Rogeeandrogee
7a9fec33c5
* HH-439: harden production artifact pipeline * fix(HH-439): address production compose review * fix(HH-439): preserve previous JWT secrets in production --------- Co-authored-by: Rogee <rogee@ipao.vip>
46 lines
1.4 KiB
Bash
Executable File
46 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
export LC_ALL=C
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
compose_args=(-f "$script_dir/docker-compose.prod.yml")
|
|
if (($#)); then
|
|
env_file=$1
|
|
set -a
|
|
source "$env_file"
|
|
set +a
|
|
compose_args=(--env-file "$env_file" "${compose_args[@]}")
|
|
fi
|
|
|
|
required=(GOCHAT_IMAGE_REF SHANGWUTONG_IMAGE_REF GOCHAT_SERVER_CORS_ALLOWED_ORIGINS POSTGRES_PASSWORD REDIS_PASSWORD MEILI_MASTER_KEY GOCHAT_JWT_SECRET)
|
|
for name in "${required[@]}"; do
|
|
value=${!name:-}
|
|
if [[ -z $value || ${value^^} == *CHANGE_ME* ]]; then
|
|
echo "$name is required and must not contain CHANGE_ME" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
if ((${#GOCHAT_JWT_SECRET} < 32)); then
|
|
echo "GOCHAT_JWT_SECRET must be at least 32 characters" >&2
|
|
exit 1
|
|
fi
|
|
if ((${#MEILI_MASTER_KEY} < 16)); then
|
|
echo "MEILI_MASTER_KEY must be at least 16 bytes" >&2
|
|
exit 1
|
|
fi
|
|
if [[ -n ${GOCHAT_DATABASE_DSN:-} && ! $GOCHAT_DATABASE_DSN =~ (^|[?&])sslmode=(require|verify-ca|verify-full)(&|$) ]]; then
|
|
echo "GOCHAT_DATABASE_DSN must explicitly require TLS for an external database" >&2
|
|
exit 1
|
|
fi
|
|
|
|
images=$(docker compose "${compose_args[@]}" config --images)
|
|
while IFS= read -r image; do
|
|
if [[ $image =~ @sha256:[0-9a-fA-F]{64}$ ]]; then
|
|
continue
|
|
fi
|
|
echo "production image must be pinned to a sha256 digest: $image" >&2
|
|
exit 1
|
|
done <<< "$images"
|
|
echo "production preflight passed"
|