From a0e722f91f21882bd4b6318c938847f992f82ecb Mon Sep 17 00:00:00 2001 From: Abhishek Kumar Date: Sat, 27 Jun 2026 17:00:19 +0530 Subject: [PATCH] fix: force script run as sudo --- docs/deployment/scaling.mdx | 2 +- scripts/setup_custom_domain.sh | 2 +- scripts/setup_remote.sh | 13 ++++++++----- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/deployment/scaling.mdx b/docs/deployment/scaling.mdx index b3910eda..b5bedd3b 100644 --- a/docs/deployment/scaling.mdx +++ b/docs/deployment/scaling.mdx @@ -55,7 +55,7 @@ Number of FastAPI workers (uvicorn processes nginx will load-balance): Press Enter for the default (`4`) or enter a different positive integer. Non-interactive callers (cloud-init, CI, Terraform) can set the value via environment variable instead: ```bash -SERVER_IP=... TURN_SECRET=... FASTAPI_WORKERS=8 ./setup_remote.sh +sudo SERVER_IP=... TURN_SECRET=... FASTAPI_WORKERS=8 ./setup_remote.sh ``` The script stores the value in **`.env`** (`FASTAPI_WORKERS=N`). The supported startup path (`./remote_up.sh`) preflights the `dograh-init` render from that value before every remote start, so nginx and the API worker count stay aligned. diff --git a/scripts/setup_custom_domain.sh b/scripts/setup_custom_domain.sh index 8860281f..7d5962dd 100755 --- a/scripts/setup_custom_domain.sh +++ b/scripts/setup_custom_domain.sh @@ -43,7 +43,7 @@ if [[ ! -d "dograh" ]]; then echo -e "${RED}Error: 'dograh' directory not found.${NC}" echo -e "${YELLOW}Please run this script from the directory containing your Dograh installation.${NC}" echo -e "${YELLOW}If you haven't set up Dograh yet, run the remote setup first:${NC}" - echo -e "${BLUE} curl -o setup_remote.sh https://raw.githubusercontent.com/dograh-hq/dograh/main/scripts/setup_remote.sh && chmod +x setup_remote.sh && ./setup_remote.sh${NC}" + echo -e "${BLUE} curl -o setup_remote.sh https://raw.githubusercontent.com/dograh-hq/dograh/main/scripts/setup_remote.sh && chmod +x setup_remote.sh && sudo ./setup_remote.sh${NC}" exit 1 fi diff --git a/scripts/setup_remote.sh b/scripts/setup_remote.sh index faed9b06..0710aec0 100755 --- a/scripts/setup_remote.sh +++ b/scripts/setup_remote.sh @@ -35,6 +35,14 @@ echo "║ Automated HTTPS deployment with TURN server ║" echo "╚══════════════════════════════════════════════════════════════╝" echo -e "${NC}" +# This setup must run as root: it provisions Docker, binds privileged ports +# 80/443, and (for public IPs) installs a Let's Encrypt certificate plus a +# system renewal hook under /etc/letsencrypt — all of which require root. Stop +# early with clear guidance rather than getting halfway and degrading the install. +if [[ $EUID -ne 0 ]]; then + dograh_fail "setup_remote.sh must be run as root.\nRe-run with sudo:\n sudo ./setup_remote.sh" +fi + # Get the server IP address (skip prompt if SERVER_IP is already set) if [[ -z "${SERVER_IP:-}" ]]; then echo -e "${YELLOW}Enter your server's IP address:${NC}" @@ -65,10 +73,6 @@ if [[ "$CERT_MODE" == "auto" ]]; then dograh_warn "$SERVER_IP is a private IP — using a self-signed certificate." dograh_warn "For a trusted cert, deploy on a public IP or a domain you own" dograh_warn "(https://docs.dograh.com/deployment/custom-domain)." - elif [[ $EUID -ne 0 ]]; then - CERT_MODE="self-signed" - dograh_warn "Not running as root — skipping automatic Let's Encrypt setup." - dograh_warn "Re-run with sudo (sudo ./setup_remote.sh) for a free trusted certificate via sslip.io." elif ! command -v docker >/dev/null 2>&1; then CERT_MODE="self-signed" dograh_warn "Docker not found — skipping automatic Let's Encrypt setup and using a self-signed cert." @@ -83,7 +87,6 @@ case "$CERT_MODE" in if dograh_is_local_ipv4 "$SERVER_IP"; then dograh_fail "CERT_MODE=sslip needs a public IP; $SERVER_IP is private/reserved." fi - [[ $EUID -eq 0 ]] || dograh_fail "CERT_MODE=sslip needs root for certbot. Re-run with sudo." command -v docker >/dev/null 2>&1 || dograh_fail "CERT_MODE=sslip needs Docker to serve the ACME challenge." ;; letsencrypt-dns|cloudflare-tunnel|external)