Unattended Loghound Installs - Every Prompt from the Environment

Every question the installer and the setup wizard ask can be answered in advance from an environment variable, so a whole install runs from Ansible, CI or a shell script with no terminal attached. A variable works whether or not the run is interactive, so you can seed one awkward answer and still be asked the rest.

sudo LOGHOUND_HOSTNAME=loghound.example.com \
     LOGHOUND_PANEL_USER=admin \
     LOGHOUND_PANEL_PASSWORD='...' \
     LOGHOUND_OPENSOLR_EMAIL=you@example.com \
     LOGHOUND_OPENSOLR_API_KEY='...' \
     LOGHOUND_OPENSOLR_REGION=YOUR_REGION \
     ./install/install.sh --non-interactive --tls-mode existing \
       --tls-cert /etc/letsencrypt/live/loghound.example.com/fullchain.pem \
       --tls-key  /etc/letsencrypt/live/loghound.example.com/privkey.pem

YOUR_REGION is one of the regions your Opensolr account offers; the wizard lists them when you run it interactively. The API key and the panel password are never echoed and never written to the install log. The wizard prints this whole list itself with bin/loghound-setup --help.

01 · The machine (install.sh)

Variable	What it answers
`LOGHOUND_PREFIX`	Install root, like `--prefix`. Default `/opt/loghound`.
`LOGHOUND_USER`	The system user Loghound runs as, like `--user`. Default `loghound`.
`LOGHOUND_HOSTNAME`	The panel’s hostname, like `--hostname`.
`LOGHOUND_WEBSERVER`	`apache`, `nginx` or `none`, like `--webserver`.
`LOGHOUND_TLS_MODE`	`existing`, `certbot`, `selfsigned` or `none`, like `--tls-mode`.
`LOGHOUND_TLS_CERT`, `LOGHOUND_TLS_KEY`	Certificate and key paths, with `existing`.
`LOGHOUND_NONINTERACTIVE=1`	Same as `--non-interactive`.

02 · Log sources

Variable	What it answers
`LOGHOUND_LOG_PATH`	An access log path, when detection finds nothing.
`LOGHOUND_CONFIRM_SOURCES`	`yes`/`no`: accept the detected sources.
`LOGHOUND_ALLOW_LOG_ROOTS`	`yes`/`no`: allow a log directory outside `allowed_log_roots`.

03 · Your Opensolr account

Variable	What it answers
`LOGHOUND_OPENSOLR_EMAIL`	The account email.
`LOGHOUND_OPENSOLR_API_KEY`	The API key. Never echoed, logged or printed back.
`LOGHOUND_OPENSOLR_REGION`	The region, for indexes this run creates.
`LOGHOUND_OPENSOLR_REUSE`	`new` (default) or an installation id, to join a pair you already have.
`LOGHOUND_OPENSOLR_UPGRADE_SCHEMA`	`yes`/`no`: when joining, add the fields this version writes to an older pair. Default `no`, which checks and stops.
`LOGHOUND_RECONFIGURE_STORAGE`	`yes`/`no`: settle storage again on a machine that already has both indexes. Default `no`.

04 · Privacy, sign-in and the beacon

Variable	What it answers
`LOGHOUND_IP_MODE`	`full`, `truncate` or `hash`. Default `full`. How addresses are stored.
`LOGHOUND_RETENTION_DAYS`	Days of history, `0` for no age limit. Default `90`. Retention.
`LOGHOUND_PANEL_USER`	The panel username.
`LOGHOUND_PANEL_PASSWORD`	The panel password, hashed at once and never echoed.
`LOGHOUND_AUTH_MODE`	`basic` (the browser’s prompt) or `session` (Loghound’s sign-in page). Signing in.
`LOGHOUND_RESET_PANEL_AUTH`	`yes`/`no`: replace panel credentials that already exist.
`LOGHOUND_BASE_URL`	The panel’s public URL, used to build the beacon snippet.
`LOGHOUND_ROTATE_BEACON_SECRET`	`yes`/`no`: make a new beacon signing key. Every token already issued stops working.
`LOGHOUND_FORCE_WRITE`	`yes`/`no`: write the configuration even if it fails validation.
`LOGHOUND_CONFIRM_RESET`	`yes`/`no`: answer the `--reset` question. Default `no`, so an unattended run cannot wipe a working setup by accident.

Privacy and retention have no prompt behind them

Neither installer asks about them. Leave the two variables out and the defaults stand (the full address, ninety days), changed later in the panel under Settings › Privacy.

05 · No variable for a Solr address

Deliberately. The connection details come back from Opensolr and the two index names are generated, so an unattended install needs the account answers and nothing else about storage. To have a machine join a pair that already exists, give it the pair’s installation id, the hex characters in the middle of the index names, which the wizard prints before it asks:

sudo LOGHOUND_HOSTNAME=shop.example.com \
     LOGHOUND_OPENSOLR_EMAIL=you@example.com \
     LOGHOUND_OPENSOLR_API_KEY='...' \
     LOGHOUND_OPENSOLR_REUSE=aaaa1111 \
     ./install/install.sh --non-interactive

LOGHOUND_OPENSOLR_REUSE defaults to new, so an unattended re-run never adopts another site’s indexes just because it found some.

--non-interactive switches on by itself when there is no terminal

A wizard that waits forever for an answer is the worst possible failure inside an automated deploy. --interactive forces the questions back on.

Every flag of every command: Command reference.

Unattended installs

Installing