134 lines
3.3 KiB
Bash
134 lines
3.3 KiB
Bash
#!/bin/bash
|
|
# Nexus Scanner — Installations-Skript
|
|
# Läuft auf Debian 12 / Ubuntu 22.04+
|
|
# Aufruf: sudo bash install.sh [LUD|BAR]
|
|
set -e
|
|
|
|
SITE="${1:-LUD}"
|
|
BINARY_URL="https://it-nexus.cereda-systems.de/downloads/nexus-scanner-linux-amd64"
|
|
BINARY="/usr/local/bin/nexus-scanner"
|
|
CONFIG_DIR="/etc/nexus-scanner"
|
|
DATA_DIR="/var/lib/nexus-scanner"
|
|
SERVICE_FILE="/etc/systemd/system/nexus-scanner.service"
|
|
USER="nexus-scanner"
|
|
|
|
echo "=============================="
|
|
echo " Nexus Scanner Installation"
|
|
echo " Standort: $SITE"
|
|
echo "=============================="
|
|
|
|
# Abhängigkeiten
|
|
apt-get update -qq
|
|
apt-get install -y -qq curl iputils-ping nmap snmp 2>/dev/null || true
|
|
|
|
# Benutzer anlegen
|
|
if ! id "$USER" &>/dev/null; then
|
|
useradd --system --no-create-home --shell /usr/sbin/nologin "$USER"
|
|
echo "Benutzer $USER angelegt."
|
|
fi
|
|
|
|
# Verzeichnisse
|
|
mkdir -p "$CONFIG_DIR" "$DATA_DIR"
|
|
chown "$USER:$USER" "$DATA_DIR"
|
|
|
|
# Binary installieren (aus deploy/-Verzeichnis oder per Download)
|
|
if [ -f "./nexus-scanner-linux-amd64" ]; then
|
|
cp ./nexus-scanner-linux-amd64 "$BINARY"
|
|
echo "Binary aus lokalem Verzeichnis installiert."
|
|
else
|
|
echo "Binary wird heruntergeladen..."
|
|
curl -fsSL "$BINARY_URL" -o "$BINARY"
|
|
fi
|
|
chmod 755 "$BINARY"
|
|
|
|
# Config installieren
|
|
if [ ! -f "$CONFIG_DIR/config.yaml" ]; then
|
|
if [ -f "./config.${SITE,,}.yaml" ]; then
|
|
cp "./config.${SITE,,}.yaml" "$CONFIG_DIR/config.yaml"
|
|
else
|
|
# Minimal-Config erzeugen
|
|
cat > "$CONFIG_DIR/config.yaml" << EOF
|
|
site: "$SITE"
|
|
log_level: "info"
|
|
setup_complete: false
|
|
db:
|
|
path: "$DATA_DIR/scanner.db"
|
|
web:
|
|
addr: ":8090"
|
|
token: ""
|
|
nexus:
|
|
url: "https://it-nexus.cereda-systems.de"
|
|
api_key: "nsx-aa0193d719c2be765441e1dd24bf7480"
|
|
offline_after: 15m
|
|
modules:
|
|
arp_discovery:
|
|
enabled: true
|
|
interval: 5m
|
|
subnets: ["192.168.0.0/24"]
|
|
interface: "eth0"
|
|
site_monitoring:
|
|
enabled: true
|
|
interval: 1m
|
|
port_scan:
|
|
enabled: true
|
|
interval: 15m
|
|
snmp:
|
|
enabled: true
|
|
interval: 5m
|
|
community: "public"
|
|
nexus_reporter:
|
|
enabled: true
|
|
interval: 10m
|
|
EOF
|
|
fi
|
|
echo "Config nach $CONFIG_DIR/config.yaml installiert."
|
|
fi
|
|
chown "$USER":"$USER" "$CONFIG_DIR/config.yaml"
|
|
chmod 640 "$CONFIG_DIR/config.yaml"
|
|
|
|
# systemd Service installieren
|
|
cat > "$SERVICE_FILE" << 'EOF'
|
|
[Unit]
|
|
Description=Nexus Scanner — Netzwerk-Discovery Agent
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=nexus-scanner
|
|
Group=nexus-scanner
|
|
ExecStart=/usr/local/bin/nexus-scanner /etc/nexus-scanner/config.yaml
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=nexus-scanner
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ReadWritePaths=/var/lib/nexus-scanner /etc/nexus-scanner
|
|
PrivateTmp=yes
|
|
AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable nexus-scanner
|
|
systemctl restart nexus-scanner
|
|
|
|
IP=$(hostname -I | awk '{print $1}')
|
|
echo ""
|
|
echo "=============================="
|
|
echo " Installation abgeschlossen!"
|
|
echo "=============================="
|
|
echo ""
|
|
echo " Web-UI: http://$IP:8090"
|
|
echo " Status: systemctl status nexus-scanner"
|
|
echo " Logs: journalctl -u nexus-scanner -f"
|
|
echo ""
|
|
echo " Öffne http://$IP:8090 im Browser"
|
|
echo " um den Setup-Wizard abzuschließen."
|
|
echo ""
|