fix(jumpserver): issues found running the v5 install

- guacd 1.6.0 fails to build against Debian 13's FreeRDP 3 under -Werror
  for deprecated APIs; allow those warnings.
- guacd binds ::1 by default while KoKo dials 127.0.0.1; pin it to IPv4.
- The core only accepts terminal registration for 5 minutes after it
  starts, so start the core and KoKo together after all builds finish.
- KoKo links libghostty-vt statically; drop the LD_LIBRARY_PATH.
- Append the admin credentials instead of overwriting the database ones.
- Restore config and data before the update rebuilds anything.

Author: opastorello

ct/jumpserver.sh

@@ -42,7 +42,8 @@ function update_script() {
     msg_info "Building guacd"
     cd /opt/guacd
     $STD autoreconf -fi
-    $STD ./configure --with-systemd-dir=/etc/systemd/system --disable-guacenc
+    # FreeRDP 3.6+ deprecates APIs guacd still calls, which -Werror turns into build failures
+    $STD ./configure --with-systemd-dir=/etc/systemd/system --disable-guacenc CFLAGS="-O2 -Wno-error=deprecated-declarations"
     $STD make -j"$(nproc)"
     $STD make install
     $STD ldconfig
@@ -60,6 +61,9 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jumpserver" "jumpserver/jumpserver" "tarball" "latest" "" "" "v5."
     JMS_TAG="v$(<~/.jumpserver)"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "koko" "jumpserver/koko" "$JMS_TAG"
+
+    restore_backup
 
     msg_info "Updating Python Environment"
     cd /opt/jumpserver
@@ -79,8 +83,6 @@ function update_script() {
     $STD ../.venv/bin/python3 manage.py compilemessages
     msg_ok "Updated Python Environment"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "koko" "jumpserver/koko" "$JMS_TAG"
-
     GHOSTTY_COMMIT=$(grep -oP 'libghostty-vt:ghostty-\K[0-9a-f]+' /opt/koko/Dockerfile-base)
     ZIG_VERSION=$(grep -oP 'libghostty-vt:ghostty-[0-9a-f]+-zig-\K[0-9.]+' /opt/koko/Dockerfile-base)
     USQL_VERSION=$(grep -oP 'ARG USQL_VERSION=\K\S+' /opt/koko/Dockerfile-base)
@@ -111,8 +113,6 @@ function update_script() {
     fetch_and_deploy_gh_release "usql" "jumpserver-dev/usql" "prebuild" "$USQL_VERSION" "/opt/usql" "usql-*-linux-$(arch_resolve amd64 arm64).tar.gz"
     fetch_and_deploy_gh_release "k8s-bundle" "jumpserver-dev/k8s-bundle" "binary" "$K8S_BUNDLE_VERSION" "" "k8s-bundle_$(arch_resolve amd64 arm64).deb"
 
-    restore_backup
-
     NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "lina" "jumpserver/lina" "$JMS_TAG" "/opt/lina-src"

install/jumpserver-install.sh

@@ -70,10 +70,18 @@ fetch_and_deploy_gh_tag "guacd" "apache/guacamole-server"
 msg_info "Building guacd"
 cd /opt/guacd
 $STD autoreconf -fi
-$STD ./configure --with-systemd-dir=/etc/systemd/system --disable-guacenc
+# FreeRDP 3.6+ deprecates APIs guacd still calls, which -Werror turns into build failures
+$STD ./configure --with-systemd-dir=/etc/systemd/system --disable-guacenc CFLAGS="-O2 -Wno-error=deprecated-declarations"
 $STD make -j"$(nproc)"
 $STD make install
 $STD ldconfig
+# guacd binds "localhost" (::1 here) by default, but KoKo dials 127.0.0.1
+mkdir -p /etc/guacamole
+cat <<EOF >/etc/guacamole/guacd.conf
+[server]
+bind_host = 127.0.0.1
+bind_port = 4822
+EOF
 systemctl enable -q --now guacd
 msg_ok "Built guacd"
 
@@ -134,7 +142,7 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now jumpserver
+systemctl enable -q jumpserver
 msg_ok "Created Core Service"
 
 fetch_and_deploy_gh_tag "koko" "jumpserver/koko" "$JMS_TAG"
@@ -186,15 +194,14 @@ After=network.target guacd.service jumpserver.service
 [Service]
 Type=simple
 WorkingDirectory=/opt/koko
-Environment=LD_LIBRARY_PATH=/opt/libghostty-vt/lib
 ExecStart=/opt/koko/koko
 Restart=on-failure
 RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now koko
+systemctl enable -q koko
 msg_ok "Configured KoKo"
 
 fetch_and_deploy_gh_tag "lina" "jumpserver/lina" "$JMS_TAG" "/opt/lina-src"
@@ -220,11 +227,18 @@ mv .output/public /opt/luna
 rm -rf /opt/luna-src
 msg_ok "Built Luna"
 
-msg_info "Securing Admin Account"
+msg_info "Starting Services"
+# The core only accepts terminal registration for 5 minutes after it starts,
+# so KoKo has to come up right behind it instead of after the long builds
+systemctl start jumpserver
 for _ in $(seq 1 90); do
   curl -fsS -o /dev/null http://127.0.0.1:8080/api/health/ 2>/dev/null && break
   sleep 5
 done
+systemctl start koko
+msg_ok "Started Services"
+
+msg_info "Securing Admin Account"
 JMS_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)
 cd /opt/jumpserver
 PYTHONPATH=/opt/jumpserver/apps DJANGO_SETTINGS_MODULE=jumpserver.settings $STD .venv/bin/python3 -c "
@@ -236,7 +250,7 @@ u.set_password('${JMS_ADMIN_PASS}')
 u.need_update_password = False
 u.save()
 "
-cat <<EOF >~/jumpserver.creds
+cat <<EOF >>~/jumpserver.creds
 JumpServer Admin Credentials
 Username: admin
 Password: ${JMS_ADMIN_PASS}