🚀 Riepilogo & Installazione
Verifica i dati e avvia l'installazione.
@@ -235,6 +288,91 @@ let keyUploaded = false;
let installing = false;
let installDomain = '';
+// ── Licenza ARGOS: fetch machine_id e gestione upload ────────────────────────
+let licenseValid = false;
+
+async function loadMachineId() {
+ try {
+ const r = await fetch('/api/machine-id');
+ const d = await r.json();
+ const el = document.getElementById('machine-id-display');
+ if (d && d.machine_id) {
+ el.value = d.machine_id;
+ } else {
+ el.value = 'Errore caricamento';
+ }
+ } catch (e) {
+ document.getElementById('machine-id-display').value = 'Errore: ' + e.message;
+ }
+}
+
+function copyMachineId() {
+ const el = document.getElementById('machine-id-display');
+ el.select();
+ navigator.clipboard.writeText(el.value).then(() => {
+ const btn = document.getElementById('btn-copy-mid');
+ const orig = btn.textContent;
+ btn.textContent = '✅ Copiato';
+ setTimeout(() => btn.textContent = orig, 1500);
+ }).catch(() => {});
+}
+
+function handleLicenseDrop(ev) {
+ ev.preventDefault();
+ ev.currentTarget.classList.remove('drag');
+ if (ev.dataTransfer.files.length) uploadLicense(ev.dataTransfer.files[0]);
+}
+
+function handleLicenseFile(inp) {
+ if (inp.files.length) uploadLicense(inp.files[0]);
+}
+
+async function uploadLicense(file) {
+ const errEl = document.getElementById('lic-error');
+ const sumEl = document.getElementById('lic-summary');
+ const btnNext = document.getElementById('btn-after-license');
+ errEl.style.display = 'none';
+ sumEl.style.display = 'none';
+ try {
+ const text = await file.text();
+ const r = await fetch('/api/license/upload', {
+ method: 'POST',
+ headers: {'Content-Type': 'application/json'},
+ body: text,
+ });
+ const d = await r.json();
+ if (!d.ok) {
+ errEl.textContent = 'Licenza non valida: ' + (d.error || 'errore sconosciuto');
+ errEl.style.display = 'block';
+ licenseValid = false;
+ btnNext.disabled = true;
+ btnNext.style.opacity = '.4';
+ btnNext.style.cursor = 'not-allowed';
+ return;
+ }
+ const s = d.summary || {};
+ document.getElementById('lic-customer').textContent = s.customer || '—';
+ document.getElementById('lic-tier').textContent = (s.tier || '—').toUpperCase();
+ document.getElementById('lic-hostname').textContent = s.issued_to || '—';
+ document.getElementById('lic-issued').textContent = s.issued_at || '—';
+ document.getElementById('lic-expires').textContent = s.expires_at || '—';
+ document.getElementById('lic-gitea').textContent = s.has_gitea ? '✓ Incluso' : '— Non incluso';
+ sumEl.style.display = 'block';
+ licenseValid = true;
+ btnNext.disabled = false;
+ btnNext.style.opacity = '1';
+ btnNext.style.cursor = 'pointer';
+ } catch (e) {
+ errEl.textContent = 'Errore upload: ' + e.message;
+ errEl.style.display = 'block';
+ }
+}
+
+// Al caricamento pagina: fetch machine_id
+window.addEventListener('DOMContentLoaded', loadMachineId);
+
+
+
function goTab(n) {
if (n > currentTab) document.getElementById('tab-' + currentTab).classList.add('done');
document.querySelectorAll('.tab-panel').forEach(p => p.classList.remove('active'));
@@ -254,7 +392,7 @@ function goToInstall() {
const err = document.getElementById('pw-error');
if (pw1 !== pw2) { err.style.display = 'block'; return; }
err.style.display = 'none';
- goTab(4);
+ goTab(5);
buildSummary();
}
diff --git a/setup_server.py b/setup_server.py
index f9eb864..c256b52 100644
--- a/setup_server.py
+++ b/setup_server.py
@@ -26,11 +26,121 @@ SETUP_DIR = Path("/opt/argos/setup")
APP_USER = "argos"
PORT = 8888
+# ── Licenza ARGOS — pubkey per verifica firma Ed25519 ─────────────────────────
+# Stessa pubkey hardcoded in backend/core.py. Raw Ed25519 (32 byte) base64.
+# Il setup_server la usa per verificare licenze ricevute dal cliente PRIMA
+# di procedere con l'installazione.
+_LICENSE_PUBLIC_KEY_B64 = "GMRsZMoxOlCBiJU66EsQcj0ZO0gVd0GHB5LelEo/hns="
+
+# ── Clone argos: username Basic Auth bot Gitea (costante del sistema) ─────────
+GITEA_BOT_USER = "argos-portal-bot"
+GITEA_REPO_PATH = "/tecnotel/argos.git"
+
install_log = []
install_done = False
install_error = False
+def get_machine_id() -> str:
+ """Fingerprint univoco del server (stesso algoritmo di core.py).
+ SHA256 hex di: /etc/machine-id | hostname | MAC prima interfaccia fisica.
+ """
+ import socket as _sock
+ import subprocess as _sp
+ parts = []
+ try:
+ with open("/etc/machine-id") as f:
+ parts.append(f.read().strip())
+ except Exception:
+ parts.append("")
+ try:
+ parts.append(_sock.gethostname())
+ except Exception:
+ parts.append("")
+ try:
+ r = _sp.run(["cat", "/sys/class/net/eth0/address"],
+ capture_output=True, text=True, timeout=2)
+ mac = r.stdout.strip()
+ if not mac or mac == "00:00:00:00:00:00":
+ r = _sp.run(["ip", "-o", "link", "show"],
+ capture_output=True, text=True, timeout=2)
+ for line in r.stdout.splitlines():
+ if "link/ether" in line and "00:00:00:00:00:00" not in line:
+ if "docker" in line or "br-" in line or "veth" in line:
+ continue
+ mac = line.split("link/ether")[1].split()[0].strip()
+ break
+ parts.append(mac or "")
+ except Exception:
+ parts.append("")
+ combined = "|".join(parts)
+ return hashlib.sha256(combined.encode()).hexdigest()
+
+
+def verify_license(raw_bytes):
+ """Verifica firma Ed25519 + machine_id match + scadenza.
+
+ Ritorna tupla (ok, license_dict, error_message).
+ Se ok=True, license_dict contiene il payload completo (inclusi gitea_url,
+ gitea_token se presenti). Se ok=False, error_message e' umano-friendly.
+ """
+ try:
+ raw = json.loads(raw_bytes)
+ except Exception as e:
+ return (False, None, f"File non e' JSON valido: {e}")
+
+ if not isinstance(raw, dict):
+ return (False, None, "Formato licenza non riconosciuto")
+
+ # Verifica firma
+ try:
+ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+ from cryptography.exceptions import InvalidSignature
+ import base64
+ sig = raw.pop("signature", "")
+ if not sig:
+ return (False, None, "Licenza senza firma (campo 'signature' mancante)")
+ payload = json.dumps(raw, sort_keys=True, separators=(",", ":"))
+ raw["signature"] = sig # ripristina
+ pub_bytes = base64.b64decode(_LICENSE_PUBLIC_KEY_B64)
+ pub = Ed25519PublicKey.from_public_bytes(pub_bytes)
+ try:
+ pub.verify(base64.b64decode(sig), payload.encode())
+ except InvalidSignature:
+ return (False, None, "Firma non valida. La licenza potrebbe essere manipolata o emessa da altro vendor.")
+ except ImportError:
+ return (False, None, "Libreria 'cryptography' non disponibile. Installa: apt install python3-cryptography")
+ except Exception as e:
+ return (False, None, f"Errore verifica firma: {e}")
+
+ # Verifica machine_id
+ lic_machine = raw.get("machine_id", "")
+ if not lic_machine:
+ return (False, None, "Licenza senza machine_id — formato non supportato")
+ cur_machine = get_machine_id()
+ if lic_machine != cur_machine:
+ return (False, None,
+ f"Machine ID non corrisponde: licenza per {lic_machine[:12]}..., "
+ f"questo server e' {cur_machine[:12]}... "
+ "La licenza non e' valida per questa macchina.")
+
+ # Verifica scadenza
+ expires = raw.get("expires_at", "")
+ if expires:
+ today = datetime.now().strftime("%Y-%m-%d")
+ if expires < today:
+ return (False, None, f"Licenza scaduta il {expires}")
+
+ # Verifica presenza credenziali Gitea (la licenza deve averle per permettere clone)
+ if not raw.get("gitea_url") or not raw.get("gitea_token"):
+ return (False, None,
+ "Licenza priva di credenziali Gitea. "
+ "Contatta Tecnotel per riemetterla con il nuovo formato.")
+
+ return (True, raw, "")
+
+
+
def log(msg):
ts = datetime.now().strftime("%H:%M:%S")
line = f"[{ts}] {msg}"
@@ -166,7 +276,51 @@ def install(data):
try:
log("=== AVVIO INSTALLAZIONE ARGOS SOC ===")
- # 1. argos.json
+ # 0. Carica licenza (gia' validata da /api/license/upload)
+ log("── Verifica licenza ARGOS ──")
+ lic_path = SETUP_DIR / "license.json"
+ if not lic_path.exists():
+ raise RuntimeError(
+ "License.json non trovata in /opt/argos/setup/. "
+ "Caricare una licenza valida prima di avviare l'installazione."
+ )
+ ok, lic, err = verify_license(lic_path.read_bytes())
+ if not ok:
+ raise RuntimeError(f"Licenza non valida: {err}")
+ gitea_url = lic.get("gitea_url", "").rstrip("/")
+ gitea_token = lic.get("gitea_token", "")
+ # Deriva host dal gitea_url (es: https://host/api/v1 -> https://host)
+ gitea_host = gitea_url[:-len("/api/v1")] if gitea_url.endswith("/api/v1") else gitea_url
+ log(f"Licenza OK: {lic.get('customer')} / {lic.get('tier')} / exp {lic.get('expires_at')}")
+
+ # 1. Clone repository argos (URL autenticato temporaneo: token NON in .git/config)
+ log("── Clone repository ARGOS ──")
+ if APP_DIR.exists() and (APP_DIR / ".git").exists():
+ log("Repository gia' presente — skip clone")
+ else:
+ auth_url = f"https://{GITEA_BOT_USER}:{gitea_token}@{gitea_host[len('https://'):]}{GITEA_REPO_PATH}"
+ APP_DIR.parent.mkdir(parents=True, exist_ok=True)
+ # Clona con URL autenticato
+ run(f"git clone {auth_url} {APP_DIR}")
+ # Dopo clone, ripulisci .git/config rimuovendo il token
+ clean_url = f"{gitea_host}{GITEA_REPO_PATH}"
+ run(f"git -C {APP_DIR} remote set-url origin {clean_url}")
+ run(f"chown -R {APP_USER}:{APP_USER} {APP_DIR}")
+ log("Repository ARGOS clonato")
+
+ # 2. Python virtualenv
+ log("── Creazione virtualenv Python ──")
+ venv_dir = APP_DIR / "backend/venv"
+ if not venv_dir.exists():
+ run(f"python3 -m venv {venv_dir}")
+ run(f"{venv_dir}/bin/pip install --upgrade pip -q")
+ req_file = APP_DIR / "backend/requirements.txt"
+ if req_file.exists():
+ run(f"{venv_dir}/bin/pip install -r {req_file} -q")
+ run(f"chown -R {APP_USER}:{APP_USER} {venv_dir}")
+ log("Virtualenv Python pronto")
+
+ # 3. argos.json
log("── Generazione argos.json ──")
CONFIG_DIR.mkdir(parents=True, exist_ok=True)
config = generate_argos_json(data)
@@ -177,7 +331,7 @@ def install(data):
chown(CONFIG_DIR)
log("argos.json creato")
- # 2. integrations.json
+ # 4. integrations.json
log("── Generazione integrations.json ──")
integ = generate_integrations_json()
# Aggiorna pdf con nome organizzazione
@@ -191,14 +345,14 @@ def install(data):
chown(integ_path)
log("integrations.json creato")
- # 3. modules.json
+ # 5. modules.json
mods = APP_DIR / "config/modules.json.example"
if mods.exists():
shutil.copy(mods, CONFIG_DIR / "modules.json")
chown(CONFIG_DIR / "modules.json")
log("modules.json copiato")
- # 4. Logo cliente
+ # 6. Logo cliente
logo_src = SETUP_DIR / "logo_cliente.png"
if logo_src.exists():
DATA_DIR.mkdir(parents=True, exist_ok=True)
@@ -206,7 +360,7 @@ def install(data):
chown(CONFIG_DIR / "assets" / "logo_cliente.png")
log("Logo cliente copiato")
- # 5. Build frontend
+ # 7. Build frontend
log("── Build frontend React ──")
run(f"cd {APP_DIR}/frontend && npm install --silent")
run(f"cd {APP_DIR}/frontend && npm run build")
@@ -216,7 +370,7 @@ def install(data):
run(f"chmod -R 755 {APP_DIR}/frontend/dist/")
log("Frontend buildato")
- # 6. Dipendenze Python
+ # 8. Dipendenze Python (re-run in caso di aggiornamenti)
log("── Dipendenze Python ──")
venv_pip = APP_DIR / "backend/venv/bin/pip"
req = APP_DIR / "backend/requirements.txt"
@@ -224,11 +378,11 @@ def install(data):
run(f"{venv_pip} install -r {req} -q")
log("Dipendenze Python installate")
- # 7. Utente admin
+ # 9. Utente admin
log("── Creazione utente admin ──")
create_admin_user(data)
- # 8. SSL
+ # 10. SSL
log("── Configurazione SSL ──")
domain = data.get("domain", "").strip()
aliases = data.get("aliases", "").strip()
@@ -257,13 +411,13 @@ def install(data):
ssl_key = f"/etc/letsencrypt/live/{domain}/privkey.pem"
log("Certificato Let's Encrypt ottenuto")
- # 9. Nginx finale
+ # 11. Nginx finale
log("── Nginx configurazione finale ──")
_write_nginx_final(all_names, ssl_crt, ssl_key)
run("nginx -t && systemctl restart nginx")
log("Nginx configurato")
- # 10. Systemd services
+ # 12. Systemd services
log("── Creazione e avvio servizi ──")
_write_services()
run("systemctl daemon-reload")
@@ -271,7 +425,15 @@ def install(data):
run(f"systemctl enable --now {svc}")
log(f"{svc} avviato")
- # 11. Chiudi web installer
+ # 13. Copia licenza + chiudi web installer
+ log("── Copia licenza in posizione finale ──")
+ DATA_DIR.mkdir(parents=True, exist_ok=True)
+ final_lic = DATA_DIR / "license.json"
+ shutil.copy(lic_path, final_lic)
+ os.chmod(final_lic, 0o600)
+ chown(final_lic)
+ log(f"Licenza copiata in {final_lic}")
+
log("── Chiusura web installer ──")
run("systemctl disable --now argos-setup", check=False)
run("ufw delete allow 8888/tcp", check=False)
@@ -435,6 +597,8 @@ class SetupHandler(BaseHTTPRequestHandler):
self.wfile.write(html)
elif path == "/api/status":
self._json({"done": install_done, "error": install_error, "log": install_log[-60:]})
+ elif path == "/api/machine-id":
+ self._json({"machine_id": get_machine_id()})
else:
self.send_response(404); self.end_headers()
@@ -462,6 +626,28 @@ class SetupHandler(BaseHTTPRequestHandler):
SETUP_DIR.mkdir(parents=True, exist_ok=True)
(SETUP_DIR / "logo_cliente.png").write_bytes(body)
self._json({"ok": True})
+ elif path == "/api/license/upload":
+ ok, lic, err = verify_license(body)
+ if not ok:
+ self._json({"ok": False, "error": err}, 400)
+ return
+ # Salva licenza valida nel SETUP_DIR per essere usata durante install()
+ SETUP_DIR.mkdir(parents=True, exist_ok=True)
+ lic_path = SETUP_DIR / "license.json"
+ lic_path.write_bytes(body)
+ os.chmod(lic_path, 0o600)
+ # Risposta: solo dati sommari (non rinvia token in plain)
+ self._json({
+ "ok": True,
+ "summary": {
+ "customer": lic.get("customer", ""),
+ "tier": lic.get("tier", ""),
+ "issued_to": lic.get("issued_to", ""),
+ "issued_at": lic.get("issued_at", ""),
+ "expires_at": lic.get("expires_at", ""),
+ "has_gitea": bool(lic.get("gitea_token")),
+ }
+ })
else:
self.send_response(404); self.end_headers()