#!/bin/bash
#
#*****************************************************
#File Name    : install_keepalived.sh
#Author       : guokai
#Mail         : xxx@163.com
#Create Time  : 2022-04-15 14:44:47
#Description  : The test script
#*****************************************************
SRC_DIR=/usr/local/src
KEEPALIVED_URL=https://keepalived.org/software/
NEIBU_URL=http://58.220.50.162:7777/download/
KEEPALIVED_FILE=keepalived-2.3.4
TAR=.tar.gz
KEEPALIVED_INSTALL_DIR=/usr/local/keepalived
CPUS=`lscpu | awk '/^CPU\(s\):/{print $2}'`
DEVICE=`nmcli device status | grep connected|grep ethernet | awk '{print $1}' | head -n 1`

color () {
	RES_COL=60
	MOVE_TO_COL="echo -en \\033[${RES_COL}G"
	SETCOLOR_SUCCESS="echo -en \\033[1;32m"
	SETCOLOR_FAILURE="echo -en \\033[1;31m"
	SETCOLOR_WARNING="echo -en \\033[1;33m"
	SETCOLOR_NORMAL="echo -en \E[0m"
	echo -n "$2" && $MOVE_TO_COL
	echo -n "["
	if [ $1 = "success" -o $1 = "0" ] ;then ${SETCOLOR_SUCCESS}
		echo -n $"  OK  "
	elif [ $1 = "failure" -o $1 = "1" ] ;then ${SETCOLOR_FAILURE}
		echo -n $"FAILED"
	else 
		${SETCOLOR_WARNING}
		echo -n $"WARNING"
	fi
	${SETCOLOR_NORMAL}
	echo -n "]"
	echo
}



check () {
	color 0 "开始安装依赖软件"
	dnf -y install gcc curl openssl-devel libnl3-devel
	color 0 "安装ansible"
	dnf install -y ansible-core sshpass
	if [ $(rpm -qa | grep -c keepalived) -gt 1 ]; then
    	color 1 "keepalived 已安装,请卸载后再安装"
		exit
	else
    	color 0 "开始安装keepalived-2.2.8"
		dnf -y install keepalived-2.2.8-5.el9_6.x86_64
	fi
	
}
keepuser(){
	color 0 "开始创建非root运行用户keepuser"
	useradd -m  -s /sbin/nologin keepuser
	mkdir -p /home/keepuser/keepalived
}

install_keepalived(){
	color 0 "开始安装 keepalived"

	mv /etc/keepalived/keepalived.conf /home/keepuser/keepalived/keepalived.conf
	cat > /home/keepuser/keepalived/keepalived.conf <<EOF
vrrp_instance VI_1 {
    state MASTER
    interface $DEVICE
    virtual_router_id 51
    priority 100
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass 1111
    }

    virtual_ipaddress {
        1.1.1.1/24 dev $DEVICE
    }
}
EOF
	sleep 2
	chown -R keepuser:keepuser  /usr/sbin/keepalived
	chown -R keepuser:keepuser /home/keepuser/keepalived
	cat > /etc/systemd/system/keepalived-nonroot.service <<EOF
[Unit]
Description=Keepalived non-root VRRP
After=network-online.target
Wants=network-online.target

[Service]
Type=forking
User=keepuser
Group=keepuser

# 保持 capability
SecureBits=keep-caps

# 限定能力边界 (只允许这两个能力)
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW

# 给进程加 ambient 能力
#AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
#ExecStartPre=/usr/sbin/setcap cap_net_admin,cap_net_raw+ep /usr/sbin/keepalived
ExecStart=/usr/sbin/keepalived   -f /home/keepuser/keepalived/keepalived.conf   -p /home/keepuser/keepalived/keepalived.pid   -r /home/keepuser/keepalived/vrrp.pid

ExecReload=/bin/kill -HUP 
ExecStop=/bin/kill 

Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

EOF
	chown keepuser:keepuser /etc/systemd/system/keepalived-nonroot.service
	mv /usr/lib/systemd/system/keepalived.service /usr/lib/systemd/system/keepalived.servicebak
	systemctl daemon-reload
	setcap 'cap_net_admin,cap_net_raw+ep' /usr/sbin/keepalived
	systemctl enable --now keepalived-nonroot.service &> /dev/null 
    systemctl status keepalived-nonroot.service 
	color 0 "keepalived 安装完成" 
	
}

check
keepuser
install_keepalived
