73 lines
5.0 KiB
Bash
Executable File
73 lines
5.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# Only run inside a disposable container with /pkg mounted read-only.
|
|
set -eu
|
|
[ "${BLUEBIRD_INSTALL_SMOKE:-}" = 1 ] && [ "$(id -u)" = 0 ] && [ -f /pkg/ARCH ] || { echo 'Only for the isolated deployment test container' >&2; exit 1; }
|
|
fixture_password=install-fixture-password
|
|
worker_pid=
|
|
trap 'if [ -n "$worker_pid" ]; then kill "$worker_pid" 2>/dev/null || :; wait "$worker_pid" 2>/dev/null || :; fi' EXIT
|
|
|
|
/pkg/bluebird validate-config --config /pkg/config.toml
|
|
[ ! -e /pkg/var ]
|
|
# Invalid site paths must fail before publishing configuration or credentials.
|
|
if BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/rejected --url http://files.example.test/path --encrypt --no-start >/tmp/rejected.log 2>&1; then echo 'Invalid site path accepted' >&2; exit 1; fi
|
|
[ ! -e /opt/rejected ]
|
|
[ -z "$(find /opt -maxdepth 1 -name '.bluebird-install-*' -print)" ]
|
|
if [ "${1:-https}" = http ]; then
|
|
BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --url http://files.example.test --encrypt --no-start
|
|
grep -q '^listen = "127.0.0.1:8080"$' /opt/bluebird/config.toml
|
|
grep -q '^secure_cookies = false$' /opt/bluebird/config.toml
|
|
runuser -u bluebird -- /opt/bluebird/bluebird check --config /opt/bluebird/config.toml
|
|
echo 'Public HTTP hostname without a port installed successfully'
|
|
exit 0
|
|
fi
|
|
|
|
if [ "${1:-https}" = lan ]; then
|
|
if BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/rejected --url http://192.168.1.10 --lan-http --no-start >/tmp/rejected-no-port.log 2>&1; then echo 'Portless LAN HTTP accepted' >&2; exit 1; fi
|
|
grep -q '内网HTTP地址须包含端口' /tmp/rejected-no-port.log
|
|
if BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/rejected --url http://192.168.1.10:8080 --no-start >/tmp/rejected-lan.log 2>&1; then echo 'LAN HTTP accepted without explicit flag' >&2; exit 1; fi
|
|
BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --url http://192.168.1.10:8080 --lan-http --encrypt --no-start
|
|
grep -q '^listen = "192.168.1.10:8080"$' /opt/bluebird/config.toml
|
|
grep -q '^allow_lan_http = true$' /opt/bluebird/config.toml
|
|
grep -q '^secure_cookies = false$' /opt/bluebird/config.toml
|
|
echo 'LAN installation and explicit HTTP opt-in passed'
|
|
exit 0
|
|
fi
|
|
# A failed password prompt/init leaves no final data directory or stale stage.
|
|
if BLUEBIRD_ADMIN_PASSWORD=short /pkg/install.sh --prefix /opt/rejected --url https://files.example.com --no-start >/tmp/rejected-password.log 2>&1; then echo 'Short password accepted' >&2; exit 1; fi
|
|
[ ! -e /opt/rejected ]
|
|
[ -z "$(find /opt -maxdepth 1 -name '.bluebird-install-*' -print)" ]
|
|
BLUEBIRD_ADMIN_PASSWORD=$fixture_password /pkg/install.sh --prefix /opt/bluebird-fixture --lan-url http://127.0.0.1:18995 --access-url http://files.example.com --url https://files.example.com --encrypt --no-start
|
|
prefix=/opt/bluebird-fixture
|
|
[ "$(stat -c '%U:%G:%a' "$prefix")" = root:bluebird:750 ]
|
|
[ "$(stat -c '%U:%G:%a' "$prefix/bluebird")" = root:bluebird:750 ]
|
|
[ "$(stat -c '%U:%G:%a' "$prefix/config.toml")" = root:bluebird:640 ]
|
|
[ "$(stat -c '%U:%G:%a' "$prefix/var")" = bluebird:bluebird:700 ]
|
|
grep -q '^public_url = .*https://files.example.com' "$prefix/config.toml"
|
|
grep -q '^secure_cookies = true$' "$prefix/config.toml"
|
|
grep -q 'http://files.example.com' "$prefix/config.toml"
|
|
grep -q 'http://127.0.0.1:18995' "$prefix/config.toml"
|
|
grep -q '^allow_lan_http = true$' "$prefix/config.toml"
|
|
grep -q '^encryption = true$' "$prefix/config.toml"
|
|
grep -q "^ExecStart=$prefix/bluebird serve --config $prefix/config.toml$" /etc/systemd/system/bluebird.service
|
|
[ -f "$prefix/var/secrets/age.key" ]
|
|
if grep -raq "$fixture_password" "$prefix"; then echo 'Plaintext bootstrap password persisted' >&2; exit 1; fi
|
|
before=$(sha256sum "$prefix/config.toml")
|
|
if BLUEBIRD_ADMIN_PASSWORD=another-password /pkg/install.sh --prefix "$prefix" --url https://other.example.com --no-start >/tmp/reinstall.log 2>&1; then echo 'Existing installation overwritten' >&2; exit 1; fi
|
|
[ "$(sha256sum "$prefix/config.toml")" = "$before" ]
|
|
runuser -u bluebird -- "$prefix/bluebird" check --config "$prefix/config.toml"
|
|
runuser -u bluebird -- "$prefix/bluebird" serve --config "$prefix/config.toml" >/tmp/bluebird-serve.log 2>&1 &
|
|
worker_pid=$!
|
|
ready=false
|
|
for attempt in 1 2 3 4 5 6 7 8 9 10; do
|
|
if bash -c 'exec 3<>/dev/tcp/127.0.0.1/18995; printf "GET /api/v1/health HTTP/1.1\r\nHost: files.example.com\r\nConnection: close\r\n\r\n" >&3; cat <&3' >/tmp/health.txt 2>/dev/null && grep -q '"ready":true' /tmp/health.txt; then ready=true; break; fi
|
|
sleep .1
|
|
done
|
|
[ "$ready" = true ] || { cat /tmp/bluebird-serve.log; exit 1; }
|
|
# Config validation is read-only and may run while the service holds its lock.
|
|
runuser -u bluebird -- "$prefix/bluebird" validate-config --config "$prefix/config.toml"
|
|
if runuser -u bluebird -- "$prefix/bluebird" check --config "$prefix/config.toml" >/tmp/locked-check.log 2>&1; then echo 'Maintenance ignored service lock' >&2; exit 1; fi
|
|
kill "$worker_pid"
|
|
wait "$worker_pid" || :
|
|
worker_pid=
|
|
echo 'Installation, ownership, protected credentials, repeat-install guard and native service passed'
|