267 lines
8.6 KiB
Bash
Executable File
267 lines
8.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
source /opt/rust-package-builder/scripts/lib.sh
|
|
|
|
SRC=${1:?source path required}
|
|
PKG=${2:?package workspace required}
|
|
BINARY_PATH=${3:?binary path required}
|
|
|
|
rm -rf "$PKG"
|
|
mkdir -p "$PKG/payload" "$PKG/scripts"
|
|
install -D -m 0755 "$BINARY_PATH" "$PKG/payload/usr/bin/$BINARY_NAME"
|
|
|
|
SERVICE_SRC="$SRC/debian/${PACKAGE_NAME}.service"
|
|
ENV_SRC="$SRC/debian/${PACKAGE_NAME}.environment"
|
|
LOGROTATE_SRC="$SRC/debian/${PACKAGE_NAME}.logrotate"
|
|
TMPFILES_SRC="$SRC/debian/${PACKAGE_NAME}.tmpfiles"
|
|
POSTINST_SRC="$SRC/debian/${PACKAGE_NAME}.postinst"
|
|
|
|
if [[ -r "$SERVICE_SRC" ]]; then
|
|
install -D -m 0644 "$SERVICE_SRC" "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service"
|
|
else
|
|
mkdir -p "$PKG/payload/usr/lib/systemd/system"
|
|
cat > "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" <<UNIT
|
|
[Unit]
|
|
Description=$DESCRIPTION
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=rustproxy
|
|
Group=rustproxy
|
|
WorkingDirectory=/var/lib/rustproxy
|
|
UMask=0077
|
|
Environment=RUST_LOG=rust_proxy=info,warn
|
|
Environment=MALLOC_ARENA_MAX=2
|
|
Environment=PATH=/opt/rustproxy-certbot/bin:/usr/local/bin:/usr/bin:/bin
|
|
EnvironmentFile=-/etc/rustproxy/environment
|
|
ExecStart=/usr/bin/$BINARY_NAME --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443
|
|
Restart=on-failure
|
|
RestartSec=3
|
|
KillSignal=SIGINT
|
|
KillMode=control-group
|
|
TimeoutStopSec=120
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectSystem=strict
|
|
LogsDirectory=rustproxy
|
|
LogsDirectoryMode=0770
|
|
ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
RestrictSUIDSGID=true
|
|
RestrictNamespaces=true
|
|
RestrictRealtime=true
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallArchitectures=native
|
|
LockPersonality=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
UNIT
|
|
fi
|
|
|
|
if [[ -r "$ENV_SRC" ]]; then
|
|
install -D -m 0640 "$ENV_SRC" "$PKG/payload/etc/${PACKAGE_NAME}/environment"
|
|
fi
|
|
if [[ -r "$LOGROTATE_SRC" ]]; then
|
|
install -D -m 0644 "$LOGROTATE_SRC" "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}"
|
|
fi
|
|
if [[ -r "$TMPFILES_SRC" ]]; then
|
|
install -D -m 0644 "$TMPFILES_SRC" "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf"
|
|
fi
|
|
|
|
# Preserve optional project-owned monitoring assets used by RustProxy's existing Debian package.
|
|
if [[ -r "$SRC/grafana/rustproxy-overview.json" ]]; then
|
|
install -D -m 0644 "$SRC/grafana/rustproxy-overview.json" "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json"
|
|
fi
|
|
if [[ -r "$SRC/grafana/README.md" ]]; then
|
|
install -D -m 0644 "$SRC/grafana/README.md" "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md"
|
|
fi
|
|
|
|
cat > "$PKG/scripts/deb-postinstall.sh" <<'SCRIPT'
|
|
#!/bin/sh
|
|
set -e
|
|
SCRIPT
|
|
if [[ -r "$POSTINST_SRC" ]]; then
|
|
sed -e '/^#![[:space:]]*\/bin\/sh/d' \
|
|
-e '/^[[:space:]]*#DEBHELPER#[[:space:]]*$/d' \
|
|
-e '/^[[:space:]]*exit[[:space:]]\+0[[:space:]]*$/d' \
|
|
"$POSTINST_SRC" >> "$PKG/scripts/deb-postinstall.sh"
|
|
else
|
|
cat >> "$PKG/scripts/deb-postinstall.sh" <<SCRIPT
|
|
if ! getent group "$PACKAGE_NAME" >/dev/null 2>&1; then
|
|
addgroup --system "$PACKAGE_NAME" >/dev/null
|
|
fi
|
|
if ! getent passwd "$PACKAGE_NAME" >/dev/null 2>&1; then
|
|
adduser --system --ingroup "$PACKAGE_NAME" --home "/var/lib/$PACKAGE_NAME" --no-create-home \\
|
|
--disabled-password --shell /usr/sbin/nologin "$PACKAGE_NAME" >/dev/null
|
|
fi
|
|
install -d -o "$PACKAGE_NAME" -g "$PACKAGE_NAME" -m 0750 "/var/lib/$PACKAGE_NAME" "/var/log/$PACKAGE_NAME"
|
|
SCRIPT
|
|
fi
|
|
cat >> "$PKG/scripts/deb-postinstall.sh" <<SCRIPT
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
systemctl enable "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true
|
|
systemctl restart "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true
|
|
exit 0
|
|
SCRIPT
|
|
|
|
cat > "$PKG/scripts/deb-preremove.sh" <<SCRIPT
|
|
#!/bin/sh
|
|
set -e
|
|
case "\${1:-}" in
|
|
remove|deconfigure) systemctl stop "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true ;;
|
|
esac
|
|
exit 0
|
|
SCRIPT
|
|
|
|
cat > "$PKG/scripts/deb-postremove.sh" <<SCRIPT
|
|
#!/bin/sh
|
|
set -e
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
exit 0
|
|
SCRIPT
|
|
|
|
cat > "$PKG/scripts/rpm-postinstall.sh" <<SCRIPT
|
|
#!/bin/sh
|
|
set -e
|
|
if ! getent group "$PACKAGE_NAME" >/dev/null 2>&1; then
|
|
groupadd --system "$PACKAGE_NAME"
|
|
fi
|
|
if ! getent passwd "$PACKAGE_NAME" >/dev/null 2>&1; then
|
|
useradd --system --gid "$PACKAGE_NAME" --home-dir "/var/lib/$PACKAGE_NAME" --no-create-home --shell /sbin/nologin "$PACKAGE_NAME"
|
|
fi
|
|
install -d -o "$PACKAGE_NAME" -g "$PACKAGE_NAME" -m 0750 "/var/lib/$PACKAGE_NAME" "/var/log/$PACKAGE_NAME"
|
|
systemd-tmpfiles --create "/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" >/dev/null 2>&1 || true
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
systemctl enable "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true
|
|
systemctl restart "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true
|
|
exit 0
|
|
SCRIPT
|
|
|
|
cat > "$PKG/scripts/rpm-preremove.sh" <<SCRIPT
|
|
#!/bin/sh
|
|
set -e
|
|
if [ "\${1:-1}" -eq 0 ]; then
|
|
systemctl stop "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true
|
|
systemctl disable "${PACKAGE_NAME}.service" >/dev/null 2>&1 || true
|
|
fi
|
|
exit 0
|
|
SCRIPT
|
|
|
|
cat > "$PKG/scripts/rpm-postremove.sh" <<SCRIPT
|
|
#!/bin/sh
|
|
set -e
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
exit 0
|
|
SCRIPT
|
|
|
|
chmod 0755 "$PKG/scripts"/*.sh
|
|
|
|
# Build nFPM contents dynamically from project-provided package assets.
|
|
CONTENTS_FILE="$PKG/contents.yaml"
|
|
: > "$CONTENTS_FILE"
|
|
add_content() {
|
|
local src=$1 dst=$2 mode=$3 type=${4:-}
|
|
{
|
|
printf ' - src: %s\n' "$(yaml_quote "$src")"
|
|
printf ' dst: %s\n' "$(yaml_quote "$dst")"
|
|
[[ -n "$type" ]] && printf ' type: %s\n' "$(yaml_quote "$type")"
|
|
printf ' file_info:\n mode: %s\n' "$mode"
|
|
} >> "$CONTENTS_FILE"
|
|
}
|
|
|
|
add_content "$PKG/payload/usr/bin/$BINARY_NAME" "/usr/bin/$BINARY_NAME" 0755
|
|
add_content "$PKG/payload/usr/lib/systemd/system/${PACKAGE_NAME}.service" "/usr/lib/systemd/system/${PACKAGE_NAME}.service" 0644
|
|
[[ -f "$PKG/payload/etc/${PACKAGE_NAME}/environment" ]] && add_content "$PKG/payload/etc/${PACKAGE_NAME}/environment" "/etc/${PACKAGE_NAME}/environment" 0640 'config|noreplace'
|
|
[[ -f "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}" ]] && add_content "$PKG/payload/etc/logrotate.d/${PACKAGE_NAME}" "/etc/logrotate.d/${PACKAGE_NAME}" 0644 'config|noreplace'
|
|
[[ -f "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" ]] && add_content "$PKG/payload/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" "/usr/lib/tmpfiles.d/${PACKAGE_NAME}.conf" 0644
|
|
[[ -f "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" ]] && add_content "$PKG/payload/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" "/usr/share/${PACKAGE_NAME}/grafana/rustproxy-overview.json" 0644
|
|
[[ -f "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" ]] && add_content "$PKG/payload/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" "/usr/share/doc/${PACKAGE_NAME}/grafana/README.md" 0644
|
|
|
|
NAME_Q=$(yaml_quote "$PACKAGE_NAME")
|
|
VERSION_Q=$(yaml_quote "$VERSION")
|
|
MAINTAINER_Q=$(yaml_quote "$MAINTAINER")
|
|
DESC_Q=$(yaml_quote "$DESCRIPTION")
|
|
LICENSE_Q=$(yaml_quote "$LICENSE")
|
|
HOMEPAGE_Q=$(yaml_quote "$HOMEPAGE")
|
|
GPG_KEY_Q=$(yaml_quote "$GPG_PRIVATE_KEY_FILE")
|
|
|
|
cat > "$PKG/nfpm-deb.yaml" <<YAML
|
|
name: $NAME_Q
|
|
arch: amd64
|
|
platform: linux
|
|
version: $VERSION_Q
|
|
release: "$PACKAGE_RELEASE"
|
|
section: net
|
|
priority: optional
|
|
maintainer: $MAINTAINER_Q
|
|
description: $DESC_Q
|
|
license: $LICENSE_Q
|
|
homepage: $HOMEPAGE_Q
|
|
contents:
|
|
$(cat "$CONTENTS_FILE")
|
|
depends:
|
|
- adduser
|
|
- ca-certificates
|
|
- gzip
|
|
- logrotate
|
|
- python3
|
|
- certbot
|
|
- python3-certbot-dns-rfc2136
|
|
- python3-certbot-dns-cloudflare
|
|
- systemd
|
|
scripts:
|
|
postinstall: "$PKG/scripts/deb-postinstall.sh"
|
|
preremove: "$PKG/scripts/deb-preremove.sh"
|
|
postremove: "$PKG/scripts/deb-postremove.sh"
|
|
deb:
|
|
compression: xz
|
|
signature:
|
|
key_file: $GPG_KEY_Q
|
|
type: origin
|
|
YAML
|
|
|
|
cat > "$PKG/nfpm-rpm.yaml" <<YAML
|
|
name: $NAME_Q
|
|
arch: amd64
|
|
platform: linux
|
|
version: $VERSION_Q
|
|
release: "$PACKAGE_RELEASE"
|
|
section: net
|
|
priority: optional
|
|
maintainer: $MAINTAINER_Q
|
|
description: $DESC_Q
|
|
license: $LICENSE_Q
|
|
homepage: $HOMEPAGE_Q
|
|
vendor: $NAME_Q
|
|
contents:
|
|
$(cat "$CONTENTS_FILE")
|
|
depends:
|
|
- ca-certificates
|
|
- gzip
|
|
- logrotate
|
|
- shadow-utils
|
|
- python3
|
|
- certbot
|
|
- python3-certbot-dns-rfc2136
|
|
- python3-certbot-dns-cloudflare
|
|
- systemd
|
|
scripts:
|
|
postinstall: "$PKG/scripts/rpm-postinstall.sh"
|
|
preremove: "$PKG/scripts/rpm-preremove.sh"
|
|
postremove: "$PKG/scripts/rpm-postremove.sh"
|
|
rpm:
|
|
compression: zstd
|
|
signature:
|
|
key_file: $GPG_KEY_Q
|
|
YAML
|