joakimp
68204f573b
setup-host.sh now detects OpenStack via metadata endpoint and skips ufw. New setup-openstack-secgroup.sh creates the required security group with SSH, mosh, and ICMP rules via the OpenStack CLI.
64 lines
2.2 KiB
Bash
Executable File
64 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# setup-openstack-secgroup.sh — Create an OpenStack security group for opencode-devbox
|
|
#
|
|
# Prerequisites:
|
|
# - OpenStack CLI installed (pip install python-openstackclient)
|
|
# - Authenticated (source your openrc.sh or clouds.yaml configured)
|
|
#
|
|
# Usage:
|
|
# ./setup-openstack-secgroup.sh [group-name]
|
|
#
|
|
# Default group name: opencode-devbox
|
|
|
|
set -euo pipefail
|
|
|
|
GROUP_NAME="${1:-opencode-devbox}"
|
|
|
|
BOLD="\033[1m"; GREEN="\033[32m"; YELLOW="\033[33m"; RESET="\033[0m"
|
|
info() { echo -e "${BOLD}==>${RESET} $*"; }
|
|
ok() { echo -e "${GREEN}${BOLD}✓${RESET} $*"; }
|
|
warn() { echo -e "${YELLOW}${BOLD}!${RESET} $*"; }
|
|
|
|
if ! command -v openstack &>/dev/null; then
|
|
echo "Error: openstack CLI not found. Install with: pip install python-openstackclient"
|
|
exit 1
|
|
fi
|
|
|
|
# Check if group already exists
|
|
if openstack security group show "$GROUP_NAME" &>/dev/null; then
|
|
warn "Security group '$GROUP_NAME' already exists — updating rules"
|
|
else
|
|
info "Creating security group '$GROUP_NAME'..."
|
|
openstack security group create "$GROUP_NAME" \
|
|
--description "opencode-devbox: SSH, mosh, HTTPS"
|
|
ok "Security group created"
|
|
fi
|
|
|
|
# Add rules (idempotent — OpenStack ignores duplicates)
|
|
info "Adding rules..."
|
|
|
|
# SSH (TCP 22)
|
|
openstack security group rule create "$GROUP_NAME" \
|
|
--protocol tcp --dst-port 22 --remote-ip 0.0.0.0/0 \
|
|
--description "SSH" 2>/dev/null && ok "SSH (TCP 22)" || warn "SSH rule already exists"
|
|
|
|
# Mosh (UDP 60000-61000)
|
|
openstack security group rule create "$GROUP_NAME" \
|
|
--protocol udp --dst-port 60000:61000 --remote-ip 0.0.0.0/0 \
|
|
--description "mosh" 2>/dev/null && ok "mosh (UDP 60000-61000)" || warn "mosh rule already exists"
|
|
|
|
# ICMP (ping — useful for diagnostics)
|
|
openstack security group rule create "$GROUP_NAME" \
|
|
--protocol icmp --remote-ip 0.0.0.0/0 \
|
|
--description "ICMP ping" 2>/dev/null && ok "ICMP ping" || warn "ICMP rule already exists"
|
|
|
|
echo ""
|
|
ok "Security group '$GROUP_NAME' ready"
|
|
echo ""
|
|
echo -e "${BOLD}Apply to a new instance:${RESET}"
|
|
echo " openstack server create --security-group $GROUP_NAME ..."
|
|
echo ""
|
|
echo -e "${BOLD}Apply to an existing instance:${RESET}"
|
|
echo " openstack server add security group <instance-name> $GROUP_NAME"
|
|
echo ""
|