install.sh

#!/bin/sh
# Truss one-command self-host installer.
#
#   curl -fsSL https://raw.githubusercontent.com/binarysquadd/truss/main/install.sh | sh
#
# Downloads the self-hosted Docker Compose file into ./truss, generates strong random
# secrets, and brings the full stack up. No repo clone, no manual config. Re-running is
# safe: existing secrets are kept, images are refreshed.
set -eu

REPO_RAW="https://raw.githubusercontent.com/binarysquadd/truss/main"
DIR="${TRUSS_DIR:-truss}"
COMPOSE="docker-compose.selfhosted.yml"
ENVFILE=".env.selfhosted"

say() { printf '\033[0;36m=>\033[0m %s\n' "$1"; }
die() { printf '\033[0;31merror:\033[0m %s\n' "$1" >&2; exit 1; }

# ── Preflight ───────────────────────────────────────────────────────────────
command -v docker >/dev/null 2>&1 || die "Docker is required: https://docs.docker.com/get-docker/"
if docker compose version >/dev/null 2>&1; then DC="docker compose"
elif command -v docker-compose >/dev/null 2>&1; then DC="docker-compose"
else die "Docker Compose v2 is required: https://docs.docker.com/compose/install/"; fi
command -v curl >/dev/null 2>&1 || die "curl is required."

gen() {
  if command -v openssl >/dev/null 2>&1; then openssl rand -hex "$1"
  else head -c "$1" /dev/urandom | od -An -tx1 | tr -d ' \n'; fi
}

mkdir -p "$DIR"
cd "$DIR"

say "Downloading $COMPOSE"
curl -fsSL "$REPO_RAW/$COMPOSE" -o "$COMPOSE"

# ── Secrets: generate once, then reuse on re-run ──────────────────────────────
if [ -f "$ENVFILE" ]; then
  say "Reusing existing $ENVFILE (delete it to regenerate secrets)"
else
  say "Generating secrets into $ENVFILE"
  cat > "$ENVFILE" <<EOF
# Generated by install.sh. Keep this file safe and backed up.
# ENCRYPTION_KEY in particular is unrecoverable: lose it and saved connection
# passwords cannot be decrypted.
DB_PASSWORD=$(gen 16)
MINIO_ACCESS_KEY=truss-$(gen 6)
MINIO_SECRET_KEY=$(gen 20)
VALKEY_PASSWORD=$(gen 16)
ENCRYPTION_KEY=$(gen 32)
KRATOS_COOKIE_SECRET=$(gen 16)
KRATOS_CIPHER_SECRET=$(gen 16)
HYDRA_SECRETS_SYSTEM=$(gen 16)
TRUSS_BOOTSTRAP_ADMIN_EMAIL=admin@truss.local
TRUSS_PUBLIC_URL=http://localhost:3000
EOF
fi

say "Pulling images and starting the stack (first run downloads a few GB)"
$DC -f "$COMPOSE" --env-file "$ENVFILE" up -d

cat <<EOF

Truss is starting. Give it a minute to migrate and become healthy.

  Dashboard:  http://localhost:3000
  Login:      admin@truss.local
  Password:   $DC -f $DIR/$COMPOSE logs truss-api | grep "Default admin"

Change the admin password after first login under Settings -> Account.
Stop with:  (cd $DIR && $DC -f $COMPOSE --env-file $ENVFILE down)

Docs: https://docs.truss.binarysquad.org/getting-started/self-hosting/
EOF