FortiAIGate 8.0.2 CPU lab - v1.3 public commands

Replace YOUR-SCRIPTS-BUCKET with the bucket hosting your launcher and scripts.
Replace YOUR-STAGING-BUCKET with the bucket hosting your release files.
Copy one block at a time; do not paste this entire file.
Steps 1 and 11: AWS CloudShell. Steps 2-9: EC2 Session Manager.
Step 10: browser onboarding, then EC2 API restart.

=== 01. Launch your AWS lab [AWS CloudShell] ===

aws s3 cp "s3://YOUR-SCRIPTS-BUCKET/scripts/fortiaigate_launcher.sh" \
  "$HOME/fortiaigate_launcher.sh" \
  --region us-east-1 --only-show-errors && \
bash "$HOME/fortiaigate_launcher.sh"

=== 02. Connect and check the host [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
cat /etc/os-release
uname -m
nproc
free -h
df -h /
printf 'PASS: host checks completed; review sizing above.\n'
FORTI_SCRIPT

=== 03. Repair the Docker repository [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
. /etc/os-release
[ "$ID" = ubuntu ]
[ "$VERSION_ID" = 22.04 ]
[ "$(dpkg --print-architecture)" = amd64 ]
printf 'Repairing Docker repository...\n'
forti_backup=$(sudo mktemp -d /etc/apt/docker-backup.XXXXXX)
for name in docker.list docker.sources; do
  path="/etc/apt/sources.list.d/$name"
  if [ -f "$path" ]; then sudo mv "$path" "$forti_backup/"; fi
done
sudo apt-get update
sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l \
  apt-get install -y ca-certificates curl unzip
sudo install -m 0755 -d /etc/apt/keyrings
key=/etc/apt/keyrings/docker.asc
sudo curl -fsSL --retry 3 \
  https://download.docker.com/linux/ubuntu/gpg -o "$key"
sudo chmod 0644 "$key"
head -n 1 "$key"
printf '%s\n' \
  'Types: deb' \
  'URIs: https://download.docker.com/linux/ubuntu' \
  'Suites: jammy' \
  'Components: stable' \
  'Architectures: amd64' \
  'Signed-By: /etc/apt/keyrings/docker.asc' \
  | sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null
sudo apt-get update
apt-cache policy docker-ce | sed -n '1,8p'
printf 'Source backup: %s\n' "$forti_backup"
printf 'PASS: repository refresh completed.\n'
FORTI_SCRIPT

=== 04. Install and verify Docker [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
printf 'Installing Docker Engine and Compose...\n'
sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l \
  apt-get install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker version
sudo docker compose version
sudo docker run --rm hello-world
sudo systemctl is-active docker
forti_docker_root=$(sudo docker info --format '{{.DockerRootDir}}')
df -h "$forti_docker_root" /opt
printf 'PASS: Docker and Compose checks completed.\n'
FORTI_SCRIPT

=== 05. Install AWS CLI and verify access [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
printf 'Downloading and installing AWS CLI v2...\n'
forti_cli_tmp=$(mktemp -d)
trap 'rm -rf -- "$forti_cli_tmp"' EXIT
curl -fsSL --retry 3 \
  https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip \
  -o "$forti_cli_tmp/awscliv2.zip"
unzip -q "$forti_cli_tmp/awscliv2.zip" -d "$forti_cli_tmp"
if [ -d /usr/local/aws-cli/v2 ]; then
  sudo "$forti_cli_tmp/aws/install" --update
else
  sudo "$forti_cli_tmp/aws/install"
fi
/usr/local/bin/aws --version
/usr/local/bin/aws sts get-caller-identity --region us-east-1 --no-cli-pager
printf 'PASS: AWS CLI v2 and EC2 identity verified.\n'
FORTI_SCRIPT

=== 06. Download the FortiAIGate release [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
forti_source=s3://YOUR-STAGING-BUCKET/FortiAIGate_8.0.2_CPU/
/usr/local/bin/aws s3 ls "$forti_source" --recursive --region us-east-1
sudo install -d -m 0755 -o "$(id -un)" -g "$(id -gn)" /opt/fortiaigate
/usr/local/bin/aws s3 sync "$forti_source" /opt/fortiaigate/ \
  --exclude "*" --include "Images/*.tar" --include "Installer/*.tar.gz" \
  --region us-east-1
cd /opt/fortiaigate
forti_build=V8.0.2-build0055-FORTINET
for part in api webui llm-gateway guardrail guardrail-scanner \
  license_manager logd; do
  file="Images/FAIG_$part-$forti_build.tar"
  printf 'Checking %s\n' "$file"
  test -s "$file"
  tar -tf "$file" >/dev/null
done
test -s "Installer/FAIG_deploy-docker-compose-cli-$forti_build.tar.gz"
printf 'PASS: seven CPU images and the installer are present.\n'
FORTI_SCRIPT

=== 07. Extract and test the installer [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
cd /opt/fortiaigate/Installer
forti_installer=FAIG_deploy-docker-compose-cli-V8.0.2-build0055-FORTINET.tar.gz
tar -tzf "$forti_installer"
tar -xzf "$forti_installer" deploy-docker-compose.sh USER-GUIDE.md
chmod 755 deploy-docker-compose.sh
bash -n deploy-docker-compose.sh
./deploy-docker-compose.sh --self-test
FORTI_SCRIPT

=== 08. Configure and deploy the stack [EC2 · Session Manager] ===

/bin/bash -c '
cd /opt/fortiaigate/Installer &&
exec /bin/bash ./deploy-docker-compose.sh
'

=== 09. Verify containers and the WebUI [EC2 · Session Manager] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
cd /opt/fortiaigate/Installer/faig_deployment_assistant_data/deployment
sudo ./compose.sh ps -a
forti_http=$(curl -ksS --max-time 15 -o /dev/null -w '%{http_code}' \
  https://127.0.0.1/ui)
printf 'WebUI HTTP %s\n' "$forti_http"
test "$forti_http" = 200
printf 'PASS: local WebUI returned HTTP 200.\n'
FORTI_SCRIPT

=== 10. Onboard, license and finish [Browser → EC2] ===

/bin/bash <<'FORTI_SCRIPT' || printf 'STOP: block failed.\n' >&2
set -euo pipefail
sudo -n true
cd /opt/fortiaigate/Installer/faig_deployment_assistant_data/deployment
sudo ./compose.sh restart api
sudo ./compose.sh ps -a
printf 'PASS: API restart command completed; review status.\n'
FORTI_SCRIPT

=== 11. Destroy the lab when finished [AWS CloudShell] ===

aws s3 cp "s3://YOUR-SCRIPTS-BUCKET/scripts/fortiaigate_launcher.sh" \
  "$HOME/fortiaigate_launcher.sh" \
  --region us-east-1 --only-show-errors && \
bash "$HOME/fortiaigate_launcher.sh"