This commit is contained in:
Qiufeng
+68
-13
@@ -15,12 +15,47 @@ INIT_ARMED=false
|
||||
INIT_COMMITTED=false
|
||||
INIT_RELEASE_ROOT=
|
||||
INIT_APP_ROOT=
|
||||
LOG_LOCALE=${KAIDI_LOG_LOCALE:-zh-CN}
|
||||
SERVICE_USER_CREATED=false
|
||||
SERVICE_GROUP_CREATED=false
|
||||
CREATED_PATHS=()
|
||||
|
||||
log() { printf '[kaidi-baota-init] %s\n' "$*"; }
|
||||
die() { printf '[kaidi-baota-init] ERROR: %s\n' "$*" >&2; exit 1; }
|
||||
localize_message() {
|
||||
local message=$1
|
||||
[ "$LOG_LOCALE" = en ] && { printf '%s' "$message"; return; }
|
||||
case "$message" in
|
||||
"Run with sudo or as root") printf '请使用 sudo 或 root 运行' ;;
|
||||
"Baota initialization only supports Linux") printf '宝塔初始化仅支持 Linux' ;;
|
||||
"Extract the release"*) printf '请先将发布包解压到 APP_ROOT/releases/VERSION' ;;
|
||||
"The supported Baota project root"*) printf '宝塔项目根目录必须是 /www/wwwroot/kaidi' ;;
|
||||
"The extracted release is incomplete") printf '解压后的发布包不完整' ;;
|
||||
"The extracted operations scripts are incomplete") printf '发布包中的运维脚本不完整' ;;
|
||||
"The release public key is missing") printf '缺少发布公钥' ;;
|
||||
"The release public-key fingerprint is invalid") printf '发布公钥指纹不匹配' ;;
|
||||
"Existing user "*" has unexpected home directory "*) printf '现有用户目录不符合 Kaidi 约定：%s' "${message#Existing user }" ;;
|
||||
"Existing user "*" is not a member"*) printf '现有 Kaidi 用户不属于服务用户组' ;;
|
||||
"A nologin shell is required") printf '服务用户必须使用 nologin shell' ;;
|
||||
*" contains a line break") printf '配置项包含换行符，已拒绝：%s' "${message%% contains a line break*}" ;;
|
||||
"find is required"|"openssl is required"|"sha256sum is required") printf '缺少初始化依赖命令：%s' "${message%% is required}" ;;
|
||||
"Kaidi is already initialized"*) printf 'Kaidi 已初始化，请先执行卸载流程再重新安装' ;;
|
||||
"The old kaidi-finance.service"*) printf '检测到旧 kaidi-finance.service，请先执行卸载流程' ;;
|
||||
"Old Kaidi update units"*) printf '检测到旧 Kaidi 更新单元，请先执行卸载流程' ;;
|
||||
"The Baota current release link"*) printf '宝塔 current 发布链接已存在，请先执行卸载流程' ;;
|
||||
"Port must be an integer"*) printf '端口必须是 1024 到 65535 的整数' ;;
|
||||
"Initialization failed"*) printf '初始化失败，本次创建的文件已回滚，可以修正原因后重试' ;;
|
||||
"Manual deployment is initialized"*) printf '宝塔手动部署初始化完成：%s' "${message#Manual deployment is initialized for Kaidi Finance }" ;;
|
||||
"Create the Baota Spring Boot project"*) printf '请在宝塔创建 Spring Boot 项目，项目路径：%s' "${message#Create the Baota Spring Boot project with }" ;;
|
||||
"Baota environment variables: leave empty") printf '宝塔环境变量请全部留空' ;;
|
||||
"Setup code: "*) printf '安装码位置：%s' "${message#Setup code: }" ;;
|
||||
*) printf '%s' "$message" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
log() { printf '[kaidi-baota-init] %s\n' "$(localize_message "$*")"; }
|
||||
die() { printf '[kaidi-baota-init] 错误：%s\n' "$(localize_message "$*")" >&2; exit 1; }
|
||||
|
||||
rollback_initialization() {
|
||||
local rc=$?
|
||||
local rc=$? index path service_uid
|
||||
trap - EXIT HUP INT TERM
|
||||
if [ "$rc" -ne 0 ] && [ "$INIT_ARMED" = true ] && [ "$INIT_COMMITTED" != true ]; then
|
||||
systemctl disable --now kaidi-update.path >/dev/null 2>&1 || true
|
||||
@@ -35,6 +70,18 @@ rollback_initialization() {
|
||||
&& [ "$(readlink "$INIT_APP_ROOT/current" 2>/dev/null || true)" = "$INIT_RELEASE_ROOT" ]; then
|
||||
rm -f "$INIT_APP_ROOT/current"
|
||||
fi
|
||||
rm -f "$CONFIG_ROOT"/*.next.* "$UPDATE_STATE_ROOT"/*.next.* "$STATE_ROOT/setup"/*.next.*
|
||||
if [ "$SERVICE_USER_CREATED" = true ]; then
|
||||
service_uid=$(id -u "$SERVICE_USER" 2>/dev/null || true)
|
||||
[ -z "$service_uid" ] || userdel --force "$SERVICE_USER" >/dev/null 2>&1 || true
|
||||
fi
|
||||
if [ "$SERVICE_GROUP_CREATED" = true ]; then
|
||||
groupdel "$SERVICE_GROUP" >/dev/null 2>&1 || true
|
||||
fi
|
||||
for ((index=${#CREATED_PATHS[@]} - 1; index >= 0; index--)); do
|
||||
path=${CREATED_PATHS[$index]}
|
||||
rmdir -- "$path" >/dev/null 2>&1 || true
|
||||
done
|
||||
log "Initialization failed; files created by this attempt were rolled back and the command can be retried"
|
||||
fi
|
||||
exit "$rc"
|
||||
@@ -48,6 +95,10 @@ sha256_file() {
|
||||
sha256sum "$1" | awk '{print $1}'
|
||||
}
|
||||
|
||||
record_path() {
|
||||
[ -e "$1" ] || [ -L "$1" ] || CREATED_PATHS+=("$1")
|
||||
}
|
||||
|
||||
random_secret() {
|
||||
openssl rand -base64 36 | tr -d '\n/+=' | cut -c1-36
|
||||
}
|
||||
@@ -73,6 +124,7 @@ ensure_service_identity() {
|
||||
local existing_home nologin_path
|
||||
if ! getent group "$SERVICE_GROUP" >/dev/null 2>&1; then
|
||||
groupadd --system "$SERVICE_GROUP"
|
||||
SERVICE_GROUP_CREATED=true
|
||||
fi
|
||||
if id "$SERVICE_USER" >/dev/null 2>&1; then
|
||||
existing_home=$(getent passwd "$SERVICE_USER" | awk -F: '{print $6}')
|
||||
@@ -86,14 +138,13 @@ ensure_service_identity() {
|
||||
[ -n "$nologin_path" ] || nologin_path=/usr/sbin/nologin
|
||||
[ -x "$nologin_path" ] || die "A nologin shell is required"
|
||||
useradd --system --gid "$SERVICE_GROUP" --home-dir "$STATE_ROOT" --shell "$nologin_path" "$SERVICE_USER"
|
||||
SERVICE_USER_CREATED=true
|
||||
}
|
||||
|
||||
main() {
|
||||
local script_dir release_root releases_root app_root version app_port field_key setup_code setup_hash
|
||||
[ "$(id -u)" -eq 0 ] || die "Run with sudo or as root"
|
||||
[ "$(uname -s)" = Linux ] || die "Baota initialization only supports Linux"
|
||||
command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ] \
|
||||
|| die "systemd is required for the privileged background updater"
|
||||
for command in find openssl sha256sum; do
|
||||
command -v "$command" >/dev/null 2>&1 || die "$command is required"
|
||||
done
|
||||
@@ -122,7 +173,7 @@ main() {
|
||||
[ ! -e "$CONFIG_ROOT/kaidi.env" ] && [ ! -e "$CONFIG_ROOT/update.env" ] \
|
||||
&& [ ! -e "$STATE_ROOT/setup/locked" ] \
|
||||
|| die "Kaidi is already initialized; run the published purge workflow before a fresh installation"
|
||||
! systemctl cat kaidi-finance.service >/dev/null 2>&1 \
|
||||
[ ! -e /etc/systemd/system/kaidi-finance.service ] \
|
||||
|| die "The old kaidi-finance.service still exists; run the published purge workflow first"
|
||||
[ ! -e /etc/systemd/system/kaidi-update.service ] \
|
||||
&& [ ! -e /etc/systemd/system/kaidi-update.path ] \
|
||||
@@ -136,6 +187,10 @@ main() {
|
||||
|
||||
INIT_ARMED=true
|
||||
ensure_service_identity
|
||||
for path in "$app_root" "$releases_root" "$STATE_ROOT" "$STATE_ROOT/files" "$STATE_ROOT/tmp" \
|
||||
"$LOG_ROOT" "$STATE_ROOT/setup" "$UPDATE_STATE_ROOT" "$UPDATE_STATE_ROOT/inbox" "$CONFIG_ROOT"; do
|
||||
record_path "$path"
|
||||
done
|
||||
install -d -o root -g "$SERVICE_GROUP" -m 0750 "$app_root" "$releases_root"
|
||||
install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0750 \
|
||||
"$STATE_ROOT" "$STATE_ROOT/files" "$STATE_ROOT/tmp" "$LOG_ROOT"
|
||||
@@ -193,16 +248,16 @@ main() {
|
||||
# panel lifecycle can participate in the transaction state machine.
|
||||
install -m 0644 "$release_root/ops/release-public.pem" "$CONFIG_ROOT/release-public.pem"
|
||||
|
||||
printf '{"state":"CURRENT","message":"Baota release is prepared","targetVersion":"%s","updatedAt":"%s"}\n' \
|
||||
printf '{"state":"CURRENT","message":"宝塔发布已准备","targetVersion":"%s","updatedAt":"%s"}\n' \
|
||||
"$version" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$UPDATE_STATE_ROOT/status.json"
|
||||
chmod 0644 "$UPDATE_STATE_ROOT/status.json"
|
||||
cat > /root/kaidi-first-login.txt <<EOF
|
||||
Project path: $app_root/current
|
||||
Start command: $app_root/current/ops/baota-start.sh
|
||||
Reverse proxy target: http://127.0.0.1:$app_port
|
||||
Setup URL: /setup
|
||||
Setup code: $setup_code
|
||||
Version: $version
|
||||
项目路径：$app_root/current
|
||||
启动命令：$app_root/current/ops/baota-start.sh
|
||||
反向代理目标：http://127.0.0.1:$app_port
|
||||
安装向导地址：/setup
|
||||
安装码：$setup_code
|
||||
版本：$version
|
||||
EOF
|
||||
chmod 0600 /root/kaidi-first-login.txt
|
||||
|
||||
|
||||
Reference in New Issue
Block a user