Download and run OpenShell gateway with podman driver on macOS X arm64

download-and-run-openshell-gateway.sh

#!/bin/sh

# Download and run openshell gateway on macOS X (ARM64).
# Execute this script from an empty directory
# Tested with OpenShell v0.0.59
set -e

ARCH="aarch64-apple-darwin"

# Check if openssl is available
if ! command -v openssl >/dev/null 2>&1; then
    echo "Error: OpenSSL is required but not installed."
    echo ""
    echo "To install OpenSSL on macOS:"
    echo "  Using Homebrew: brew install openssl"
    echo "  Using MacPorts: sudo port install openssl3"
    echo ""
    echo "After installation, you may need to add it to your PATH:"
    echo "  export PATH=\"/opt/homebrew/bin:\$PATH\"  # for Homebrew"
    echo "  export PATH=\"/opt/local/bin:\$PATH\"     # for MacPorts"
    echo ""
    exit 1
fi

echo "Downloading openshell-gateway for macOS ARM64..."

# Download and extract openshell-gateway
echo "Downloading openshell-gateway..."
curl -L "https://github.com/NVIDIA/OpenShell/releases/latest/download/openshell-gateway-$ARCH.tar.gz" -o openshell-gateway.tgz
tar zxvf openshell-gateway.tgz && rm openshell-gateway.tgz

# Make executable
chmod +x openshell-gateway

# Create required directories
mkdir -p files state tls/jwt tls/server tls/client

# Generate JWT signing keys
echo "Generating JWT signing keys..."
openssl genpkey -algorithm Ed25519 -out tls/jwt/signing.pem
openssl pkey -in tls/jwt/signing.pem -pubout -out tls/jwt/public.pem

# Generate a random kid (key identifier)
openssl rand -hex 16 > tls/jwt/kid

# Generate CA certificate
echo "Generating CA certificate..."
openssl req -x509 -newkey rsa:4096 -keyout tls/ca.key -out tls/ca.crt -days 365 -nodes \
  -subj "/CN=Dev Root CA"

# Generate server certificate
echo "Generating server certificate..."
openssl req -newkey rsa:4096 -keyout tls/server/tls.key -out tls/server/tls.csr -nodes \
  -subj "/CN=localhost"

# Create temporary extension file for SAN
cat > tls/server/v3.ext << 'EOF'
[v3_req]
subjectAltName=DNS:localhost,IP:127.0.0.1
EOF

openssl x509 -req -in tls/server/tls.csr -CA tls/ca.crt -CAkey tls/ca.key -CAcreateserial \
  -out tls/server/tls.crt -days 365 -extensions v3_req \
  -extfile tls/server/v3.ext

rm tls/server/tls.csr tls/server/v3.ext

# Generate client certificate
echo "Generating client certificate..."
openssl req -newkey rsa:4096 -keyout tls/client/tls.key -out tls/client/tls.csr -nodes \
  -subj "/CN=dev-client"

openssl x509 -req -in tls/client/tls.csr -CA tls/ca.crt -CAkey tls/ca.key -CAcreateserial \
  -out tls/client/tls.crt -days 365

rm tls/client/tls.csr

# Create basic config in current directory
echo "Creating config.toml..."
cat > config.toml << 'EOF'
[openshell]
version = 1

[openshell.gateway]
bind_address    = "127.0.0.1:8081"
log_level       = "info"
compute_drivers = ["podman"]

[openshell.gateway.gateway_jwt]
signing_key_path = "./tls/jwt/signing.pem"
public_key_path  = "./tls/jwt/public.pem"
kid_path         = "./tls/jwt/kid"
gateway_id       = "openshell"
ttl_secs         = 3600

[openshell.gateway.auth]
allow_unauthenticated_users = true

[openshell.drivers.vm]
state_dir = "./state"
EOF

echo "Starting openshell-gateway..."

# Run the gateway
exec ./openshell-gateway \
  --disable-tls \
  --db-url "sqlite:./files/openshell.db" \
  --config "./config.toml"