setup.sh

#!/bin/bash
# =============================================================================
# Juniper Multi-Platform Upgrade Utility — Setup Script
# =============================================================================
# Run this once on your Raspberry Pi (or any Debian/Ubuntu jump host) to:
#   1. Install required Python dependencies
#   2. Create the FTP directory structure under /srv/ftp/code/
#   3. Set correct permissions for vsftpd anonymous read + local user write
#
# Usage:
#   chmod +x setup.sh
#   sudo ./setup.sh
# =============================================================================

set -e  # exit on any error

# --- Colours ------------------------------------------------------------------
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
CYAN='\033[0;36m'
BOLD='\033[1m'
RESET='\033[0m'

info()    { echo -e "${CYAN}[INFO]${RESET} $*"; }
success() { echo -e "${GREEN}[OK]${RESET}   $*"; }
warn()    { echo -e "${YELLOW}[WARN]${RESET} $*"; }
error()   { echo -e "${RED}[ERROR]${RESET} $*"; exit 1; }

echo
echo -e "${BOLD}============================================================${RESET}"
echo -e "${BOLD}  Juniper Upgrade Utility — Setup${RESET}"
echo -e "${BOLD}============================================================${RESET}"
echo

# --- Must run as root ---------------------------------------------------------
if [[ $EUID -ne 0 ]]; then
    error "Please run as root:  sudo ./setup.sh"
fi

# =============================================================================
# 1. Python dependencies
# =============================================================================
echo -e "${BOLD}--- Python Dependencies ---${RESET}"

# Check Python 3 is available
if ! command -v python3 &>/dev/null; then
    error "python3 not found. Install it with:  sudo apt install python3 python3-pip"
fi
PYTHON_VER=$(python3 --version)
info "Found $PYTHON_VER"

# Install pip if missing
if ! command -v pip3 &>/dev/null && ! python3 -m pip --version &>/dev/null 2>&1; then
    info "Installing python3-pip ..."
    apt-get install -y python3-pip
fi

# Install required packages
# --break-system-packages is needed on Debian 12+ / Ubuntu 23.04+
info "Installing junos-eznc, lxml, paramiko ..."
if python3 -m pip install junos-eznc lxml paramiko --break-system-packages --quiet; then
    success "Python packages installed"
else
    # Fallback: try without --break-system-packages (older pip)
    warn "--break-system-packages not supported, trying without ..."
    python3 -m pip install junos-eznc lxml paramiko --quiet
    success "Python packages installed"
fi

# Verify imports
info "Verifying imports ..."
if python3 -c "import jnpr.junos, lxml, paramiko" 2>/dev/null; then
    success "All imports verified OK"
else
    error "Import verification failed — check pip install output above"
fi

echo

# =============================================================================
# 2. FTP directory structure
# =============================================================================
echo -e "${BOLD}--- FTP Directory Structure ---${RESET}"

FTP_ROOT="/srv/ftp"
CODE_DIR="${FTP_ROOT}/code"

# Platforms — add new ones here as needed
PLATFORMS=(
    "EX2300"
    "EX3400"
    "EX4100"
    "EX4600"
    "EX4650"
    "MX204"
    "SRX300"
)

# Create FTP root if it doesn't exist
if [[ ! -d "$FTP_ROOT" ]]; then
    info "Creating $FTP_ROOT ..."
    mkdir -p "$FTP_ROOT"
fi

# Create code directory
if [[ ! -d "$CODE_DIR" ]]; then
    info "Creating $CODE_DIR ..."
    mkdir -p "$CODE_DIR"
fi

# Create each platform directory
for platform in "${PLATFORMS[@]}"; do
    dir="${CODE_DIR}/${platform}"
    if [[ ! -d "$dir" ]]; then
        mkdir -p "$dir"
        info "Created $dir"
    else
        info "Already exists: $dir"
    fi
done

echo

# =============================================================================
# 3. vsftpd permissions
# =============================================================================
echo -e "${BOLD}--- FTP Permissions ---${RESET}"
#
# vsftpd requires:
#   /srv/ftp        — NOT writable by others (chroot jail root rule)
#   /srv/ftp/code/* — readable by all (anonymous download)
#
# For local users (you uploading code files):
#   /srv/ftp/code/* — writable by the ftp group
#
# We add the current SUDO_USER to the ftp group so they can upload
# without needing root each time.

# /srv/ftp root — must NOT be world-writable (vsftpd chroot rule)
chmod 755 "$FTP_ROOT"
chown root:root "$FTP_ROOT"
success "Set $FTP_ROOT to 755 (root:root) — vsftpd chroot rule satisfied"

# /srv/ftp/code — readable by anonymous, writable by ftp group
chmod 755 "$CODE_DIR"
chown root:ftp "$CODE_DIR"

# Each platform directory — readable by anonymous, writable by ftp group
for platform in "${PLATFORMS[@]}"; do
    dir="${CODE_DIR}/${platform}"
    chmod 775 "$dir"
    chown root:ftp "$dir"
done
success "Set code directories to 775 (root:ftp)"

# Add the invoking user to the ftp group so they can upload code files
if [[ -n "$SUDO_USER" ]]; then
    if id -nG "$SUDO_USER" | grep -qw ftp; then
        info "$SUDO_USER is already in the ftp group"
    else
        usermod -aG ftp "$SUDO_USER"
        success "Added $SUDO_USER to ftp group — log out and back in for this to take effect"
    fi
else
    warn "Could not determine invoking user — add yourself to the ftp group manually:"
    warn "  sudo usermod -aG ftp \$USER"
fi

echo

# =============================================================================
# 4. vsftpd config check
# =============================================================================
echo -e "${BOLD}--- vsftpd Configuration Check ---${RESET}"

VSFTPD_CONF="/etc/vsftpd.conf"
NEEDS_RESTART=false

if [[ ! -f "$VSFTPD_CONF" ]]; then
    warn "vsftpd.conf not found at $VSFTPD_CONF — is vsftpd installed?"
    warn "Install with:  sudo apt install vsftpd"
else
    check_setting() {
        local key="$1"
        local expected="$2"
        local current
        current=$(grep -E "^${key}=" "$VSFTPD_CONF" 2>/dev/null | tail -1 | cut -d= -f2)
        if [[ "$current" == "$expected" ]]; then
            success "  $key=$expected"
        else
            warn "  $key is '${current:-not set}' — should be '$expected'"
            warn "  Edit $VSFTPD_CONF and set:  ${key}=${expected}"
            NEEDS_RESTART=true
        fi
    }

    info "Checking required vsftpd settings ..."
    check_setting "anonymous_enable"      "YES"
    check_setting "no_anon_password"      "YES"
    check_setting "anon_root"             "/srv/ftp"
    check_setting "local_enable"          "YES"
    check_setting "write_enable"          "YES"
    check_setting "anon_upload_enable"    "NO"
    check_setting "anon_mkdir_write_enable" "NO"
    check_setting "allow_writeable_chroot" "YES"

    if [[ "$NEEDS_RESTART" == true ]]; then
        warn "Some vsftpd settings need updating — see warnings above"
        warn "After editing vsftpd.conf, restart with:  sudo systemctl restart vsftpd"
    else
        success "vsftpd config looks correct"
        info "Restarting vsftpd to apply any permission changes ..."
        if systemctl restart vsftpd 2>/dev/null; then
            success "vsftpd restarted"
        else
            warn "Could not restart vsftpd — try:  sudo systemctl restart vsftpd"
        fi
    fi
fi

echo

# =============================================================================
# 5. Create logs directory and check targets file
# =============================================================================
echo -e "${BOLD}--- Local Directories ---${RESET}"

SCRIPT_DIR="$(dirname "$(realpath "$0")")"
LOGS_DIR="${SCRIPT_DIR}/logs"
TARGETS_FILE="${SCRIPT_DIR}/targets.txt"

if [[ ! -d "$LOGS_DIR" ]]; then
    mkdir -p "$LOGS_DIR"
    # Ensure logs are owned by the invoking user, not root
    if [[ -n "$SUDO_USER" ]]; then
        chown "$SUDO_USER":"$SUDO_USER" "$LOGS_DIR"
    fi
    success "Created $LOGS_DIR"
else
    info "Already exists: $LOGS_DIR"
fi

if [[ ! -f "$TARGETS_FILE" ]]; then
    warn "targets.txt not found at $TARGETS_FILE"
    warn "Create it with one device IP or hostname per line, e.g.:"
    warn "  echo '192.168.10.201' >> targets.txt"
else
    count=$(grep -v '^\s*#' "$TARGETS_FILE" | grep -v '^\s*$' | wc -l)
    info "Found targets.txt ($count active target(s))"
fi

echo

# =============================================================================
# Summary
# =============================================================================
echo -e "${BOLD}============================================================${RESET}"
echo -e "${BOLD}  Setup Complete${RESET}"
echo -e "${BOLD}============================================================${RESET}"
echo
echo -e "  FTP root      : ${CYAN}/srv/ftp${RESET}"
echo -e "  Code dirs     : ${CYAN}/srv/ftp/code/<PLATFORM>/${RESET}"
echo
echo -e "  Upload code files to the appropriate directory, e.g.:"
echo -e "    ${CYAN}/srv/ftp/code/EX2300/${RESET}   <- junos-arm-32-{version}.tgz"
echo -e "    ${CYAN}/srv/ftp/code/EX3400/${RESET}   <- junos-arm-32-{version}.tgz"
echo -e "    ${CYAN}/srv/ftp/code/EX4100/${RESET}   <- junos-install-ex-arm-64-{version}.tgz"
echo -e "    ${CYAN}/srv/ftp/code/EX4600/${RESET}   <- jinstall-host-ex-4600-{version}-signed.tgz"
echo -e "    ${CYAN}/srv/ftp/code/EX4650/${RESET}   <- jinstall-host-ex-4e-x86-64-{version}-secure-signed.tgz"
echo -e "    ${CYAN}/srv/ftp/code/MX204/${RESET}    <- junos-vmhost-install-mx-x86-64-{version}.tgz"
echo -e "    ${CYAN}/srv/ftp/code/SRX300/${RESET}   <- junos-srxsme-{version}.tgz"
echo
echo -e "  Edit targets.txt with your device IPs/hostnames, then:"
echo
echo -e "  Dry run (validate, no changes):"
echo -e "    ${CYAN}python3 juniper_upgrade.py --targets targets.txt --dry-run${RESET}"
echo
echo -e "  Real run — sequential (one device at a time, safest):"
echo -e "    ${CYAN}python3 juniper_upgrade.py --targets targets.txt${RESET}"
echo
echo -e "  Real run — parallel (all selected devices simultaneously):"
echo -e "    ${CYAN}python3 juniper_upgrade.py --targets targets.txt --parallel-upgrades${RESET}"
echo
if [[ "$NEEDS_RESTART" == true ]]; then
    echo -e "  ${YELLOW}⚠ vsftpd config needs updating — see warnings above${RESET}"
    echo
fi