state_dir=/run/specter-package
5
 
6
restart_marked_service() {
7
	service=$1
8
	marker="$state_dir/$service.restart"
9
	if [ ! -f "$marker" ]; then
10
		return
11
	fi
12
	if ! systemctl start "$service" >/dev/null 2>&1; then
13
		echo "warning: failed to start $service after package install" >&2
14
	fi
15
	rm -f "$marker"
16
}
17
 
18
create_group() {
19
	if getent group specter >/dev/null 2>&1; then
20
		return
21
	fi
22
	if command -v groupadd >/dev/null 2>&1; then
23
		groupadd -r specter >/dev/null 2>&1 || groupadd --system specter >/dev/null 2>&1 || groupadd specter
24
		return
25
	fi
26
	if command -v addgroup >/dev/null 2>&1; then
27
		addgroup --system specter >/dev/null 2>&1 || addgroup specter
28
		return
29
	fi
30
	echo "unable to create specter group" >&2
31
	exit 1
32
}
33
 
34
create_user() {
35
	if getent passwd specter >/dev/null 2>&1; then
36
		return
37
	fi
38
	nologin=/usr/sbin/nologin
39
	if [ ! -x "$nologin" ]; then
40
		nologin=/sbin/nologin
41
	fi
42
	if [ ! -x "$nologin" ]; then
43
		nologin=/bin/false
44
	fi
45
	if command -v useradd >/dev/null 2>&1; then
46
		useradd --system --gid specter --home-dir /var/lib/specter --no-create-home --shell "$nologin" specter >/dev/null 2>&1 || \
47
			useradd -r -g specter -d /var/lib/specter -M -s "$nologin" specter >/dev/null 2>&1 || \
48
			useradd -g specter -d /var/lib/specter -M -s "$nologin" specter
49
		return
50
	fi
51
	if command -v adduser >/dev/null 2>&1; then
52
		adduser --system --ingroup specter --home /var/lib/specter --no-create-home --shell "$nologin" specter >/dev/null 2>&1 || \
53
			adduser -S -G specter -h /var/lib/specter -s "$nologin" specter >/dev/null 2>&1 || \
54
			adduser -D -H -G specter -h /var/lib/specter -s "$nologin" specter
55
		return
56
	fi
57
	echo "unable to create specter user" >&2
58
	exit 1
59
}
60
 
61
create_group
62
create_user
63
 
64
mkdir -p /etc/specter/cert /var/lib/specter /var/log/specter
65
 
66
chown root:specter /etc/specter
67
chmod 0750 /etc/specter
68
 
69
chown -R specter:specter /etc/specter/cert /var/lib/specter /var/log/specter
70
chmod 0750 /etc/specter/cert /var/lib/specter /var/log/specter
71
 
72
for env_file in /etc/specter/server.env /etc/specter/dns.env /etc/specter/client.env; do
73
	if [ -f "$env_file" ]; then
74
		chown root:specter "$env_file"
75
		chmod 0640 "$env_file"
76
	fi
77
done
78
 
79
if [ -f /etc/specter/client.yaml ]; then
80
	chown specter:specter /etc/specter/client.yaml
81
	chmod 0640 /etc/specter/client.yaml
82
fi
83
 
84
if command -v systemctl >/dev/null 2>&1; then
85
	systemctl daemon-reload >/dev/null 2>&1 || true
86
	restart_marked_service specter-server.service
87
	restart_marked_service specter-dns.service
88
	restart_marked_service specter-client.service
89
fi
90
 
91
rmdir "$state_dir" >/dev/null 2>&1 || true