Merge pull request #148 from theta42/fix/setup-openbao-unseal-fallback-v1.35.5

fix(setup): fallback to .env VAULT_UNSEAL_KEY and VAULT_TOKEN if bao-init.json is missing v1.35.5

CHANGELOG.md

@@ -8,6 +8,30 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
+## [v1.35.2] - 2026-08-03
+
+### Fixed
+- **Unbound `CFG_CREATE_ALL_HTTP` variable in `setup.sh`** — Fixed unbound variable error during host registration in `setup.sh` when `ensure_secrets_files()` is skipped on pre-configured installations.
+
+## [v1.35.1] - 2026-08-03
+
+### Fixed
+- **Directory & Configuration UI enhancements** — Live Cytoscape graph update on parent/child edge modifications, improved discovery reconciler host matching, updated configuration sidebar layout, relocated discovery and messaging plugins to Directory and Configuration pages.
+- **Managed Host Target Filter** — Filter SSH connection targets in Jump Host to managed hosts only.
+
+## [v1.35.0] - 2026-08-02
+
+### Added
+- **Non-interactive theta-agent configuration** — Added three `setup.env` variables
+  to control theta-agent installation and configuration without interactive prompts:
+  - `CFG_THETA_AGENT_ENABLE` (default: 1) — Enable theta-agent installation
+  - `CFG_THETA_AGENT_LDAP_AUTH` (default: 1) — Configure LDAP authentication via ldap-client
+  - `CFG_THETA_AGENT_FULL_CONTROL` (default: 1) — Enable all agent capabilities
+
+### Changed
+- **`setup.sh`**: Made theta-agent setup fully non-interactive, driven by `setup.env`
+  variables. Defaults preserve existing behavior (all features enabled).
+
 ## [v1.34.0] - 2026-08-02
 
 ### Added

bootstrap/bootstrap.js

@@ -423,10 +423,12 @@ async function seedDirectory(token, clientId, jumpClientId) {
 	const host = await ensure('host', HOST_FACTS.name || 'Stack host', hostSlug, site.id, {
 		subType: 'linux',
 		ip: HOST_FACTS.ip,
+		address: HOST_FACTS.ip,
 		macAddress: HOST_FACTS.mac,
 		os: HOST_FACTS.os,
 		kernel: HOST_FACTS.kernel,
 		sshPort: 22,
+		managed: true,
 	}, ['stack-host']);
 	await ensure('service', 'SSO Manager', 'sso-manager', host.id, {
 		address: `https://${SSO_HOST}`,

setup.env.example

@@ -73,13 +73,6 @@ CFG_DOMAIN=example.com
 # 'sso-manager' so clients don't need a public 636 port forward. See docs.
 #CFG_LDAPS_HOST=
 
-# Optional SMTP (outbound email from the SSO app). Leave blank to disable:
-#CFG_SMTP_HOST=smtp.example.com
-#CFG_SMTP_PORT=587
-#CFG_SMTP_USER=noreply@example.com
-#CFG_SMTP_PASS=your-smtp-password
-#CFG_SMTP_FROM=SSO Manager <noreply@example.com>
-
 # ── DO NOT put secrets here ──────────────────────────────────────────────────
 # The LDAP admin password, JWT secret, admin password, LDAP service-account
 # password, and the proxy's local admin password are all GENERATED (random)
@@ -90,6 +83,20 @@ CFG_DOMAIN=example.com
 # CFG_LDAP_ADMIN_PASS / CFG_JWT_SECRET / CFG_ADMIN_PASS / CFG_SVC_PASS /
 # CFG_PROXY_ADMIN_PASS here.
 
+# ── theta-agent Host Integration ─────────────────────────────────────────────
+# Configure theta-agent integration with the local host. All options default to
+# enabled (1). Set to 0 to disable.
+#
+# Enable theta-agent installation and configuration on this host.
+#CFG_THETA_AGENT_ENABLE=1
+#
+# Configure LDAP authentication for this host via ldap-client (SSSD/PAM).
+#CFG_THETA_AGENT_LDAP_AUTH=1
+#
+# Allow theta-agent full control of this host (arbitrary_bash, service_control,
+# reboot, configure_ldap capabilities).
+#CFG_THETA_AGENT_FULL_CONTROL=1
+
 # ── Geo-Location Scaling (N-Way Multi-Master LDAP) ───────────────────────────
 # If deploying this stack across multiple physical sites to provide local HA
 # for directory services, you can enable N-Way Multi-Master OpenLDAP replication.

setup.sh

@@ -178,6 +178,8 @@ fi
 # resolved in ensure_config; this is only the hostname override.
 [[ -f ./setup.env ]] && parse_kv_file ./setup.env
 export CFG_JUMP_HOST
+CFG_CREATE_ALL_HTTP="${CFG_CREATE_ALL_HTTP:-0}"
+export CFG_CREATE_ALL_HTTP
 
 # ── Optional outbound HTTP(S) proxy for docker build + the running containers ─
 # CFG_HTTP_PROXY / CFG_HTTPS_PROXY / CFG_NO_PROXY (from ./setup.env or the
@@ -674,7 +676,7 @@ for i in $(seq 1 30); do
 	sleep 2
 done
 
-if ! docker exec openbao bao status -format=json 2>/dev/null | grep -q '"initialized": true' || true; then
+if ! docker exec openbao bao status -format=json 2>/dev/null | grep -q '"initialized": true'; then
     status_json=$(docker exec openbao bao status -format=json 2>/dev/null || true)
     if ! echo "$status_json" | grep -q '"initialized": true'; then
         info "Initializing openbao for the first time..."
@@ -686,13 +688,37 @@ fi
 
 status_json=$(docker exec openbao bao status -format=json 2>/dev/null || true)
 if echo "$status_json" | grep -q '"sealed": true'; then
-	info "Unsealing openbao..."
-	UNSEAL_KEY=$(grep -A1 '"unseal_keys_b64":' "$CONFIG_DIR/bao-init.json" | tail -n1 | cut -d'"' -f2)
-	docker exec openbao bao operator unseal "$UNSEAL_KEY" >/dev/null
+	UNSEAL_KEY=""
+	if [[ -f "$CONFIG_DIR/bao-init.json" ]]; then
+		UNSEAL_KEY=$(grep -A1 '"unseal_keys_b64":' "$CONFIG_DIR/bao-init.json" 2>/dev/null | tail -n1 | cut -d'"' -f2 || true)
+	fi
+	if [[ -z "$UNSEAL_KEY" ]]; then
+		UNSEAL_KEY="$(env_get VAULT_UNSEAL_KEY)"
+	fi
+
+	if [[ -n "$UNSEAL_KEY" ]]; then
+		info "Unsealing openbao..."
+		docker exec openbao bao operator unseal "$UNSEAL_KEY" >/dev/null
+	else
+		die "OpenBao is sealed, but no unseal key was found in $CONFIG_DIR/bao-init.json or .env (VAULT_UNSEAL_KEY)."
+	fi
 fi
 
 export VAULT_TOKEN
-VAULT_TOKEN=$(grep '"root_token":' "$CONFIG_DIR/bao-init.json" | cut -d'"' -f4)
+if [[ -f "$CONFIG_DIR/bao-init.json" ]]; then
+	VAULT_TOKEN=$(grep '"root_token":' "$CONFIG_DIR/bao-init.json" 2>/dev/null | cut -d'"' -f4 || true)
+fi
+if [[ -z "$VAULT_TOKEN" ]]; then
+	VAULT_TOKEN="$(env_get VAULT_TOKEN)"
+fi
+
+if [[ -z "$VAULT_TOKEN" ]]; then
+	die "Could not determine OpenBao VAULT_TOKEN from $CONFIG_DIR/bao-init.json or .env."
+fi
+
+if [[ -n "$UNSEAL_KEY" ]]; then
+	env_upsert VAULT_UNSEAL_KEY "$UNSEAL_KEY"
+fi
 env_upsert VAULT_TOKEN "$VAULT_TOKEN"
 
 if ! docker exec -e BAO_TOKEN="$VAULT_TOKEN" openbao bao secrets list -format=json 2>/dev/null | grep -q '"secret/":'; then
@@ -978,7 +1004,7 @@ async function ensureHost(host, ip, targetPort) {
 			host: host,
 			ip: ip,
 			targetPort: targetPort,
-			forcessl: $( [[ "$CFG_CREATE_ALL_HTTP" == "1" ]] && echo false || echo true ),
+			forcessl: $( [[ "${CFG_CREATE_ALL_HTTP:-0}" == "1" ]] && echo false || echo true ),
 			targetssl: false,
 			sso_enabled: false,
 			created_by: 'setup.sh',
@@ -1035,7 +1061,7 @@ const {Host} = require('/app/models').models;
 		try { await Host.get($(js_str "$JUMP_HOST")); console.log('SKIP ${JUMP_HOST} (already exists)'); }
 		catch (e) {
 			if (e.name !== 'EntryNotFound') throw e;
-			await Host.create({ host: $(js_str "$JUMP_HOST"), ip: 'jump-host', targetPort: 3002, forcessl: $( [[ "$CFG_CREATE_ALL_HTTP" == "1" ]] && echo false || echo true ), targetssl: false, sso_enabled: false, created_by: 'setup.sh' });
+			await Host.create({ host: $(js_str "$JUMP_HOST"), ip: 'jump-host', targetPort: 3002, forcessl: $( [[ "${CFG_CREATE_ALL_HTTP:-0}" == "1" ]] && echo false || echo true ), targetssl: false, sso_enabled: false, created_by: 'setup.sh' });
 			console.log('CREATED ${JUMP_HOST} -> jump-host:3002');
 		}
 		process.exit(0);
@@ -1046,31 +1072,34 @@ NODEEOF
 echo "$JUMP_HOSTS_OUT" | sed 's/^/[setup] /'
 
 # ── 7c. Install theta-agent on the host ──────────────────────────────────────
-info "Setting up theta-agent on the host..."
-(
-	cd theta-agent || exit 0
-	if ! command -v go >/dev/null 2>&1; then
-		warn "Go is not installed. Skipping theta-agent installation."
-	else
-		info "  Building theta-agent..."
-		go build -o theta-agent main.go websocket.go config.go || warn "  Failed to build theta-agent."
-		if [[ -x "theta-agent" ]]; then
-			sudo mkdir -p /etc/theta
-			if [[ ! -f /etc/theta/agent.yml ]]; then
-				sudo cp agent.yml.example /etc/theta/agent.yml
-				AGENT_TOKEN="$(rand_hex 16)"
-				sudo sed -i "s/REPLACE_WITH_AGENT_TOKEN/$AGENT_TOKEN/" /etc/theta/agent.yml
-				# We want to connect to either https or http depending on CFG_CREATE_ALL_HTTP
-				if [[ "$CFG_CREATE_ALL_HTTP" == "1" ]]; then
-					sudo sed -i "s|https://sso.example.com|http://${SSO_HOST}|" /etc/theta/agent.yml
-				else
-					sudo sed -i "s|https://sso.example.com|https://${SSO_HOST}|" /etc/theta/agent.yml
+# Controlled by CFG_THETA_AGENT_ENABLE (default: 1 = enabled)
+CFG_THETA_AGENT_ENABLE="${CFG_THETA_AGENT_ENABLE:-1}"
+if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]]; then
+	info "Setting up theta-agent on the host..."
+	(
+		cd theta-agent || exit 0
+		if ! command -v go >/dev/null 2>&1; then
+			warn "Go is not installed. Skipping theta-agent installation."
+		else
+			info "  Building theta-agent..."
+			go build -o theta-agent main.go websocket.go config.go || warn "  Failed to build theta-agent."
+			if [[ -x "theta-agent" ]]; then
+				sudo mkdir -p /etc/theta
+				if [[ ! -f /etc/theta/agent.yml ]]; then
+					sudo cp agent.yml.example /etc/theta/agent.yml
+					AGENT_TOKEN="$(rand_hex 16)"
+					sudo sed -i "s/REPLACE_WITH_AGENT_TOKEN/$AGENT_TOKEN/" /etc/theta/agent.yml
+					# We want to connect to either https or http depending on CFG_CREATE_ALL_HTTP
+					if [[ "${CFG_CREATE_ALL_HTTP:-0}" == "1" ]]; then
+						sudo sed -i "s|https://sso.example.com|http://${SSO_HOST}|" /etc/theta/agent.yml
+					else
+						sudo sed -i "s|https://sso.example.com|https://${SSO_HOST}|" /etc/theta/agent.yml
+					fi
 				fi
-			fi
-			sudo cp theta-agent /usr/local/bin/theta-agent
-			sudo chmod +x /usr/local/bin/theta-agent
-			
-			sudo bash -c "cat <<'EOF' > /etc/systemd/system/theta-agent.service
+				sudo cp theta-agent /usr/local/bin/theta-agent
+				sudo chmod +x /usr/local/bin/theta-agent
+
+				sudo bash -c "cat <<'EOF' > /etc/systemd/system/theta-agent.service
 [Unit]
 Description=Theta Agent
 After=network.target
@@ -1084,12 +1113,58 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF"
-			sudo systemctl daemon-reload
-			sudo systemctl enable --now theta-agent.service
-			info "  theta-agent installed and started."
+				sudo systemctl daemon-reload
+				sudo systemctl enable --now theta-agent.service
+				info "  theta-agent installed and started."
+			fi
 		fi
+	)
+else
+	info "theta-agent installation skipped (CFG_THETA_AGENT_ENABLE=0)."
+fi
+# ── 7d. Configure theta-agent integration with this host ─────────────────────
+# Non-interactive configuration driven by setup.env variables:
+#   CFG_THETA_AGENT_ENABLE (default: 1) - Install/configure theta-agent
+#   CFG_THETA_AGENT_LDAP_AUTH (default: 1) - Configure LDAP authentication via ldap-client
+#   CFG_THETA_AGENT_FULL_CONTROL (default: 1) - Enable all agent capabilities
+# Only runs if theta-agent was installed (section 7c) or already exists.
+if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]] && [[ -x /usr/local/bin/theta-agent ]]; then
+	info "Configuring theta-agent integration with this host..."
+
+	# Default to enabled unless explicitly disabled
+	CFG_THETA_AGENT_LDAP_AUTH="${CFG_THETA_AGENT_LDAP_AUTH:-1}"
+	CFG_THETA_AGENT_FULL_CONTROL="${CFG_THETA_AGENT_FULL_CONTROL:-1}"
+
+	if [[ "$CFG_THETA_AGENT_LDAP_AUTH" == "1" ]]; then
+		info "  Configuring LDAP authentication for this host..."
+		(
+			cd ldap-client || exit 0
+			if [[ -x "index.sh" ]]; then
+				bash index.sh --non-interactive 2>/dev/null || warn "  ldap-client enrollment failed (continuing)..."
+			fi
+		)
+	else
+		info "  LDAP authentication configuration skipped (CFG_THETA_AGENT_LDAP_AUTH=0)."
 	fi
-)
+
+	if [[ "$CFG_THETA_AGENT_FULL_CONTROL" == "1" ]]; then
+		info "  Configuring theta-agent with full host control capabilities..."
+		if [[ -f /etc/theta/agent.yml ]]; then
+			sudo sed -i 's/arbitrary_bash: false/arbitrary_bash: true/' /etc/theta/agent.yml
+			sudo sed -i 's/service_control: .*/service_control: true/' /etc/theta/agent.yml
+			sudo sed -i 's/reboot: false/reboot: true/' /etc/theta/agent.yml
+			sudo sed -i 's/configure_ldap: false/configure_ldap: true/' /etc/theta/agent.yml
+			info "  theta-agent full control enabled. Restarting service..."
+			sudo systemctl restart theta-agent.service
+		else
+			warn "  /etc/theta/agent.yml not found. Full control not configured."
+		fi
+	else
+		info "  theta-agent running with limited capabilities (CFG_THETA_AGENT_FULL_CONTROL=0)."
+	fi
+else
+	info "  theta-agent configuration skipped (agent not installed or CFG_THETA_AGENT_ENABLE=0)."
+fi
 
 # ── 8. Summary ───────────────────────────────────────────────────────────────
 echo