mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 06:58:52 +03:00
c554dc761d
Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN, and credentials pointers for mirror token recovery. Co-authored-by: Cursor <cursoragent@cursor.com>
129 lines
4.7 KiB
Bash
Executable File
129 lines
4.7 KiB
Bash
Executable File
#!/bin/sh
|
|
# Install and start Gitea on cluster primary (cast01) — config only, no repo mirrors yet.
|
|
set -eu
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
# shellcheck source=/dev/null
|
|
. "$ROOT/scripts/lib/common.sh"
|
|
load_cluster_env
|
|
|
|
GITEA_DIR="${ROOT}/gitea"
|
|
TEMPLATE="${GITEA_DIR}/app.ini.template"
|
|
INI="/etc/gitea/app.ini"
|
|
GITEA_APP_DATA="${GITEA_APP_DATA:-/var/lib/gitea}"
|
|
GITEA_HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
|
|
GITEA_DOMAIN="${GITEA_PUBLIC_HOST:-${ACL0_CNAME:-acl0.f0xx.org}}"
|
|
GITEA_ROOT_URL="${GITEA_ROOT_URL:-https://${GITEA_DOMAIN}/app/androidcast_project/git/}"
|
|
GITEA_DB_USER="${GITEA_DB_USER:-androidcast}"
|
|
GITEA_DB_PASS="$(read_cred mariadb_app password)"
|
|
GITEA_SECRETS="${GITEA_APP_DATA}/.lab-secrets.env"
|
|
|
|
if [ "${GITEA_ENABLE:-0}" != "1" ]; then
|
|
log "GITEA_ENABLE!=1 — skip deploy-gitea"
|
|
exit 0
|
|
fi
|
|
|
|
if ! is_primary_node; then
|
|
log "deploy-gitea: skip on replica $(host_short) (Gitea runs on ${CAST01_HOST} only)"
|
|
exit 0
|
|
fi
|
|
|
|
gitea_stop_clean() {
|
|
rc-service gitea stop 2>/dev/null || true
|
|
sleep 2
|
|
pkill -u gitea -f '/usr/bin/gitea web' 2>/dev/null || true
|
|
sleep 1
|
|
rm -f "${GITEA_APP_DATA}/gitea.db-shm" "${GITEA_APP_DATA}/gitea.db-wal" 2>/dev/null || true
|
|
}
|
|
|
|
gitea_wait_http() {
|
|
_port="${1:-$GITEA_HTTP_PORT}"
|
|
_i=0
|
|
while [ "$_i" -lt 180 ]; do
|
|
if curl -fsS -m 2 -o /dev/null "http://127.0.0.1:${_port}/" 2>/dev/null; then
|
|
return 0
|
|
fi
|
|
_i=$((_i + 1))
|
|
sleep 2
|
|
done
|
|
die "timeout waiting for gitea http://127.0.0.1:${_port}/"
|
|
}
|
|
|
|
[ -f "$TEMPLATE" ] || die "missing $TEMPLATE"
|
|
|
|
apk add --no-cache gitea 2>/dev/null || apk add --no-cache gitea
|
|
|
|
mkdir -p "$GITEA_APP_DATA/data/gitea-repositories" "$GITEA_APP_DATA/lfs" /var/log/gitea /etc/gitea
|
|
chown -R gitea:www-data "$GITEA_APP_DATA" /var/log/gitea 2>/dev/null || true
|
|
|
|
# Optional MariaDB backend (set GITEA_DB_TYPE=mysql in cluster.env). Default: sqlite3 for lab.
|
|
if [ "${GITEA_DB_TYPE:-sqlite3}" = "mysql" ]; then
|
|
mariadb -u root -e "CREATE DATABASE IF NOT EXISTS gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" 2>/dev/null \
|
|
|| mariadb -e "CREATE DATABASE IF NOT EXISTS gitea CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
|
|
mariadb -u root -e "GRANT ALL PRIVILEGES ON gitea.* TO '${GITEA_DB_USER}'@'localhost'; FLUSH PRIVILEGES;" 2>/dev/null \
|
|
|| mariadb -e "GRANT ALL PRIVILEGES ON gitea.* TO '${GITEA_DB_USER}'@'localhost'; FLUSH PRIVILEGES;"
|
|
fi
|
|
|
|
gitea_rand_secret() {
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
openssl rand -base64 48 | tr -d '/+=' | head -c 64
|
|
return 0
|
|
fi
|
|
head -c 48 /dev/urandom | base64 | tr -d '/+=' | head -c 64
|
|
}
|
|
|
|
if [ -f "$GITEA_SECRETS" ]; then
|
|
# shellcheck disable=SC1090
|
|
. "$GITEA_SECRETS"
|
|
else
|
|
GITEA_INTERNAL_TOKEN="$(gitea_rand_secret)"
|
|
GITEA_OAUTH_JWT="$(gitea_rand_secret)"
|
|
GITEA_LFS_JWT="$(gitea_rand_secret)"
|
|
umask 077
|
|
cat > "$GITEA_SECRETS" <<EOF
|
|
GITEA_INTERNAL_TOKEN=${GITEA_INTERNAL_TOKEN}
|
|
GITEA_OAUTH_JWT=${GITEA_OAUTH_JWT}
|
|
GITEA_LFS_JWT=${GITEA_LFS_JWT}
|
|
EOF
|
|
chown gitea:gitea "$GITEA_SECRETS" 2>/dev/null || true
|
|
fi
|
|
|
|
if [ ! -f "$INI" ] || [ "${FORCE_GITEA_CONFIG:-0}" = "1" ] || ! grep -q 'AndroidCast lab' "$INI" 2>/dev/null; then
|
|
log "render $INI from template (ROOT_URL=$GITEA_ROOT_URL)"
|
|
_tmp="$(mktemp)"
|
|
sed \
|
|
-e "s|@GITEA_APP_DATA@|${GITEA_APP_DATA}|g" \
|
|
-e "s|@GITEA_DOMAIN@|${GITEA_DOMAIN}|g" \
|
|
-e "s|@GITEA_ROOT_URL@|${GITEA_ROOT_URL}|g" \
|
|
-e "s|@GITEA_HTTP_PORT@|${GITEA_HTTP_PORT}|g" \
|
|
-e "s|@GITEA_INTERNAL_TOKEN@|${GITEA_INTERNAL_TOKEN}|g" \
|
|
-e "s|@GITEA_OAUTH_JWT@|${GITEA_OAUTH_JWT}|g" \
|
|
-e "s|@GITEA_LFS_JWT@|${GITEA_LFS_JWT}|g" \
|
|
"$TEMPLATE" > "$_tmp"
|
|
install -m 640 -o gitea -g www-data "$_tmp" "$INI"
|
|
rm -f "$_tmp"
|
|
if [ -d "${GITEA_APP_DATA}/custom/conf" ]; then
|
|
install -D -m 640 -o gitea -g www-data "$INI" "${GITEA_APP_DATA}/custom/conf/app.ini"
|
|
fi
|
|
fi
|
|
|
|
gitea_stop_clean
|
|
rc-update add gitea default 2>/dev/null || true
|
|
rc-service gitea start 2>/dev/null || rc-service gitea restart 2>/dev/null || true
|
|
gitea_wait_http "$GITEA_HTTP_PORT"
|
|
# First admin (lab) — idempotent.
|
|
GITEA_ADMIN_USER="${GITEA_ADMIN_USER:-admin}"
|
|
GITEA_ADMIN_PASS="$(read_cred gitea_admin password)"
|
|
if [ -z "$GITEA_ADMIN_PASS" ]; then
|
|
GITEA_ADMIN_PASS="$(read_cred mariadb_app password)"
|
|
fi
|
|
if ! su -s /bin/sh gitea -c "gitea -c '$INI' admin user list" 2>/dev/null | awk 'NR>1 && NF>=2 {found=1} END{exit !found}'; then
|
|
log "create Gitea admin user ${GITEA_ADMIN_USER}"
|
|
su -s /bin/sh gitea -c "gitea -c '$INI' admin user create \
|
|
--username '${GITEA_ADMIN_USER}' \
|
|
--password '${GITEA_ADMIN_PASS}' \
|
|
--email 'admin@${GITEA_DOMAIN}' \
|
|
--admin" 2>/dev/null || log "WARN: admin user create skipped (may already exist)"
|
|
fi
|
|
|
|
log "deploy-gitea_ok $(host_short) ROOT_URL=${GITEA_ROOT_URL} port=${GITEA_HTTP_PORT}"
|