opn
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
cce1081f75
commit
2b8f11ef8c
36 files changed
+1868
-309
No files matched your search
@@ -10,40 +10,24 @@ DATA_DIR="$ROOT/data"
|
||||
SERVICE="rust-package-builder"
|
||||
HTTP_SERVICE="repository-http"
|
||||
DEFAULT_HTTP_PORT=18765
|
||||
DEFAULT_OPNSENSE_HTTP_PORT=18766
|
||||
|
||||
log() {
|
||||
printf '[start] %s\n' "$*"
|
||||
}
|
||||
|
||||
warn() {
|
||||
printf '[start] WARN: %s\n' "$*" >&2
|
||||
}
|
||||
|
||||
die() {
|
||||
printf '[start] ERROR: %s\n' "$*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
require_cmd() {
|
||||
command -v "$1" >/dev/null 2>&1 || die "brak wymaganego polecenia: $1"
|
||||
}
|
||||
log() { printf '[start] %s\n' "$*"; }
|
||||
warn() { printf '[start] WARN: %s\n' "$*" >&2; }
|
||||
die() { printf '[start] ERROR: %s\n' "$*" >&2; exit 1; }
|
||||
require_cmd() { command -v "$1" >/dev/null 2>&1 || die "brak wymaganego polecenia: $1"; }
|
||||
|
||||
write_env_file() {
|
||||
local source_repo=${SOURCE_REPO:-}
|
||||
local repository_url=${REPOSITORY_URL:-}
|
||||
|
||||
cat > "$ENV_FILE" <<ENV
|
||||
SOURCE_REPO=$source_repo
|
||||
REPOSITORY_URL=$repository_url
|
||||
SOURCE_REPO=${SOURCE_REPO:-}
|
||||
REPOSITORY_URL=${REPOSITORY_URL:-}
|
||||
OPNSENSE_REPOSITORY_URL=${OPNSENSE_REPOSITORY_URL:-}
|
||||
ENV
|
||||
chmod 0600 "$ENV_FILE" 2>/dev/null || true
|
||||
}
|
||||
|
||||
update_env_var() {
|
||||
local key=$1
|
||||
local value=$2
|
||||
local tmp="$ENV_FILE.tmp.$$"
|
||||
|
||||
local key=$1 value=$2 tmp="$ENV_FILE.tmp.$$"
|
||||
awk -v key="$key" -v value="$value" '
|
||||
BEGIN { found=0 }
|
||||
index($0, key "=") == 1 { print key "=" value; found=1; next }
|
||||
@@ -55,58 +39,53 @@ update_env_var() {
|
||||
}
|
||||
|
||||
load_env_file() {
|
||||
# .env is intentionally limited to simple KEY=value entries used by Compose.
|
||||
# shellcheck disable=SC1090
|
||||
set -a
|
||||
# shellcheck disable=SC1090
|
||||
source "$ENV_FILE"
|
||||
set +a
|
||||
}
|
||||
|
||||
normalize_http_settings() {
|
||||
local url=${REPOSITORY_URL%/}
|
||||
local rest hostpart explicit_port=""
|
||||
normalize_repo_url() {
|
||||
local url_var=$1 port_var=$2 default_port=$3 label=$4
|
||||
local url=${!url_var:-} port=${!port_var:-} rest hostpart explicit_port=""
|
||||
|
||||
HTTP_PORT=${HTTP_PORT:-}
|
||||
url=${url%/}
|
||||
[[ -n "$url" ]] || die "$url_var jest wymagane"
|
||||
|
||||
case "$url" in
|
||||
http://*)
|
||||
rest=${url#http://}
|
||||
[[ "$rest" != */* ]] || die "REPOSITORY_URL dla wbudowanego HTTP nie moze zawierac sciezki: $REPOSITORY_URL"
|
||||
hostpart=$rest
|
||||
|
||||
if [[ "$hostpart" =~ ^\[[^]]+\]:([0-9]+)$ ]]; then
|
||||
explicit_port=${BASH_REMATCH[1]}
|
||||
elif [[ "$hostpart" =~ ^[^:]+:([0-9]+)$ ]]; then
|
||||
explicit_port=${BASH_REMATCH[1]}
|
||||
fi
|
||||
|
||||
if [[ -n "$explicit_port" ]]; then
|
||||
HTTP_PORT=$explicit_port
|
||||
else
|
||||
HTTP_PORT=${HTTP_PORT:-$DEFAULT_HTTP_PORT}
|
||||
url="${url}:${HTTP_PORT}"
|
||||
REPOSITORY_URL=$url
|
||||
export REPOSITORY_URL
|
||||
update_env_var REPOSITORY_URL "$REPOSITORY_URL"
|
||||
log "REPOSITORY_URL bez portu - ustawiono $REPOSITORY_URL"
|
||||
fi
|
||||
;;
|
||||
https://*)
|
||||
# HTTPS is supported as a public URL only when an external TLS proxy points
|
||||
# to the local micro HTTP service. The embedded service itself is HTTP only.
|
||||
HTTP_PORT=${HTTP_PORT:-$DEFAULT_HTTP_PORT}
|
||||
warn "REPOSITORY_URL uzywa HTTPS. Wbudowany serwer nasluchuje po zwyklym HTTP na porcie $HTTP_PORT; HTTPS wymaga zewnetrznego reverse proxy/TLS."
|
||||
;;
|
||||
*)
|
||||
die "REPOSITORY_URL musi zaczynac sie od http:// albo https://"
|
||||
;;
|
||||
http://*) rest=${url#http://} ;;
|
||||
https://*) rest=${url#https://} ;;
|
||||
*) die "$url_var musi zaczynac sie od http:// albo https://" ;;
|
||||
esac
|
||||
|
||||
[[ "$HTTP_PORT" =~ ^[0-9]+$ ]] || die "HTTP_PORT musi byc liczba"
|
||||
(( HTTP_PORT >= 1024 && HTTP_PORT <= 65535 )) || die "HTTP_PORT musi byc z zakresu 1024-65535"
|
||||
[[ "$rest" != */* ]] || die "$url_var nie moze zawierac sciezki: $url"
|
||||
hostpart=$rest
|
||||
if [[ "$hostpart" =~ ^\[[^]]+\]:([0-9]+)$ ]]; then
|
||||
explicit_port=${BASH_REMATCH[1]}
|
||||
elif [[ "$hostpart" =~ ^[^:]+:([0-9]+)$ ]]; then
|
||||
explicit_port=${BASH_REMATCH[1]}
|
||||
fi
|
||||
|
||||
export HTTP_PORT
|
||||
update_env_var HTTP_PORT "$HTTP_PORT"
|
||||
if [[ "$url" == http://* && -n "$explicit_port" ]]; then
|
||||
port=$explicit_port
|
||||
else
|
||||
port=${port:-$default_port}
|
||||
if [[ "$url" == http://* && -z "$explicit_port" ]]; then
|
||||
url="${url}:${port}"
|
||||
log "$label URL bez portu - ustawiono $url"
|
||||
elif [[ "$url" == https://* ]]; then
|
||||
warn "$label uzywa HTTPS. Wbudowany nginx nasluchuje lokalnie po HTTP na porcie $port; TLS wymaga reverse proxy."
|
||||
fi
|
||||
fi
|
||||
|
||||
[[ "$port" =~ ^[0-9]+$ ]] || die "$port_var musi byc liczba"
|
||||
(( port >= 1024 && port <= 65535 )) || die "$port_var musi byc z zakresu 1024-65535"
|
||||
|
||||
printf -v "$url_var" '%s' "$url"
|
||||
printf -v "$port_var" '%s' "$port"
|
||||
export "$url_var" "$port_var"
|
||||
update_env_var "$url_var" "$url"
|
||||
update_env_var "$port_var" "$port"
|
||||
}
|
||||
|
||||
require_cmd docker
|
||||
@@ -123,40 +102,40 @@ else
|
||||
die "brak Docker Compose (docker compose lub docker-compose)"
|
||||
fi
|
||||
|
||||
if [[ ! -f "$ENV_FILE" ]]; then
|
||||
write_env_file
|
||||
fi
|
||||
|
||||
[[ -f "$ENV_FILE" ]] || write_env_file
|
||||
load_env_file
|
||||
|
||||
: "${SOURCE_REPO:?Uzupelnij SOURCE_REPO w .env albo ustaw zmienna przed uruchomieniem start.sh}"
|
||||
: "${REPOSITORY_URL:?Uzupelnij REPOSITORY_URL w .env albo ustaw zmienna przed uruchomieniem start.sh}"
|
||||
: "${REPOSITORY_URL:?Uzupelnij REPOSITORY_URL dla APT/RPM}"
|
||||
: "${OPNSENSE_REPOSITORY_URL:?Uzupelnij OPNSENSE_REPOSITORY_URL dla repo FreeBSD pkg}"
|
||||
|
||||
case "$SOURCE_REPO" in
|
||||
http://*|https://*|ssh://*|git@*|file://*) ;;
|
||||
*) die "SOURCE_REPO ma nieobslugiwany format: $SOURCE_REPO" ;;
|
||||
esac
|
||||
|
||||
normalize_http_settings
|
||||
normalize_repo_url REPOSITORY_URL HTTP_PORT "$DEFAULT_HTTP_PORT" "APT/RPM"
|
||||
normalize_repo_url OPNSENSE_REPOSITORY_URL OPNSENSE_HTTP_PORT "$DEFAULT_OPNSENSE_HTTP_PORT" "OPNsense"
|
||||
[[ "$HTTP_PORT" != "$OPNSENSE_HTTP_PORT" ]] || die "HTTP_PORT i OPNSENSE_HTTP_PORT musza byc rozne"
|
||||
|
||||
mkdir -p "$DATA_DIR/repository" "$DATA_DIR/state" "$DATA_DIR/cargo" "$DATA_DIR/work" "$GPG_DIR"
|
||||
chmod 0700 "$GPG_DIR" 2>/dev/null || true
|
||||
|
||||
log "budowanie obrazu buildera"
|
||||
log "budowanie obrazu buildera (Linux + FreeBSD cross-toolchain)"
|
||||
"${COMPOSE[@]}" --env-file "$ENV_FILE" build "$SERVICE"
|
||||
|
||||
if [[ ! -s "$GPG_DIR/private-key.asc" ]]; then
|
||||
log "brak klucza GPG - generowanie stalego klucza podpisujacego"
|
||||
log "brak klucza GPG - generowanie stalego klucza podpisujacego Linux APT/RPM"
|
||||
|
||||
IMAGE_REF=$("${COMPOSE[@]}" --env-file "$ENV_FILE" config | awk '''
|
||||
IMAGE_REF=$("${COMPOSE[@]}" --env-file "$ENV_FILE" config | awk '
|
||||
$1 == "rust-package-builder:" { in_builder=1; next }
|
||||
in_builder && $1 == "image:" { print $2; exit }
|
||||
''')
|
||||
')
|
||||
[[ -n "$IMAGE_REF" ]] || die "nie mozna ustalic nazwy zbudowanego obrazu buildera"
|
||||
docker image inspect "$IMAGE_REF" >/dev/null 2>&1 || die "zbudowany obraz nie istnieje: $IMAGE_REF"
|
||||
|
||||
uid=$(id -u)
|
||||
gid=$(id -g)
|
||||
|
||||
docker run --rm \
|
||||
--user "$uid:$gid" \
|
||||
--entrypoint /bin/bash \
|
||||
@@ -168,7 +147,6 @@ if [[ ! -s "$GPG_DIR/private-key.asc" ]]; then
|
||||
export GNUPGHOME=/tmp/rpb-keygen
|
||||
mkdir -p "$GNUPGHOME"
|
||||
chmod 0700 "$GNUPGHOME"
|
||||
|
||||
cat > /tmp/gpg-batch <<"KEY"
|
||||
Key-Type: RSA
|
||||
Key-Length: 3072
|
||||
@@ -179,11 +157,9 @@ Expire-Date: 0
|
||||
%no-protection
|
||||
%commit
|
||||
KEY
|
||||
|
||||
gpg --batch --generate-key /tmp/gpg-batch
|
||||
fingerprint=$(gpg --batch --with-colons --list-secret-keys | awk -F: '\''/^sec:/ {seen=1; next} seen && /^fpr:/ {print $10; exit}'\'')
|
||||
test -n "$fingerprint"
|
||||
|
||||
gpg --batch --armor --export-secret-keys "$fingerprint" > /out/private-key.asc
|
||||
gpg --batch --armor --export "$fingerprint" > /out/public-key.asc
|
||||
printf "%s\n" "$fingerprint" > /out/fingerprint
|
||||
@@ -197,30 +173,25 @@ else
|
||||
log "uzywanie istniejacego klucza GPG"
|
||||
fi
|
||||
|
||||
log "uruchamianie buildera i mikro HTTP przez Docker Compose"
|
||||
log "uruchamianie buildera i wspolnego nginx przez Docker Compose"
|
||||
"${COMPOSE[@]}" --env-file "$ENV_FILE" up -d "$SERVICE" "$HTTP_SERVICE"
|
||||
|
||||
fingerprint=""
|
||||
if [[ -r "$GPG_DIR/fingerprint" ]]; then
|
||||
fingerprint=$(tr -d '[:space:]' < "$GPG_DIR/fingerprint")
|
||||
fi
|
||||
[[ -r "$GPG_DIR/fingerprint" ]] && fingerprint=$(tr -d '[:space:]' < "$GPG_DIR/fingerprint")
|
||||
|
||||
log "gotowe"
|
||||
printf '\n'
|
||||
printf 'SOURCE_REPO: %s\n' "$SOURCE_REPO"
|
||||
printf 'REPOSITORY_URL: %s\n' "$REPOSITORY_URL"
|
||||
printf 'HTTP port: %s\n' "$HTTP_PORT"
|
||||
[[ -n "$fingerprint" ]] && printf 'GPG fingerprint: %s\n' "$fingerprint"
|
||||
printf 'Publiczny katalog: %s\n' "$DATA_DIR/repository"
|
||||
printf '\n'
|
||||
printf 'Repo/strona: %s/\n' "${REPOSITORY_URL%/}"
|
||||
printf 'Healthcheck: http://127.0.0.1:%s/healthz\n' "$HTTP_PORT"
|
||||
printf '\n'
|
||||
printf 'Podglad logow buildera:\n '
|
||||
printf '\nSOURCE_REPO: %s\n' "$SOURCE_REPO"
|
||||
printf 'APT/RPM URL: %s/\n' "${REPOSITORY_URL%/}"
|
||||
printf 'APT/RPM local HTTP port: %s\n' "$HTTP_PORT"
|
||||
printf 'OPNsense pkg URL: %s/\n' "${OPNSENSE_REPOSITORY_URL%/}"
|
||||
printf 'OPNsense local HTTP port: %s\n' "$OPNSENSE_HTTP_PORT"
|
||||
[[ -n "$fingerprint" ]] && printf 'GPG fingerprint: %s\n' "$fingerprint"
|
||||
printf 'Publiczny katalog: %s\n\n' "$DATA_DIR/repository"
|
||||
printf 'Health Linux: http://127.0.0.1:%s/healthz\n' "$HTTP_PORT"
|
||||
printf 'Health OPNsense: http://127.0.0.1:%s/healthz\n\n' "$OPNSENSE_HTTP_PORT"
|
||||
printf 'Logi buildera:\n '
|
||||
printf '%q ' "${COMPOSE[@]}"
|
||||
printf 'logs -f %q\n' "$SERVICE"
|
||||
printf 'Podglad logow HTTP:\n '
|
||||
printf 'Logi HTTP:\n '
|
||||
printf '%q ' "${COMPOSE[@]}"
|
||||
printf 'logs -f %q\n' "$HTTP_SERVICE"
|
||||
printf '\n'
|
||||
printf 'Builder natychmiast sprawdzi branch master (lub SOURCE_BRANCH, jezeli ustawiono go opcjonalnie) i po udanym buildzie opublikuje repozytorium.\n'
|
||||
Reference in new issue
Block a user