Unverified Commit 0758b9c5 authored by Minseong Choi's avatar Minseong Choi 💬
Browse files

docs(bootstrap): pass tunables on the sudo line, not by export 

The header said to export tunables before running, but its own
`curl ... | sudo bash` entrypoint resets the environment, so an
exported FELIS_INSTALL_MODE or FELIS_NANO_LISTEN never reached the
installer. The header now shows the two forms that do arrive: the
variable named on the sudo line, or export followed by sudo -E.

The nano summary's hint for a proxy on another machine now prints a
sudo line that can be pasted as is, instead of "re-run with
FELIS_NANO_LISTEN=...". Comment and log text only.
parent 02c079c8

deploy/bootstrap.sh

+8 −3
Changes for deploy/bootstrap.sh: 8 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -26,7 +26,10 @@ 
# The script is idempotent: re-running it converges rather than duplicating, and

# generated secrets are persisted to /etc/felis/secrets.env so reruns reuse them.

#

# Tunables (export before running to override the demo defaults):

# Tunables override the demo defaults. sudo resets the environment, so a variable exported

# before `curl ... | sudo bash` never arrives. Name it on the sudo line, or keep it with -E:

#   curl -fsSL <raw-url>/deploy/bootstrap.sh | sudo FELIS_INSTALL_MODE=nano FELIS_NANO_LISTEN=10.0.0.5:8081 bash

#   export FELIS_INSTALL_MODE=nano; curl -fsSL <raw-url>/deploy/bootstrap.sh | sudo -E bash

#   FELIS_INSTALL_MODE full|nano — skip the prompt (default: ask on a tty, else full; nano

#                     instead on a host that runs felis-nano and no full install)

#   FELIS_NANO_LISTEN listen addr for `felis nano` (default: the address an installed
@@ -2460,8 +2463,10 @@ summary_nano() { 
  log "     the full https://sessionserver.mojang.com/session/minecraft/hasJoined)"

  if nano_listen_is_loopback; then

    log "Bound to loopback: reachable from Velocity on THIS host, and from nowhere else."

    log "Proxy on another machine? Re-run with FELIS_NANO_LISTEN=<private-ip>:${port} and"

    log "allow ${port}/tcp ONLY from that proxy — hasJoined takes no auth token, so an"

    log "Proxy on another machine? Re-run with the address on the sudo line (sudo drops"

    log "exported variables):"

    log "    curl -fsSL <raw-url>/deploy/bootstrap.sh | sudo FELIS_NANO_LISTEN=<private-ip>:${port} bash"

    log "and allow ${port}/tcp ONLY from that proxy — hasJoined takes no auth token, so an"

    log "internet-facing one is a free auth relay burning your Mojang egress IP."

  else

    log "WARNING: bound to ${FELIS_NANO_LISTEN} — hasJoined takes no auth token, so restrict"