mrcharles
c810942239
open-terminal 0.11.34 bare-metal (human-authorized host install) with a systemd template unit: reachableceo on tailscale-only :30000 (cwd ~/projects) and all 8 other accounts on :30001-30008, each with its own key kept out of ps in per-user TOMLs, all users added to the docker group. Keys live in ~/.creds + /etc/ukrrs/open-terminal, never in this repo. UAT: throwaway OpenWebUI v0.11.1 (matched to the human's Cloudron prod) driven purely over its HTTP API against the beta gateway lane - connection verify/config PASS, direct exec as uid 1001 PASS, and the chat round trip PASS: the model emitted run_command, we executed it through OpenWebUI's terminal proxy (server holds the key), and the final answer named 9/9 real project directories; earlier negative runs prove the test catches hallucinated output. Ops note OPEN-TERMINAL.md documents production wiring (prod openwebui container v0.3.10 is too old and needs an upgrade first). Also tonight: agent-stack relaunchers removed (6-, backups kept) so no screen/crush sessions auto-start on reboot; 22:00 night-profile flip observed live; docs synced for the earlier teardown. 💘 Generated with Crush Assisted-by: Crush:glm-5.2 [#610]
87 lines
3.2 KiB
Bash
Executable File
87 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# 7-open-terminal-install.sh — OpenWebUI Open Terminal for reachableceo (#610).
|
|
# Bare-metal (human-authorized one-case host install, ruling 2026-08-31):
|
|
# - binary via uv tool install (pinned open-terminal==0.11.34, managed py3.12)
|
|
# → /usr/local/bin/open-terminal, venvs under /opt/uv-tools
|
|
# - per-user TOML config keeps the API key OUT of ps/cmdline (docs' advice)
|
|
# - binds TAILSCALE ONLY (100.101.187.119, human ruling 2026-08-31 night):
|
|
# reachable from openwebui containers + tailscale clients, never the LAN
|
|
# - systemd template unit open-terminal@.service → instance per account
|
|
# - this script creates the reachableceo instance: port 30000, cwd ~/projects
|
|
# - key copy for the human lands in ~/.creds/open-terminal.env (0600)
|
|
# Self-elevating. Run: ~/projects/ultix/7-open-terminal-install.sh
|
|
set -euo pipefail
|
|
[ "$EUID" -eq 0 ] || exec sudo bash "$0"
|
|
|
|
OUT=/home/reachableceo/projects/ultix/7-open-terminal-install.out
|
|
exec > >(tee "$OUT") 2>&1
|
|
echo "== open-terminal install $(date -Is) =="
|
|
|
|
UV=/home/reachableceo/.local/bin/uv
|
|
VER=0.11.34
|
|
UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
|
|
UV_PYTHON_INSTALL_DIR=/opt/uv-python \
|
|
$UV tool install --python 3.12 "open-terminal==$VER" \
|
|
|| UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin \
|
|
UV_PYTHON_INSTALL_DIR=/opt/uv-python $UV tool install --reinstall --python 3.12 "open-terminal==$VER"
|
|
chmod -R a+rX /opt/uv-tools /opt/uv-python
|
|
/usr/local/bin/open-terminal --help >/dev/null && echo "open-terminal $VER ok"
|
|
|
|
mkdir -p /etc/ukrrs/open-terminal /etc/systemd/system
|
|
|
|
KEY=$(openssl rand -hex 32)
|
|
cat > /etc/ukrrs/open-terminal/reachableceo.toml <<EOF
|
|
host = "100.101.187.119"
|
|
port = 30000
|
|
api_key = "$KEY"
|
|
EOF
|
|
chown root:reachableceo /etc/ukrrs/open-terminal/reachableceo.toml
|
|
chmod 640 /etc/ukrrs/open-terminal/reachableceo.toml
|
|
|
|
cat > /etc/systemd/system/open-terminal@.service <<'EOF'
|
|
[Unit]
|
|
Description=Open Terminal (%i)
|
|
Documentation=https://docs.openwebui.com/features/open-terminal/
|
|
After=network-online.target tailscaled.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=%i
|
|
EnvironmentFile=/etc/ukrrs/open-terminal/%i.env
|
|
ExecStart=/usr/local/bin/open-terminal run --config /etc/ukrrs/open-terminal/%i.toml --cwd ${OPEN_TERMINAL_CWD}
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
printf 'OPEN_TERMINAL_CWD=/home/reachableceo/projects\n' \
|
|
> /etc/ukrrs/open-terminal/reachableceo.env
|
|
chown root:reachableceo /etc/ukrrs/open-terminal/reachableceo.env
|
|
chmod 640 /etc/ukrrs/open-terminal/reachableceo.env
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now open-terminal@reachableceo
|
|
|
|
CREDS=/home/reachableceo/.creds/open-terminal.env
|
|
{
|
|
echo "# Open Terminal fleet — added 2026-08-31 (#610). 0600, never repo."
|
|
echo "REACHABLECEO_URL=http://100.101.187.119:30000"
|
|
echo "REACHABLECEO_API_KEY=$KEY"
|
|
} > "$CREDS"
|
|
chown reachableceo:reachableceo "$CREDS"
|
|
chmod 600 "$CREDS"
|
|
|
|
sleep 2
|
|
for _ in 1 2 3 4 5 6 7 8; do
|
|
STATE=$(systemctl is-active open-terminal@reachableceo || true)
|
|
[ "$STATE" = active ] && break
|
|
sleep 2
|
|
done
|
|
echo "-- verify --"
|
|
echo "unit: $STATE"
|
|
curl -s -m 10 http://100.101.187.119:30000/health && echo
|
|
echo "== done $(date -Is) =="
|