Skip to content

[feature] Allow custom install/upgrade path in auto-install.sh #515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
c-gabri wants to merge 7 commits into
base: master
Choose a base branch
from
+65 −45
Open

[feature] Allow custom install/upgrade path in auto-install.sh #515

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7e4a5fe
[feature] Allow custom install/upgrade path in auto-install.sh #514
c-gabri Oct 4, 2025
3f352fe
[docs] Fix formatting of quickstart.rst #514
c-gabri Oct 5, 2025
c9d7b2f
Merge branch 'master' into custom-install-path
nemesifier Mar 10, 2026
a546fe3
[chores] Minor improvements
nemesifier Mar 10, 2026
9080740
[docs] Minor improvements
nemesifier Mar 10, 2026
bf4963c
[chores] Apply suggestions from code review
nemesifier Mar 11, 2026
12f00c6
[chores] Update docs/user/quickstart.rst
nemesifier Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 45 additions & 36 deletions deploy/auto-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,7 @@
#!/bin/bash

export DEBIAN_FRONTEND=noninteractive
export INSTALL_PATH=/opt/openwisp/docker-openwisp
export LOG_FILE=/opt/openwisp/autoinstall.log
export ENV_USER=/opt/openwisp/config.env
export ENV_BACKUP=/opt/openwisp/backup.env
export USER_INSTALL_PATH=/opt/openwisp
export GIT_PATH=${GIT_PATH:-https://github.com/openwisp/docker-openwisp.git}

# Terminal colors
Expand All @@ -14,17 +11,17 @@ export YLW='\033[1;33m'
export BLU='\033[1;34m'
export NON='\033[0m'

start_step() { printf '\e[1;34m%-70s\e[m' "$1" && echo "$1" &>>$LOG_FILE; }
start_step() { printf '\e[1;34m%-70s\e[m' "$1" && echo "$1" &>>"$LOG_FILE"; }
report_ok() { echo -e ${GRN}" done"${NON}; }
report_error() { echo -e ${RED}" error"${NON}; }
get_env() { grep "^$1" "$2" | cut -d'=' -f 2-50; }
set_env() {
line=$(grep -n "^$1=" $INSTALL_PATH/.env)
line=$(grep -n "^$1=" "$INSTALL_PATH/.env")
if [ -z "$line" ]; then
echo "$1=$2" >>$INSTALL_PATH/.env
echo "$1=$2" >>"$INSTALL_PATH/.env"
else
line_number=$(echo $line | cut -f1 -d:)
eval $(echo "awk -i inplace 'NR=="${line_number}" {\$0=\"${1}=${2}\"}1' $INSTALL_PATH/.env")
eval $(echo "awk -i inplace 'NR=="${line_number}" {\$0=\"${1}=${2}\"}1' \"$INSTALL_PATH/.env\"")
fi
Comment on lines 18 to 25
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 11, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Remove eval from set_env before writing config values.

Line 24 builds an awk command through eval with raw values coming from prompts and from backup.env. Any value containing " or shell syntax can break the update or execute shell code as root during install/upgrade. Pass the replacement via awk -v instead of interpolating it into an evaluated command.

🐛 Proposed fix 
 set_env() {
 	line=$(grep -n "^$1=" "$INSTALL_PATH/.env")
 	if [ -z "$line" ]; then
 		echo "$1=$2" >>"$INSTALL_PATH/.env"
 	else
-		line_number=$(echo $line | cut -f1 -d:)
-		eval $(echo "awk -i inplace 'NR=="${line_number}" {\$0=\"${1}=${2}\"}1' \"$INSTALL_PATH/.env\"")
+		line_number=$(printf '%s' "$line" | cut -f1 -d:)
+		awk -i inplace -v line_number="$line_number" -v replacement="$1=$2" \
+			'NR == line_number { $0 = replacement } 1' "$INSTALL_PATH/.env"
 	fi
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
set_env() {
line=$(grep -n "^$1=" $INSTALL_PATH/.env)
line=$(grep -n "^$1=" "$INSTALL_PATH/.env")
if [ -z "$line" ]; then
echo "$1=$2" >>$INSTALL_PATH/.env
echo "$1=$2" >>"$INSTALL_PATH/.env"
else
line_number=$(echo $line | cut -f1 -d:)
eval $(echo "awk -i inplace 'NR=="${line_number}" {\$0=\"${1}=${2}\"}1' $INSTALL_PATH/.env")
eval $(echo "awk -i inplace 'NR=="${line_number}" {\$0=\"${1}=${2}\"}1' \"$INSTALL_PATH/.env\"")
fi
set_env() {
line=$(grep -n "^$1=" "$INSTALL_PATH/.env")
if [ -z "$line" ]; then
echo "$1=$2" >>"$INSTALL_PATH/.env"
else
line_number=$(printf '%s' "$line" | cut -f1 -d:)
awk -i inplace -v line_number="$line_number" -v replacement="$1=$2" \
'NR == line_number { $0 = replacement } 1' "$INSTALL_PATH/.env"
fi
}
🧰 Tools
🪛 Shellcheck (0.11.0)

[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)

[warning] 24-24: Quote this to prevent word splitting.

(SC2046)

[style] 24-24: Useless echo? Instead of 'cmd $(echo foo)', just use 'cmd foo'.

(SC2116)

[warning] 24-24: The surrounding quotes actually unquote this. Remove or escape them.

(SC2027)

[info] 24-24: Double quote to prevent globbing and word splitting.

(SC2086)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@deploy/auto-install.sh` around lines 18 - 25, The set_env function currently
uses eval to construct an awk command which risks shell injection; change it to
call awk directly without eval and pass the key, value and target line number
via awk -v (e.g., use awk -i inplace -v k="$1" -v v="$2" -v ln="$line_number"
'NR==ln {$0 = k"="v}1' "$INSTALL_PATH/.env"), ensure you still handle the append
case when the key is missing and keep using INSTALL_PATH, set_env, line_number
and the .env file variables.

Copy link
Copy Markdown
Member

@nemesifier nemesifier Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this could be moved to a separate issue as it's not really specific to this PR

Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nemesifier, that's a fair point — the eval concern in set_env pre-dates this PR. Would you like me to open a GitHub issue to track the fix separately?

}

Expand Down Expand Up @@ -54,7 +51,7 @@ error_msg_with_continue() {

apt_dependenices_setup() {
start_step "Setting up dependencies..."
apt --yes install python3 python3-pip git python3-dev gawk libffi-dev libssl-dev gcc make curl jq &>>$LOG_FILE
apt --yes install python3 python3-pip git python3-dev gawk libffi-dev libssl-dev gcc make curl jq &>>"$LOG_FILE"
check_status $? "Python dependencies installation failed."
}

Expand All @@ -72,8 +69,8 @@ setup_docker() {
if [ $? -eq 0 ]; then
report_ok
else
curl -fsSL 'https://get.docker.com' -o '/opt/openwisp/get-docker.sh' &>>$LOG_FILE
sh '/opt/openwisp/get-docker.sh' &>>$LOG_FILE
curl -fsSL 'https://get.docker.com' -o "${USER_INSTALL_PATH}/get-docker.sh" &>>"$LOG_FILE"
sh "${USER_INSTALL_PATH}/get-docker.sh" &>>"$LOG_FILE"
docker info &>/dev/null
check_status $? "Docker installation failed."
fi
Expand All @@ -82,9 +79,9 @@ setup_docker() {
download_docker_openwisp() {
local openwisp_version="$1"
start_step "Downloading docker-openwisp..."
if [[ -f $INSTALL_PATH/.env ]]; then
mv $INSTALL_PATH/.env $ENV_BACKUP &>>$LOG_FILE
rm -rf $INSTALL_PATH &>>$LOG_FILE
if [[ -f "$INSTALL_PATH/.env" ]]; then
mv "$INSTALL_PATH/.env" "$ENV_BACKUP" &>>"$LOG_FILE"
rm -rf "$INSTALL_PATH" &>>"$LOG_FILE"
fi
if [ -z "$GIT_BRANCH" ]; then
if [[ "$openwisp_version" == "edge" ]]; then
Expand All @@ -94,7 +91,7 @@ download_docker_openwisp() {
fi
fi

git clone $GIT_PATH $INSTALL_PATH --depth 1 --branch $GIT_BRANCH &>>$LOG_FILE
git clone "$GIT_PATH" "$INSTALL_PATH" --depth 1 --branch "$GIT_BRANCH" &>>"$LOG_FILE"
}

setup_docker_openwisp() {
Expand All @@ -120,15 +117,14 @@ setup_docker_openwisp() {
echo -ne ${GRN}"(5/5) Use Let's Encrypt SSL? (y/N, blank for no): "${NON}
read use_letsencrypt
else
cp $env_path $ENV_USER &>>$LOG_FILE
cp "$env_path" "$ENV_USER" &>>"$LOG_FILE"
fi
echo ""

download_docker_openwisp "$openwisp_version"

cd $INSTALL_PATH &>>$LOG_FILE
cd "$INSTALL_PATH" || exit 1
check_status $? "docker-openwisp download failed."
echo $openwisp_version >$INSTALL_PATH/VERSION
echo "$openwisp_version" >"$INSTALL_PATH/VERSION"

if [[ ! -f "$env_path" ]]; then
# Dashboard Domain
Expand Down Expand Up @@ -158,8 +154,8 @@ setup_docker_openwisp() {
# Site manager email
set_env "EMAIL_DJANGO_DEFAULT" "$django_default_email"
# Set random secret values
python3 $INSTALL_PATH/build.py change-secret-key >/dev/null
python3 $INSTALL_PATH/build.py change-database-credentials >/dev/null
python3 "$INSTALL_PATH/build.py" change-secret-key >/dev/null
python3 "$INSTALL_PATH/build.py" change-database-credentials >/dev/null
# SSL Configuration
use_letsencrypt_lower=$(echo "$use_letsencrypt" | tr '[:upper:]' '[:lower:]')
if [[ "$use_letsencrypt_lower" == "y" || "$use_letsencrypt_lower" == "yes" ]]; then
Expand All @@ -172,14 +168,14 @@ setup_docker_openwisp() {
set_env "POSTFIX_ALLOWED_SENDER_DOMAINS" "$hostname"
set_env "POSTFIX_MYHOSTNAME" "$hostname"
else
mv $ENV_USER $INSTALL_PATH/.env &>>$LOG_FILE
rm -rf $ENV_USER &>>$LOG_FILE
mv "$ENV_USER" "$INSTALL_PATH/.env" &>>"$LOG_FILE"
rm -rf "$ENV_USER" &>>"$LOG_FILE"
fi

start_step "Configuring docker-openwisp..."
report_ok
start_step "Starting images docker-openwisp (this will take a while)..."
make start TAG=$(cat $INSTALL_PATH/VERSION) -C $INSTALL_PATH/ &>>$LOG_FILE
make start TAG=$(cat "$INSTALL_PATH/VERSION") -C "$INSTALL_PATH/" &>>"$LOG_FILE"
check_status $? "Starting openwisp failed."
}

Expand All @@ -189,20 +185,19 @@ upgrade_docker_openwisp() {
echo ""

download_docker_openwisp "$openwisp_version"

cd $INSTALL_PATH &>>$LOG_FILE
cd "$INSTALL_PATH" || exit 1
check_status $? "docker-openwisp download failed."
echo $openwisp_version >$INSTALL_PATH/VERSION
echo "$openwisp_version" >"$INSTALL_PATH/VERSION"

start_step "Configuring docker-openwisp..."
for config in $(grep '=' $ENV_BACKUP | cut -f1 -d'='); do
for config in $(grep '=' "$ENV_BACKUP" | cut -f1 -d'='); do
value=$(get_env "$config" "$ENV_BACKUP")
set_env "$config" "$value"
done
report_ok

start_step "Starting images docker-openwisp (this will take a while)..."
make start TAG=$(cat $INSTALL_PATH/VERSION) -C $INSTALL_PATH/ &>>$LOG_FILE
make start TAG=$(cat "$INSTALL_PATH/VERSION") -C "$INSTALL_PATH/" &>>"$LOG_FILE"
check_status $? "Starting openwisp failed."
}

Expand Down Expand Up @@ -251,20 +246,20 @@ init_setup() {
echo -e " - Supported systems"
echo -e " - Debian: 11, 12 & 13"
echo -e " - Ubuntu 22.04 & 24.04"
echo -e ${YLW}"\nYou can use -u\--upgrade if you are upgrading from an older version.\n"${NON}
echo -e ${YLW}"\nYou can use -u\--upgrade ${USER_INSTALL_PATH} if you are upgrading from an older version.\n"${NON}
fi

if [ "$EUID" -ne 0 ]; then
echo -e ${RED}"Please run with root privileges."${NON}
exit 1
fi

mkdir -p /opt/openwisp
echo "" >$LOG_FILE
mkdir -p "${USER_INSTALL_PATH}"
echo "" >"$LOG_FILE"

start_step "Checking your system capabilities..."
apt update &>>$LOG_FILE
apt -qq --yes install lsb-release &>>$LOG_FILE
apt update &>>"$LOG_FILE"
apt -qq --yes install lsb-release &>>"$LOG_FILE"
system_id=$(lsb_release --id --short)
system_release=$(lsb_release --release --short)
incompatible_message="$system_id $system_release is not supported. Installation might fail, continue anyway? (Y/n): "
Expand Down Expand Up @@ -299,8 +294,8 @@ init_help() {
echo -e " - Supported systems"
echo -e " - Debian: 11, 12 & 13"
echo -e " - Ubuntu 22.04 & 24.04\n"
echo -e " -i\--install : (default) Install OpenWISP"
echo -e " -u\--upgrade : Change OpenWISP version already setup with this script"
echo -e " -i\--install [install-path]: (default) Install OpenWISP. Default path is /opt/openwisp"
echo -e " -u\--upgrade [install-path]: Change OpenWISP version already setup with this script"
echo -e " -h\--help : See this help message"
echo -e ${NON}
}
Expand All @@ -313,9 +308,23 @@ while test $# != 0; do
-h | --help) action='help' ;;
*) action='help' ;;
esac
case "$1" in
-i | --install | -u | --upgrade)
# Check if next argument exists and is not another flag (starts with -)
if [[ -n "$2" && "$2" != -* ]]; then
USER_INSTALL_PATH=$(realpath -m "$2")
shift
fi
;;
esac
shift
done

export INSTALL_PATH=${USER_INSTALL_PATH}/docker-openwisp
export LOG_FILE=${USER_INSTALL_PATH}/autoinstall.log
export ENV_USER=${USER_INSTALL_PATH}/config.env
export ENV_BACKUP=${USER_INSTALL_PATH}/backup.env

## Init script
if [[ "$action" == "help" ]]; then
init_help
Expand Down
13 changes: 12 additions & 1 deletion docs/user/quickstart.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,24 +72,35 @@ script and execute it:
.. code-block:: bash

curl https://raw.githubusercontent.com/openwisp/docker-openwisp/master/deploy/auto-install.sh -o auto-install.sh
# Default installation (to /opt/openwisp):
sudo bash auto-install.sh

# To use a custom installation path:
sudo bash auto-install.sh --install /path/to/install

The default installation path is ``/opt/openwisp`` and may be changed if
needed with the ``--install`` flag.

The auto-install script maintains a log, which is useful for debugging or
checking the real-time output of the script. You can view the log by
running the following command:

.. code-block:: bash

tail -n 50 -f /opt/openwisp/autoinstall.log
tail -n 50 -f /opt/openwisp/autoinstall.log # assuming default install path

The auto-install script can be used to upgrade installations that were
originally deployed using this script. You can upgrade your installation
by using the following command

.. code-block:: bash

# Upgrade default installation:
sudo bash auto-install.sh --upgrade

# If you used a custom installation path:
sudo bash auto-install.sh --upgrade /path/to/install

.. note::

- If you're having any installation issues with the ``latest``
Expand Down
16 changes: 8 additions & 8 deletions images/openwisp_dashboard/openvpn.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,14 +12,14 @@
"comp_lzo": "no",
"auth": "SHA1",
"data_ciphers": [
{
"cipher": "AES-128-GCM",
"optional": false
},
{
"cipher": "none",
"optional": false
}
{
"cipher": "AES-128-GCM",
"optional": false
},
{
"cipher": "none",
"optional": false
}
],
"data_ciphers_fallback": "AES-128-GCM",
"cipher": "AES-128-GCM",
Expand Down