227 lines
7.0 KiB
Bash
Executable File
227 lines
7.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
cd "$ROOT"
|
|
|
|
ENV_FILE="$ROOT/.env"
|
|
GPG_DIR="$ROOT/gpg"
|
|
DATA_DIR="$ROOT/data"
|
|
SERVICE="rust-package-builder"
|
|
HTTP_SERVICE="repository-http"
|
|
DEFAULT_HTTP_PORT=18765
|
|
|
|
log() {
|
|
printf '[start] %s\n' "$*"
|
|
}
|
|
|
|
warn() {
|
|
printf '[start] WARN: %s\n' "$*" >&2
|
|
}
|
|
|
|
die() {
|
|
printf '[start] ERROR: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
require_cmd() {
|
|
command -v "$1" >/dev/null 2>&1 || die "brak wymaganego polecenia: $1"
|
|
}
|
|
|
|
write_env_file() {
|
|
local source_repo=${SOURCE_REPO:-}
|
|
local repository_url=${REPOSITORY_URL:-}
|
|
|
|
cat > "$ENV_FILE" <<ENV
|
|
SOURCE_REPO=$source_repo
|
|
REPOSITORY_URL=$repository_url
|
|
ENV
|
|
chmod 0600 "$ENV_FILE" 2>/dev/null || true
|
|
}
|
|
|
|
update_env_var() {
|
|
local key=$1
|
|
local value=$2
|
|
local tmp="$ENV_FILE.tmp.$$"
|
|
|
|
awk -v key="$key" -v value="$value" '
|
|
BEGIN { found=0 }
|
|
index($0, key "=") == 1 { print key "=" value; found=1; next }
|
|
{ print }
|
|
END { if (!found) print key "=" value }
|
|
' "$ENV_FILE" > "$tmp"
|
|
mv "$tmp" "$ENV_FILE"
|
|
chmod 0600 "$ENV_FILE" 2>/dev/null || true
|
|
}
|
|
|
|
load_env_file() {
|
|
# .env is intentionally limited to simple KEY=value entries used by Compose.
|
|
# shellcheck disable=SC1090
|
|
set -a
|
|
source "$ENV_FILE"
|
|
set +a
|
|
}
|
|
|
|
normalize_http_settings() {
|
|
local url=${REPOSITORY_URL%/}
|
|
local rest hostpart explicit_port=""
|
|
|
|
HTTP_PORT=${HTTP_PORT:-}
|
|
|
|
case "$url" in
|
|
http://*)
|
|
rest=${url#http://}
|
|
[[ "$rest" != */* ]] || die "REPOSITORY_URL dla wbudowanego HTTP nie moze zawierac sciezki: $REPOSITORY_URL"
|
|
hostpart=$rest
|
|
|
|
if [[ "$hostpart" =~ ^\[[^]]+\]:([0-9]+)$ ]]; then
|
|
explicit_port=${BASH_REMATCH[1]}
|
|
elif [[ "$hostpart" =~ ^[^:]+:([0-9]+)$ ]]; then
|
|
explicit_port=${BASH_REMATCH[1]}
|
|
fi
|
|
|
|
if [[ -n "$explicit_port" ]]; then
|
|
HTTP_PORT=$explicit_port
|
|
else
|
|
HTTP_PORT=${HTTP_PORT:-$DEFAULT_HTTP_PORT}
|
|
url="${url}:${HTTP_PORT}"
|
|
REPOSITORY_URL=$url
|
|
export REPOSITORY_URL
|
|
update_env_var REPOSITORY_URL "$REPOSITORY_URL"
|
|
log "REPOSITORY_URL bez portu - ustawiono $REPOSITORY_URL"
|
|
fi
|
|
;;
|
|
https://*)
|
|
# HTTPS is supported as a public URL only when an external TLS proxy points
|
|
# to the local micro HTTP service. The embedded service itself is HTTP only.
|
|
HTTP_PORT=${HTTP_PORT:-$DEFAULT_HTTP_PORT}
|
|
warn "REPOSITORY_URL uzywa HTTPS. Wbudowany serwer nasluchuje po zwyklym HTTP na porcie $HTTP_PORT; HTTPS wymaga zewnetrznego reverse proxy/TLS."
|
|
;;
|
|
*)
|
|
die "REPOSITORY_URL musi zaczynac sie od http:// albo https://"
|
|
;;
|
|
esac
|
|
|
|
[[ "$HTTP_PORT" =~ ^[0-9]+$ ]] || die "HTTP_PORT musi byc liczba"
|
|
(( HTTP_PORT >= 1024 && HTTP_PORT <= 65535 )) || die "HTTP_PORT musi byc z zakresu 1024-65535"
|
|
|
|
export HTTP_PORT
|
|
update_env_var HTTP_PORT "$HTTP_PORT"
|
|
}
|
|
|
|
require_cmd docker
|
|
require_cmd awk
|
|
if ! docker info >/dev/null 2>&1; then
|
|
die "Docker daemon nie jest dostepny dla aktualnego uzytkownika"
|
|
fi
|
|
|
|
if docker compose version >/dev/null 2>&1; then
|
|
COMPOSE=(docker compose)
|
|
elif command -v docker-compose >/dev/null 2>&1; then
|
|
COMPOSE=(docker-compose)
|
|
else
|
|
die "brak Docker Compose (docker compose lub docker-compose)"
|
|
fi
|
|
|
|
if [[ ! -f "$ENV_FILE" ]]; then
|
|
write_env_file
|
|
fi
|
|
|
|
load_env_file
|
|
: "${SOURCE_REPO:?Uzupelnij SOURCE_REPO w .env albo ustaw zmienna przed uruchomieniem start.sh}"
|
|
: "${REPOSITORY_URL:?Uzupelnij REPOSITORY_URL w .env albo ustaw zmienna przed uruchomieniem start.sh}"
|
|
|
|
case "$SOURCE_REPO" in
|
|
http://*|https://*|ssh://*|git@*|file://*) ;;
|
|
*) die "SOURCE_REPO ma nieobslugiwany format: $SOURCE_REPO" ;;
|
|
esac
|
|
|
|
normalize_http_settings
|
|
|
|
mkdir -p "$DATA_DIR/repository" "$DATA_DIR/state" "$DATA_DIR/cargo" "$DATA_DIR/work" "$GPG_DIR"
|
|
chmod 0700 "$GPG_DIR" 2>/dev/null || true
|
|
|
|
log "budowanie obrazu buildera"
|
|
"${COMPOSE[@]}" --env-file "$ENV_FILE" build "$SERVICE"
|
|
|
|
if [[ ! -s "$GPG_DIR/private-key.asc" ]]; then
|
|
log "brak klucza GPG - generowanie stalego klucza podpisujacego"
|
|
|
|
IMAGE_REF=$("${COMPOSE[@]}" --env-file "$ENV_FILE" config | awk '''
|
|
$1 == "rust-package-builder:" { in_builder=1; next }
|
|
in_builder && $1 == "image:" { print $2; exit }
|
|
''')
|
|
[[ -n "$IMAGE_REF" ]] || die "nie mozna ustalic nazwy zbudowanego obrazu buildera"
|
|
docker image inspect "$IMAGE_REF" >/dev/null 2>&1 || die "zbudowany obraz nie istnieje: $IMAGE_REF"
|
|
|
|
uid=$(id -u)
|
|
gid=$(id -g)
|
|
|
|
docker run --rm \
|
|
--user "$uid:$gid" \
|
|
--entrypoint /bin/bash \
|
|
-e HOME=/tmp \
|
|
-v "$GPG_DIR:/out" \
|
|
"$IMAGE_REF" \
|
|
-lc '
|
|
set -Eeuo pipefail
|
|
export GNUPGHOME=/tmp/rpb-keygen
|
|
mkdir -p "$GNUPGHOME"
|
|
chmod 0700 "$GNUPGHOME"
|
|
|
|
cat > /tmp/gpg-batch <<"KEY"
|
|
Key-Type: RSA
|
|
Key-Length: 3072
|
|
Key-Usage: sign
|
|
Name-Real: Rust Package Builder Repository
|
|
Name-Email: packages@localhost
|
|
Expire-Date: 0
|
|
%no-protection
|
|
%commit
|
|
KEY
|
|
|
|
gpg --batch --generate-key /tmp/gpg-batch
|
|
fingerprint=$(gpg --batch --with-colons --list-secret-keys | awk -F: '\''/^sec:/ {seen=1; next} seen && /^fpr:/ {print $10; exit}'\'')
|
|
test -n "$fingerprint"
|
|
|
|
gpg --batch --armor --export-secret-keys "$fingerprint" > /out/private-key.asc
|
|
gpg --batch --armor --export "$fingerprint" > /out/public-key.asc
|
|
printf "%s\n" "$fingerprint" > /out/fingerprint
|
|
chmod 0600 /out/private-key.asc
|
|
chmod 0644 /out/public-key.asc /out/fingerprint
|
|
'
|
|
|
|
[[ -s "$GPG_DIR/private-key.asc" ]] || die "generowanie prywatnego klucza GPG nie powiodlo sie"
|
|
[[ -s "$GPG_DIR/public-key.asc" ]] || die "generowanie publicznego klucza GPG nie powiodlo sie"
|
|
else
|
|
log "uzywanie istniejacego klucza GPG"
|
|
fi
|
|
|
|
log "uruchamianie buildera i mikro HTTP przez Docker Compose"
|
|
"${COMPOSE[@]}" --env-file "$ENV_FILE" up -d "$SERVICE" "$HTTP_SERVICE"
|
|
|
|
fingerprint=""
|
|
if [[ -r "$GPG_DIR/fingerprint" ]]; then
|
|
fingerprint=$(tr -d '[:space:]' < "$GPG_DIR/fingerprint")
|
|
fi
|
|
|
|
log "gotowe"
|
|
printf '\n'
|
|
printf 'SOURCE_REPO: %s\n' "$SOURCE_REPO"
|
|
printf 'REPOSITORY_URL: %s\n' "$REPOSITORY_URL"
|
|
printf 'HTTP port: %s\n' "$HTTP_PORT"
|
|
[[ -n "$fingerprint" ]] && printf 'GPG fingerprint: %s\n' "$fingerprint"
|
|
printf 'Publiczny katalog: %s\n' "$DATA_DIR/repository"
|
|
printf '\n'
|
|
printf 'Repo/strona: %s/\n' "${REPOSITORY_URL%/}"
|
|
printf 'Healthcheck: http://127.0.0.1:%s/healthz\n' "$HTTP_PORT"
|
|
printf '\n'
|
|
printf 'Podglad logow buildera:\n '
|
|
printf '%q ' "${COMPOSE[@]}"
|
|
printf 'logs -f %q\n' "$SERVICE"
|
|
printf 'Podglad logow HTTP:\n '
|
|
printf '%q ' "${COMPOSE[@]}"
|
|
printf 'logs -f %q\n' "$HTTP_SERVICE"
|
|
printf '\n'
|
|
printf 'Builder natychmiast sprawdzi branch master (lub SOURCE_BRANCH, jezeli ustawiono go opcjonalnie) i po udanym buildzie opublikuje repozytorium.\n'
|