Support Ubuntu 24.04 and harden TacticalRMM install/update scripts#2463
Open
cengbrecht wants to merge 6 commits into
Open
Support Ubuntu 24.04 and harden TacticalRMM install/update scripts#2463cengbrecht wants to merge 6 commits into
cengbrecht wants to merge 6 commits into
Conversation
- allow Ubuntu 24.04 in OS validation alongside existing supported releases - add strict shell error handling with ERR trap and optional trace mode - switch package install/update commands to apt-get and add qrencode plus python3-certbot-dns-cloudflare dependencies - make random secret generation compatible with pipefail by temporarily disabling it around urandom pipelines - support pre-seeded environment variables for domains, email, Django credentials, and Cloudflare token to improve automation - add Cloudflare DNS API wildcard certificate flow while preserving manual DNS, insecure, and BYO certificate modes - strengthen hosts-file detection and initialization logic - improve self-signed certificate setup with safer quoting and clearer mode messaging - make /rmm cloning safer by cloning to a temp directory first and refusing to continue if /rmm already contains unexpected content - install Python build prerequisites including python3-venv and python3-pip - switch venv creation and package management to explicit Python, pip, and manage.py paths instead of relying on shell activation - validate the expected Python 3.11 binary before creating the virtual environment - support noninteractive Django superuser creation when password is supplied - make post-install pause optional with TRMM_AUTO_CONTINUE - replace fragile $GROUP usage with the user's actual primary group - harden MeshCentral readiness loops and related status initialization - add WEB_VERSION and WEBTAR_URL validation before frontend deployment - preserve existing TacticalRMM install flow while improving Ubuntu 24.04 compatibility, repeatability, and script robustness
- allow Ubuntu 24.04 in OS validation alongside existing supported releases
- add strict shell error handling with ERR trap and optional trace mode
- add shared print helpers for consistent error, warning, and status output
- harden self-update execution by preserving original script arguments
- validate the install user lookup from rmm.service before continuing
- capture the caller's primary group and replace fragile $GROUP usage
- prepare and refresh nginx repo key material before apt-get update
- switch package management commands to apt-get for consistency with the
hardened installer flow
- make optional grep-based checks safe under strict mode by treating missing
matches as empty state instead of fatal errors
- normalize service-file repair logic for nats and preserve Group=${USER}
ownership consistency
- update weasyprint dependency checks to use dpkg -s instead of line-count
matching
- validate supported Debian and Ubuntu releases before continuing the update
- replace python3.11 shell activation usage with explicit Python, pip, celery,
and manage.py paths
- remove activate/deactivate dependency from the updater and operate directly
on the virtual environment binaries
- validate the expected Python 3.11 binary before rebuilding the virtual
environment
- install python3-venv and python3-pip when rebuilding Python toolchain
- make /etc/letsencrypt ownership correction conditional on the directory
existing
- harden nginx config patching and file checks with safer quoting
- standardize npm detection with command -v and align NodeSource fallback with
the keyring-based repository method used by the installer
- make host-file detection safe when expected entries are absent
- validate WEB_VERSION and WEBTAR_URL before frontend deployment
- use mkdir -p for reporting schema/assets directory creation to keep updates
idempotent
- add explicit validation for virtual environment python and pip binaries
before running package installs or management commands
- preserve existing TacticalRMM update flow while improving Ubuntu 24.04
compatibility, repeatability, and script robustness
Incremented version to 159
|
|
Author
|
This is my first "real" public commit. This commit also enables Cloudflare DNS Cert Renewal. I have included the instructions for that as a separate file, as I did not know where best to put them in line. When export is used, it is cleared after the run uses it. export djangopassword='adminportalpassword' It also enables silent installation via the variables listed. |
- allow Ubuntu 24.04 in OS validation alongside existing supported releases
- add strict shell error handling with ERR trap and optional trace mode
- add shared print helpers for consistent status and error output
- validate supported Debian and Ubuntu releases before continuing
- capture the caller's primary group and replace fragile ${USER}:${USER}
ownership assumptions
- validate the expected TacticalRMM Python binary before reading runtime
configuration
- validate the expected local_settings.py file before backup operations
- switch jq detection to command -v and install it with apt-get only when
needed for MeshCentral postgres-backed configuration parsing
- replace mixed mkdir usage with mkdir -p for idempotent backup staging and
backup directory creation
- add safer quoting for paths, filenames, and copied certificate/config files
- preserve standalone backup behavior while ensuring /rmmbackups exists and
ownership is corrected before archive creation
- preserve scheduled backup behavior while simplifying backup directory
creation and ownership assignment
- keep daily, weekly, and monthly rotation behavior intact while hardening the
archive creation paths
- preserve existing TacticalRMM backup flow while improving Ubuntu 24.04
compatibility, repeatability, and script robustness
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR updates
install.shandupdate.shto add Ubuntu 24.04 support and harden several fragile script behaviors.Highlights
activate/deactivateby using explicit venv binary paths$GROUPusage with the caller's actual primary groupWEB_VERSION, andWEBTAR_URLbefore continuingScope
These changes are intended to preserve the existing TacticalRMM install/update flow while improving: