Merge pull request #143 from theta42/feature/v1.35.0-final-roll-up

release: v1.35.0 final roll-up

CHANGELOG.md

@@ -8,6 +8,19 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
+## [v1.35.0] - 2026-08-02
+
+### Added
+- **Non-interactive theta-agent configuration** — Added three `setup.env` variables
+  to control theta-agent installation and configuration without interactive prompts:
+  - `CFG_THETA_AGENT_ENABLE` (default: 1) — Enable theta-agent installation
+  - `CFG_THETA_AGENT_LDAP_AUTH` (default: 1) — Configure LDAP authentication via ldap-client
+  - `CFG_THETA_AGENT_FULL_CONTROL` (default: 1) — Enable all agent capabilities
+
+### Changed
+- **`setup.sh`**: Made theta-agent setup fully non-interactive, driven by `setup.env`
+  variables. Defaults preserve existing behavior (all features enabled).
+
 ## [v1.34.0] - 2026-08-02
 
 ### Added

setup.env.example

@@ -73,13 +73,6 @@ CFG_DOMAIN=example.com
 # 'sso-manager' so clients don't need a public 636 port forward. See docs.
 #CFG_LDAPS_HOST=
 
-# Optional SMTP (outbound email from the SSO app). Leave blank to disable:
-#CFG_SMTP_HOST=smtp.example.com
-#CFG_SMTP_PORT=587
-#CFG_SMTP_USER=noreply@example.com
-#CFG_SMTP_PASS=your-smtp-password
-#CFG_SMTP_FROM=SSO Manager <noreply@example.com>
-
 # ── DO NOT put secrets here ──────────────────────────────────────────────────
 # The LDAP admin password, JWT secret, admin password, LDAP service-account
 # password, and the proxy's local admin password are all GENERATED (random)
@@ -90,6 +83,20 @@ CFG_DOMAIN=example.com
 # CFG_LDAP_ADMIN_PASS / CFG_JWT_SECRET / CFG_ADMIN_PASS / CFG_SVC_PASS /
 # CFG_PROXY_ADMIN_PASS here.
 
+# ── theta-agent Host Integration ─────────────────────────────────────────────
+# Configure theta-agent integration with the local host. All options default to
+# enabled (1). Set to 0 to disable.
+#
+# Enable theta-agent installation and configuration on this host.
+#CFG_THETA_AGENT_ENABLE=1
+#
+# Configure LDAP authentication for this host via ldap-client (SSSD/PAM).
+#CFG_THETA_AGENT_LDAP_AUTH=1
+#
+# Allow theta-agent full control of this host (arbitrary_bash, service_control,
+# reboot, configure_ldap capabilities).
+#CFG_THETA_AGENT_FULL_CONTROL=1
+
 # ── Geo-Location Scaling (N-Way Multi-Master LDAP) ───────────────────────────
 # If deploying this stack across multiple physical sites to provide local HA
 # for directory services, you can enable N-Way Multi-Master OpenLDAP replication.

setup.sh

@@ -674,7 +674,7 @@ for i in $(seq 1 30); do
 	sleep 2
 done
 
-if ! docker exec openbao bao status -format=json 2>/dev/null | grep -q '"initialized": true' || true; then
+if ! docker exec openbao bao status -format=json 2>/dev/null | grep -q '"initialized": true'; then
     status_json=$(docker exec openbao bao status -format=json 2>/dev/null || true)
     if ! echo "$status_json" | grep -q '"initialized": true'; then
         info "Initializing openbao for the first time..."
@@ -1046,31 +1046,34 @@ NODEEOF
 echo "$JUMP_HOSTS_OUT" | sed 's/^/[setup] /'
 
 # ── 7c. Install theta-agent on the host ──────────────────────────────────────
-info "Setting up theta-agent on the host..."
-(
-	cd theta-agent || exit 0
-	if ! command -v go >/dev/null 2>&1; then
-		warn "Go is not installed. Skipping theta-agent installation."
-	else
-		info "  Building theta-agent..."
-		go build -o theta-agent main.go websocket.go config.go || warn "  Failed to build theta-agent."
-		if [[ -x "theta-agent" ]]; then
-			sudo mkdir -p /etc/theta
-			if [[ ! -f /etc/theta/agent.yml ]]; then
-				sudo cp agent.yml.example /etc/theta/agent.yml
-				AGENT_TOKEN="$(rand_hex 16)"
-				sudo sed -i "s/REPLACE_WITH_AGENT_TOKEN/$AGENT_TOKEN/" /etc/theta/agent.yml
-				# We want to connect to either https or http depending on CFG_CREATE_ALL_HTTP
-				if [[ "$CFG_CREATE_ALL_HTTP" == "1" ]]; then
-					sudo sed -i "s|https://sso.example.com|http://${SSO_HOST}|" /etc/theta/agent.yml
-				else
-					sudo sed -i "s|https://sso.example.com|https://${SSO_HOST}|" /etc/theta/agent.yml
+# Controlled by CFG_THETA_AGENT_ENABLE (default: 1 = enabled)
+CFG_THETA_AGENT_ENABLE="${CFG_THETA_AGENT_ENABLE:-1}"
+if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]]; then
+	info "Setting up theta-agent on the host..."
+	(
+		cd theta-agent || exit 0
+		if ! command -v go >/dev/null 2>&1; then
+			warn "Go is not installed. Skipping theta-agent installation."
+		else
+			info "  Building theta-agent..."
+			go build -o theta-agent main.go websocket.go config.go || warn "  Failed to build theta-agent."
+			if [[ -x "theta-agent" ]]; then
+				sudo mkdir -p /etc/theta
+				if [[ ! -f /etc/theta/agent.yml ]]; then
+					sudo cp agent.yml.example /etc/theta/agent.yml
+					AGENT_TOKEN="$(rand_hex 16)"
+					sudo sed -i "s/REPLACE_WITH_AGENT_TOKEN/$AGENT_TOKEN/" /etc/theta/agent.yml
+					# We want to connect to either https or http depending on CFG_CREATE_ALL_HTTP
+					if [[ "$CFG_CREATE_ALL_HTTP" == "1" ]]; then
+						sudo sed -i "s|https://sso.example.com|http://${SSO_HOST}|" /etc/theta/agent.yml
+					else
+						sudo sed -i "s|https://sso.example.com|https://${SSO_HOST}|" /etc/theta/agent.yml
+					fi
 				fi
-			fi
-			sudo cp theta-agent /usr/local/bin/theta-agent
-			sudo chmod +x /usr/local/bin/theta-agent
-			
-			sudo bash -c "cat <<'EOF' > /etc/systemd/system/theta-agent.service
+				sudo cp theta-agent /usr/local/bin/theta-agent
+				sudo chmod +x /usr/local/bin/theta-agent
+
+				sudo bash -c "cat <<'EOF' > /etc/systemd/system/theta-agent.service
 [Unit]
 Description=Theta Agent
 After=network.target
@@ -1084,12 +1087,58 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF"
-			sudo systemctl daemon-reload
-			sudo systemctl enable --now theta-agent.service
-			info "  theta-agent installed and started."
+				sudo systemctl daemon-reload
+				sudo systemctl enable --now theta-agent.service
+				info "  theta-agent installed and started."
+			fi
 		fi
+	)
+else
+	info "theta-agent installation skipped (CFG_THETA_AGENT_ENABLE=0)."
+fi
+# ── 7d. Configure theta-agent integration with this host ─────────────────────
+# Non-interactive configuration driven by setup.env variables:
+#   CFG_THETA_AGENT_ENABLE (default: 1) - Install/configure theta-agent
+#   CFG_THETA_AGENT_LDAP_AUTH (default: 1) - Configure LDAP authentication via ldap-client
+#   CFG_THETA_AGENT_FULL_CONTROL (default: 1) - Enable all agent capabilities
+# Only runs if theta-agent was installed (section 7c) or already exists.
+if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]] && [[ -x /usr/local/bin/theta-agent ]]; then
+	info "Configuring theta-agent integration with this host..."
+
+	# Default to enabled unless explicitly disabled
+	CFG_THETA_AGENT_LDAP_AUTH="${CFG_THETA_AGENT_LDAP_AUTH:-1}"
+	CFG_THETA_AGENT_FULL_CONTROL="${CFG_THETA_AGENT_FULL_CONTROL:-1}"
+
+	if [[ "$CFG_THETA_AGENT_LDAP_AUTH" == "1" ]]; then
+		info "  Configuring LDAP authentication for this host..."
+		(
+			cd ldap-client || exit 0
+			if [[ -x "index.sh" ]]; then
+				bash index.sh --non-interactive 2>/dev/null || warn "  ldap-client enrollment failed (continuing)..."
+			fi
+		)
+	else
+		info "  LDAP authentication configuration skipped (CFG_THETA_AGENT_LDAP_AUTH=0)."
 	fi
-)
+
+	if [[ "$CFG_THETA_AGENT_FULL_CONTROL" == "1" ]]; then
+		info "  Configuring theta-agent with full host control capabilities..."
+		if [[ -f /etc/theta/agent.yml ]]; then
+			sudo sed -i 's/arbitrary_bash: false/arbitrary_bash: true/' /etc/theta/agent.yml
+			sudo sed -i 's/service_control: .*/service_control: true/' /etc/theta/agent.yml
+			sudo sed -i 's/reboot: false/reboot: true/' /etc/theta/agent.yml
+			sudo sed -i 's/configure_ldap: false/configure_ldap: true/' /etc/theta/agent.yml
+			info "  theta-agent full control enabled. Restarting service..."
+			sudo systemctl restart theta-agent.service
+		else
+			warn "  /etc/theta/agent.yml not found. Full control not configured."
+		fi
+	else
+		info "  theta-agent running with limited capabilities (CFG_THETA_AGENT_FULL_CONTROL=0)."
+	fi
+else
+	info "  theta-agent configuration skipped (agent not installed or CFG_THETA_AGENT_ENABLE=0)."
+fi
 
 # ── 8. Summary ───────────────────────────────────────────────────────────────
 echo