Bootstrap a Fedora analysis server
scripts/bootstrap-server.sh prepares a Fedora 44 server interactively over SSH: GitLab key, LUKS storage, repository/cache placement, three public checkouts, tool setup and an optional template report. Run as the normal login user with sudo. From an existing STIG checkout:
Use the server's actual login name/address. The script installs tmux for long builds. Keep this standalone copy outside encrypted storage so it remains accessible after reboot.
Bootstrap installs its own prerequisites before key/storage setup:
Encrypted storage
Disk layout | Select | Capacity |
|---|---|---|
Fedora occupies the 500 GB disk |
| Up to 400 GiB, adjusted to retain at least 50 GiB free outside it |
Separate empty block volume |
| Selected volume capacity, less metadata/filesystem overhead |
Existing LUKS file or device |
| Open and mount it; never reformat it |
A nominal 500 GB disk has about 466 GiB before partitioning. File mode preallocates a LUKS container on persistent ext4, XFS or Btrfs storage. It does not repartition or encrypt Fedora itself. Device mode refuses mounted devices, swap, active holders and existing filesystem/partition signatures. Review the displayed device and capacity before accepting the formatting prompts. This workflow targets a fresh development server.
Key registration and storage creation require typing YES in uppercase. Blank input or lowercase yes repeats the prompt; NO cancels. The script supplies this confirmation before invoking cryptsetup, so cryptsetup does not ask a second differently worded confirmation. Its passphrase verification remains enabled. The LUKS disk passphrase is chosen separately from the SSH key passphrase: enter it twice to create LUKS, then again to open it.
The default mountpoint is /srv/stig. Normal user paths become symlinks into it:
Normal path | Encrypted destination |
|---|---|
|
|
|
|
|
|
|
|
Repositories, build outputs, Bazel caches, Gradle distributions/JDKs and user Node/browser caches then use encrypted storage without changing their usual paths or setting build environment variables. Existing directories require a move confirmation; conflicting locations are never silently merged. Stop other builds before moving them. Moving existing files does not securely erase old plaintext copies.
stig/scripts/setup.sh installs JDK/build utilities, cleanup tools, Bazelisk, pinned Node/npm dependencies, Chromium and media tooling. Full setup also calls stig-code-analyzer/scripts/setup.sh to install CMake, LLVM/Clang 18, Z3 and the other native build prerequisites. PhASAR and the analyzer are built separately by Gradle. OS packages remain on the system filesystem. The 50 GiB reserve is a planning allowance, not a measured installer requirement; native build trees and retained outputs determine much of the eventual usage.
Fedora setup installs JDK 25 to start the bootstrap. Any working Java 21 or newer can perform that step. The bootstrap downloads and verifies the exact Java release selected by STIG, currently Java 25, before starting Gradle. Its shared cache lives under ~/.gradle/stig/java, which is on encrypted storage. See installation.
The script checks /tmp is tmpfs and swap is zram or on an encrypted device. It stops on a different layout without changing live mounts or swap. The data volume does not encrypt system logs or crash dumps. The login .ssh directory and dedicated GitLab key remain on the system disk; ssh-keygen prompts for the key's passphrase, and only its public key is printed for registration. LUKS passphrases are never saved.
Repositories and first report
Each URL below is the prompt's default; an alternative SSH URL and optional branch can be entered. Existing checkouts are kept without pulling, resetting or switching branches. Normal SSH host-key checking stays enabled. Each checkout uses ~/.ssh/id_ed25519_stig_gitlab through its local Git configuration.
Directory below | Default SSH URL |
|---|---|
|
|
|
|
|
|
This preserves the sibling layout required by local source mode. Project-specific clones and links belong in a separate project bootstrap.
After cloning, the script offers bash scripts/setup.sh --os fedora in STIG, followed by a template report check. The latter sets stigSource=local in the template's gradle.properties and runs there:
Each command prints its working directory and complete log path under /srv/stig/logs. Failure stops the script. The public template has no native analysis configuration; its report checks model/report generation. Later native analysis requires its own source checkout and consumer configuration. Git clone obtains remote commits; local uncommitted changes need a deliberate transfer or later submission. The bootstrap never commits or publishes.
After reboot
The source path or LUKS UUID and mountpoint are recorded in ~/.config/stig-server/storage. Unlock prompts for the passphrase and verifies the saved volume identity. There is no automatic unlock. When locked, the root-owned mountpoint prevents the ordinary build user from creating plaintext files there.
Resume an interrupted setup
If prerequisites and GitLab key registration are complete, restart at storage setup with:
The existing SSH key is reused. Saved initialized storage is reopened without formatting, then directory placement, cloning and the optional setup/report continue. If creation stopped before LUKS was initialized, its preallocated file may still occupy disk space. The script refuses to overwrite an existing file; inspect the unfinished file before removing it and retrying. Do not remove an initialized LUKS container. This resume mode does not guess the state of a partly formatted filesystem.
References: cryptsetup FAQ, Fedora disk encryption guide.