feat(install): unattended setup for package-manager installs - #980
Merged
Conversation
Debian and Ubuntu users install lerd from a Launchpad PPA, where a maintainer script runs as root and cannot answer the interactive sudo prompts a normal lerd install relies on. This adds the pieces that let a package finish setup without prompting, while leaving the interactive install path unchanged. lerd bootstrap --system performs the root-level, machine-global steps: the unprivileged-port sysctl, systemd linger, and the DNS sudoers rule. lerd install --unattended runs the rest non-interactively, defaults to managed .test, and generates the mkcert CA with TRUST_STORES=nss so it needs no sudo. lerd bootstrap --trust-ca then installs that CA into the system trust store as root. The postinst runs bootstrap --system, the per-user install, then bootstrap --trust-ca, so managed DNS and HTTPS come up with no password. Every unattended-only step is gated behind the flag, so an ordinary lerd install behaves exactly as before. The systemd unit templates hardcoded ~/.local/bin/lerd, which cannot resolve for a package that installs the binary to /usr/bin. The unit ExecStart is now filled in with the running binary's real path, so the daemon starts from wherever lerd actually lives. lerd update self-replaces a ~/.local/bin binary, which would fight apt on a packaged install, so it now recognises a binary under /usr and points the user at their package manager instead.
geodro
force-pushed
the
feat/unattended-install-split
branch
from
July 25, 2026 05:16
732b84d to
ebca695
Compare
The system trust step hardcoded Debian's update-ca-certificates, so bootstrap --trust-ca failed everywhere else. TrustCAInSystemStore now detects the anchor directory the way mkcert does, covering the Fedora, Debian, Arch and openSUSE layouts, and on distros with no writable trust store (NixOS) it reports where the CA lives so it can be trusted declaratively instead of failing the maintainer script. lerd update and lerd uninstall printed apt commands on every distro. They now name the package manager actually present, with rpm-ostree recognised ahead of dnf for atomic Fedora, a Nix hint for /nix/store binaries, and a generic fallback. Uninstall also says plainly that a packaged binary stays in place instead of claiming to have removed it. On ostree systems /usr/local resolves to /var/usrlocal, which slipped past the /usr prefix check and made lerd update try to self-replace a root-owned binary. /var/usrlocal and /nix/store now count as package-managed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Debian and Ubuntu users install lerd from a Launchpad PPA (ppa:lerd/lerd), where a maintainer script runs as root and cannot answer the interactive sudo prompts a normal lerd install relies on. This adds the pieces that let a package finish setup without prompting, and teaches lerd to cooperate with a system-managed binary, while leaving the interactive install untouched.
lerd bootstrap --system does the root-level machine-global steps, the unprivileged-port sysctl, systemd linger, and the DNS sudoers rule. lerd install --unattended runs the rest non-interactively, defaults to managed .test, and generates the mkcert CA with TRUST_STORES=nss so it needs no sudo. lerd bootstrap --trust-ca installs that CA into the system trust store as root afterward. The companion lerd-deb package runs bootstrap --system, the per-user install, then bootstrap --trust-ca, so managed DNS and HTTPS come up with no password. Every unattended-only branch is gated behind the flag, so an ordinary lerd install behaves exactly as before.
The systemd unit templates hardcoded ~/.local/bin/lerd, which cannot resolve for a package that installs the binary to /usr/bin, so the unit ExecStart now carries the running binary's real path.
lerd update self-replaces a ~/.local/bin binary, which would fight apt on a packaged install, so it now recognises a binary under /usr and defers to the package manager.
Closes #979