121 lines
5.0 KiB
Markdown
121 lines
5.0 KiB
Markdown
# OverCooked Customer Installer
|
|
|
|
This repository is the public, image-only customer installer. A customer does
|
|
not need access to any application source repository. The installer downloads
|
|
only these public images:
|
|
|
|
- `git.leee.xin/overcooked/overcooked-e`
|
|
- `git.leee.xin/overcooked/overcooked-s-control`
|
|
- `git.leee.xin/overcooked/overcooked-s-webui`
|
|
- `git.leee.xin/overcooked/overcooked-media-node`
|
|
|
|
It does not download or start an Auth image, and it does not use Docker build
|
|
contexts.
|
|
|
|
Because E production mode requires an encrypted control-plane connection, the
|
|
installer generates a minimal allowlisted HTTPS reverse proxy at install time
|
|
and runs it from the already-listed S WebUI image. The proxy only accepts
|
|
mTLS-authenticated `/internal/v1/` requests and `/health/live`, and forwards
|
|
only to the S control service; it is not a public endpoint and does not expose
|
|
Shell, SQL, Docker, or arbitrary file access.
|
|
|
|
## Install
|
|
|
|
```sh
|
|
curl -fsSL \\
|
|
https://git.leee.xin/OverCooked/OverCooked-Installer/raw/branch/main/install.sh \\
|
|
-o install.sh
|
|
|
|
sudo env \\
|
|
OVERCOOKED_SERVER_IP=203.0.113.10 \\
|
|
OVERCOOKED_AUTH_PUBLIC_KEYS='{"auth-1":"PUBLIC_KEY"}' \\
|
|
OVERCOOKED_ACTIVATION_CODE='ACTIVATION_CODE' \\
|
|
./install.sh
|
|
```
|
|
|
|
The default central Auth endpoint is `http://148.135.97.10:18091`. Override it
|
|
with `OVERCOOKED_AUTH_URL`. Auth private keys, administrator credentials,
|
|
license databases, provider credentials, and production secrets are never
|
|
included in this repository.
|
|
|
|
Turnstile is optional. Set `OVERCOOKED_TURNSTILE_SITE_KEY` and
|
|
`OVERCOOKED_TURNSTILE_SECRET_KEY` together to enable it; leaving both empty
|
|
disables only the Turnstile challenge and does not disable Auth, license, or
|
|
login policy checks. A partial pair is rejected by S configuration validation.
|
|
|
|
## Endpoints
|
|
|
|
- WebUI: `http://SERVER_IP:18083/`
|
|
- S API: `http://SERVER_IP:18080/`
|
|
- E: `http://SERVER_IP:8096/`
|
|
- First setup: `http://SERVER_IP:18083/setup`
|
|
|
|
The installer checks these host ports before changing service state and does
|
|
not bind ports 80 or 443. Configure the firewall to allow the chosen public
|
|
ports and restrict database/Valkey traffic to the Docker networks.
|
|
|
|
S's E client uses the private backend Docker network (`http://e-server:8096`)
|
|
with its explicit private-network opt-in. E's control-plane client is a
|
|
separate production path and always uses the generated HTTPS/mTLS proxy.
|
|
|
|
The server address is selected from `OVERCOOKED_SERVER_IP`, or from the
|
|
interface selected by `ip -4 route get 1.1.1.1`. A detected RFC1918,
|
|
loopback, link-local, or carrier-grade NAT address is rejected unless explicitly
|
|
provided through `OVERCOOKED_SERVER_IP`.
|
|
|
|
## Configuration and logs
|
|
|
|
`OVERCOOKED_REGISTRY` and `OVERCOOKED_VERSION` override the default image
|
|
registry and tag. `OVERCOOKED_ROOT` changes the default `/opt/overcooked`
|
|
installation directory. Generated `production.env` is mode 600 and contains
|
|
the setup token and randomly generated service keys. The installer never
|
|
prints those values. Keep the file private.
|
|
|
|
```sh
|
|
docker compose --env-file /opt/overcooked/production.env \\
|
|
-f /opt/overcooked/compose/s.yml -p overcooked-s ps
|
|
docker compose --env-file /opt/overcooked/production.env \\
|
|
-f /opt/overcooked/compose/e.yml -p overcooked-e logs --tail=100
|
|
```
|
|
|
|
Migration is fail-closed. E uses the migration command built into its official
|
|
image. S uses only the schema migration assets published in this repository.
|
|
If either migration fails, the installer exits non-zero and does not start the
|
|
corresponding application service.
|
|
|
|
The fixed PostgreSQL roles are `product_e` and `product_s`; the installer never
|
|
uses a `postgres` superuser login. A retry reuses the passwords in the existing
|
|
mode-600 `production.env` and keeps named volumes. If a role password cannot be
|
|
authenticated, it stops with
|
|
`DATABASE_PASSWORD_MISMATCH_NEEDS_MANUAL_RECOVERY` and does not delete data.
|
|
Only a failed E database volume may be reset, and only when both
|
|
`OVERCOOKED_RESET_FAILED_INSTALL=1` and
|
|
`OVERCOOKED_CONFIRM_NO_BUSINESS_DATA=YES` are explicitly supplied. No
|
|
`down -v` or broad volume cleanup is performed.
|
|
|
|
The installer also exports the approved Media Node image into
|
|
`/opt/overcooked/node-images/media-node.tar.gz`; S uses that archive when a
|
|
customer adds a node without a source checkout.
|
|
|
|
## Common 404/401 download failures
|
|
|
|
The customer command must fetch the raw script from the public Installer
|
|
repository. A 404 usually means a wrong repository, branch, or raw path. A
|
|
401/403 means that a private source URL or credentialed mirror was used. Do
|
|
not grant customer access to application source to work around these errors.
|
|
Use the public raw URL and verify anonymous image pulls instead.
|
|
|
|
## Uninstall
|
|
|
|
Review the project names and volumes first, then stop the two projects:
|
|
|
|
```sh
|
|
docker compose --env-file /opt/overcooked/production.env \\
|
|
-f /opt/overcooked/compose/s.yml -p overcooked-s down
|
|
docker compose --env-file /opt/overcooked/production.env \\
|
|
-f /opt/overcooked/compose/e.yml -p overcooked-e down
|
|
```
|
|
|
|
The named volumes contain customer data and are intentionally not removed by
|
|
the installer or this documentation.
|