simplify remotes
This commit is contained in:
abrown38 committed
1 parent
02017d470f
commit
998d9f603d
6 files changed
+137
-133
No files matched your search
+26
-24
@@ -670,7 +670,7 @@ sudo terractl move calamity nas: # this host → nas
|
||||
terractl copy nas:calamity pi:test # nas → pi, as 'test'
|
||||
```
|
||||
|
||||
### Turning on the daemon
|
||||
### Setting it up
|
||||
|
||||
On the host to be managed:
|
||||
|
||||
@@ -678,29 +678,31 @@ On the host to be managed:
|
||||
sudo terractl daemon enable
|
||||
```
|
||||
|
||||
This starts `terractld.service` and makes it start at boot. It listens on **TCP port 7776**, on all addresses. If a firewall is active, allow that port (for example `sudo ufw allow 7776/tcp`), ideally only from the computers that will manage the host. To listen on one address or on another port, set `TERRACTL_LISTEN` in `/etc/default/terractl` (e.g. `TERRACTL_LISTEN=10.0.10.77:7776`) and run `sudo systemctl restart terractld`.
|
||||
It prints a command with a one-time token. Run that command on the computer that should manage the host:
|
||||
|
||||
`sudo terractl daemon disable` turns it off again. `terractl daemon status` shows whether it's running, where it listens and its certificate's fingerprint, and with `sudo`, which computers it trusts.
|
||||
```bash
|
||||
terractl remote add tctl1_eyJ2IjoxLCJmcCI6...
|
||||
```
|
||||
|
||||
That's all: the host is now a remote called by its hostname (say `nas`), and `terractl --host nas list` works. To call it something else, put a name before the token: `terractl remote add nas tctl1_...`. The host, in turn, knows the computer by the computer's hostname.
|
||||
|
||||
For each further computer, run `sudo terractl daemon token` on the host for a new token. A token works **once**, **within 24 hours**.
|
||||
|
||||
### The daemon
|
||||
|
||||
`daemon enable` starts `terractld.service` and makes it start at boot. It listens on **TCP port 7776**, on all addresses. If a firewall is active, allow that port (for example `sudo ufw allow 7776/tcp`), ideally only from the computers that will manage the host. To listen on one address or on another port, set `TERRACTL_LISTEN` in `/etc/default/terractl` (e.g. `TERRACTL_LISTEN=10.0.10.77:7776`) and run `sudo systemctl restart terractld`.
|
||||
|
||||
`sudo terractl daemon disable` turns it off again. `terractl daemon status` shows whether it's running, where it listens and its certificate's fingerprint, and with `sudo`, which computers it trusts. `sudo terractl daemon revoke <name>` takes a computer's access away.
|
||||
|
||||
The daemon is an ordinary systemd service: systemd starts it at boot, restarts it if it crashes, and keeps its log. `journalctl -u terractld` lists every command it ran and for which computer.
|
||||
|
||||
### Adding a remote
|
||||
### Remotes
|
||||
|
||||
Each computer that should manage the host needs a one-time token. On the host with the daemon:
|
||||
The token contains the host's addresses, so usually `remote add` needs nothing else. If none of them works from the computer (behind NAT, for example), add one that does: `terractl remote add tctl1_... --address 203.0.113.5`, or `--address nas.example.com:7800` for another port.
|
||||
|
||||
```bash
|
||||
sudo terractl daemon trust add laptop
|
||||
```
|
||||
Adding a host that's already a remote replaces that remote, keeping its name unless you give a new one. So if a remote stops working because its access was revoked, just get a new token and add it again.
|
||||
|
||||
`laptop` is a name for the computer, used in the host's log and to revoke it later. The command prints what to run on that computer:
|
||||
|
||||
```bash
|
||||
terractl remote add nas tctl1_eyJ2IjoxLCJmcCI6...
|
||||
```
|
||||
|
||||
`nas` is the name you'll use for the host there; choose any. The token contains the host's addresses, so usually nothing else is needed. If none of them works from the computer (behind NAT, for example), add the address: `terractl remote add nas 203.0.113.5 tctl1_...`, or `nas.example.com:7800` for another port.
|
||||
|
||||
A token works **once**, **within 24 hours**. Remotes are kept per user in `~/.config/terractl/remotes.json`, readable only by you. Under `sudo`, the remotes of the person who ran sudo are used.
|
||||
Remotes are kept per user in `~/.config/terractl/remotes.json`, readable only by you. Under `sudo`, the remotes of the person who ran sudo are used.
|
||||
|
||||
```bash
|
||||
terractl remote list # your remotes
|
||||
@@ -757,7 +759,7 @@ On this host, copying *from* it works for members of the `terraria` group. Copyi
|
||||
- **Encrypted and pinned.** Traffic is HTTPS (TLS 1.2 or newer). The daemon's certificate is self-signed, the token carries its fingerprint, and every connection checks it, so nothing in between can pose as the daemon. If the fingerprint ever changes, `terractl` refuses to connect and says so.
|
||||
- **Keys, not passwords.** Joining trades the token for a random key for that computer. The daemon keeps only hashes of keys and tokens, in `/var/lib/terractl/trust.json` (root only).
|
||||
- **A trusted computer is an admin of the host's servers.** It can do what `sudo terractl` can: create, delete, import, start and stop instances, and install mods or server files, which run as the `terraria` user. It can't change the daemon or run anything other than `terractl`. Give tokens only to computers you'd trust with `sudo terractl`.
|
||||
- **Revoking.** `sudo terractl daemon trust list` shows the trusted computers, and `sudo terractl daemon trust remove laptop` takes one's access away immediately.
|
||||
- **Revoking.** `sudo terractl daemon status` shows the trusted computers, and `sudo terractl daemon revoke laptop` takes one's access away immediately.
|
||||
- **Firewall.** The daemon doesn't need to be reachable from the internet. Limit port 7776 to your LAN or VPN, or set `TERRACTL_LISTEN` to a LAN or VPN address.
|
||||
|
||||
The daemon runs as root, because it creates and removes instances and starts services, but with systemd's protections it can't write to `/usr`, `/boot`, `/etc` or home folders. Its certificate, key and trust list are in `/var/lib/terractl/`. Files in transit are kept in `/var/lib/terractl/transfers/`, and removed once used, after 6 hours unused, or when the daemon restarts.
|
||||
@@ -798,7 +800,7 @@ The servers always run as the `terraria` user. Administration is simplest with `
|
||||
| `import` | root (or `terraria`) | Run as root, it gives the new instance to `terraria`. |
|
||||
| `prepare`, `run` | Normally only the service | Run as root, they automatically switch to the `terraria` user, so no files end up owned by root. Any other user is refused. |
|
||||
| `service-stop` | Only the service | Needs the server's process ID from systemd. |
|
||||
| `daemon enable`, `daemon disable`, `daemon trust ...` | root only | |
|
||||
| `daemon enable`, `disable`, `token`, `revoke` | root only | |
|
||||
| `daemon status` | anyone | Shows the trusted computers only with `sudo`. |
|
||||
| `remote ...`, `--host ...` | anyone | Uses your own remotes. On the remote, the daemon runs the command as root. |
|
||||
| `copy`, `move` | depends on this host's part | Copying from this host: the group is enough. Copying to it, or moving away from it: root. |
|
||||
@@ -918,7 +920,7 @@ The daemon isn't running on that host (check with `terractl daemon status` there
|
||||
The daemon has a different certificate than when you added it. That's expected if `/var/lib/terractl` was deleted there, or the package was purged and installed again; remove the remote and add it again. If nothing like that happened, don't work around it: something may be intercepting the connection.
|
||||
|
||||
**`doesn't trust this computer (any more)`.**
|
||||
Its access was revoked with `daemon trust remove`, or that computer was added again under the same name elsewhere. Get a new token.
|
||||
Its access was revoked with `daemon revoke`, or the host's `/var/lib/terractl` was reset. Run `sudo terractl daemon token` there and `terractl remote add <token>` here; that replaces the old remote.
|
||||
|
||||
---
|
||||
|
||||
@@ -972,12 +974,12 @@ terractl copy [<remote>:]<name> [<remote>:][<new name>] [--with-server]
|
||||
Copy an instance, here or between hosts
|
||||
terractl move [<remote>:]<name> [<remote>:][<new name>] [--with-server]
|
||||
Move or rename an instance
|
||||
terractl remote add <name> <token> Add a remote (token from 'daemon trust add')
|
||||
terractl remote add <name> <address> [<token>] ... at an address the token doesn't list
|
||||
terractl remote add [<name>] <token> [--address <host>[:<port>]]
|
||||
Add (or replace) a remote
|
||||
terractl remote list | remove <name> Show or forget remotes
|
||||
terractl daemon enable|disable|status Let other hosts manage this one
|
||||
terractl daemon trust add|remove <name> Create a token for a computer, or revoke one
|
||||
terractl daemon trust list Show trusted computers and unused tokens
|
||||
terractl daemon token A one-time token for another computer
|
||||
terractl daemon revoke <name> Take a computer's access away
|
||||
|
||||
Used by the service:
|
||||
terractl prepare <name> Create dirs/configs, unpack zip if needed
|
||||
|
||||
Reference in new issue
Block a user