netadmin/deploy/install-agent.sh

#!/bin/bash
# ═══════════════════════════════════════════════════════════════════════════
# NetAdmin — Script d'installation des AGENTS (serveur DNS ou Mail)
# À exécuter sur le serveur distant (BIND9 ou Postfix)
# Usage : sudo bash install-agent.sh [dns|mail]
# ═══════════════════════════════════════════════════════════════════════════
set -e

AGENT_TYPE="${1:-}"
AGENT_DIR="/opt/netadmin-agent"
LOG_DIR="/var/log/netadmin"
CONFIG_DIR="/etc/netadmin"

if [ "$EUID" -ne 0 ]; then
    echo "✗ Ce script doit être exécuté en root (sudo)"
    exit 1
fi

if [ "$AGENT_TYPE" != "dns" ] && [ "$AGENT_TYPE" != "mail" ]; then
    echo "Usage : sudo bash install-agent.sh [dns|mail]"
    exit 1
fi

echo "══════════════════════════════════════════"
echo "  NetAdmin — Installation agent $AGENT_TYPE"
echo "══════════════════════════════════════════"

# ── Répertoires ────────────────────────────────────────────────────────────
echo "→ Création des répertoires..."
mkdir -p $AGENT_DIR/venv
mkdir -p $LOG_DIR
mkdir -p $CONFIG_DIR
echo "  ✓"

# ── Dépendances système ────────────────────────────────────────────────────
echo "→ Installation des dépendances Python..."
apt-get update -qq
apt-get install -y -qq python3 python3-venv python3-pip
echo "  ✓"

# ── Copie des fichiers agent ───────────────────────────────────────────────
echo "→ Copie des fichiers..."
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SOURCE_DIR="$(dirname "$SCRIPT_DIR")"

cp $SOURCE_DIR/agents/${AGENT_TYPE}_agent.py $AGENT_DIR/
cp $SOURCE_DIR/agents/requirements.txt       $AGENT_DIR/
echo "  ✓"

# ── Environnement Python ───────────────────────────────────────────────────
echo "→ Création du venv Python..."
python3 -m venv $AGENT_DIR/venv
$AGENT_DIR/venv/bin/pip install --quiet --upgrade pip
$AGENT_DIR/venv/bin/pip install --quiet -r $AGENT_DIR/requirements.txt
echo "  ✓"

# ── Certificats mTLS ──────────────────────────────────────────────────────
echo "→ Configuration des certificats mTLS..."
mkdir -p $CONFIG_DIR/certs
if [ ! -f $CONFIG_DIR/certs/agent.crt ]; then
    echo "  ⚠ Certificats mTLS absents dans $CONFIG_DIR/certs/"
    echo "    Copier depuis le serveur principal :"
    echo "    - agent.crt  (certificat de cet agent)"
    echo "    - agent.key  (clé privée de cet agent)"
    echo "    - ca.crt     (certificat CA NetAdmin)"
    echo ""
    echo "    Puis adapter config.yaml :"
    echo "    redis:"
    echo "      ssl_ca_cert:     /etc/netadmin/certs/ca.crt"
    echo "      ssl_certfile:    /etc/netadmin/certs/agent.crt"
    echo "      ssl_keyfile:     /etc/netadmin/certs/agent.key"
else
    echo "  ✓ Certificats trouvés"
fi

# ── Configuration ──────────────────────────────────────────────────────────
if [ ! -f $CONFIG_DIR/config.yaml ]; then
    echo "→ Création config.yaml (à compléter)..."
    cat > $CONFIG_DIR/config.yaml << YAML
# NetAdmin Agent — $AGENT_TYPE
# Adapter les valeurs ci-dessous

redis:
  host:         "netadmin.example.fr"   # ← IP/FQDN du serveur NetAdmin
  port:         6380
  password:     "changeme"              # ← mot de passe Redis
  ssl:          true
  ssl_ca_cert:  "/etc/netadmin/certs/ca.crt"
  ssl_certfile: "/etc/netadmin/certs/agent.crt"
  ssl_keyfile:  "/etc/netadmin/certs/agent.key"

YAML

    if [ "$AGENT_TYPE" = "dns" ]; then
        cat >> $CONFIG_DIR/config.yaml << YAML
dns_agent:
  zones_dir:        "/etc/bind/zones"
  named_conf_local: "/etc/bind/named.conf.local"
  rndc_cmd:         "rndc"
  key_dir:          "/etc/bind/keys"
  dnssec_policy:    "default"
YAML
    else
        cat >> $CONFIG_DIR/config.yaml << YAML
mail_agent:
  db:
    host:     "localhost"
    port:     3306
    user:     "postfix"
    password: "changeme"   # ← mot de passe MariaDB netadmin_mail
    name:     "netadmin_mail"
  postfix:
    reload_cmd: "postfix reload"
  dkim:
    dir:      "/var/lib/rspamd/dkim"
    selector: "mail"
YAML
    fi

    chmod 640 $CONFIG_DIR/config.yaml
    echo "  ✓ Éditer $CONFIG_DIR/config.yaml"
else
    echo "→ Configuration existante conservée."
fi

# ── Service systemd ────────────────────────────────────────────────────────
echo "→ Installation du service systemd..."
cp $SOURCE_DIR/deploy/netadmin-${AGENT_TYPE}-agent.service /etc/systemd/system/
systemctl daemon-reload
systemctl enable netadmin-${AGENT_TYPE}-agent
echo "  ✓"

# ── Logrotate ──────────────────────────────────────────────────────────────
cat > /etc/logrotate.d/netadmin-agent << LOGROTATE
/var/log/netadmin/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 0640 root root
}
LOGROTATE
echo "→ Logrotate ✓"

# ── Résumé ─────────────────────────────────────────────────────────────────
echo ""
echo "══════════════════════════════════════════"
echo "  Installation agent $AGENT_TYPE terminée !"
echo "══════════════════════════════════════════"
echo ""
echo "  Étapes suivantes :"
echo "  1. Copier les certificats mTLS dans $CONFIG_DIR/certs/"
echo "  2. Éditer $CONFIG_DIR/config.yaml"
echo "     - IP du serveur NetAdmin (redis.host)"
echo "     - Mot de passe Redis"
if [ "$AGENT_TYPE" = "dns" ]; then
echo "     - Chemins BIND9 (zones_dir, named_conf_local)"
else
echo "     - Connexion MariaDB (netadmin_mail)"
fi
echo "  3. Démarrer l'agent :"
echo "     systemctl start netadmin-${AGENT_TYPE}-agent"
echo "  4. Vérifier les logs :"
echo "     journalctl -u netadmin-${AGENT_TYPE}-agent -f"
echo ""