Sam & Claude
18816a7712
- TESTING.md: expected output banner now matches updated integration-test.sh - shell-env.sh: EMBED_BASE_URL defaults to empty when no OpenRouter key exists, letting config.ts resolve dynamically at runtime instead of baking localhost:8080 into .env
309 lines
11 KiB
Bash
Executable file
309 lines
11 KiB
Bash
Executable file
#!/bin/sh
|
|
# Clawdie Shell — Environment Configuration Module
|
|
# Purpose: Generate .env file with secrets and configuration
|
|
# POSIX-compliant (no bash-isms)
|
|
|
|
set -eu
|
|
|
|
# Configuration (can be overridden for testing)
|
|
CLAWDIE_HOME="${CLAWDIE_HOME:-/home/clawdie}"
|
|
ENV_FILE="${ENV_FILE:-$CLAWDIE_HOME/.env}"
|
|
LOG_FILE="${LOG_FILE:-/var/log/clawdie-firstboot.log}"
|
|
PROGRESS_FILE="${PROGRESS_FILE:-/var/log/clawdie-firstboot.progress}"
|
|
|
|
# Subnet base (default 10.0.0)
|
|
AGENT_SUBNET_BASE="${AGENT_SUBNET_BASE:-10.0.0}"
|
|
|
|
# ============================================================================
|
|
# MAIN ENTRY POINT
|
|
# ============================================================================
|
|
|
|
clawdie_shell_env_generate() {
|
|
# Main orchestrator: generate .env file with all required variables.
|
|
# In upgrade mode, secrets are NEVER regenerated — only new keys are appended.
|
|
# This is the fix for the PC-BSD class of upgrade bug where new install
|
|
# passwords orphan the existing database.
|
|
|
|
log_msg "[env] Starting .env generation (mode: ${CLAWDIE_BOOT_MODE:-install})"
|
|
|
|
# ── Upgrade path: preserve secrets, append only missing keys ──────────────
|
|
if [ "${CLAWDIE_BOOT_MODE:-install}" = "upgrade" ] && [ -f "$ENV_FILE" ]; then
|
|
clawdie_shell_env_append_new_keys || {
|
|
log_msg "[env] ERROR: Failed to append new .env keys"
|
|
return 1
|
|
}
|
|
clawdie_shell_env_validate || log_msg "[env] WARNING: .env validation found issues (upgrade)"
|
|
echo "[ENV] SUCCESS" >> "$PROGRESS_FILE"
|
|
log_msg "[env] Upgrade .env complete — existing secrets preserved"
|
|
return 0
|
|
fi
|
|
|
|
# ── Fresh install path ─────────────────────────────────────────────────────
|
|
|
|
# Validate required inputs
|
|
if [ -z "${ASSISTANT_NAME:-}" ]; then
|
|
log_msg "[env] ERROR: ASSISTANT_NAME not set"
|
|
return 1
|
|
fi
|
|
|
|
if [ -z "${AGENT_DOMAIN:-}" ]; then
|
|
log_msg "[env] ERROR: AGENT_DOMAIN not set"
|
|
return 1
|
|
fi
|
|
|
|
if [ -z "${TZ:-}" ]; then
|
|
TZ="UTC"
|
|
log_msg "[env] WARNING: TZ not set, defaulting to UTC"
|
|
fi
|
|
if [ -z "${SYSTEM_LOCALE:-}" ]; then
|
|
SYSTEM_LOCALE="en_US.UTF-8"
|
|
log_msg "[env] WARNING: SYSTEM_LOCALE not set, defaulting to ${SYSTEM_LOCALE}"
|
|
fi
|
|
DISPLAY_LOCALE="${DISPLAY_LOCALE:-$SYSTEM_LOCALE}"
|
|
ASSISTANT_LOCALE="${ASSISTANT_LOCALE:-$SYSTEM_LOCALE}"
|
|
KEYMAP="${KEYMAP:-us}"
|
|
|
|
# Step 1: Create directory
|
|
mkdir -p "$CLAWDIE_HOME"
|
|
chown clawdie:clawdie "$CLAWDIE_HOME" 2>/dev/null || true
|
|
|
|
# Step 2: Generate all .env variables
|
|
clawdie_shell_env_write_file || {
|
|
log_msg "[env] ERROR: Failed to write .env file"
|
|
return 1
|
|
}
|
|
|
|
log_msg "[env] .env file generated successfully"
|
|
|
|
# Step 3: Validate
|
|
clawdie_shell_env_validate || {
|
|
log_msg "[env] ERROR: .env validation failed"
|
|
return 1
|
|
}
|
|
|
|
echo "[ENV] SUCCESS" >> "$PROGRESS_FILE"
|
|
log_msg "[env] Environment configuration complete"
|
|
}
|
|
|
|
clawdie_shell_env_append_new_keys() {
|
|
# Upgrade-only: read the existing .env and add any keys introduced in the new
|
|
# version that are not yet present. Never touches existing values.
|
|
# Pattern: if key is absent → append with safe default; if present → skip.
|
|
|
|
log_msg "[env] Upgrade mode: appending missing keys to existing .env"
|
|
|
|
_env_append_if_missing() {
|
|
_key="$1"; _val="$2"
|
|
if ! grep -q "^${_key}=" "$ENV_FILE" 2>/dev/null; then
|
|
printf '%s=%s\n' "$_key" "$_val" >> "$ENV_FILE"
|
|
log_msg "[env] Appended new key: $_key"
|
|
fi
|
|
}
|
|
|
|
# Keys added in v0.10.x / v1.0.0 that older installs may not have.
|
|
# Do not append provider/model defaults here; Clawdie-AI resolves those at
|
|
# runtime unless the operator explicitly configures them.
|
|
_env_append_if_missing "DB_RUNTIME" '"jail"'
|
|
_env_append_if_missing "EMBED_DIMENSIONS" '"1024"'
|
|
_env_append_if_missing "LOCAL_LLM_PROVIDER" '"none"'
|
|
_env_append_if_missing "FEATURE_OLLAMA" '"NO"'
|
|
_env_append_if_missing "FEATURE_LLAMA_CPP" '"NO"'
|
|
_env_append_if_missing "CLAWDIE_PROFILE" '"core"'
|
|
|
|
_env_append_if_missing "CONTROLPLANE_SHARED_SECRET" '""'
|
|
_env_append_if_missing "CONTROLPLANE_BIND_HOST" '"127.0.0.1"'
|
|
_env_append_if_missing "CONTROLPLANE_HOST_IP" "\"${AGENT_SUBNET_BASE}.1\""
|
|
_env_append_if_missing "CONTROLPLANE_EXPOSURE" '"internal"'
|
|
_env_append_if_missing "CONTROLPLANE_AUTH_MODE" '"local_trusted"'
|
|
_env_append_if_missing "CONTROLPLANE_PORT" '"3100"'
|
|
_env_append_if_missing "BETTER_AUTH_URL" '"http://127.0.0.1:3100"'
|
|
_env_append_if_missing "BETTER_AUTH_SECRET" '""'
|
|
_env_append_if_missing "GIT_LOCAL_URL" "\"git@${AGENT_SUBNET_BASE}.6:/srv/git/${ASSISTANT_NAME:-clawdie}-ai.git\""
|
|
|
|
chmod 600 "$ENV_FILE" 2>/dev/null || true
|
|
chown clawdie:clawdie "$ENV_FILE" 2>/dev/null || true
|
|
|
|
log_msg "[env] Append complete ($(wc -l < "$ENV_FILE") lines total)"
|
|
}
|
|
|
|
# ============================================================================
|
|
# .ENV FILE GENERATION
|
|
# ============================================================================
|
|
|
|
clawdie_shell_env_write_file() {
|
|
# Write a minimal .env seed file.
|
|
#
|
|
# This file is copied into the Clawdie-AI repo by the deploy module and then
|
|
# completed by Clawdie-AI onboarding (secrets, derived defaults, URLs, etc).
|
|
|
|
# Derive agent name from assistant name (lowercase, strip non-alnum)
|
|
local agent_name
|
|
agent_name=$(echo "$ASSISTANT_NAME" | tr 'A-Z' 'a-z' | sed 's/[^a-z0-9]//g')
|
|
|
|
# Generate controlplane auth secrets (one-time at install)
|
|
local cp_secret auth_secret
|
|
cp_secret=$(openssl rand -base64 32)
|
|
auth_secret=$(openssl rand -base64 32)
|
|
|
|
# Provider/model are intentionally unset by default; Clawdie-AI resolves the
|
|
# recommended runtime profile and post-install setup writes the operator's
|
|
# chosen provider. Embedding base URL is left empty when no OpenRouter key
|
|
# exists so config.ts can dynamically pick OpenRouter or local at runtime.
|
|
local pi_tui_provider pi_tui_model embed_base_url embed_model embed_api_key
|
|
pi_tui_provider="${PI_TUI_PROVIDER:-}"
|
|
pi_tui_model="${PI_TUI_MODEL:-}"
|
|
if [ -n "${EMBED_BASE_URL:-}" ]; then
|
|
embed_base_url="$EMBED_BASE_URL"
|
|
elif [ -n "${OPENROUTER_API_KEY:-}" ]; then
|
|
embed_base_url="https://openrouter.ai/api/v1"
|
|
else
|
|
embed_base_url=""
|
|
fi
|
|
embed_model="${EMBED_MODEL:-BAAI/bge-m3}"
|
|
if [ -n "${EMBED_API_KEY:-}" ]; then
|
|
embed_api_key="$EMBED_API_KEY"
|
|
elif [ "$embed_base_url" = "https://openrouter.ai/api/v1" ]; then
|
|
embed_api_key="${OPENROUTER_API_KEY:-}"
|
|
else
|
|
embed_api_key=""
|
|
fi
|
|
|
|
# Remove existing .env if present
|
|
rm -f "$ENV_FILE" 2>/dev/null || true
|
|
|
|
# Create new .env with restricted permissions
|
|
touch "$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
chown clawdie:clawdie "$ENV_FILE" 2>/dev/null || true
|
|
|
|
# Write .env file
|
|
cat > "$ENV_FILE" <<EOF
|
|
# Clawdie-AI environment configuration (seed)
|
|
# Auto-generated by clawdie-iso firstboot installer.
|
|
# Secrets and derived defaults are generated by Clawdie-AI onboarding.
|
|
|
|
# === Identity ===
|
|
ASSISTANT_NAME="$ASSISTANT_NAME"
|
|
AGENT_NAME="$agent_name"
|
|
AGENT_GENDER="${AGENT_GENDER:-f}"
|
|
CLAWDIE_PROFILE="${CLAWDIE_PROFILE:-core}"
|
|
AGENT_DOMAIN="$AGENT_DOMAIN"
|
|
AGENT_INTERNAL_DOMAIN="${agent_name}.home.arpa"
|
|
TZ="$TZ"
|
|
DISPLAY_LOCALE="$DISPLAY_LOCALE"
|
|
ASSISTANT_LOCALE="$ASSISTANT_LOCALE"
|
|
SYSTEM_LOCALE="$SYSTEM_LOCALE"
|
|
KEYMAP="$KEYMAP"
|
|
|
|
# === LLM Provider ===
|
|
PI_TUI_PROVIDER="$pi_tui_provider"
|
|
PI_TUI_MODEL="$pi_tui_model"
|
|
ZAI_API_KEY="${ZAI_API_KEY:-}"
|
|
ZAI_API_BASE="${ZAI_API_BASE:-https://api.z.ai/api/coding/paas/v4}"
|
|
OPENROUTER_API_KEY="${OPENROUTER_API_KEY:-}"
|
|
ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-}"
|
|
CLAUDE_CODE_OAUTH_TOKEN="${CLAUDE_CODE_OAUTH_TOKEN:-}"
|
|
|
|
# === Embeddings ===
|
|
EMBED_BASE_URL="$embed_base_url"
|
|
EMBED_MODEL="$embed_model"
|
|
EMBED_API_KEY="$embed_api_key"
|
|
EMBED_DIMENSIONS="${EMBED_DIMENSIONS:-1024}"
|
|
|
|
# === Database ===
|
|
# DB_RUNTIME=jail — PostgreSQL runs inside a bastille jail (default, provisioned by installer)
|
|
# DB_RUNTIME=host — PostgreSQL runs on the host; set DB_HOST to warden0 gateway IP
|
|
DB_RUNTIME="jail"
|
|
|
|
# === Network Configuration (warden0) ===
|
|
AGENT_SUBNET_BASE="$AGENT_SUBNET_BASE"
|
|
WARDEN_SUBNET_BASE="$AGENT_SUBNET_BASE"
|
|
WARDEN_SUBNET="${AGENT_SUBNET_BASE}.0/24"
|
|
WARDEN_GATEWAY="${AGENT_SUBNET_BASE}.1"
|
|
|
|
# === Features (optional) ===
|
|
FEATURE_TELEGRAM="${FEATURE_TELEGRAM:-NO}"
|
|
FEATURE_GIT="${FEATURE_GIT:-YES}"
|
|
FEATURE_GITEA="${FEATURE_GITEA:-NO}"
|
|
CODE_HOSTING_MODE="${CODE_HOSTING_MODE:-git}"
|
|
FEATURE_TAILSCALE="${FEATURE_TAILSCALE:-NO}"
|
|
TAILSCALE_AUTHKEY="${TAILSCALE_AUTHKEY:-}"
|
|
LOCAL_LLM_PROVIDER="${LOCAL_LLM_PROVIDER:-none}"
|
|
FEATURE_OLLAMA="${FEATURE_OLLAMA:-NO}"
|
|
FEATURE_LLAMA_CPP="${FEATURE_LLAMA_CPP:-NO}"
|
|
FEATURE_OLLAMA_HPP="${FEATURE_OLLAMA_HPP:-NO}"
|
|
|
|
# === Telegram ===
|
|
TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-}"
|
|
TELEGRAM_ADMIN_IDS="${TELEGRAM_ADMIN_IDS:-${TELEGRAM_ADMIN_ID:-}}"
|
|
|
|
# === Optional: SSH Public Key (if provided at install) ===
|
|
SSH_PUBLIC_KEY="${SSH_PUBLIC_KEY:-}"
|
|
|
|
# === Controlplane (multi-agent orchestration) ===
|
|
CONTROLPLANE_SHARED_SECRET="$cp_secret"
|
|
CONTROLPLANE_BIND_HOST="127.0.0.1"
|
|
CONTROLPLANE_HOST_IP="${AGENT_SUBNET_BASE}.1"
|
|
CONTROLPLANE_EXPOSURE="internal"
|
|
CONTROLPLANE_AUTH_MODE="local_trusted"
|
|
CONTROLPLANE_PORT="3100"
|
|
BETTER_AUTH_URL="http://127.0.0.1:3100"
|
|
BETTER_AUTH_SECRET="$auth_secret"
|
|
|
|
# === Git (local bare repo on git jail) ===
|
|
GIT_LOCAL_URL="git@${AGENT_SUBNET_BASE}.6:/srv/git/${ASSISTANT_NAME}-ai.git"
|
|
EOF
|
|
|
|
log_msg "[env] Wrote .env with $(wc -l < "$ENV_FILE") configuration lines"
|
|
return 0
|
|
}
|
|
|
|
# ============================================================================
|
|
# VALIDATION
|
|
# ============================================================================
|
|
|
|
clawdie_shell_env_validate() {
|
|
# Verify .env file is properly formatted
|
|
|
|
if [ ! -f "$ENV_FILE" ]; then
|
|
log_msg "[env] ERROR: .env file not found: $ENV_FILE"
|
|
return 1
|
|
fi
|
|
|
|
# Check permissions (should be 600)
|
|
local perms
|
|
perms=$(stat -f "%OLp" "$ENV_FILE" 2>/dev/null || stat -c "%a" "$ENV_FILE" 2>/dev/null || echo "")
|
|
if [ "$perms" != "600" ] && [ -n "$perms" ]; then
|
|
log_msg "[env] WARNING: .env permissions are $perms (should be 600)"
|
|
fi
|
|
|
|
# Check for required variables
|
|
local required_vars="ASSISTANT_NAME AGENT_NAME AGENT_DOMAIN AGENT_INTERNAL_DOMAIN TZ SYSTEM_LOCALE DISPLAY_LOCALE ASSISTANT_LOCALE KEYMAP"
|
|
local missing=0
|
|
for var in $required_vars; do
|
|
if ! grep -q "^$var=" "$ENV_FILE" 2>/dev/null; then
|
|
log_msg "[env] ERROR: Missing required variable: $var"
|
|
missing=$((missing + 1))
|
|
fi
|
|
done
|
|
|
|
if [ $missing -gt 0 ]; then
|
|
return 1
|
|
fi
|
|
|
|
log_msg "[env] .env validation passed ($(wc -l < "$ENV_FILE") lines)"
|
|
return 0
|
|
}
|
|
|
|
# ============================================================================
|
|
# LOGGING HELPER
|
|
# ============================================================================
|
|
|
|
log_msg() {
|
|
echo "$(date '+%H:%M:%S') $1" | tee -a "$LOG_FILE" 2>/dev/null || true
|
|
}
|
|
|
|
# Only run if sourced directly (not during test)
|
|
if [ "${SHELL_ENV_TEST:-0}" -eq 0 ]; then
|
|
clawdie_shell_env_generate
|
|
fi
|