feat: provisioner podman + podman-compose + Cockpit untuk Fedora server
This commit is contained in:
oxpoe committed
commit
0147dad533
3 files changed
+249
No files matched your search
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 oxpoe
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,85 @@
|
||||
# fedora-server
|
||||
|
||||
Provisioner **Fedora** untuk menjadikan VPS langsung siap sebagai **server container**:
|
||||
[Podman](https://podman.io) + `podman-compose` + **Cockpit** (`cockpit-podman`) + pendukung.
|
||||
|
||||
Satu perintah:
|
||||
|
||||
```bash
|
||||
curl -fsSL https://gitea.oxpoe.qzz.io/oxpoe/fedora-server/raw/branch/main/install.sh | sudo bash
|
||||
```
|
||||
|
||||
## Yang dipasang
|
||||
|
||||
| Kategori | Paket |
|
||||
|---|---|
|
||||
| Container engine | `podman`, `podman-compose`, `buildah`, `skopeo` |
|
||||
| Manajemen web | `cockpit`, `cockpit-podman`, `cockpit-storaged`, `cockpit-networkmanager` |
|
||||
| Util | `git`, `jq` |
|
||||
| SELinux tooling | `policycoreutils-python-utils` |
|
||||
|
||||
Service yang diaktifkan:
|
||||
- `podman.socket` — API socket (untuk Cockpit/klien remote).
|
||||
- `podman-restart.service` — **container ber-`restart:` policy naik otomatis saat boot**.
|
||||
- `cockpit.socket` — web UI di `https://<ip>:9090`.
|
||||
|
||||
## Opsi
|
||||
|
||||
```bash
|
||||
install.sh [opsi]
|
||||
|
||||
--update jalankan `dnf upgrade` dulu (default: tidak)
|
||||
--with-docker-shim pasang podman-docker (perintah `docker` -> podman)
|
||||
--with-tui pasang podman-tui (TUI di terminal)
|
||||
--no-cockpit tanpa Cockpit (podman saja)
|
||||
--admin-user NAME buat user (grup wheel) untuk login Cockpit
|
||||
--uninstall lepas paket & service yang dipasang skrip ini
|
||||
```
|
||||
|
||||
Contoh:
|
||||
|
||||
```bash
|
||||
# podman saja, tanpa Cockpit
|
||||
curl -fsSL .../install.sh | sudo bash -s -- --no-cockpit
|
||||
|
||||
# lengkap + shim docker + user admin
|
||||
curl -fsSL .../install.sh | sudo bash -s -- --with-docker-shim --admin-user admin
|
||||
```
|
||||
|
||||
Skrip **idempotent** — aman dijalankan ulang.
|
||||
|
||||
## Setelah selesai
|
||||
|
||||
```bash
|
||||
podman run --rm docker.io/alpine echo "podman jalan"
|
||||
podman compose up -d # di folder berisi compose.yaml
|
||||
```
|
||||
|
||||
**Cockpit**: buka `https://<ip-vps>:9090`, login pakai user Linux + password.
|
||||
> Cloud image biasanya *key-only* (root tanpa password) → buat user dulu:
|
||||
> `useradd -m admin && passwd admin`, lalu login `admin`.
|
||||
|
||||
## Catatan penting
|
||||
|
||||
- **Rootful** secara default (paling cocok untuk server & VPN/tun/host-network). Untuk
|
||||
rootless, buat user non-root (subuid/subgid dibuat otomatis di Fedora) dan pakai
|
||||
`systemctl --user enable podman-restart.service`.
|
||||
- **SELinux** (kalau `Enforcing`): bind mount ke path host butuh relabel — tambahkan
|
||||
`:z` (shared) atau `:Z` (private) di compose/volume, cth `- ./data:/data:Z`.
|
||||
Tanpa itu bisa muncul "Permission denied" padahal file ada.
|
||||
- **Autostart container** mengandalkan `podman-restart.service` (sudah di-enable). Urutan
|
||||
antar-service tidak dijamin; untuk itu pakai **Quadlet**.
|
||||
- **firewalld**: kalau aktif, service `cockpit` dibuka otomatis. Podman mengatur aturan
|
||||
port container-nya sendiri via integrasi firewalld.
|
||||
|
||||
## Uninstall
|
||||
|
||||
```bash
|
||||
curl -fsSL .../install.sh | sudo bash -s -- --uninstall
|
||||
```
|
||||
|
||||
`podman` dan data container (`/var/lib/containers`) tidak dihapus otomatis.
|
||||
|
||||
## Lisensi
|
||||
|
||||
MIT — lihat [LICENSE](LICENSE).
|
||||
Executable
+143
@@ -0,0 +1,143 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# fedora-server — provisioner Fedora untuk server container:
|
||||
# podman + podman-compose + Cockpit (cockpit-podman) + pendukung.
|
||||
#
|
||||
# Pakai:
|
||||
# curl -fsSL https://gitea.oxpoe.qzz.io/oxpoe/fedora-server/raw/branch/main/install.sh | sudo bash
|
||||
#
|
||||
# Opsi:
|
||||
# --update jalankan `dnf upgrade` dulu (default: tidak)
|
||||
# --with-docker-shim pasang podman-docker (perintah `docker` -> podman)
|
||||
# --with-tui pasang podman-tui (TUI di terminal)
|
||||
# --no-cockpit tanpa Cockpit (podman saja)
|
||||
# --admin-user NAME buat user (grup wheel) untuk login ke Cockpit
|
||||
# --uninstall lepas paket & service yang dipasang skrip ini
|
||||
# -h, --help bantuan ini
|
||||
#
|
||||
# Idempotent: aman dijalankan berulang.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
BLUE='\033[1;34m'; YEL='\033[1;33m'; RED='\033[1;31m'; GRN='\033[1;32m'; NC='\033[0m'
|
||||
log() { printf "${BLUE}==>${NC} %s\n" "$*"; }
|
||||
ok() { printf "${GRN} +${NC} %s\n" "$*"; }
|
||||
warn() { printf "${YEL} !${NC} %s\n" "$*"; }
|
||||
die() { printf "${RED} x${NC} %s\n" "$*" >&2; exit 1; }
|
||||
|
||||
UPDATE=0 WITH_DOCKER=0 WITH_TUI=0 WITH_COCKPIT=1 ADMIN_USER="" UNINSTALL=0
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--update) UPDATE=1 ;;
|
||||
--with-docker-shim) WITH_DOCKER=1 ;;
|
||||
--with-tui) WITH_TUI=1 ;;
|
||||
--no-cockpit) WITH_COCKPIT=0 ;;
|
||||
--admin-user) shift; ADMIN_USER="${1:?--admin-user butuh nama}";;
|
||||
--uninstall) UNINSTALL=1 ;;
|
||||
-h|--help) sed -n '2,18p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
|
||||
*) die "opsi tak dikenal: $1" ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
[ "${EUID:-$(id -u)}" -eq 0 ] || die "Jalankan sebagai root: ... | sudo bash"
|
||||
command -v dnf >/dev/null 2>&1 || die "Ini bukan sistem berbasis dnf (Fedora/RHEL)."
|
||||
|
||||
CORE=(podman podman-compose buildah skopeo git jq)
|
||||
COCKPIT=(cockpit cockpit-podman cockpit-storaged cockpit-networkmanager)
|
||||
SELTOOLS=(policycoreutils-python-utils)
|
||||
|
||||
# ---------------------------------------------------------------- uninstall
|
||||
if [ "$UNINSTALL" = 1 ]; then
|
||||
log "Melepas service"
|
||||
systemctl disable --now cockpit.socket 2>/dev/null || true
|
||||
systemctl disable --now podman.socket 2>/dev/null || true
|
||||
systemctl disable podman-restart.service 2>/dev/null || true
|
||||
|
||||
log "Menghapus paket yang dipasang skrip ini"
|
||||
dnf remove -y "${COCKPIT[@]}" podman-tui podman-docker buildah skopeo "${SELTOOLS[@]}" 2>/dev/null || true
|
||||
|
||||
warn "podman & data container TIDAK dihapus otomatis."
|
||||
warn "Kalau mau benar-benar bersih: dnf remove -y podman && rm -rf /var/lib/containers"
|
||||
ok "Selesai."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------- update
|
||||
if [ "$UPDATE" = 1 ]; then
|
||||
log "Update paket (dnf upgrade)"
|
||||
dnf upgrade -y --refresh
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------- install
|
||||
log "Memasang inti: podman + podman-compose + buildah/skopeo"
|
||||
dnf install -y "${CORE[@]}"
|
||||
|
||||
log "Memasang alat SELinux (troubleshooting :z/:Z)"
|
||||
dnf install -y "${SELTOOLS[@]}" || warn "policycoreutils-python-utils gagal (lanjut)"
|
||||
|
||||
if [ "$WITH_COCKPIT" = 1 ]; then
|
||||
log "Memasang Cockpit (podman, storage, network)"
|
||||
dnf install -y "${COCKPIT[@]}" || { warn "modul Cockpit sebagian gagal, coba versi minimal"; dnf install -y cockpit cockpit-podman; }
|
||||
fi
|
||||
|
||||
if [ "$WITH_DOCKER" = 1 ]; then
|
||||
log "Memasang shim podman-docker (perintah 'docker' -> podman)"
|
||||
dnf install -y podman-docker
|
||||
fi
|
||||
|
||||
if [ "$WITH_TUI" = 1 ]; then
|
||||
log "Memasang podman-tui"
|
||||
dnf install -y podman-tui
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------- services
|
||||
log "Mengaktifkan service"
|
||||
systemctl enable --now podman.socket
|
||||
systemctl enable podman-restart.service # container ber-restart policy naik saat boot
|
||||
if [ "$WITH_COCKPIT" = 1 ]; then
|
||||
systemctl enable --now cockpit.socket
|
||||
fi
|
||||
|
||||
if systemctl is-active --quiet firewalld; then
|
||||
log "Firewall: buka Cockpit"
|
||||
firewall-cmd --permanent --add-service=cockpit >/dev/null
|
||||
firewall-cmd --reload >/dev/null
|
||||
ok "firewalld: service 'cockpit' dibuka"
|
||||
else
|
||||
warn "firewalld tidak aktif — dilewati (perlu dibuka manual bila nanti diaktifkan)"
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------- admin user
|
||||
if [ -n "$ADMIN_USER" ]; then
|
||||
log "Menyiapkan user admin untuk Cockpit: $ADMIN_USER"
|
||||
id "$ADMIN_USER" >/dev/null 2>&1 || useradd -m "$ADMIN_USER"
|
||||
usermod -aG wheel "$ADMIN_USER"
|
||||
warn "Set password untuk $ADMIN_USER (dipakai login Cockpit):"
|
||||
passwd "$ADMIN_USER" || warn "gagal set password — jalankan manual: passwd $ADMIN_USER"
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------- ringkasan
|
||||
IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
|
||||
VER_PODMAN="$(rpm -q --qf '%{VERSION}' podman 2>/dev/null || echo '-')"
|
||||
VER_PCOMPOSE="$(rpm -q --qf '%{VERSION}' podman-compose 2>/dev/null || echo '-')"
|
||||
|
||||
printf '\n%s\n' "$(printf "${GRN}==>${NC} Selesai. Fedora siap jadi server container.")"
|
||||
printf ' %-18s %s\n' "podman" "$VER_PODMAN"
|
||||
printf ' %-18s %s\n' "podman-compose" "$VER_PCOMPOSE"
|
||||
printf ' %-18s %s\n' "podman.socket" "$(systemctl is-enabled podman.socket 2>/dev/null || echo off)"
|
||||
printf ' %-18s %s\n' "podman-restart" "$(systemctl is-enabled podman-restart.service 2>/dev/null || echo off)"
|
||||
|
||||
if [ "$WITH_COCKPIT" = 1 ]; then
|
||||
printf ' %-18s %s\n' "Cockpit" "https://${IP:-<ip-vps>}:9090"
|
||||
warn "Cockpit butuh login user + PASSWORD. Cloud image sering key-only (belum ada)."
|
||||
warn "Kalau belum ada user berpassword: useradd -m admin && passwd admin (login pakai 'admin')"
|
||||
fi
|
||||
|
||||
cat <<'EOF'
|
||||
|
||||
Coba cepat:
|
||||
podman run --rm docker.io/alpine echo "podman jalan"
|
||||
Jalankan stack compose:
|
||||
cd /path/berisi/compose.yaml && podman compose up -d
|
||||
EOF
|
||||
Reference in new issue
Block a user