miaou/miaou-server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

experimental service

Browse Source
This commit is contained in:
pvincent
2024-05-05 14:25:54 +04:00
parent 6dac199554
commit ec66d2bd14
4 changed files with 112 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/miaou
+36 -16
View File
@@ -126,15 +126,35 @@ function expand_conf() {
yqmi '.expanded.monitored.containers = ([ .services[] | to_entries | .[] | .value | select (.enabled == true ) | .container ] | unique)'
# add monitored.hosts section
yqmi '.expanded.monitored.hosts = [( .services[][] | select (.enabled == true ) | {"domain": ( parent | key ), "subdomain": key, "fqdn": key + (parent | parent | parent | .expanded.fqdn_middlepart) + ( parent | key ), "container":.container, "port":.port, "app":.app })]'
# yqmi '.expanded.monitored.hosts = [( .services[][] | select (.enabled == true ) | {"domain": ( parent | key ), "subdomain": key, "fqdn": key + (parent | parent | parent | .expanded.fqdn_middlepart) + ( parent | key ), "container":.container, "port":.port, "app":.app })]'
# add services section
if [[ ${#services_app_only[@]} -gt 0 ]]; then
yqmi '.expanded.services = [( .services[][] | select (.enabled == true ) | {"domain": ( parent | key ), "subdomain": key, "fqdn": key + (parent | parent | parent | .expanded.fqdn_middlepart) + ( parent | key ), "container":.container, "port":.port, "app":.app, "name": .name // ""})]'
yqmi '.expanded.services = [( .services[][] | select (.enabled == true ) | {"domain": ( parent | key ), "subdomain": key, "fqdn": key + (parent | parent | parent | .expanded.fqdn_middlepart) + ( parent | key ), "container":.container, "port":.port, "app":.app, "name": .name // "", "exp": .exp // false })]'
else
yqmi '.expanded.services = []'
fi
# change fqdn when exp:true found
readarray -t services < <(yqmt '.expanded.services[] | [ .[] ]')
index=0
for i in "${services[@]}"; do
read -r -a item <<<"$i"
exp=${item[7]}
if [[ "$exp" == true ]]; then
domain=${item[0]}
subdomain=${item[1]}
fqdn=${item[2]}
if [[ $target != beta ]]; then
echowarn "experimental service <$subdomain.exp.$domain> not recommended for target <$target>"
else
echo "experimental service <$subdomain.exp.$domain> detected"
fi
yqmi ".expanded.services[$index].fqdn = \"$subdomain.exp.$domain\""
fi
index=$((index + 1))
done
# add firewall section, bridge_subnet + mail_passthrough if any
bridge_subnet=$(lxc network get lxdbr0 ipv4.address)
yqmi ".firewall.bridge_subnet = \"$bridge_subnet\""
@@ -188,13 +208,14 @@ function monit_show() {
PREFIX="monit:show"
: $PREFIX
readarray -t hosts < <(yqmt '.expanded.monitored.hosts[] | [ .container, .port, .fqdn, .app ]')
echo "================="
echo "${#hosts[@]} available hosts"
echo "================="
readarray -t services < <(yqmt '.expanded.services[] | [ .container, .port, .fqdn, .app ]')
echo "======================"
echo "${#services[@]} available services"
echo "======================"
for service in "${services[@]}"; do
read -r -a item <<<"$service"
for host in "${hosts[@]}"; do
read -r -a item <<<"$host"
container=${item[0]}
port=${item[1]}
fqdn=${item[2]}
@@ -217,7 +238,7 @@ function build_monit() {
# test whether monitored items actually run safely
PREFIX="monit:build"
echo -n "testing monitored hosts ..."
readarray -t hosts < <(yqmt '.expanded.monitored.hosts[] | [ .container, .port, .fqdn ]')
readarray -t hosts < <(yqmt '.expanded.services[] | [ .container, .port, .fqdn ]')
for host in "${hosts[@]}"; do
read -r -a item <<<"$host"
container=${item[0]}
@@ -225,18 +246,18 @@ function build_monit() {
fqdn=${item[2]}
if ! (lxc exec "$container" -- ss -tln | grep -q "\(0.0.0.0\|*\):$port"); then
echoerr
PREFIX='' echo
echoerr "no HTTP server responds on <$container.lxd:$port>"
echoerr "please review configuration <miaou.yaml> for fqdn: $fqdn"
exit 2
fi
if ! curl_check_unsecure "https://$fqdn"; then
echoerr
PREFIX='' echo
echoerr "DMZ does not seem to dispatch <https://$fqdn> please review DMZ Nginx proxy"
exit 3
elif [[ "$target" != 'dev' ]] && ! curl_check "https://$fqdn"; then
PREFIX="" echo
PREFIX='' echo
echowarn "T=$target missing valid certificate for fqdn <https://$fqdn> please review DMZ certbot"
fi
@@ -288,17 +309,17 @@ function build_nftables() {
fi
}
# check whether http server responds 200 OK, required <url>, ie: http://example.com:8001, https://example.com
# check whether http server responds something, required <url>, ie: http://example.com:8001, https://example.com
function curl_check() {
arg1_required "$@"
# echo "curl $1"
curl -m $MAX_WAIT -sLI4 "$1" | grep -q "^HTTP.* 200"
curl -m $MAX_WAIT -sLI4 "$1" | grep -q "^HTTP.* [2|3|4].*"
}
# check whether https server responds 200 OK, even unsecured certificate (auto-signed in mode DEV)
function curl_check_unsecure() {
arg1_required "$@"
curl -m $MAX_WAIT -skLI4 "$1" | grep -q "^HTTP.* 200"
curl -m $MAX_WAIT -skLI4 "$1" | grep -q "^HTTP.* [2|3|4].*"
}
function get_dmz_ip() {
@@ -478,6 +499,5 @@ if check_expand_conf; then
build_routes
build_monit
else
build_routes
monit_show
fi