135 lines
5.9 KiB
Bash
135 lines
5.9 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
src_dir=${1:-/tmp/xtao-phase03}
|
|
runner_src="$src_dir/secret_agent_runner_phase03.py"
|
|
agent=/usr/local/bin/xtao-secret-agent
|
|
docker_bin=/usr/local/bin/docker
|
|
compose_bin=/usr/local/bin/docker-compose
|
|
ts=$(date -u +%Y%m%dT%H%M%SZ)
|
|
|
|
[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
|
|
[ -r "$runner_src" ] || { echo "FAIL missing_runner_src"; exit 2; }
|
|
|
|
runner_dst=/volume1/xtao-data/secret-agent/bin/secret_agent_runner.py
|
|
cp -p "$runner_dst" "$runner_dst.bak.phase03.reconcile.$ts"
|
|
install -m 600 "$runner_src" "$runner_dst"
|
|
|
|
"$agent" upsert --entry infra/nextcloud/admin
|
|
"$agent" upsert --entry infra/nextcloud/postgres
|
|
"$agent" upsert --entry infra/nextcloud/redis
|
|
"$agent" check --entry infra/nextcloud/admin
|
|
"$agent" check --entry infra/nextcloud/postgres
|
|
"$agent" check --entry infra/nextcloud/redis
|
|
|
|
tmpdir=$(mktemp -d /volume1/xtao-data/nextcloud/secrets/.reconcile.XXXXXX)
|
|
chmod 700 "$tmpdir"
|
|
cleanup() {
|
|
rm -rf "$tmpdir"
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
"$agent" raw-field --entry infra/nextcloud/postgres --field password > "$tmpdir/dbpass"
|
|
"$agent" raw-field --entry infra/nextcloud/redis --field password > "$tmpdir/redispass"
|
|
"$agent" raw-field --entry infra/nextcloud/admin --field password > "$tmpdir/adminpass"
|
|
chmod 600 "$tmpdir/dbpass" "$tmpdir/redispass" "$tmpdir/adminpass"
|
|
|
|
dbuser=$("$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php -r 'include "/var/www/html/config/config.php"; echo $CONFIG["dbuser"];')
|
|
dbname=$("$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php -r 'include "/var/www/html/config/config.php"; echo $CONFIG["dbname"];')
|
|
case "$dbuser" in
|
|
*[!A-Za-z0-9_-]*|"") echo "FAIL unexpected_dbuser"; exit 3;;
|
|
esac
|
|
case "$dbname" in
|
|
*[!A-Za-z0-9_-]*|"") echo "FAIL unexpected_dbname"; exit 3;;
|
|
esac
|
|
|
|
if grep -q "'" "$tmpdir/dbpass"; then
|
|
echo "FAIL unexpected_dbpass_character"
|
|
exit 3
|
|
fi
|
|
awk -v u="$dbuser" '{printf "ALTER USER \"%s\" WITH PASSWORD '"'"'%s'"'"';\n", u, $0}' "$tmpdir/dbpass" > "$tmpdir/alter.sql"
|
|
chmod 600 "$tmpdir/alter.sql"
|
|
"$docker_bin" exec -i nextcloud-nextcloud-db-1 psql -U nextcloud -d "$dbname" < "$tmpdir/alter.sql" >/dev/null
|
|
|
|
{
|
|
printf 'POSTGRES_HOST=nextcloud-db\nPOSTGRES_DB=%s\nPOSTGRES_USER=%s\nPOSTGRES_PASSWORD=' "$dbname" "$dbuser"
|
|
cat "$tmpdir/dbpass"
|
|
printf '\nREDIS_HOST=nextcloud-redis\nREDIS_HOST_PORT=6379\nREDIS_HOST_PASSWORD='
|
|
cat "$tmpdir/redispass"
|
|
printf '\nNEXTCLOUD_ADMIN_USER=xtao-admin\nNEXTCLOUD_ADMIN_PASSWORD='
|
|
cat "$tmpdir/adminpass"
|
|
printf '\nNEXTCLOUD_TRUSTED_DOMAINS=cloud.xtao.net\n'
|
|
printf 'TRUSTED_PROXIES=172.16.0.0/12 192.168.1.0/24\n'
|
|
printf 'OVERWRITEHOST=cloud.xtao.net\nOVERWRITEPROTOCOL=https\nOVERWRITECLIURL=https://cloud.xtao.net\n'
|
|
printf 'APACHE_DISABLE_REWRITE_IP=1\nPHP_MEMORY_LIMIT=1024M\nPHP_UPLOAD_LIMIT=10G\n'
|
|
} > "$tmpdir/nextcloud.env"
|
|
chmod 600 "$tmpdir/nextcloud.env"
|
|
mv "$tmpdir/nextcloud.env" /volume1/xtao-data/nextcloud/secrets/nextcloud.env
|
|
|
|
{
|
|
printf 'POSTGRES_DB=nextcloud\nPOSTGRES_USER=nextcloud\nPOSTGRES_PASSWORD='
|
|
cat "$tmpdir/dbpass"
|
|
printf '\n'
|
|
} > "$tmpdir/postgres.env"
|
|
chmod 600 "$tmpdir/postgres.env"
|
|
mv "$tmpdir/postgres.env" /volume1/xtao-data/nextcloud/secrets/postgres.env
|
|
|
|
{
|
|
printf 'appendonly yes\nrequirepass '
|
|
cat "$tmpdir/redispass"
|
|
printf '\n'
|
|
} > "$tmpdir/redis.conf"
|
|
chmod 400 "$tmpdir/redis.conf"
|
|
chown 999:0 "$tmpdir/redis.conf"
|
|
mv "$tmpdir/redis.conf" /volume1/xtao-data/nextcloud/secrets/redis.conf
|
|
|
|
cd /volume1/xtao-data/nextcloud
|
|
"$compose_bin" -f compose.yaml up -d nextcloud-redis
|
|
"$docker_bin" restart nextcloud-nextcloud-redis-1 >/dev/null
|
|
sleep 3
|
|
|
|
cat "$tmpdir/dbpass" | "$docker_bin" exec -i -u www-data nextcloud-nextcloud-web-1 php -r '
|
|
$v = trim(stream_get_contents(STDIN));
|
|
include "/var/www/html/config/config.php";
|
|
$CONFIG["dbpassword"] = $v;
|
|
$out = "<?php\n$"."CONFIG = " . var_export($CONFIG, true) . ";\n";
|
|
file_put_contents("/var/www/html/config/config.php", $out);
|
|
'
|
|
|
|
cat "$tmpdir/redispass" | "$docker_bin" exec -i -u www-data nextcloud-nextcloud-web-1 php -r '
|
|
$v = trim(stream_get_contents(STDIN));
|
|
include "/var/www/html/config/config.php";
|
|
if (!isset($CONFIG["redis"]) || !is_array($CONFIG["redis"])) {
|
|
$CONFIG["redis"] = array();
|
|
}
|
|
$CONFIG["redis"]["host"] = "nextcloud-redis";
|
|
$CONFIG["redis"]["port"] = 6379;
|
|
$CONFIG["redis"]["password"] = $v;
|
|
$CONFIG["memcache.locking"] = "\\OC\\Memcache\\Redis";
|
|
$out = "<?php\n$"."CONFIG = " . var_export($CONFIG, true) . ";\n";
|
|
file_put_contents("/var/www/html/config/config.php", $out);
|
|
'
|
|
|
|
{
|
|
cat "$tmpdir/adminpass"
|
|
printf '\n'
|
|
cat "$tmpdir/adminpass"
|
|
printf '\n'
|
|
} | "$docker_bin" exec -i -u www-data nextcloud-nextcloud-web-1 php occ user:resetpassword xtao-admin >/dev/null
|
|
|
|
"$compose_bin" -f compose.yaml up -d
|
|
sleep 5
|
|
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ background:cron
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_domains 1 --value=cloud.xtao.net
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 0 --value=172.16.0.0/12
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set trusted_proxies 1 --value=192.168.1.0/24
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwritehost --value=cloud.xtao.net
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwriteprotocol --value=https
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set overwrite.cli.url --value=https://cloud.xtao.net
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set htaccess.RewriteBase --value=/
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ config:system:set maintenance_window_start --type=integer --value=8
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ maintenance:update:htaccess
|
|
"$docker_bin" exec -u www-data nextcloud-nextcloud-web-1 php occ status
|
|
|
|
printf 'PASS nextcloud_secret_reconcile values=redacted\n'
|