Add client onboarding script with Semaphore API integration
This commit is contained in:
Semaphore
227
scripts/onboard_client.sh
Executable file
227
scripts/onboard_client.sh
Executable file
@@ -0,0 +1,227 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# ─── Usage ───────────────────────────────────────────────────────────────────
|
||||
usage() {
|
||||
echo "Usage: $0 [options]"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " -i, --id Client ID (e.g. DFA-001)"
|
||||
echo " -n, --name Client name (e.g. 'DFA Tech Colo')"
|
||||
echo " -s, --slug Short slug for filenames (e.g. dfa_tech)"
|
||||
echo " -w, --webhook n8n webhook URL"
|
||||
echo " -b, --billing Billing model (hybrid|per-host|time-saved|tiered) default: hybrid"
|
||||
echo " -e, --estimate Human time estimate seconds (default: 2700)"
|
||||
echo " -v, --vpn VPN type (ipsec|openvpn) default: ipsec"
|
||||
echo " -h, --hypervisor Hypervisor type (proxmox|xcpng) default: proxmox"
|
||||
echo " --semaphore-url Semaphore base URL (default: http://localhost:3000)"
|
||||
echo " --semaphore-token Semaphore API token"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 -i DFA-001 -n 'DFA Tech Colo' -s dfa_tech -w https://n8n.voice1.me/webhook/xxx"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# ─── Defaults ────────────────────────────────────────────────────────────────
|
||||
BILLING="hybrid"
|
||||
ESTIMATE="2700"
|
||||
VPN="ipsec"
|
||||
HYPERVISOR="proxmox"
|
||||
SEMAPHORE_URL="http://localhost:3000"
|
||||
REPO_DIR="/opt/ansible-msp-automations"
|
||||
|
||||
# ─── Parse args ──────────────────────────────────────────────────────────────
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case $1 in
|
||||
-i|--id) CLIENT_ID="$2"; shift 2 ;;
|
||||
-n|--name) CLIENT_NAME="$2"; shift 2 ;;
|
||||
-s|--slug) CLIENT_SLUG="$2"; shift 2 ;;
|
||||
-w|--webhook) WEBHOOK_URL="$2"; shift 2 ;;
|
||||
-b|--billing) BILLING="$2"; shift 2 ;;
|
||||
-e|--estimate) ESTIMATE="$2"; shift 2 ;;
|
||||
-v|--vpn) VPN="$2"; shift 2 ;;
|
||||
-h|--hypervisor) HYPERVISOR="$2"; shift 2 ;;
|
||||
--semaphore-url) SEMAPHORE_URL="$2"; shift 2 ;;
|
||||
--semaphore-token) SEMAPHORE_TOKEN="$2"; shift 2 ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
done
|
||||
|
||||
# ─── Validate required args ──────────────────────────────────────────────────
|
||||
if [[ -z "$CLIENT_ID" || -z "$CLIENT_NAME" || -z "$CLIENT_SLUG" || -z "$WEBHOOK_URL" ]]; then
|
||||
echo "ERROR: --id, --name, --slug, and --webhook are required"
|
||||
usage
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo " Onboarding client: $CLIENT_NAME ($CLIENT_ID)"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
|
||||
# ─── Step 1: Generate SSH key ─────────────────────────────────────────────────
|
||||
echo ""
|
||||
echo "[ 1/5 ] Generating SSH key..."
|
||||
KEY_FILE="/root/.ssh/client_${CLIENT_SLUG}"
|
||||
if [[ -f "$KEY_FILE" ]]; then
|
||||
echo " ⚠ Key already exists at $KEY_FILE — skipping generation"
|
||||
else
|
||||
ssh-keygen -t ed25519 -C "ansible-${CLIENT_SLUG}" -f "$KEY_FILE" -N ""
|
||||
echo " ✓ Key generated: $KEY_FILE"
|
||||
fi
|
||||
echo ""
|
||||
echo " ┌─ Deploy this public key to all client hosts ───────────────────────"
|
||||
echo " │"
|
||||
cat "$KEY_FILE.pub" | sed 's/^/ │ /'
|
||||
echo " │"
|
||||
echo " └────────────────────────────────────────────────────────────────────"
|
||||
|
||||
# ─── Step 2: Create inventory from template ───────────────────────────────────
|
||||
echo ""
|
||||
echo "[ 2/5 ] Creating inventory from template..."
|
||||
INVENTORY_DIR="$REPO_DIR/inventories/client_${CLIENT_SLUG}"
|
||||
|
||||
if [[ -d "$INVENTORY_DIR" ]]; then
|
||||
echo " ⚠ Inventory directory already exists — skipping"
|
||||
else
|
||||
cp -r "$REPO_DIR/inventories/client_template" "$INVENTORY_DIR"
|
||||
|
||||
# Write hosts.yml
|
||||
cat > "$INVENTORY_DIR/hosts.yml" << HOSTSEOF
|
||||
---
|
||||
all:
|
||||
vars:
|
||||
client_id: "${CLIENT_ID}"
|
||||
client_name: "${CLIENT_NAME}"
|
||||
billing_model: "${BILLING}"
|
||||
maintenance_window_start: "02:00"
|
||||
maintenance_window_end: "05:00"
|
||||
maintenance_window_tz: "UTC"
|
||||
change_freeze: false
|
||||
hypervisor_type: "${HYPERVISOR}"
|
||||
vpn_type: "${VPN}"
|
||||
auto_reboot: false
|
||||
human_estimate_seconds: ${ESTIMATE}
|
||||
|
||||
children:
|
||||
linux_hosts:
|
||||
hosts: {}
|
||||
vars:
|
||||
ansible_user: root
|
||||
os_family: "debian"
|
||||
|
||||
windows_hosts:
|
||||
hosts: {}
|
||||
vars:
|
||||
ansible_user: Administrator
|
||||
ansible_connection: winrm
|
||||
ansible_winrm_transport: ntlm
|
||||
ansible_winrm_server_cert_validation: validate
|
||||
ansible_port: 5986
|
||||
HOSTSEOF
|
||||
|
||||
# Write group_vars/all.yml
|
||||
cat > "$INVENTORY_DIR/group_vars/all.yml" << VARSEOF
|
||||
---
|
||||
# Client: ${CLIENT_NAME} (${CLIENT_ID})
|
||||
# Onboarded: $(date +%Y-%m-%d)
|
||||
# VPN: ${VPN}
|
||||
# Hypervisor: ${HYPERVISOR}
|
||||
# Billing: ${BILLING}
|
||||
|
||||
# Add client-specific overrides below
|
||||
VARSEOF
|
||||
|
||||
echo " ✓ Inventory created at $INVENTORY_DIR"
|
||||
fi
|
||||
|
||||
# ─── Step 3: Commit and push to Gitea ────────────────────────────────────────
|
||||
echo ""
|
||||
echo "[ 3/5 ] Committing to Gitea..."
|
||||
cd "$REPO_DIR"
|
||||
git add .
|
||||
git commit -m "Onboard client: ${CLIENT_NAME} (${CLIENT_ID}) — inventory scaffold" \
|
||||
|| echo " ⚠ Nothing to commit"
|
||||
git push origin main
|
||||
echo " ✓ Pushed to Gitea"
|
||||
|
||||
# ─── Step 4: Create Semaphore project via API ─────────────────────────────────
|
||||
echo ""
|
||||
echo "[ 4/5 ] Creating Semaphore project via API..."
|
||||
|
||||
if [[ -z "$SEMAPHORE_TOKEN" ]]; then
|
||||
echo " ⚠ No --semaphore-token provided — skipping Semaphore API setup"
|
||||
echo " Create the project manually in Semaphore UI"
|
||||
else
|
||||
# Create project
|
||||
PROJECT_RESPONSE=$(curl -s -X POST "$SEMAPHORE_URL/api/projects" \
|
||||
-H "Authorization: Bearer $SEMAPHORE_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\": \"Client - ${CLIENT_NAME}\", \"alert\": false, \"max_parallel_tasks\": 0}")
|
||||
|
||||
PROJECT_ID=$(echo "$PROJECT_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])" 2>/dev/null)
|
||||
|
||||
if [[ -z "$PROJECT_ID" ]]; then
|
||||
echo " ✗ Failed to create project — check token and Semaphore URL"
|
||||
echo " Response: $PROJECT_RESPONSE"
|
||||
else
|
||||
echo " ✓ Project created (ID: $PROJECT_ID)"
|
||||
|
||||
# Add gitea-deploy key to project key store
|
||||
GITEA_KEY=$(cat /root/.ssh/gitea_ansible)
|
||||
curl -s -X POST "$SEMAPHORE_URL/api/project/$PROJECT_ID/keys" \
|
||||
-H "Authorization: Bearer $SEMAPHORE_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\": \"gitea-deploy\", \"type\": \"ssh\", \"ssh\": {\"private_key\": $(echo "$GITEA_KEY" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")}}" > /dev/null
|
||||
echo " ✓ Gitea deploy key added"
|
||||
|
||||
# Add client SSH key
|
||||
CLIENT_KEY=$(cat "$KEY_FILE")
|
||||
curl -s -X POST "$SEMAPHORE_URL/api/project/$PROJECT_ID/keys" \
|
||||
-H "Authorization: Bearer $SEMAPHORE_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\": \"client-${CLIENT_SLUG}-ssh\", \"type\": \"ssh\", \"ssh\": {\"private_key\": $(echo "$CLIENT_KEY" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")}}" > /dev/null
|
||||
echo " ✓ Client SSH key added to Key Store"
|
||||
|
||||
# Add repository
|
||||
REPO_RESPONSE=$(curl -s -X POST "$SEMAPHORE_URL/api/project/$PROJECT_ID/repositories" \
|
||||
-H "Authorization: Bearer $SEMAPHORE_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\": \"ansible-msp-automations\", \"project_id\": $PROJECT_ID, \"git_url\": \"ssh://git@172.31.10.8:2222/VOICE1/ansible-msp-automations.git\", \"git_branch\": \"main\", \"ssh_key_id\": 1}")
|
||||
REPO_ID=$(echo "$REPO_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])" 2>/dev/null)
|
||||
echo " ✓ Repository linked (ID: $REPO_ID)"
|
||||
|
||||
# Add variable group
|
||||
curl -s -X POST "$SEMAPHORE_URL/api/project/$PROJECT_ID/environment" \
|
||||
-H "Authorization: Bearer $SEMAPHORE_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"name\": \"${CLIENT_SLUG}-vars\", \"project_id\": $PROJECT_ID, \"json\": \"{\\\"N8N_WEBHOOK_URL\\\": \\\"${WEBHOOK_URL}\\\", \\\"CLIENT_ID\\\": \\\"${CLIENT_ID}\\\", \\\"CLIENT_NAME\\\": \\\"${CLIENT_NAME}\\\", \\\"BILLING_MODEL\\\": \\\"${BILLING}\\\", \\\"HUMAN_ESTIMATE_SECONDS\\\": \\\"${ESTIMATE}\\\"}\"}" > /dev/null
|
||||
echo " ✓ Variable group created"
|
||||
|
||||
echo ""
|
||||
echo " Semaphore project ID: $PROJECT_ID"
|
||||
echo " Still needed manually:"
|
||||
echo " - Add inventory (File type → inventories/client_${CLIENT_SLUG}/hosts.yml)"
|
||||
echo " - Create task templates"
|
||||
echo " - Add hosts to inventory file in Gitea"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ─── Step 5: Summary ──────────────────────────────────────────────────────────
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo " ✓ Client onboarding complete: $CLIENT_NAME"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo ""
|
||||
echo " SSH public key to deploy to client hosts:"
|
||||
echo " $KEY_FILE.pub"
|
||||
echo ""
|
||||
echo " Inventory file to populate with hosts:"
|
||||
echo " $INVENTORY_DIR/hosts.yml"
|
||||
echo ""
|
||||
echo " Next steps:"
|
||||
echo " 1. Deploy SSH public key to all client hosts"
|
||||
echo " 2. Add hosts to inventory file in Gitea"
|
||||
echo " 3. Add inventory entry in Semaphore (File type)"
|
||||
echo " 4. Create task templates in Semaphore"
|
||||
echo " 5. Run preflight check"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user