# OverCooked Customer Installer

This repository is the public, image-only customer installer. A customer does
not need access to any application source repository. The installer downloads
only these public images:

- `git.leee.xin/overcooked/overcooked-e`
- `git.leee.xin/overcooked/overcooked-s-control`
- `git.leee.xin/overcooked/overcooked-s-webui`
- `git.leee.xin/overcooked/overcooked-media-node`

It does not download or start an Auth image, and it does not use Docker build
contexts.

Because E production mode requires an encrypted control-plane connection, the
installer generates a minimal allowlisted HTTPS reverse proxy at install time
and runs it from the already-listed S WebUI image. The proxy only accepts
mTLS-authenticated `/internal/v1/` requests and `/health/live`, and forwards
only to the S control service; it is not a public endpoint and does not expose
Shell, SQL, Docker, or arbitrary file access.

## Install

```sh
curl -fsSL \\
  https://git.leee.xin/OverCooked/OverCooked-Installer/raw/branch/main/install.sh \\
  -o install.sh

sudo env \\
  OVERCOOKED_SERVER_IP=203.0.113.10 \\
  OVERCOOKED_AUTH_PUBLIC_KEYS='{"auth-1":"PUBLIC_KEY"}' \\
  OVERCOOKED_ACTIVATION_CODE='ACTIVATION_CODE' \\
  ./install.sh
```

The default central Auth endpoint is `http://148.135.97.10:18091`. Override it
with `OVERCOOKED_AUTH_URL`. Auth private keys, administrator credentials,
license databases, provider credentials, and production secrets are never
included in this repository.

Turnstile is optional. Set `OVERCOOKED_TURNSTILE_SITE_KEY` and
`OVERCOOKED_TURNSTILE_SECRET_KEY` together to enable it; leaving both empty
disables only the Turnstile challenge and does not disable Auth, license, or
login policy checks. A partial pair is rejected by S configuration validation.

## Endpoints

- WebUI: `http://SERVER_IP:18083/`
- S API: `http://SERVER_IP:18080/`
- E: `http://SERVER_IP:8096/`
- First setup: `http://SERVER_IP:18083/setup`

The installer checks these host ports before changing service state and does
not bind ports 80 or 443. Configure the firewall to allow the chosen public
ports and restrict database/Valkey traffic to the Docker networks.

S's E client uses the private backend Docker network (`http://e-server:8096`)
with its explicit private-network opt-in. E's control-plane client is a
separate production path and always uses the generated HTTPS/mTLS proxy.

The server address is selected from `OVERCOOKED_SERVER_IP`, or from the
interface selected by `ip -4 route get 1.1.1.1`. A detected RFC1918,
loopback, link-local, or carrier-grade NAT address is rejected unless explicitly
provided through `OVERCOOKED_SERVER_IP`.

## Configuration and logs

`OVERCOOKED_REGISTRY` and `OVERCOOKED_VERSION` override the default image
registry and tag. `OVERCOOKED_ROOT` changes the default `/opt/overcooked`
installation directory. Generated `production.env` is mode 600 and contains
the setup token and randomly generated service keys. The installer never
prints those values. Keep the file private.

```sh
docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/s.yml -p overcooked-s ps
docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/e.yml -p overcooked-e logs --tail=100
```

Migration is fail-closed. E uses the migration command built into its official
image. S uses only the schema migration assets published in this repository.
If either migration fails, the installer exits non-zero and does not start the
corresponding application service.

The installer also exports the approved Media Node image into
`/opt/overcooked/node-images/media-node.tar.gz`; S uses that archive when a
customer adds a node without a source checkout.

## Common 404/401 download failures

The customer command must fetch the raw script from the public Installer
repository. A 404 usually means a wrong repository, branch, or raw path. A
401/403 means that a private source URL or credentialed mirror was used. Do
not grant customer access to application source to work around these errors.
Use the public raw URL and verify anonymous image pulls instead.

## Uninstall

Review the project names and volumes first, then stop the two projects:

```sh
docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/s.yml -p overcooked-s down
docker compose --env-file /opt/overcooked/production.env \\
  -f /opt/overcooked/compose/e.yml -p overcooked-e down
```

The named volumes contain customer data and are intentionally not removed by
the installer or this documentation.