| 1 | #!/usr/bin/env bash |
| 2 | |
| 3 | # SPDX-License-Identifier: GPL-3.0-or-later |
| 4 | |
| 5 | # shellcheck source=./packaging/makeself/functions.sh |
| 6 | . "$(dirname "${0}")"/functions.sh |
| 7 | |
| 8 | export LC_ALL=C |
| 9 | umask 002 |
| 10 | |
| 11 | # Be nice on production environments |
| 12 | renice 19 $$ >/dev/null 2>/dev/null |
| 13 | |
| 14 | NETDATA_PREFIX="/opt/netdata" |
| 15 | NETDATA_USER_CONFIG_DIR="${NETDATA_PREFIX}/etc/netdata" |
| 16 | |
| 17 | # ----------------------------------------------------------------------------- |
| 18 | if [ -d /opt/netdata/etc/netdata.old ]; then |
| 19 | progress "Found old etc/netdata directory, reinstating this" |
| 20 | [ -d /opt/netdata/etc/netdata.new ] && rm -rf /opt/netdata/etc/netdata.new |
| 21 | mv -f /opt/netdata/etc/netdata /opt/netdata/etc/netdata.new |
| 22 | mv -f /opt/netdata/etc/netdata.old /opt/netdata/etc/netdata |
| 23 | |
| 24 | progress "Trigger stock config clean up" |
| 25 | rm -f /opt/netdata/etc/netdata/.installer-cleanup-of-stock-configs-done |
| 26 | fi |
| 27 | |
| 28 | STARTIT=1 |
| 29 | REINSTALL_OPTIONS="" |
| 30 | NETDATA_CERT_MODE="${NETDATA_CERT_MODE:-check}" |
| 31 | NETDATA_CERT_TEST_URL="${NETDATA_CERT_TEST_URL:-https://app.netdata.cloud}" |
| 32 | RELEASE_CHANNEL="nightly" |
| 33 | |
| 34 | while [ "${1}" ]; do |
| 35 | case "${1}" in |
| 36 | "--dont-start-it") |
| 37 | STARTIT=0 |
| 38 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} ${1}" |
| 39 | ;; |
| 40 | "--auto-update" | "-u") ;; |
| 41 | "--stable-channel") |
| 42 | RELEASE_CHANNEL="stable" |
| 43 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} ${1}" |
| 44 | ;; |
| 45 | "--nightly-channel") |
| 46 | RELEASE_CHANNEL="nightly" |
| 47 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} ${1}" |
| 48 | ;; |
| 49 | "--disable-telemetry") |
| 50 | NETDATA_DISABLE_TELEMETRY=1 |
| 51 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} ${1}" |
| 52 | ;; |
| 53 | "--certificates") |
| 54 | case "${2}" in |
| 55 | auto | system) NETDATA_CERT_MODE="auto" ;; |
| 56 | check) NETDATA_CERT_MODE="check" ;; |
| 57 | bundled) NETDATA_CERT_MODE="bundled" ;; |
| 58 | *) |
| 59 | run_failed "Unknown certificate handling mode '${2}'. Supported modes are auto, check, system, and bundled." |
| 60 | exit 1 |
| 61 | ;; |
| 62 | esac |
| 63 | shift 1 |
| 64 | ;; |
| 65 | "--certificate-test-url") |
| 66 | NETDATA_CERT_TEST_URL="${2}" |
| 67 | shift 1 |
| 68 | ;; |
| 69 | |
| 70 | *) echo >&2 "Unknown option '${1}'. Ignoring it." ;; |
| 71 | esac |
| 72 | shift 1 |
| 73 | done |
| 74 | |
| 75 | if [ ! "${DISABLE_TELEMETRY:-0}" -eq 0 ] || |
| 76 | [ -n "$DISABLE_TELEMETRY" ] || |
| 77 | [ ! "${DO_NOT_TRACK:-0}" -eq 0 ] || |
| 78 | [ -n "$DO_NOT_TRACK" ]; then |
| 79 | NETDATA_DISABLE_TELEMETRY=1 |
| 80 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} --disable-telemetry" |
| 81 | fi |
| 82 | |
| 83 | if [ -n "${NETDATA_CERT_MODE}" ]; then |
| 84 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} --certificates ${NETDATA_CERT_MODE}" |
| 85 | fi |
| 86 | |
| 87 | if [ -n "${NETDATA_CERT_TEST_URL}" ]; then |
| 88 | REINSTALL_OPTIONS="${REINSTALL_OPTIONS} --certificate-test-url ${NETDATA_CERT_TEST_URL}" |
| 89 | fi |
| 90 | |
| 91 | # ----------------------------------------------------------------------------- |
| 92 | progress "Attempt to create user/group netdata/netadata" |
| 93 | |
| 94 | NETDATA_WANTED_GROUPS="docker nginx varnish haproxy adm nsd proxy squid ceph nobody I2C" |
| 95 | NETDATA_ADDED_TO_GROUPS="" |
| 96 | # Default user/group |
| 97 | NETDATA_USER="netdata" |
| 98 | NETDATA_GROUP="netdata" |
| 99 | |
| 100 | create_netdata_accounts |
| 101 | |
| 102 | # ----------------------------------------------------------------------------- |
| 103 | progress "Install logrotate configuration for netdata" |
| 104 | |
| 105 | install_netdata_logrotate || run_failed "Cannot install logrotate file for netdata." |
| 106 | |
| 107 | progress "Install journald configuration for netdata" |
| 108 | |
| 109 | install_netdata_journald_conf || run_failed "Cannot install journald file for netdata." |
| 110 | |
| 111 | # ----------------------------------------------------------------------------- |
| 112 | progress "Telemetry configuration" |
| 113 | |
| 114 | # Opt-out from telemetry program |
| 115 | if [ -n "${NETDATA_DISABLE_TELEMETRY}" ]; then |
| 116 | run touch "${NETDATA_USER_CONFIG_DIR}/.opt-out-from-anonymous-statistics" |
| 117 | else |
| 118 | printf "You can opt out from anonymous statistics via the --disable-telemetry option, or by creating an empty file %s \n\n" "${NETDATA_USER_CONFIG_DIR}/.opt-out-from-anonymous-statistics" |
| 119 | fi |
| 120 | |
| 121 | # ----------------------------------------------------------------------------- |
| 122 | progress "Install netdata at system init" |
| 123 | |
| 124 | install_netdata_service || run_failed "Cannot install netdata init service." |
| 125 | |
| 126 | set_netdata_updater_channel || run_failed "Cannot set netdata updater tool release channel to '${RELEASE_CHANNEL}'" |
| 127 | |
| 128 | # ----------------------------------------------------------------------------- |
| 129 | progress "Install (but not enable) netdata updater tool" |
| 130 | install_netdata_updater || run_failed "Cannot install netdata updater tool." |
| 131 | |
| 132 | # ----------------------------------------------------------------------------- |
| 133 | progress "creating quick links" |
| 134 | |
| 135 | dir_should_be_link() { |
| 136 | local p="${1}" t="${2}" d="${3}" old |
| 137 | |
| 138 | old="${PWD}" |
| 139 | cd "${p}" || return 0 |
| 140 | |
| 141 | if [ -e "${d}" ]; then |
| 142 | if [ -h "${d}" ]; then |
| 143 | run rm "${d}" |
| 144 | else |
| 145 | run mv -f "${d}" "${d}.old.$$" |
| 146 | fi |
| 147 | fi |
| 148 | |
| 149 | run ln -s "${t}" "${d}" |
| 150 | cd "${old}" || true |
| 151 | } |
| 152 | |
| 153 | dir_should_be_link . bin sbin |
| 154 | dir_should_be_link usr ../bin bin |
| 155 | dir_should_be_link usr ../bin sbin |
| 156 | dir_should_be_link usr . local |
| 157 | |
| 158 | dir_should_be_link . etc/netdata netdata-configs |
| 159 | dir_should_be_link . usr/share/netdata/web netdata-web-files |
| 160 | dir_should_be_link . usr/libexec/netdata netdata-plugins |
| 161 | dir_should_be_link . var/lib/netdata netdata-dbs |
| 162 | dir_should_be_link . var/cache/netdata netdata-metrics |
| 163 | dir_should_be_link . var/log/netdata netdata-logs |
| 164 | |
| 165 | dir_should_be_link etc/netdata ../../usr/lib/netdata/conf.d orig |
| 166 | |
| 167 | # ----------------------------------------------------------------------------- |
| 168 | progress "fix permissions" |
| 169 | |
| 170 | run chmod g+rx,o+rx /opt |
| 171 | run find /opt/netdata -type d -exec chmod go+rx '{}' \+ |
| 172 | |
| 173 | install_netdata_dirs |
| 174 | |
| 175 | if [ -d /opt/netdata/usr/libexec/netdata/plugins.d/ebpf.d ]; then |
| 176 | run chown -R root:${NETDATA_GROUP} /opt/netdata/usr/libexec/netdata/plugins.d/ebpf.d |
| 177 | fi |
| 178 | |
| 179 | # ----------------------------------------------------------------------------- |
| 180 | |
| 181 | progress "changing plugins ownership and permissions" |
| 182 | |
| 183 | for x in ndsudo apps.plugin perf.plugin slabinfo.plugin debugfs.plugin freeipmi.plugin ioping cgroup-network local-listeners network-viewer.plugin ebpf.plugin nfacct.plugin xenstat.plugin python.d.plugin charts.d.plugin go.d.plugin ioping.plugin cgroup-network-helper.sh otel-plugin otel-signal-viewer-plugin systemd-journal.plugin netflow-plugin; do |
| 184 | f="usr/libexec/netdata/plugins.d/${x}" |
| 185 | if [ -f "${f}" ]; then |
| 186 | run chown root:${NETDATA_GROUP} "${f}" |
| 187 | fi |
| 188 | done |
| 189 | |
| 190 | if command -v setcap >/dev/null 2>&1; then |
| 191 | if ! run setcap "cap_dac_read_search,cap_sys_ptrace=ep" "usr/libexec/netdata/plugins.d/apps.plugin"; then |
| 192 | run chmod 4750 "usr/libexec/netdata/plugins.d/apps.plugin" |
| 193 | fi |
| 194 | if ! run setcap "cap_dac_read_search=ep" "usr/libexec/netdata/plugins.d/slabinfo.plugin"; then |
| 195 | run chmod 4750 "usr/libexec/netdata/plugins.d/slabinfo.plugin" |
| 196 | fi |
| 197 | if ! run setcap "cap_dac_read_search,cap_audit_control=ep" "usr/libexec/netdata/plugins.d/debugfs.plugin"; then |
| 198 | run chmod 4750 "usr/libexec/netdata/plugins.d/debugfs.plugin" |
| 199 | fi |
| 200 | if ! run setcap "cap_dac_read_search+epi cap_net_admin+epi cap_net_raw=eip" "usr/libexec/netdata/plugins.d/go.d.plugin"; then |
| 201 | run chmod 4750 "usr/libexec/netdata/plugins.d/go.d.plugin" |
| 202 | fi |
| 203 | |
| 204 | perf_caps="cap_sys_admin=ep" |
| 205 | if command -v capsh >/dev/null 2>&1 && capsh --supports=cap_perfmon 2>/dev/null; then |
| 206 | perf_caps="cap_perfmon=ep" |
| 207 | fi |
| 208 | |
| 209 | if ! run setcap "${perf_caps}" "usr/libexec/netdata/plugins.d/perf.plugin"; then |
| 210 | run chmod 4750 "usr/libexec/netdata/plugins.d/perf.plugin" |
| 211 | fi |
| 212 | if [ -f "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin" ]; then |
| 213 | if ! run setcap "cap_dac_read_search=eip" "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin"; then |
| 214 | run chmod 4750 "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin" |
| 215 | fi |
| 216 | fi |
| 217 | if [ -f "usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then |
| 218 | if ! run setcap "cap_dac_read_search=eip" "usr/libexec/netdata/plugins.d/systemd-journal.plugin"; then |
| 219 | run chmod 4750 "usr/libexec/netdata/plugins.d/systemd-journal.plugin" |
| 220 | fi |
| 221 | fi |
| 222 | else |
| 223 | for x in apps.plugin perf.plugin slabinfo.plugin debugfs.plugin; do |
| 224 | f="usr/libexec/netdata/plugins.d/${x}" |
| 225 | run chmod 4750 "${f}" |
| 226 | done |
| 227 | if [ -f "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin" ]; then |
| 228 | run chmod 4750 "usr/libexec/netdata/plugins.d/otel-signal-viewer-plugin" |
| 229 | fi |
| 230 | if [ -f "usr/libexec/netdata/plugins.d/systemd-journal.plugin" ]; then |
| 231 | run chmod 4750 "usr/libexec/netdata/plugins.d/systemd-journal.plugin" |
| 232 | fi |
| 233 | fi |
| 234 | |
| 235 | for x in ndsudo freeipmi.plugin ioping cgroup-network local-listeners network-viewer.plugin ebpf.plugin nfacct.plugin xenstat.plugin; do |
| 236 | f="usr/libexec/netdata/plugins.d/${x}" |
| 237 | |
| 238 | if [ -f "${f}" ]; then |
| 239 | run chmod 4750 "${f}" |
| 240 | fi |
| 241 | done |
| 242 | |
| 243 | for x in otel-plugin netflow-plugin; do |
| 244 | f="usr/libexec/netdata/plugins.d/${x}" |
| 245 | if [ -f "${f}" ]; then |
| 246 | run chmod 0750 "${f}" |
| 247 | fi |
| 248 | done |
| 249 | |
| 250 | # ----------------------------------------------------------------------------- |
| 251 | |
| 252 | replace_symlink() { |
| 253 | target="${1}" |
| 254 | name="${2}" |
| 255 | rm -f "${name}" |
| 256 | ln -s "${target}" "${name}" |
| 257 | } |
| 258 | |
| 259 | ensure_ca_certificates_link() { |
| 260 | local ssl_prefix="/opt/netdata/etc/ssl/" |
| 261 | local link_path="${ssl_prefix}/certs/ca-certificates.crt" |
| 262 | |
| 263 | # If ca-certificates.crt already exists, we're done |
| 264 | [ -e "${link_path}" ] && return 0 |
| 265 | |
| 266 | local cert_names=( |
| 267 | "certs/ca-bundle.crt" # RHEL, Fedora, RHEL clones |
| 268 | "ca-bundle.pem" # SLE, OpenSUSE |
| 269 | "cert.pem" # Alpine |
| 270 | ) |
| 271 | |
| 272 | mkdir -p "$(dirname "${link_path}")" |
| 273 | |
| 274 | for cert_name in "${cert_names[@]}"; do |
| 275 | local target="${ssl_prefix}/${cert_name}" |
| 276 | |
| 277 | if [ -f "${target}" ] && [ -r "${target}" ]; then |
| 278 | # Create relative symlink to avoid breaking if Netdata is uninstalled |
| 279 | if command -v realpath >/dev/null 2>&1; then |
| 280 | ln -s "$(realpath --relative-to="$(dirname "${link_path}")" "${target}")" "${link_path}" |
| 281 | else |
| 282 | ln -s "../${cert_name}" "${link_path}" |
| 283 | fi |
| 284 | return 0 |
| 285 | fi |
| 286 | done |
| 287 | |
| 288 | echo "Warning: No valid certificate bundle found" |
| 289 | return 1 |
| 290 | } |
| 291 | |
| 292 | select_system_certs() { |
| 293 | if [ -d /etc/pki/tls ]; then |
| 294 | echo "${1} /etc/pki/tls for TLS configuration and certificates" |
| 295 | replace_symlink /etc/pki/tls /opt/netdata/etc/ssl |
| 296 | elif [ -d /etc/ssl ]; then |
| 297 | echo "${1} /etc/ssl for TLS configuration and certificates" |
| 298 | replace_symlink /etc/ssl /opt/netdata/etc/ssl |
| 299 | fi |
| 300 | |
| 301 | # Ensure static curl can find the certificates |
| 302 | ensure_ca_certificates_link |
| 303 | } |
| 304 | |
| 305 | select_internal_certs() { |
| 306 | echo "Using bundled TLS configuration and certificates" |
| 307 | replace_symlink /opt/netdata/share/ssl /opt/netdata/etc/ssl |
| 308 | } |
| 309 | |
| 310 | certs_selected() { |
| 311 | [ -L /opt/netdata/etc/ssl ] || return 1 |
| 312 | } |
| 313 | |
| 314 | test_certs() { |
| 315 | /opt/netdata/bin/curl --fail --max-time 300 --silent --output /dev/null "${NETDATA_CERT_TEST_URL}" |
| 316 | |
| 317 | case "$?" in |
| 318 | 35 | 77) |
| 319 | echo "Failed to load certificate files for test." |
| 320 | return 1 |
| 321 | ;; |
| 322 | 60 | 82 | 83) |
| 323 | echo "Certificates cannot be used to connect to ${NETDATA_CERT_TEST_URL}" |
| 324 | return 1 |
| 325 | ;; |
| 326 | 53 | 54 | 66) |
| 327 | echo "Unable to use OpenSSL configuration associated with certificates" |
| 328 | return 1 |
| 329 | ;; |
| 330 | 0) echo "Successfully connected to ${NETDATA_CERT_TEST_URL} using certificates" ;; |
| 331 | *) echo "Unable to test certificates due to networking problems, blindly assuming they work" ;; |
| 332 | esac |
| 333 | } |
| 334 | |
| 335 | # If the user has manually set up certificates, don’t mess with it. |
| 336 | if [ ! -L /opt/netdata/etc/ssl ] && [ -d /opt/netdata/etc/ssl ]; then |
| 337 | echo "Preserving existing user configuration for TLS" |
| 338 | else |
| 339 | echo "Configure TLS certificate paths (mode: ${NETDATA_CERT_MODE})" |
| 340 | case "${NETDATA_CERT_MODE}" in |
| 341 | check) |
| 342 | select_system_certs "Testing" |
| 343 | if certs_selected && test_certs; then |
| 344 | select_system_certs "Using" |
| 345 | else |
| 346 | select_internal_certs |
| 347 | fi |
| 348 | ;; |
| 349 | bundled) select_internal_certs ;; |
| 350 | *) |
| 351 | select_system_certs "Using" |
| 352 | if ! certs_selected; then |
| 353 | select_internal_certs |
| 354 | fi |
| 355 | ;; |
| 356 | esac |
| 357 | fi |
| 358 | |
| 359 | # ----------------------------------------------------------------------------- |
| 360 | |
| 361 | echo "Save install options" |
| 362 | grep -qv 'IS_NETDATA_STATIC_BINARY="yes"' "${NETDATA_PREFIX}/etc/netdata/.environment" || echo IS_NETDATA_STATIC_BINARY=\"yes\" >>"${NETDATA_PREFIX}/etc/netdata/.environment" |
| 363 | REINSTALL_OPTIONS="$(echo "${REINSTALL_OPTIONS}" | awk '{gsub("/", "\\/"); print}')" |
| 364 | sed -i "s/REINSTALL_OPTIONS=\".*\"/REINSTALL_OPTIONS=\"${REINSTALL_OPTIONS}\"/" "${NETDATA_PREFIX}/etc/netdata/.environment" |
| 365 | |
| 366 | # ----------------------------------------------------------------------------- |
| 367 | if [ ${STARTIT} -eq 0 ]; then |
| 368 | create_netdata_conf "${NETDATA_PREFIX}/etc/netdata/netdata.conf" |
| 369 | netdata_banner "is installed now!" |
| 370 | else |
| 371 | progress "starting netdata" |
| 372 | |
| 373 | if ! restart_netdata "${NETDATA_PREFIX}/bin/netdata"; then |
| 374 | create_netdata_conf "${NETDATA_PREFIX}/etc/netdata/netdata.conf" |
| 375 | netdata_banner "is installed and running now!" |
| 376 | else |
| 377 | create_netdata_conf "${NETDATA_PREFIX}/etc/netdata/netdata.conf" "http://localhost:19999/netdata.conf" |
| 378 | netdata_banner "is installed now!" |
| 379 | fi |
| 380 | fi |
| 381 | run chmod 0644 "${NETDATA_PREFIX}/etc/netdata/netdata.conf" |