ERP-Team/kaidi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

feat: support Baota manual deployment and managed updates
Release / release (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Qiufeng
2026-08-18 03:08:28 +08:00
parent fa4517c263
commit cfdc0fed44
13 changed files with 765 additions and 269 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/update.sh
+205 -21
View File
@@ -19,6 +19,9 @@ RELEASE_TOKEN=${UPDATE_RELEASE_TOKEN:-}
CACHE_ROOT=${KAIDI_UPDATE_CACHE_ROOT:-$STATE_ROOT/cache}
SERVICE_NAME=${KAIDI_SERVICE_NAME:-kaidi-finance.service}
UPDATE_PATH_NAME=${KAIDI_UPDATE_PATH_NAME:-kaidi-update.path}
PROCESS_MANAGER=${KAIDI_PROCESS_MANAGER:-systemd}
PID_FILE=${KAIDI_PID_FILE:-/var/lib/kaidi/kaidi.pid}
RUNTIME_ENV_FILE=${KAIDI_RUNTIME_ENV_FILE:-/var/lib/kaidi/setup/application.env}
SERVICE_USER=${KAIDI_SERVICE_USER:-kaidi}
SERVICE_GROUP=${KAIDI_SERVICE_GROUP:-kaidi}
HEALTH_URL=${KAIDI_HEALTH_URL:-http://127.0.0.1:18080/actuator/health}
@@ -30,6 +33,7 @@ SYSTEMD_ROOT=${KAIDI_SYSTEMD_ROOT:-/etc/systemd/system}
LOG_ROOT=${KAIDI_LOG_ROOT:-/var/log/kaidi}
HEALTH_ATTEMPTS=${KAIDI_UPDATE_HEALTH_ATTEMPTS:-60}
HEALTH_INTERVAL_SECONDS=${KAIDI_UPDATE_HEALTH_INTERVAL_SECONDS:-2}
SHUTDOWN_ATTEMPTS=${KAIDI_UPDATE_SHUTDOWN_ATTEMPTS:-45}
WORK_DIR=
CACHE_TEMP=
RELEASE_AUTH_HEADER_FILE=
@@ -40,12 +44,85 @@ case "$HEALTH_ATTEMPTS:$HEALTH_INTERVAL_SECONDS" in
*[!0-9:]* | :* | *:) printf '%s\n' "Update health-check settings must be non-negative integers" >&2; exit 1 ;;
esac
[ "$HEALTH_ATTEMPTS" -ge 1 ] || { printf '%s\n' "Update health-check attempts must be at least 1" >&2; exit 1; }
case "$PROCESS_MANAGER" in
systemd|baota) ;;
*) printf '%s\n' "KAIDI_PROCESS_MANAGER must be systemd or baota" >&2; exit 1 ;;
esac
case "$SHUTDOWN_ATTEMPTS" in
''|*[!0-9]*) printf '%s\n' "KAIDI_UPDATE_SHUTDOWN_ATTEMPTS must be a positive integer" >&2; exit 1 ;;
esac
[ "$SHUTDOWN_ATTEMPTS" -ge 1 ] || { printf '%s\n' "KAIDI_UPDATE_SHUTDOWN_ATTEMPTS must be at least 1" >&2; exit 1; }
case "$PID_FILE" in
/*) ;;
*) printf '%s\n' "KAIDI_PID_FILE must be an absolute path" >&2; exit 1 ;;
esac
case "$RUNTIME_ENV_FILE" in
/*) ;;
*) printf '%s\n' "KAIDI_RUNTIME_ENV_FILE must be an absolute path" >&2; exit 1 ;;
esac
bootstrap_die() {
printf '%s\n' "$1" >&2
exit 1
}
decode_runtime_env_value() {
encoded_value=$1
case "$encoded_value" in
\"*\")
encoded_value=${encoded_value#\"}
encoded_value=${encoded_value%\"}
printf '%s' "$encoded_value" | sed 's/\\\"/"/g; s/\\\\/\\/g'
;;
\'*\')
encoded_value=${encoded_value#\'}
encoded_value=${encoded_value%\'}
printf '%s' "$encoded_value"
;;
*) printf '%s' "$encoded_value" ;;
esac
}
load_runtime_database_env() {
[ -e "$RUNTIME_ENV_FILE" ] || return 0
[ -f "$RUNTIME_ENV_FILE" ] && [ ! -L "$RUNTIME_ENV_FILE" ] \
|| bootstrap_die "Setup runtime environment must be a regular file"
[ -r "$RUNTIME_ENV_FILE" ] \
|| bootstrap_die "Setup runtime environment is not readable"
runtime_size=$(wc -c < "$RUNTIME_ENV_FILE" | tr -d '[:space:]')
[ "$runtime_size" -le 65536 ] \
|| bootstrap_die "Setup runtime environment is too large"
runtime_owner=$(stat -c '%u' "$RUNTIME_ENV_FILE" 2>/dev/null || true)
service_uid=$(id -u "$SERVICE_USER" 2>/dev/null || true)
[ "$runtime_owner" = 0 ] || [ "$runtime_owner" = "$service_uid" ] \
|| bootstrap_die "Setup runtime environment has an unexpected owner"
if find "$RUNTIME_ENV_FILE" -prune -perm /022 -print -quit | grep -q .; then
bootstrap_die "Setup runtime environment must not be writable by group or other users"
fi
while IFS= read -r runtime_line || [ -n "$runtime_line" ]; do
case "$runtime_line" in ''|'#'*) continue ;; esac
runtime_name=${runtime_line%%=*}
[ "$runtime_name" != "$runtime_line" ] \
|| bootstrap_die "Setup runtime environment contains an invalid line"
runtime_raw=${runtime_line#*=}
runtime_value=$(decode_runtime_env_value "$runtime_raw")
case "$runtime_name" in
KAIDI_DB_HOST) KAIDI_DB_HOST=$runtime_value; export KAIDI_DB_HOST ;;
KAIDI_DB_PORT) KAIDI_DB_PORT=$runtime_value; export KAIDI_DB_PORT ;;
KAIDI_DB_NAME) KAIDI_DB_NAME=$runtime_value; export KAIDI_DB_NAME ;;
KAIDI_DB_USERNAME) KAIDI_DB_USERNAME=$runtime_value; export KAIDI_DB_USERNAME ;;
KAIDI_DB_PASSWORD) KAIDI_DB_PASSWORD=$runtime_value; export KAIDI_DB_PASSWORD ;;
esac
done < "$RUNTIME_ENV_FILE"
case "${KAIDI_DB_PORT:-}" in
''|*[!0-9]*) bootstrap_die "Setup runtime database port is invalid" ;;
esac
[ "$KAIDI_DB_PORT" -ge 1 ] && [ "$KAIDI_DB_PORT" -le 65535 ] \
|| bootstrap_die "Setup runtime database port is invalid"
}
status() {
state=$1
message=$2
@@ -103,6 +180,7 @@ secure_release_tree() {
find "$release_dir" -type d -exec chmod 0750 {} + || return 1
find "$release_dir" -type f -exec chmod 0640 {} + || return 1
chmod 0750 "$release_dir/ops/update.sh" "$release_dir/ops/baota-start.sh"
[ ! -f "$release_dir/ops/baota-init.sh" ] || chmod 0750 "$release_dir/ops/baota-init.sh"
}
verify_release_access() {
@@ -111,12 +189,16 @@ verify_release_access() {
runuser -u "$SERVICE_USER" -- sh -c \
'cd "$1" && test -r app.jar && test -r public/index.html' sh "$release_dir" \
|| return 1
runuser -u "$SERVICE_USER" -- test -x "$APP_ROOT/runtime/java/bin/java" \
|| return 1
runuser -u "$SERVICE_USER" -- "$APP_ROOT/runtime/java/bin/java" -version >/dev/null 2>&1
if [ "$PROCESS_MANAGER" = baota ]; then
runuser -u "$SERVICE_USER" -- test -x "$release_dir/ops/baota-start.sh"
else
runuser -u "$SERVICE_USER" -- test -x "$APP_ROOT/runtime/java/bin/java" \
&& runuser -u "$SERVICE_USER" -- "$APP_ROOT/runtime/java/bin/java" -version >/dev/null 2>&1
fi
}
prepare_update_layout
load_runtime_database_env
# shellcheck disable=SC2329 # Invoked by the EXIT trap below.
cleanup() {
@@ -204,18 +286,103 @@ wait_for_health() {
}
verify_app_surface() {
expected_release=${1:-}
wait_for_health "$HEALTH_URL" || return 1
index_file=$(mktemp "$STATE_ROOT/work/public-index.XXXXXX")
if curl -fsS "$APP_INDEX_URL" -o "$index_file" \
&& grep -Eiq '<!doctype|<html' "$index_file"; then
rm -f "$index_file"
if [ "$PROCESS_MANAGER" = baota ] && [ -n "$expected_release" ]; then
running_release=$(baota_process_release) || return 1
[ "$running_release" = "$expected_release" ] || return 1
fi
return 0
fi
rm -f "$index_file"
return 1
}
baota_process_record() {
[ -f "$PID_FILE" ] && [ ! -L "$PID_FILE" ] || return 1
pid_record=$(cat "$PID_FILE" 2>/dev/null || true)
pid=${pid_record%% *}
start_time=${pid_record#* }
[ "$pid" != "$pid_record" ] || return 1
case "$pid:$start_time" in
*[!0-9:]*) return 1 ;;
esac
[ "$pid" -ne "$$" ] && [ -r "/proc/$pid/cmdline" ] || return 1
actual_start_time=$(awk '{print $22}' "/proc/$pid/stat" 2>/dev/null || true)
[ -n "$actual_start_time" ] && [ "$actual_start_time" = "$start_time" ] || return 1
owner_uid=$(stat -c '%u' "/proc/$pid" 2>/dev/null || true)
service_uid=$(id -u "$SERVICE_USER" 2>/dev/null || true)
[ -n "$owner_uid" ] && [ "$owner_uid" = "$service_uid" ] || return 1
process_args=$(mktemp "$STATE_ROOT/work/process-args.XXXXXX") || return 1
if ! tr '\000' '\n' < "/proc/$pid/cmdline" > "$process_args" 2>/dev/null; then
rm -f "$process_args"
return 1
fi
release_path=$(sed -n 's/^-Dkaidi\.release\.path=//p' "$process_args")
release_path_count=$(sed -n '/^-Dkaidi\.release\.path=/p' "$process_args" | wc -l | tr -d '[:space:]')
jar_path=$(awk 'previous == "-jar" { print; exit } { previous = $0 }' "$process_args")
rm -f "$process_args"
[ "$release_path_count" -eq 1 ] || return 1
case "$release_path" in
"$APP_ROOT"/releases/*) ;;
*) return 1 ;;
esac
[ -d "$release_path" ] && [ ! -L "$release_path" ] \
&& [ "$jar_path" = "$release_path/app.jar" ] && [ -f "$jar_path" ] \
|| return 1
printf '%s\t%s\n' "$pid" "$release_path"
}
baota_process_pid() {
baota_process_record | cut -f1
}
baota_process_release() {
baota_process_record | cut -f2-
}
restart_application() {
allow_missing=${1:-false}
if [ "$PROCESS_MANAGER" = systemd ]; then
systemctl reset-failed "$SERVICE_NAME" >/dev/null 2>&1 || true
systemctl restart "$SERVICE_NAME" || systemctl start "$SERVICE_NAME"
return
fi
old_pid=$(baota_process_pid) || {
[ "$allow_missing" = true ] && return 0
return 1
}
kill -TERM "$old_pid" 2>/dev/null || return 1
attempts=0
while [ "$attempts" -lt "$SHUTDOWN_ATTEMPTS" ]; do
if ! kill -0 "$old_pid" 2>/dev/null; then
current_pid_record=$(cat "$PID_FILE" 2>/dev/null || true)
case "$current_pid_record" in "$old_pid "*) rm -f "$PID_FILE" ;; esac
return 0
fi
attempts=$((attempts + 1))
sleep 1
done
return 1
}
application_state() {
if [ "$PROCESS_MANAGER" = systemd ]; then
systemctl is-active "$SERVICE_NAME" 2>/dev/null || printf unknown
elif baota_process_pid >/dev/null 2>&1; then
printf active
else
printf stopped
fi
}
backup_database() {
DATABASE_BACKUP=
[ "${KAIDI_SKIP_DB_BACKUP:-false}" = "true" ] && return
mkdir -p "$BACKUP_ROOT"
chmod 0700 "$BACKUP_ROOT"
@@ -255,6 +422,7 @@ backup_database() {
fi
chmod 0600 "$backup_tmp"
mv -f "$backup_tmp" "$backup"
DATABASE_BACKUP=$backup
rm -f "$dump_file"
find "$BACKUP_ROOT" -type f -name 'mysql-*.sql.gz' -printf '%T@ %p\n' \
| sort -nr | awk 'NR > 5 {sub(/^[^ ]+ /, ""); print}' | xargs -r rm -f
@@ -321,18 +489,22 @@ restore_managed_file() {
backup_operations() {
OPS_BACKUP="$ACTIVE_TRANSACTION/operations-backup"
mkdir -p "$OPS_BACKUP"
backup_managed_file "$UPDATER_PATH" update.sh \
&& backup_managed_file "$SYSTEMD_ROOT/kaidi-finance.service" kaidi-finance.service \
&& backup_managed_file "$SYSTEMD_ROOT/kaidi-update.service" kaidi-update.service \
backup_managed_file "$UPDATER_PATH" update.sh || return 1
if [ "$PROCESS_MANAGER" = systemd ]; then
backup_managed_file "$SYSTEMD_ROOT/kaidi-finance.service" kaidi-finance.service || return 1
fi
backup_managed_file "$SYSTEMD_ROOT/kaidi-update.service" kaidi-update.service \
&& backup_managed_file "$SYSTEMD_ROOT/kaidi-update.path" kaidi-update.path
}
apply_operations() {
SYSTEMD_OPERATIONS_CHANGED=false
install_operation "$RELEASE_DIR/ops/update.sh" "$UPDATER_PATH" 0755 false \
&& install_operation "$RELEASE_DIR/ops/kaidi-finance.service" \
"$SYSTEMD_ROOT/kaidi-finance.service" 0644 true \
&& install_operation "$RELEASE_DIR/ops/kaidi-update.service" \
install_operation "$RELEASE_DIR/ops/update.sh" "$UPDATER_PATH" 0755 false || return 1
if [ "$PROCESS_MANAGER" = systemd ]; then
install_operation "$RELEASE_DIR/ops/kaidi-finance.service" \
"$SYSTEMD_ROOT/kaidi-finance.service" 0644 true || return 1
fi
install_operation "$RELEASE_DIR/ops/kaidi-update.service" \
"$SYSTEMD_ROOT/kaidi-update.service" 0644 true \
&& install_operation "$RELEASE_DIR/ops/kaidi-update.path" \
"$SYSTEMD_ROOT/kaidi-update.path" 0644 true \
@@ -343,7 +515,9 @@ apply_operations() {
restore_operations() {
restore_failed=0
restore_managed_file "$UPDATER_PATH" update.sh || restore_failed=1
restore_managed_file "$SYSTEMD_ROOT/kaidi-finance.service" kaidi-finance.service || restore_failed=1
if [ "$PROCESS_MANAGER" = systemd ]; then
restore_managed_file "$SYSTEMD_ROOT/kaidi-finance.service" kaidi-finance.service || restore_failed=1
fi
restore_managed_file "$SYSTEMD_ROOT/kaidi-update.service" kaidi-update.service || restore_failed=1
restore_managed_file "$SYSTEMD_ROOT/kaidi-update.path" kaidi-update.path || restore_failed=1
systemctl daemon-reload || restore_failed=1
@@ -378,6 +552,7 @@ rollback_active_transaction() {
OPS_BACKUP="$ACTIVE_TRANSACTION/operations-backup"
link_restored=true
operations_restored=true
application_restarted=true
if [ -n "$previous_target" ] && [ -d "$previous_target" ]; then
if ! ln -sfn "$previous_target" "$APP_ROOT/current.next" \
@@ -388,15 +563,15 @@ rollback_active_transaction() {
link_restored=false
fi
restore_operations || operations_restored=false
systemctl reset-failed "$SERVICE_NAME" >/dev/null 2>&1 || true
systemctl restart "$SERVICE_NAME" || systemctl start "$SERVICE_NAME" || true
if [ "$link_restored" = true ] && verify_app_surface; then
restart_application true || application_restarted=false
if [ "$link_restored" = true ] && [ "$application_restarted" = true ] \
&& verify_app_surface "$previous_target"; then
remove_failed_release "$failed_release"
rm -rf "$ACTIVE_TRANSACTION"
if [ "$operations_restored" = true ]; then
fail "$reason; previous release was restored and verified"
rm -rf "$ACTIVE_TRANSACTION"
fail "$reason; previous application release was restored and verified; database backup was retained"
fi
fail "$reason; previous release is running, but operations restoration requires manual review"
fail "$reason; previous application release is running, but operations restoration requires manual review; transaction evidence was retained"
fi
TERMINAL_STATUS_WRITTEN=true
status FAILED "$reason; rollback is incomplete and manual recovery is required" "${TARGET_VERSION:-}"
@@ -430,6 +605,10 @@ recover_interrupted_transaction() {
validate_release_operations() {
sh -n "$WORK_DIR/extracted/ops/update.sh" || return 1
bash -n "$WORK_DIR/extracted/ops/baota-start.sh" || return 1
bash -n "$WORK_DIR/extracted/ops/baota-init.sh" || return 1
[ -s "$WORK_DIR/extracted/ops/release-public.pem" ] \
&& cmp -s "$WORK_DIR/extracted/ops/release-public.pem" "$PUBLIC_KEY" \
|| return 1
command -v systemd-analyze >/dev/null 2>&1 || return 1
systemd-analyze verify \
"$WORK_DIR/extracted/ops/kaidi-finance.service" \
@@ -555,6 +734,9 @@ fi
[ -s "$WORK_DIR/extracted/public/index.html" ] || fail "Release frontend is missing"
[ "$(cat "$WORK_DIR/extracted/VERSION" 2>/dev/null)" = "$TARGET_VERSION" ] || fail "Release version file mismatch"
[ -x "$WORK_DIR/extracted/ops/update.sh" ] || fail "Release updater is missing"
[ -x "$WORK_DIR/extracted/ops/baota-start.sh" ] || fail "Release Baota launcher is missing"
[ -x "$WORK_DIR/extracted/ops/baota-init.sh" ] || fail "Release Baota initializer is missing"
[ -s "$WORK_DIR/extracted/ops/release-public.pem" ] || fail "Release public key is missing"
[ -s "$WORK_DIR/extracted/ops/kaidi-finance.service" ] || fail "Release application unit is missing"
[ -s "$WORK_DIR/extracted/ops/kaidi-update.service" ] || fail "Release updater unit is missing"
[ -s "$WORK_DIR/extracted/ops/kaidi-update.path" ] || fail "Release updater path unit is missing"
@@ -605,6 +787,7 @@ write_transaction_value phase PREPARED
status BACKING_UP "Backing up database before installing $TARGET_VERSION" "$TARGET_VERSION"
backup_database
[ -z "${DATABASE_BACKUP:-}" ] || write_transaction_value database-backup "$DATABASE_BACKUP"
if ! backup_operations; then
remove_failed_release "$RELEASE_DIR"
rm -rf "$ACTIVE_TRANSACTION"
@@ -624,9 +807,10 @@ write_transaction_value phase APP_SWITCHED
status RUNNING "Starting and verifying release $TARGET_VERSION" "$TARGET_VERSION"
write_transaction_value phase HEALTH_CHECKING
systemctl reset-failed "$SERVICE_NAME" >/dev/null 2>&1 || true
systemctl restart "$SERVICE_NAME" || systemctl start "$SERVICE_NAME" || true
if verify_app_surface; then
if ! restart_application; then
rollback_active_transaction "Release application restart failed"
fi
if verify_app_surface "$RELEASE_DIR"; then
success_message="Release $TARGET_VERSION is running"
if ! systemctl start "$UPDATE_PATH_NAME" >/dev/null 2>&1; then
success_message="$success_message; automatic update watcher could not be started"
@@ -639,7 +823,7 @@ if verify_app_surface; then
exit 0
fi
service_state=$(systemctl is-active "$SERVICE_NAME" 2>/dev/null || true)
service_state=$(application_state 2>/dev/null || true)
[ -n "$service_state" ] || service_state=unknown
rollback_active_transaction \
"Release health or application-surface verification failed (service state: $service_state)"