1222 lines
53 KiB
Bash
Executable File
1222 lines
53 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -Eeuo pipefail
|
||
|
||
umask 077
|
||
|
||
APP_ROOT=${KAIDI_APP_ROOT:-/opt/kaidi}
|
||
STATE_ROOT=${KAIDI_STATE_ROOT:-/var/lib/kaidi}
|
||
UPDATE_STATE_ROOT=${KAIDI_UPDATE_STATE_ROOT:-/var/lib/kaidi-update}
|
||
CONFIG_ROOT=${KAIDI_CONFIG_ROOT:-/etc/kaidi}
|
||
RELEASE_BASE_URL=${KAIDI_RELEASE_BASE_URL:-}
|
||
RELEASE_API_URL=${KAIDI_RELEASE_API_URL:-https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest}
|
||
RELEASE_TOKEN=${KAIDI_RELEASE_TOKEN:-}
|
||
RELEASE_TOKEN_FILE=${KAIDI_RELEASE_TOKEN_FILE:-}
|
||
HEALTH_URL=${KAIDI_HEALTH_URL:-}
|
||
APP_INDEX_URL=${KAIDI_APP_INDEX_URL:-}
|
||
APP_PORT=${KAIDI_APP_PORT:-}
|
||
SERVER_ADDRESS=${KAIDI_SERVER_ADDRESS:-127.0.0.1}
|
||
PROXY_TARGET=
|
||
TRUSTED_PUBLIC_KEY_SHA256=${KAIDI_RELEASE_PUBLIC_KEY_SHA256:-807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9}
|
||
REINSTALL=${KAIDI_REINSTALL:-false}
|
||
if [ "${KAIDI_SETUP_WIZARD+x}" = x ]; then
|
||
SETUP_WIZARD=$KAIDI_SETUP_WIZARD
|
||
elif [ "$REINSTALL" = true ]; then
|
||
SETUP_WIZARD=false
|
||
else
|
||
SETUP_WIZARD=true
|
||
fi
|
||
WORK_DIR=
|
||
RELEASE_AUTH_HEADER_FILE=
|
||
INSTALL_TRANSACTION_ARMED=false
|
||
INSTALL_COMMITTED=false
|
||
RELEASE_DIR=
|
||
BACKUP_DIR=
|
||
JAVA_BIN=
|
||
JAVA_STAGED_DIR=
|
||
JAVA_PREVIOUS_DIR=
|
||
JAVA_ACTIVATED=false
|
||
SERVICE_USER=kaidi
|
||
SERVICE_GROUP=kaidi
|
||
HOST_ARCH=
|
||
LOG_LOCALE=${KAIDI_LOG_LOCALE:-zh-CN}
|
||
SERVICE_USER_CREATED=false
|
||
SERVICE_GROUP_CREATED=false
|
||
CREATED_LAYOUT_PATHS=()
|
||
|
||
localize_message() {
|
||
local message=$1
|
||
[ "$LOG_LOCALE" = en ] && { printf '%s' "$message"; return; }
|
||
case "$message" in
|
||
"Unsupported CPU architecture: "*) printf '不支持的 CPU 架构：%s' "${message#Unsupported CPU architecture: }" ;;
|
||
"The installer only supports Linux") printf '安装程序仅支持 Linux' ;;
|
||
"Custom installation roots"*) printf '打包版 systemd 不支持自定义安装目录' ;;
|
||
"systemd is required") printf '需要 systemd' ;;
|
||
"systemd-analyze is required") printf '需要 systemd-analyze' ;;
|
||
"getconf is required") printf '需要 getconf' ;;
|
||
"systemd is not running as PID 1") printf 'systemd 当前不是 PID 1，无法托管服务' ;;
|
||
"/etc/systemd/system is missing") printf '缺少 /etc/systemd/system' ;;
|
||
"CPU architecture and userspace word size"*) printf 'CPU 架构与用户空间位数不匹配：%s' "${message#*: }" ;;
|
||
"32-bit Linux deployment requires glibc"*) printf '32 位 Linux 需要 glibc；当前系统不兼容 i686 Java' ;;
|
||
"32-bit Linux deployment requires the glibc loader"*) printf '32 位 Linux 缺少 glibc 加载器 /lib/ld-linux.so.2' ;;
|
||
"Set KAIDI_RELEASE_PUBLIC_KEY_SHA256"*) printf '请设置受信任的发布公钥 SHA-256：KAIDI_RELEASE_PUBLIC_KEY_SHA256' ;;
|
||
"Run with sudo or as root") printf '请使用 sudo 或 root 运行' ;;
|
||
"Set only one of KAIDI_RELEASE_TOKEN"*) printf 'KAIDI_RELEASE_TOKEN 与 KAIDI_RELEASE_TOKEN_FILE 只能设置一个' ;;
|
||
"KAIDI_RELEASE_TOKEN_FILE must be a regular file") printf 'KAIDI_RELEASE_TOKEN_FILE 必须是普通文件' ;;
|
||
"KAIDI_RELEASE_TOKEN_FILE is too large") printf 'KAIDI_RELEASE_TOKEN_FILE 过大' ;;
|
||
"KAIDI_REINSTALL must be true or false") printf 'KAIDI_REINSTALL 只能是 true 或 false' ;;
|
||
"KAIDI_SETUP_WIZARD must be true or false") printf 'KAIDI_SETUP_WIZARD 只能是 true 或 false' ;;
|
||
"A setup-wizard repair needs"*) printf '安装向导修复需要已有配置文件：%s' "${message#A setup-wizard repair needs the existing }" ;;
|
||
"The existing installation is already in production mode"*) printf '现有安装已是正式模式，请执行普通修复重装' ;;
|
||
"The setup wizard is already locked"*) printf '安装向导已锁定，请执行普通修复重装' ;;
|
||
"Kaidi Finance is already installed"*) printf 'Kaidi 财务系统已安装，请从系统更新页面执行更新或先卸载' ;;
|
||
"Set KAIDI_RELEASE_BASE_URL"*) printf '请设置 Gitea Release 源：KAIDI_RELEASE_BASE_URL 或 KAIDI_RELEASE_API_URL' ;;
|
||
"KAIDI_RELEASE_TOKEN is invalid") printf 'KAIDI_RELEASE_TOKEN 无效' ;;
|
||
"Download failed: "*) printf '下载失败：%s' "${message#Download failed: }" ;;
|
||
"Release URLs must use HTTPS") printf '发布地址必须使用 HTTPS' ;;
|
||
"Release authentication header is unavailable") printf '发布认证请求头不可用' ;;
|
||
"Release asset "*" is missing") printf '缺少发布资产：%s' "${message#Release asset }" ;;
|
||
"Gitea Release tag is invalid") printf 'Gitea Release 标签无效' ;;
|
||
"KAIDI_RELEASE_API_URL must be a Gitea"*) printf 'KAIDI_RELEASE_API_URL 必须是 Gitea Release API 地址' ;;
|
||
"Required command is missing"*) printf '依赖命令缺失：%s' "${message#*: }" ;;
|
||
"Supported package managers"*) printf '仅支持 apt、dnf 或 yum' ;;
|
||
"Using existing Java"*) printf '使用现有 Java：%s' "${message#Using existing Java 17+ runtime at }" ;;
|
||
"Local Java verified: "*) printf '本机 Java 校验通过：%s' "${message#Local Java verified: }" ;;
|
||
"No local Java"*) printf '未找到可用 Java 17，正在下载 Azul Java 17 运行时' ;;
|
||
"Java 17 runtime download URL"*) printf 'Java 17 运行时下载地址无效' ;;
|
||
"Downloaded Java verified: "*) printf '下载的 Java 校验通过：%s' "${message#Downloaded Java verified: }" ;;
|
||
"The existing Java runtime cannot start"*) printf '现有 Java 运行时无法启动，请检查架构和权限' ;;
|
||
"No Java 17 runtime is published"*) printf '当前 Linux 架构没有可用的 Java 17 运行时' ;;
|
||
"Java 17 runtime SHA-256 verification failed") printf 'Java 17 运行时 SHA-256 校验失败' ;;
|
||
"Downloaded Java runtime architecture"*) printf '下载的 Java 运行时架构与主机不匹配' ;;
|
||
"The downloaded Java runtime cannot start"*) printf '下载的 Java 运行时无法启动，请检查 glibc 和主机架构' ;;
|
||
"Java 17 runtime SHA-256 is unavailable") printf 'Java 17 运行时缺少 SHA-256 摘要' ;;
|
||
"Existing user "*" has unexpected home directory "*) printf '现有用户目录不符合 Kaidi 约定：%s' "${message#Existing user }" ;;
|
||
"Service-user filesystem and Java access checks passed") printf '服务用户文件系统与 Java 访问检查通过' ;;
|
||
*" cannot traverse or read the active release") printf '服务用户无法进入或读取当前发布目录' ;;
|
||
"The selected Java runtime is unavailable"*) printf '选定的 Java 运行时不可用：%s' "${message#The selected Java runtime is unavailable at }" ;;
|
||
"The selected Java runtime cannot execute"*) printf '服务用户无法执行选定的 Java 运行时' ;;
|
||
*" cannot execute the selected Java runtime") printf '服务用户无法执行选定的 Java 运行时' ;;
|
||
*" cannot execute as "*) printf '服务用户无法启动 Java 运行时' ;;
|
||
*" cannot write the file-storage directory") printf '服务用户无法写入文件存储目录' ;;
|
||
*" cannot write the update inbox") printf '服务用户无法写入更新请求目录' ;;
|
||
"SELinux context restoration reported"*) printf 'SELinux 上下文恢复有提示，将继续进行服务访问检查' ;;
|
||
"No interactive terminal detected"*) printf '未检测到交互终端，使用应用端口 %s' "${message##*port }" ;;
|
||
"Application port "*" is already held"*) printf '应用端口已由现有 Kaidi 服务占用：%s' "${message#Application port }" ;;
|
||
"Application port "*" is already in use"*) printf '应用端口已被占用，请使用 KAIDI_APP_PORT 更换端口' ;;
|
||
"Application will bind "*) printf '应用监听地址：%s' "${message#Application will bind }" ;;
|
||
"Reverse proxy target: "*) printf '反向代理目标：%s' "${message#Reverse proxy target: }" ;;
|
||
"KAIDI_SERVER_ADDRESS contains"*) printf 'KAIDI_SERVER_ADDRESS 含有不支持的字符' ;;
|
||
"KAIDI_APP_PORT must be an integer"*) printf 'KAIDI_APP_PORT 必须是 1024 到 65535 的整数' ;;
|
||
"Do not pass database credentials"*) printf '向导模式不要在命令行传数据库账号密码，请在浏览器向导中填写' ;;
|
||
"KAIDI_DB_USERNAME and KAIDI_DB_PASSWORD"*) printf '设置 KAIDI_DB_URL 时必须同时提供数据库用户名和密码' ;;
|
||
"An external MySQL 8.4 database is required"*) printf '需要连接用户预先准备的 MySQL 8.4 数据库：请设置 KAIDI_DB_URL、KAIDI_DB_USERNAME、KAIDI_DB_PASSWORD' ;;
|
||
"KAIDI_REINSTALL needs"*) printf 'KAIDI_REINSTALL 需要读取已有安装配置或提供数据库配置' ;;
|
||
"The database host is empty") printf '数据库主机不能为空' ;;
|
||
"The database port is invalid") printf '数据库端口无效' ;;
|
||
"The database name is invalid") printf '数据库名无效，只能包含字母、数字、下划线和美元符号' ;;
|
||
"KAIDI_DB_URL must start with jdbc:mysql://") printf 'KAIDI_DB_URL 必须以 jdbc:mysql:// 开头' ;;
|
||
"KAIDI_DB_USERNAME is empty") printf 'KAIDI_DB_USERNAME 不能为空' ;;
|
||
"KAIDI_DB_PASSWORD is empty") printf 'KAIDI_DB_PASSWORD 不能为空' ;;
|
||
"KAIDI_DB_BACKUP_MODE must be skip or mysqldump") printf 'KAIDI_DB_BACKUP_MODE 只能是 skip 或 mysqldump' ;;
|
||
"Waiting for application startup"*) printf '正在等待应用启动：%s' "${message#Waiting for application startup at }" ;;
|
||
"Application health check is UP") printf '应用健康检查通过（UP）' ;;
|
||
"Application is still starting"*) printf '应用仍在启动：%s' "${message#Application is still starting }" ;;
|
||
"Application service failed"*) printf '应用服务启动失败：%s' "${message#Application service failed during startup }" ;;
|
||
"Application health check did not become UP") printf '应用健康检查未变为 UP，请查看服务日志' ;;
|
||
"Application frontend entry point is unavailable") printf '应用前端入口不可访问，请检查服务和端口' ;;
|
||
"Installation failed; restoring"*) printf '安装失败，正在恢复原有运行状态' ;;
|
||
"ERROR: rollback was incomplete"*) printf '错误：回滚未完成，请检查 systemd 状态' ;;
|
||
*" contains a line break") printf '配置项包含换行符，已拒绝：%s' "${message%% contains a line break*}" ;;
|
||
"Kaidi Finance "*" is installed") printf 'Kaidi 财务系统 %s 已安装' "${message#Kaidi Finance }" ;;
|
||
"Configure your reverse proxy"*) printf '请将反向代理指向：%s' "${message#Configure your reverse proxy to }" ;;
|
||
"Open /setup"*) printf '请通过反向代理域名打开 /setup，完成首次安装向导' ;;
|
||
"Setup code: "*) printf '安装码位置：%s' "${message#Setup code: }" ;;
|
||
"Open the reverse-proxy domain"*) printf '请打开反向代理域名并使用管理员账号登录' ;;
|
||
"Temporary credentials: "*) printf '临时凭据位置：%s' "${message#Temporary credentials: }" ;;
|
||
"Change the temporary password"*) printf '首次登录后请立即修改临时密码' ;;
|
||
"Release public-key SHA-256 does not match"*) printf '发布公钥 SHA-256 与受信指纹不一致' ;;
|
||
"Release manifest signature verification failed") printf '发布清单签名校验失败' ;;
|
||
"Release version is invalid") printf '发布版本无效' ;;
|
||
"Release artifact name is invalid") printf '发布包文件名无效' ;;
|
||
"Release SHA-256 is invalid") printf '发布包 SHA-256 无效' ;;
|
||
"Release artifact SHA-256 verification failed") printf '发布包 SHA-256 校验失败' ;;
|
||
"Release archive contains an unsafe path") printf '发布归档包含不安全路径，已拒绝' ;;
|
||
"Release archive must not contain symbolic links") printf '发布归档不能包含符号链接，已拒绝' ;;
|
||
"Release app.jar is missing") printf '发布包缺少 app.jar' ;;
|
||
"Release frontend is missing") printf '发布包缺少前端文件' ;;
|
||
"Release version mismatch") printf '发布包版本与清单不一致' ;;
|
||
"Release updater is missing") printf '发布包缺少更新脚本' ;;
|
||
"Baota Spring Boot launcher is missing") printf '发布包缺少宝塔启动脚本' ;;
|
||
"Baota Spring Boot launcher is invalid") printf '宝塔启动脚本语法无效' ;;
|
||
"The existing FIELD_ENCRYPTION_KEY is missing") printf '已有安装缺少 FIELD_ENCRYPTION_KEY' ;;
|
||
"Installed systemd units failed validation") printf '已安装的 systemd 单元校验失败' ;;
|
||
"Environment verified: "*) printf '环境检查通过：%s' "${message#Environment verified: }" ;;
|
||
*) printf '%s' "$message" ;;
|
||
esac
|
||
}
|
||
|
||
log() { printf '[kaidi-install] %s\n' "$(localize_message "$*")"; }
|
||
die() { printf '[kaidi-install] 错误：%s\n' "$(localize_message "$*")" >&2; exit 1; }
|
||
|
||
sha256_file() {
|
||
sha256sum "$1" | awk '{print $1}'
|
||
}
|
||
|
||
normalized_host_arch() {
|
||
local machine host_bits
|
||
machine=$(uname -m)
|
||
host_bits=$(getconf LONG_BIT 2>/dev/null || true)
|
||
case "$machine" in
|
||
x86_64|amd64)
|
||
[ "$host_bits" = 32 ] && printf x86 || printf x86_64
|
||
;;
|
||
i386|i486|i586|i686) printf x86 ;;
|
||
aarch64|arm64)
|
||
[ "$host_bits" = 32 ] && printf arm || printf aarch64
|
||
;;
|
||
armv7l|armv6l) printf arm ;;
|
||
*) die "Unsupported CPU architecture: $machine" ;;
|
||
esac
|
||
}
|
||
|
||
preflight_host() {
|
||
local host_bits expected_bits
|
||
[ "$(uname -s)" = Linux ] || die "The installer only supports Linux"
|
||
[ "$APP_ROOT" = /opt/kaidi ] && [ "$STATE_ROOT" = /var/lib/kaidi ] \
|
||
&& [ "$UPDATE_STATE_ROOT" = /var/lib/kaidi-update ] && [ "$CONFIG_ROOT" = /etc/kaidi ] \
|
||
|| die "Custom installation roots are not supported by the packaged systemd configuration"
|
||
command -v systemctl >/dev/null 2>&1 || die "systemd is required"
|
||
command -v systemd-analyze >/dev/null 2>&1 || die "systemd-analyze is required"
|
||
command -v getconf >/dev/null 2>&1 || die "getconf is required"
|
||
[ -d /run/systemd/system ] || die "systemd is not running as PID 1"
|
||
[ -d /etc/systemd/system ] || die "/etc/systemd/system is missing"
|
||
HOST_ARCH=$(normalized_host_arch)
|
||
host_bits=$(getconf LONG_BIT 2>/dev/null || true)
|
||
case "$HOST_ARCH" in
|
||
x86_64|aarch64) expected_bits=64 ;;
|
||
x86|arm) expected_bits=32 ;;
|
||
esac
|
||
[ "$host_bits" = "$expected_bits" ] \
|
||
|| die "CPU architecture and userspace word size do not match: $HOST_ARCH/$host_bits-bit"
|
||
if [ "$HOST_ARCH" = x86 ]; then
|
||
getconf GNU_LIBC_VERSION >/dev/null 2>&1 \
|
||
|| die "32-bit Linux deployment requires glibc; the downloaded i686 Java runtime is not compatible with musl"
|
||
if ! for loader in /lib/ld-linux.so.2 /lib32/ld-linux.so.2 /lib/i386-linux-gnu/ld-linux.so.2; do
|
||
[ -x "$loader" ] && break
|
||
done; then
|
||
die "32-bit Linux deployment requires the glibc loader /lib/ld-linux.so.2"
|
||
fi
|
||
fi
|
||
[[ "$TRUSTED_PUBLIC_KEY_SHA256" =~ ^[0-9A-Fa-f]{64}$ ]] \
|
||
|| die "Set KAIDI_RELEASE_PUBLIC_KEY_SHA256 to the trusted release public-key SHA-256"
|
||
case "$REINSTALL" in
|
||
true|false) ;;
|
||
*) die "KAIDI_REINSTALL must be true or false" ;;
|
||
esac
|
||
case "$SETUP_WIZARD" in
|
||
true|false) ;;
|
||
*) die "KAIDI_SETUP_WIZARD must be true or false" ;;
|
||
esac
|
||
if [ "$SETUP_WIZARD" = true ] && [ "$REINSTALL" = true ]; then
|
||
[ -s "$CONFIG_ROOT/kaidi.env" ] \
|
||
|| die "A setup-wizard repair needs the existing $CONFIG_ROOT/kaidi.env"
|
||
[ "$(read_existing_env FINANCE_SETUP_ENABLED)" = true ] \
|
||
|| die "The existing installation is already in production mode; use a normal repair reinstall"
|
||
[ ! -e "$STATE_ROOT/setup/locked" ] \
|
||
|| die "The setup wizard is already locked; use a normal repair reinstall"
|
||
fi
|
||
log "Environment verified: $(uname -sr), architecture=$HOST_ARCH, userspace=${host_bits}-bit, systemd"
|
||
}
|
||
|
||
validate_inputs() {
|
||
[ "$(id -u)" -eq 0 ] || die "Run with sudo or as root"
|
||
[ -z "$RELEASE_TOKEN" ] || [ -z "$RELEASE_TOKEN_FILE" ] \
|
||
|| die "Set only one of KAIDI_RELEASE_TOKEN or KAIDI_RELEASE_TOKEN_FILE"
|
||
if [ -n "$RELEASE_TOKEN_FILE" ]; then
|
||
[ -f "$RELEASE_TOKEN_FILE" ] && [ ! -L "$RELEASE_TOKEN_FILE" ] \
|
||
|| die "KAIDI_RELEASE_TOKEN_FILE must be a regular file"
|
||
[ "$(wc -c < "$RELEASE_TOKEN_FILE" | tr -d '[:space:]')" -le 512 ] \
|
||
|| die "KAIDI_RELEASE_TOKEN_FILE is too large"
|
||
RELEASE_TOKEN=$(cat "$RELEASE_TOKEN_FILE")
|
||
fi
|
||
[ "$REINSTALL" = "true" ] || [ ! -e "$APP_ROOT/current" ] \
|
||
|| die "Kaidi Finance is already installed; use the system update page"
|
||
if [ -z "$RELEASE_API_URL" ]; then
|
||
case "$RELEASE_BASE_URL" in
|
||
*OWNER/REPO*) die "Set KAIDI_RELEASE_BASE_URL or KAIDI_RELEASE_API_URL to the Git release source" ;;
|
||
esac
|
||
fi
|
||
[ -z "$RELEASE_TOKEN" ] || { [ "${#RELEASE_TOKEN}" -le 512 ] \
|
||
&& ! printf '%s' "$RELEASE_TOKEN" | grep -q '[[:cntrl:]]'; } \
|
||
|| die "KAIDI_RELEASE_TOKEN is invalid"
|
||
}
|
||
|
||
download() {
|
||
local url=$1 output=$2
|
||
case "$url" in
|
||
https://*)
|
||
if ! curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
|
||
--tlsv1.2 --connect-timeout 15 --max-time 600 "$url" -o "$output"; then
|
||
die "Download failed: $url"
|
||
fi
|
||
;;
|
||
*)
|
||
[ "${KAIDI_ALLOW_INSECURE_UPDATE:-false}" = "true" ] || die "Release URLs must use HTTPS"
|
||
if ! curl --fail --silent --show-error --location --proto '=http,https' \
|
||
--proto-redir '=http,https' --connect-timeout 15 --max-time 600 "$url" -o "$output"; then
|
||
die "Download failed: $url"
|
||
fi
|
||
;;
|
||
esac
|
||
}
|
||
|
||
download_release_url() {
|
||
local url=$1 output=$2
|
||
case "$url" in
|
||
https://*)
|
||
if [ -n "$RELEASE_TOKEN" ]; then
|
||
[ -s "$RELEASE_AUTH_HEADER_FILE" ] || die "Release authentication header is unavailable"
|
||
curl --fail --silent --show-error --proto '=https' --tlsv1.2 \
|
||
--header "@$RELEASE_AUTH_HEADER_FILE" "$url" -o "$output"
|
||
else
|
||
download "$url" "$output"
|
||
fi
|
||
;;
|
||
*)
|
||
[ "${KAIDI_ALLOW_INSECURE_UPDATE:-false}" = "true" ] || die "Release URLs must use HTTPS"
|
||
if [ -n "$RELEASE_TOKEN" ]; then
|
||
[ -s "$RELEASE_AUTH_HEADER_FILE" ] || die "Release authentication header is unavailable"
|
||
curl --fail --silent --show-error --proto '=http,https' \
|
||
--header "@$RELEASE_AUTH_HEADER_FILE" "$url" -o "$output"
|
||
else
|
||
download "$url" "$output"
|
||
fi
|
||
;;
|
||
esac
|
||
}
|
||
|
||
release_asset_url() {
|
||
local asset_name=$1 api_origin repo_path release_tag encoded_tag encoded_asset
|
||
if [ -n "$RELEASE_API_URL" ]; then
|
||
jq -e --arg name "$asset_name" 'any(.assets[]?; .name == $name)' \
|
||
"$WORK_DIR/release-api.json" >/dev/null || die "Release asset $asset_name is missing"
|
||
release_tag=$(jq -er '.tag_name | strings
|
||
| select(test("^v[0-9A-Za-z][0-9A-Za-z._+-]{0,127}$"))' \
|
||
"$WORK_DIR/release-api.json") || die "Gitea Release tag is invalid"
|
||
api_origin=$(printf '%s' "$RELEASE_API_URL" | sed -E 's#^(https?://[^/]+).*$#\1#')
|
||
repo_path=$(printf '%s' "$RELEASE_API_URL" | sed -nE \
|
||
's#^https?://[^/]+/api/v1/repos/([A-Za-z0-9._-]+/[A-Za-z0-9._-]+)/releases/(latest|tags/[^/?#]+)$#\1#p')
|
||
[ -n "$repo_path" ] || die "KAIDI_RELEASE_API_URL must be a Gitea repository Release API endpoint"
|
||
encoded_tag=$(jq -rn --arg value "$release_tag" '$value | @uri')
|
||
encoded_asset=$(jq -rn --arg value "$asset_name" '$value | @uri')
|
||
printf '%s/%s/releases/download/%s/%s\n' "$api_origin" "$repo_path" "$encoded_tag" "$encoded_asset"
|
||
else
|
||
printf '%s/%s\n' "${RELEASE_BASE_URL%/}" "$asset_name"
|
||
fi
|
||
}
|
||
|
||
download_release_asset() {
|
||
local asset_name=$1 output=$2 url
|
||
url=$(release_asset_url "$asset_name")
|
||
download_release_url "$url" "$output"
|
||
}
|
||
|
||
install_packages() {
|
||
if command -v apt-get >/dev/null 2>&1; then
|
||
export DEBIAN_FRONTEND=noninteractive
|
||
apt-get update -qq >/dev/null 2>&1 \
|
||
|| die "系统软件源更新失败，请检查网络和 apt 配置"
|
||
apt-get install -y -qq ca-certificates coreutils curl findutils gzip jq openssl tar util-linux \
|
||
>/dev/null 2>&1 \
|
||
|| die "系统依赖安装失败；安装器不会安装 MySQL 或 Docker"
|
||
elif command -v dnf >/dev/null 2>&1; then
|
||
dnf install -y ca-certificates coreutils curl findutils gzip jq openssl tar util-linux \
|
||
>/dev/null 2>&1 \
|
||
|| die "系统依赖安装失败；安装器不会安装 MySQL 或 Docker"
|
||
elif command -v yum >/dev/null 2>&1; then
|
||
yum install -y ca-certificates coreutils curl findutils gzip jq openssl tar util-linux \
|
||
>/dev/null 2>&1 \
|
||
|| die "系统依赖安装失败；安装器不会安装 MySQL 或 Docker"
|
||
else
|
||
die "Supported package managers are apt, dnf, and yum"
|
||
fi
|
||
log "系统依赖检查完成（未安装 MySQL、MariaDB、Docker）"
|
||
}
|
||
|
||
preflight_runtime_commands() {
|
||
local command_name
|
||
for command_name in \
|
||
awk bash chmod chown cp curl cut date find getconf getent grep gzip head id install jq journalctl \
|
||
ln mktemp mv nologin openssl readlink rm runuser sed sha256sum sleep sort systemctl \
|
||
systemd-analyze tar tr useradd usermod groupadd wc flock setsid; do
|
||
command -v "$command_name" >/dev/null 2>&1 \
|
||
|| die "Required command is missing after dependency preparation: $command_name"
|
||
done
|
||
}
|
||
|
||
azul_arch() {
|
||
case "${HOST_ARCH:-$(normalized_host_arch)}" in
|
||
x86_64) printf x86 ;;
|
||
x86) printf i686 ;;
|
||
aarch64) printf arm_64 ;;
|
||
arm) printf arm ;;
|
||
esac
|
||
}
|
||
|
||
java_arch_matches_host() {
|
||
local java_bin=$1 java_arch host_arch
|
||
host_arch=${HOST_ARCH:-$(normalized_host_arch)}
|
||
java_arch=$(
|
||
"$java_bin" -XshowSettings:properties -version 2>&1 \
|
||
| sed -n 's/^[[:space:]]*os\.arch = [[:space:]]*//p' \
|
||
| head -n 1
|
||
)
|
||
case "$host_arch:$java_arch" in
|
||
x86_64:amd64|x86_64:x86_64|x86:x86|x86:i386|x86:i486|x86:i586|x86:i686|\
|
||
aarch64:aarch64|aarch64:arm64|arm:arm) return 0 ;;
|
||
*) return 1 ;;
|
||
esac
|
||
}
|
||
|
||
java_home_from_bin() {
|
||
local java_bin=$1 resolved_java java_major home
|
||
[ -x "$java_bin" ] || return 1
|
||
java_major=$(
|
||
"$java_bin" -version 2>&1 \
|
||
| sed -n 's/.*version "\([0-9][0-9]*\).*/\1/p' \
|
||
| head -n 1
|
||
)
|
||
[[ "$java_major" =~ ^[0-9]+$ ]] && [ "$java_major" -ge 17 ] || return 1
|
||
java_arch_matches_host "$java_bin" || return 1
|
||
resolved_java=$(readlink -f "$java_bin" 2>/dev/null || printf '%s' "$java_bin")
|
||
case "$resolved_java" in
|
||
*/bin/java) home=${resolved_java%/bin/java} ;;
|
||
*) return 1 ;;
|
||
esac
|
||
[ -x "$home/bin/java" ] || return 1
|
||
printf '%s\n' "$home"
|
||
}
|
||
|
||
system_java_home() {
|
||
local candidate home
|
||
if [ -n "${KAIDI_JAVA_HOME:-}" ]; then
|
||
candidate="${KAIDI_JAVA_HOME%/}/bin/java"
|
||
java_home_from_bin "$candidate" && return 0
|
||
return 1
|
||
fi
|
||
candidate=$(command -v java 2>/dev/null || true)
|
||
if [ -n "$candidate" ] && home=$(java_home_from_bin "$candidate"); then
|
||
printf '%s\n' "$home"
|
||
return 0
|
||
fi
|
||
# Baota commonly keeps JDKs outside PATH. Prefer an existing Java 17 there
|
||
# before consulting the remote Azul metadata endpoint.
|
||
for candidate in \
|
||
/www/server/java/*/bin/java \
|
||
/www/server/java/*/jre/bin/java \
|
||
/usr/lib/jvm/*/bin/java \
|
||
/usr/java/*/bin/java; do
|
||
[ -x "$candidate" ] || continue
|
||
if home=$(java_home_from_bin "$candidate"); then
|
||
printf '%s\n' "$home"
|
||
return 0
|
||
fi
|
||
done
|
||
return 1
|
||
}
|
||
|
||
prepare_java() {
|
||
local api java_metadata package_metadata package_uuid java_url java_sha256 actual_sha256 system_home java_line java_version
|
||
JAVA_BIN=
|
||
JAVA_STAGED_DIR=
|
||
if system_home=$(system_java_home); then
|
||
JAVA_BIN="$system_home/bin/java"
|
||
java_line=$("$JAVA_BIN" -version 2>&1 | head -n 1) \
|
||
|| die "The existing Java runtime cannot start on this host"
|
||
java_version=$(printf '%s\n' "$java_line" | sed -n 's/.*version "\([0-9][0-9.]*\).*/\1/p')
|
||
log "使用现有 Java 运行时：$system_home（版本 ${java_version:-未知}）"
|
||
return 0
|
||
fi
|
||
log "No local Java 17 runtime found; downloading the official Azul Java 17 runtime"
|
||
api="https://api.azul.com/metadata/v1/zulu/packages/?java_version=17&os=linux&arch=$(azul_arch)&archive_type=tar.gz&java_package_type=jre&release_status=ga&availability_types=CA&latest=true"
|
||
java_metadata="$WORK_DIR/zulu-metadata.json"
|
||
download "$api" "$java_metadata"
|
||
package_uuid=$(jq -er '[.[] | select(.name | contains("-fx-") | not)][0].package_uuid' \
|
||
"$java_metadata") \
|
||
|| die "No Java 17 runtime is published for this Linux architecture"
|
||
package_metadata="$WORK_DIR/zulu-package.json"
|
||
download "https://api.azul.com/metadata/v1/zulu/packages/$package_uuid" "$package_metadata"
|
||
java_url=$(jq -er '.download_url | strings | select(startswith("https://cdn.azul.com/"))' \
|
||
"$package_metadata") || die "Java 17 runtime download URL is invalid"
|
||
java_sha256=$(jq -er '.sha256_hash | strings | ascii_downcase | select(test("^[0-9a-f]{64}$"))' \
|
||
"$package_metadata") || die "Java 17 runtime SHA-256 is unavailable"
|
||
JAVA_STAGED_DIR="$WORK_DIR/java.next"
|
||
download "$java_url" "$WORK_DIR/java.tar.gz"
|
||
actual_sha256=$(sha256_file "$WORK_DIR/java.tar.gz")
|
||
[ "$actual_sha256" = "$java_sha256" ] || die "Java 17 runtime SHA-256 verification failed"
|
||
mkdir -p "$JAVA_STAGED_DIR"
|
||
tar -xzf "$WORK_DIR/java.tar.gz" --strip-components=1 -C "$JAVA_STAGED_DIR"
|
||
java_arch_matches_host "$JAVA_STAGED_DIR/bin/java" \
|
||
|| die "Downloaded Java runtime architecture does not match $HOST_ARCH"
|
||
java_line=$("$JAVA_STAGED_DIR/bin/java" -version 2>&1 | head -n 1) \
|
||
|| die "The downloaded Java runtime cannot start; verify glibc and the host architecture"
|
||
JAVA_BIN="$APP_ROOT/runtime/java/bin/java"
|
||
java_version=$(printf '%s\n' "$java_line" | sed -n 's/.*version "\([0-9][0-9.]*\).*/\1/p')
|
||
log "下载的 Java 运行时校验通过（版本 ${java_version:-未知}）"
|
||
}
|
||
|
||
activate_java() {
|
||
[ -n "$JAVA_STAGED_DIR" ] || return 0
|
||
mkdir -p "$APP_ROOT/runtime"
|
||
JAVA_PREVIOUS_DIR="$WORK_DIR/java.previous"
|
||
if [ -e "$APP_ROOT/runtime/java" ] || [ -L "$APP_ROOT/runtime/java" ]; then
|
||
mv "$APP_ROOT/runtime/java" "$JAVA_PREVIOUS_DIR"
|
||
fi
|
||
mv "$JAVA_STAGED_DIR" "$APP_ROOT/runtime/java"
|
||
chown -R root:"$SERVICE_GROUP" "$APP_ROOT/runtime/java"
|
||
chmod -R u=rwX,g=rX,o= "$APP_ROOT/runtime/java"
|
||
JAVA_ACTIVATED=true
|
||
}
|
||
|
||
ensure_service_identity() {
|
||
local existing_home nologin_path
|
||
command -v getent >/dev/null 2>&1 || die "getent is required"
|
||
if ! getent group "$SERVICE_GROUP" >/dev/null 2>&1; then
|
||
groupadd --system "$SERVICE_GROUP"
|
||
SERVICE_GROUP_CREATED=true
|
||
fi
|
||
if id "$SERVICE_USER" >/dev/null 2>&1; then
|
||
existing_home=$(getent passwd "$SERVICE_USER" | awk -F: '{print $6}')
|
||
[ "$existing_home" = "$STATE_ROOT" ] \
|
||
|| die "Existing user $SERVICE_USER has unexpected home directory $existing_home"
|
||
if ! id -nG "$SERVICE_USER" | tr ' ' '\n' | grep -Fxq "$SERVICE_GROUP"; then
|
||
usermod --append --groups "$SERVICE_GROUP" "$SERVICE_USER"
|
||
fi
|
||
return 0
|
||
fi
|
||
nologin_path=$(command -v nologin 2>/dev/null || true)
|
||
[ -n "$nologin_path" ] || nologin_path=/usr/sbin/nologin
|
||
[ -x "$nologin_path" ] || die "A nologin shell is required"
|
||
useradd --system --gid "$SERVICE_GROUP" --home-dir "$STATE_ROOT" --shell "$nologin_path" "$SERVICE_USER"
|
||
SERVICE_USER_CREATED=true
|
||
}
|
||
|
||
record_layout_path() {
|
||
[ -e "$1" ] || [ -L "$1" ] || CREATED_LAYOUT_PATHS+=("$1")
|
||
}
|
||
|
||
prepare_managed_layout() {
|
||
command -v runuser >/dev/null 2>&1 || die "runuser is required"
|
||
record_layout_path "$APP_ROOT"
|
||
record_layout_path "$APP_ROOT/releases"
|
||
record_layout_path "$APP_ROOT/runtime"
|
||
record_layout_path "$APP_ROOT/bin"
|
||
record_layout_path "$STATE_ROOT"
|
||
record_layout_path "$STATE_ROOT/files"
|
||
record_layout_path "$STATE_ROOT/tmp"
|
||
record_layout_path /var/log/kaidi
|
||
record_layout_path "$STATE_ROOT/setup"
|
||
record_layout_path "$UPDATE_STATE_ROOT"
|
||
record_layout_path "$UPDATE_STATE_ROOT/inbox"
|
||
record_layout_path "$CONFIG_ROOT"
|
||
install -d -o root -g "$SERVICE_GROUP" -m 0750 \
|
||
"$APP_ROOT" "$APP_ROOT/releases" "$APP_ROOT/runtime" "$APP_ROOT/bin"
|
||
install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0750 \
|
||
"$STATE_ROOT" "$STATE_ROOT/files" "$STATE_ROOT/tmp" /var/log/kaidi
|
||
install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0700 "$STATE_ROOT/setup"
|
||
install -d -o root -g "$SERVICE_GROUP" -m 0750 "$UPDATE_STATE_ROOT"
|
||
install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0750 "$UPDATE_STATE_ROOT/inbox"
|
||
install -d -o root -g root -m 0700 "$CONFIG_ROOT"
|
||
}
|
||
|
||
secure_release_tree() {
|
||
local release_dir=$1
|
||
chown -R root:"$SERVICE_GROUP" "$release_dir"
|
||
find "$release_dir" -type d -exec chmod 0750 {} +
|
||
find "$release_dir" -type f -exec chmod 0640 {} +
|
||
chmod 0750 "$release_dir/ops/update.sh" "$release_dir/ops/baota-start.sh"
|
||
}
|
||
|
||
restore_security_contexts() {
|
||
command -v restorecon >/dev/null 2>&1 || return 0
|
||
restorecon -RF "$APP_ROOT" "$STATE_ROOT" "$UPDATE_STATE_ROOT" /var/log/kaidi \
|
||
/etc/systemd/system/kaidi-finance.service \
|
||
/etc/systemd/system/kaidi-update.service \
|
||
/etc/systemd/system/kaidi-update.path >/dev/null 2>&1 \
|
||
|| log "SELinux context restoration reported a warning; service access checks will decide whether installation can continue"
|
||
}
|
||
|
||
verify_service_access() {
|
||
# shellcheck disable=SC2016 # Positional parameters are expanded by the child shell.
|
||
runuser -u "$SERVICE_USER" -- sh -c \
|
||
'cd "$1" && test -r app.jar && test -r public/index.html' sh "$APP_ROOT/current" \
|
||
|| die "$SERVICE_USER cannot traverse or read the active release"
|
||
[ -n "$JAVA_BIN" ] && [ -x "$JAVA_BIN" ] \
|
||
|| die "The selected Java runtime is unavailable at $JAVA_BIN"
|
||
runuser -u "$SERVICE_USER" -- test -x "$JAVA_BIN" \
|
||
|| die "$SERVICE_USER cannot execute the selected Java runtime"
|
||
runuser -u "$SERVICE_USER" -- "$JAVA_BIN" -version >/dev/null 2>&1 \
|
||
|| die "The selected Java runtime cannot execute as $SERVICE_USER"
|
||
runuser -u "$SERVICE_USER" -- test -w "$STATE_ROOT/files" \
|
||
|| die "$SERVICE_USER cannot write the file-storage directory"
|
||
runuser -u "$SERVICE_USER" -- test -w "$UPDATE_STATE_ROOT/inbox" \
|
||
|| die "$SERVICE_USER cannot write the update inbox"
|
||
log "Service-user filesystem and Java access checks passed"
|
||
}
|
||
|
||
random_secret() { openssl rand -base64 36 | tr -d '\n/+=' | cut -c1-36; }
|
||
|
||
decode_env_value() {
|
||
local raw=$1 result='' char next index=0 length
|
||
if [[ "$raw" == \"*\" && ${#raw} -ge 2 ]]; then
|
||
raw=${raw:1:${#raw}-2}
|
||
length=${#raw}
|
||
while [ "$index" -lt "$length" ]; do
|
||
char=${raw:index:1}
|
||
if [ "$char" = "\\" ] && [ $((index + 1)) -lt "$length" ]; then
|
||
next=${raw:index+1:1}
|
||
if [ "$next" = "\\" ] || [ "$next" = '"' ]; then
|
||
result+="$next"
|
||
index=$((index + 2))
|
||
continue
|
||
fi
|
||
fi
|
||
result+="$char"
|
||
index=$((index + 1))
|
||
done
|
||
printf '%s' "$result"
|
||
elif [[ "$raw" == \'*\' && ${#raw} -ge 2 ]]; then
|
||
printf '%s' "${raw:1:${#raw}-2}"
|
||
else
|
||
printf '%s' "$raw"
|
||
fi
|
||
}
|
||
|
||
read_existing_env() {
|
||
read_env_file "$CONFIG_ROOT/kaidi.env" "$1"
|
||
}
|
||
|
||
read_env_file() {
|
||
local file=$1 name=$2 line value='' found=false
|
||
[ -s "$file" ] || return 0
|
||
while IFS= read -r line || [ -n "$line" ]; do
|
||
case "$line" in
|
||
"$name="*)
|
||
value=${line#*=}
|
||
found=true
|
||
;;
|
||
esac
|
||
done < "$file"
|
||
if [ "$found" = true ]; then
|
||
decode_env_value "$value"
|
||
fi
|
||
}
|
||
|
||
read_setup_env() {
|
||
read_env_file "$STATE_ROOT/setup/application.env" "$1"
|
||
}
|
||
|
||
read_reinstall_env() {
|
||
local value
|
||
value=$(read_setup_env "$1")
|
||
if [ -n "$value" ]; then
|
||
printf '%s' "$value"
|
||
else
|
||
read_existing_env "$1"
|
||
fi
|
||
}
|
||
|
||
port_is_listening() {
|
||
local port_hex files=(/proc/net/tcp)
|
||
port_hex=$(printf '%04X' "$APP_PORT")
|
||
[ -r /proc/net/tcp ] || return 1
|
||
[ ! -r /proc/net/tcp6 ] || files+=(/proc/net/tcp6)
|
||
awk -v port="$port_hex" '
|
||
toupper($2) ~ (":" port "$") && $4 == "0A" { found=1 }
|
||
END { exit(found ? 0 : 1) }
|
||
' "${files[@]}" 2>/dev/null
|
||
}
|
||
|
||
valid_app_port() {
|
||
[[ "$1" =~ ^[0-9]{1,5}$ ]] && [ "$1" -ge 1024 ] && [ "$1" -le 65535 ]
|
||
}
|
||
|
||
configure_app_port() {
|
||
local default_port=18080 existing_port entered probe_host probe_authority
|
||
if [ -z "$APP_PORT" ]; then
|
||
default_port=$(read_reinstall_env SERVER_PORT || true)
|
||
[[ "$default_port" =~ ^[0-9]{1,5}$ ]] || default_port=18080
|
||
if [ -t 1 ] && [ -r /dev/tty ]; then
|
||
printf '[kaidi-install] 应用端口 [%s]：' "$default_port" > /dev/tty
|
||
if IFS= read -r entered < /dev/tty; then
|
||
APP_PORT=${entered:-$default_port}
|
||
else
|
||
APP_PORT=$default_port
|
||
fi
|
||
else
|
||
APP_PORT=$default_port
|
||
log "No interactive terminal detected; using application port $APP_PORT"
|
||
fi
|
||
fi
|
||
valid_app_port "$APP_PORT" \
|
||
|| die "KAIDI_APP_PORT must be an integer between 1024 and 65535"
|
||
case "$SERVER_ADDRESS" in
|
||
''|*[!A-Za-z0-9_.:-]*) die "KAIDI_SERVER_ADDRESS contains unsupported characters" ;;
|
||
esac
|
||
if port_is_listening; then
|
||
existing_port=$(read_existing_env SERVER_PORT || true)
|
||
if [ "$REINSTALL" = true ] && [ "$existing_port" = "$APP_PORT" ] \
|
||
&& systemctl is-active --quiet kaidi-finance.service; then
|
||
log "Application port $APP_PORT is already held by the existing Kaidi service"
|
||
else
|
||
die "Application port $APP_PORT is already in use; choose another port with KAIDI_APP_PORT"
|
||
fi
|
||
fi
|
||
probe_host=${KAIDI_HEALTH_HOST:-$SERVER_ADDRESS}
|
||
case "$probe_host" in
|
||
0.0.0.0) probe_host=127.0.0.1 ;;
|
||
::) probe_host=::1 ;;
|
||
esac
|
||
case "$probe_host" in
|
||
*:*) probe_authority="[$probe_host]" ;;
|
||
*) probe_authority="$probe_host" ;;
|
||
esac
|
||
if [ -z "$HEALTH_URL" ]; then
|
||
HEALTH_URL="http://${probe_authority}:${APP_PORT}/actuator/health"
|
||
fi
|
||
if [ -z "$APP_INDEX_URL" ]; then
|
||
APP_INDEX_URL="http://${probe_authority}:${APP_PORT}/"
|
||
fi
|
||
PROXY_TARGET="http://${probe_authority}:${APP_PORT}"
|
||
log "Application will bind ${SERVER_ADDRESS}:${APP_PORT}"
|
||
log "Reverse proxy target: $PROXY_TARGET"
|
||
}
|
||
|
||
is_semver() {
|
||
[ "${#1}" -le 128 ] \
|
||
&& LC_ALL=C grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$' \
|
||
<<EOF
|
||
$1
|
||
EOF
|
||
}
|
||
|
||
configure_database() {
|
||
if [ "$SETUP_WIZARD" = true ]; then
|
||
[ -z "${KAIDI_DB_URL:-}${KAIDI_DB_USERNAME:-}${KAIDI_DB_PASSWORD:-}" ] \
|
||
|| die "Do not pass database credentials when KAIDI_SETUP_WIZARD=true; enter them in the browser wizard"
|
||
# First-run mode does not create a datasource. Keep database fields empty
|
||
# so hosting panels cannot mistake a placeholder for a local MySQL service.
|
||
DB_URL=
|
||
DB_USERNAME=
|
||
DB_PASSWORD=
|
||
return 0
|
||
fi
|
||
if [ "$REINSTALL" = true ]; then
|
||
[ -s "$CONFIG_ROOT/kaidi.env" ] || die "KAIDI_REINSTALL needs the existing $CONFIG_ROOT/kaidi.env"
|
||
DB_USERNAME=${KAIDI_DB_USERNAME:-$(read_reinstall_env DB_USERNAME)}
|
||
DB_PASSWORD=${KAIDI_DB_PASSWORD:-$(read_reinstall_env DB_PASSWORD)}
|
||
DB_URL=${KAIDI_DB_URL:-$(read_reinstall_env DB_URL)}
|
||
else
|
||
DB_USERNAME=${KAIDI_DB_USERNAME:-}
|
||
DB_PASSWORD=${KAIDI_DB_PASSWORD:-}
|
||
DB_URL=${KAIDI_DB_URL:-}
|
||
fi
|
||
if [ -n "$DB_URL" ]; then
|
||
[ -n "$DB_USERNAME" ] && [ -n "$DB_PASSWORD" ] \
|
||
|| die "KAIDI_DB_USERNAME and KAIDI_DB_PASSWORD are required with KAIDI_DB_URL"
|
||
return 0
|
||
fi
|
||
[ "$REINSTALL" != true ] \
|
||
|| die "KAIDI_REINSTALL needs database credentials in the existing installation or command environment"
|
||
die "An external MySQL 8.4 database is required; set KAIDI_DB_URL, KAIDI_DB_USERNAME, and KAIDI_DB_PASSWORD"
|
||
}
|
||
|
||
database_host() {
|
||
local endpoint host_port
|
||
[ -n "$DB_URL" ] || { printf ''; return; }
|
||
endpoint=${DB_URL#jdbc:mysql://}
|
||
host_port=${endpoint%%/*}
|
||
printf '%s' "${KAIDI_DB_HOST:-${host_port%%:*}}"
|
||
}
|
||
|
||
database_port() {
|
||
local endpoint host_port candidate
|
||
[ -n "$DB_URL" ] || { printf ''; return; }
|
||
endpoint=${DB_URL#jdbc:mysql://}
|
||
host_port=${endpoint%%/*}
|
||
candidate=${host_port##*:}
|
||
[ "$candidate" != "$host_port" ] || candidate=3306
|
||
printf '%s' "${KAIDI_DB_PORT:-$candidate}"
|
||
}
|
||
|
||
database_name() {
|
||
local endpoint name
|
||
[ -n "$DB_URL" ] || { printf ''; return; }
|
||
endpoint=${DB_URL#jdbc:mysql://}
|
||
name=${endpoint#*/}
|
||
name=${name%%\?*}
|
||
printf '%s' "${KAIDI_DB_NAME:-$name}"
|
||
}
|
||
|
||
validate_database_configuration() {
|
||
[ "$SETUP_WIZARD" != true ] || return 0
|
||
case "$DB_URL" in
|
||
jdbc:mysql://*) ;;
|
||
*) die "KAIDI_DB_URL must start with jdbc:mysql://" ;;
|
||
esac
|
||
[ -n "$DB_USERNAME" ] || die "KAIDI_DB_USERNAME is empty"
|
||
[ -n "$DB_PASSWORD" ] || die "KAIDI_DB_PASSWORD is empty"
|
||
[ -n "$(database_host)" ] || die "The database host is empty"
|
||
[[ "$(database_port)" =~ ^[0-9]{1,5}$ ]] \
|
||
&& [ "$(database_port)" -ge 1 ] && [ "$(database_port)" -le 65535 ] \
|
||
|| die "The database port is invalid"
|
||
[[ "$(database_name)" =~ ^[A-Za-z0-9_$]+$ ]] || die "The database name is invalid"
|
||
# The installer deliberately does not invoke mysql/mariadb and does not
|
||
# execute DDL/DML. The application performs Flyway migrations only after
|
||
# it has connected to the operator-provided schema.
|
||
log "已记录外部 MySQL 连接配置；安装器不安装 MySQL、不连接数据库、不执行 SQL"
|
||
}
|
||
|
||
# Kept as a compatibility name for older local fixtures and wrappers. It is
|
||
# now a pure configuration check and has no database side effects.
|
||
preflight_database() {
|
||
validate_database_configuration
|
||
}
|
||
|
||
validate_database_backup_mode() {
|
||
case "${KAIDI_DB_BACKUP_MODE:-skip}" in
|
||
skip|mysqldump) ;;
|
||
*) die "KAIDI_DB_BACKUP_MODE must be skip or mysqldump" ;;
|
||
esac
|
||
}
|
||
|
||
write_env_file() {
|
||
local output=$1 temporary name value escaped
|
||
shift
|
||
temporary="${output}.next.$$"
|
||
: > "$temporary"
|
||
while [ "$#" -gt 0 ]; do
|
||
name=$1
|
||
value=$2
|
||
shift 2
|
||
case "$value" in
|
||
*$'\n'*|*$'\r'*) die "$name contains a line break" ;;
|
||
esac
|
||
escaped=${value//\\/\\\\}
|
||
escaped=${escaped//\"/\\\"}
|
||
printf '%s="%s"\n' "$name" "$escaped" >> "$temporary"
|
||
done
|
||
mv -f "$temporary" "$output"
|
||
}
|
||
|
||
write_env_file_preserving_unknown() {
|
||
local output=$1 existing='' temporary name value escaped line key managed_keys='|'
|
||
shift
|
||
if [ "$REINSTALL" = true ] && [ -f "$output" ]; then
|
||
existing="$WORK_DIR/existing-kaidi.env"
|
||
cp -p "$output" "$existing"
|
||
fi
|
||
local arguments=("$@")
|
||
while [ "$#" -gt 0 ]; do
|
||
managed_keys+="$1|"
|
||
shift 2
|
||
done
|
||
temporary="${output}.next.$$"
|
||
: > "$temporary"
|
||
if [ -n "$existing" ]; then
|
||
while IFS= read -r line || [ -n "$line" ]; do
|
||
if [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)= ]]; then
|
||
key=${BASH_REMATCH[1]}
|
||
case "$managed_keys" in
|
||
*"|$key|"*) continue ;;
|
||
esac
|
||
fi
|
||
printf '%s\n' "$line" >> "$temporary"
|
||
done < "$existing"
|
||
fi
|
||
set -- "${arguments[@]}"
|
||
while [ "$#" -gt 0 ]; do
|
||
name=$1
|
||
value=$2
|
||
shift 2
|
||
case "$value" in
|
||
*$'\n'*|*$'\r'*) die "$name contains a line break" ;;
|
||
esac
|
||
escaped=${value//\\/\\\\}
|
||
escaped=${escaped//\"/\\\"}
|
||
printf '%s="%s"\n' "$name" "$escaped" >> "$temporary"
|
||
done
|
||
mv -f "$temporary" "$output"
|
||
}
|
||
|
||
wait_for_health() {
|
||
local attempts=0 active_state restart_count
|
||
log "Waiting for application startup at $HEALTH_URL"
|
||
while [ "$attempts" -lt 60 ]; do
|
||
if curl --fail --silent --connect-timeout 1 --max-time 2 "$HEALTH_URL" 2>/dev/null \
|
||
| jq -e '.status == "UP"' >/dev/null 2>&1; then
|
||
log "Application health check is UP"
|
||
return 0
|
||
fi
|
||
active_state=$(systemctl show kaidi-finance.service --property=ActiveState --value 2>/dev/null || printf unknown)
|
||
restart_count=$(systemctl show kaidi-finance.service --property=NRestarts --value 2>/dev/null || printf 0)
|
||
[[ "$restart_count" =~ ^[0-9]+$ ]] || restart_count=0
|
||
if [ "$active_state" = failed ] || [ "$restart_count" -ge 3 ]; then
|
||
journalctl -u kaidi-finance.service -n 80 --no-pager >&2 || true
|
||
die "Application service failed during startup (state=$active_state, restarts=$restart_count)"
|
||
fi
|
||
attempts=$((attempts + 1))
|
||
if [ $((attempts % 5)) -eq 0 ]; then
|
||
log "Application is still starting (state=$active_state, elapsed=$((attempts * 2))s)"
|
||
fi
|
||
sleep 2
|
||
done
|
||
journalctl -u kaidi-finance.service -n 80 --no-pager >&2 || true
|
||
die "Application health check did not become UP"
|
||
}
|
||
|
||
backup_managed_state() {
|
||
local index=0 path
|
||
MANAGED_PATHS=(
|
||
"$APP_ROOT/current"
|
||
"$APP_ROOT/bin/update.sh"
|
||
"$CONFIG_ROOT/kaidi.env"
|
||
"$CONFIG_ROOT/update.env"
|
||
"$CONFIG_ROOT/release-public.pem"
|
||
"$UPDATE_STATE_ROOT/status.json"
|
||
/root/kaidi-first-login.txt
|
||
/etc/systemd/system/kaidi-finance.service
|
||
/etc/systemd/system/kaidi-update.service
|
||
/etc/systemd/system/kaidi-update.path
|
||
)
|
||
BACKUP_DIR="$WORK_DIR/rollback"
|
||
mkdir -p "$BACKUP_DIR/files"
|
||
for path in "${MANAGED_PATHS[@]}"; do
|
||
if [ -e "$path" ] || [ -L "$path" ]; then
|
||
cp -a -- "$path" "$BACKUP_DIR/files/$index"
|
||
: > "$BACKUP_DIR/files/$index.exists"
|
||
fi
|
||
index=$((index + 1))
|
||
done
|
||
systemctl is-active --quiet kaidi-finance.service >/dev/null 2>&1 \
|
||
&& PREVIOUS_APP_ACTIVE=true || PREVIOUS_APP_ACTIVE=false
|
||
systemctl is-enabled --quiet kaidi-finance.service >/dev/null 2>&1 \
|
||
&& PREVIOUS_APP_ENABLED=true || PREVIOUS_APP_ENABLED=false
|
||
systemctl is-active --quiet kaidi-update.path >/dev/null 2>&1 \
|
||
&& PREVIOUS_UPDATE_ACTIVE=true || PREVIOUS_UPDATE_ACTIVE=false
|
||
systemctl is-enabled --quiet kaidi-update.path >/dev/null 2>&1 \
|
||
&& PREVIOUS_UPDATE_ENABLED=true || PREVIOUS_UPDATE_ENABLED=false
|
||
INSTALL_TRANSACTION_ARMED=true
|
||
}
|
||
|
||
restore_unit_state() {
|
||
local unit=$1 was_enabled=$2 was_active=$3
|
||
if ! systemctl cat "$unit" >/dev/null 2>&1; then
|
||
systemctl reset-failed "$unit" >/dev/null 2>&1 || true
|
||
[ "$was_enabled" = false ] && [ "$was_active" = false ]
|
||
return
|
||
fi
|
||
systemctl reset-failed "$unit" >/dev/null 2>&1 || true
|
||
if [ "$was_enabled" = true ]; then
|
||
systemctl enable "$unit" >/dev/null 2>&1
|
||
else
|
||
systemctl disable "$unit" >/dev/null 2>&1
|
||
fi
|
||
if [ "$was_active" = true ]; then
|
||
systemctl start "$unit" >/dev/null 2>&1
|
||
else
|
||
systemctl stop "$unit" >/dev/null 2>&1
|
||
fi
|
||
}
|
||
|
||
restore_managed_path() {
|
||
local path=$1 index=$2 temporary
|
||
if [ -e "$BACKUP_DIR/files/$index.exists" ]; then
|
||
mkdir -p "$(dirname "$path")"
|
||
temporary="${path}.rollback.$$"
|
||
rm -rf -- "$temporary"
|
||
cp -a -- "$BACKUP_DIR/files/$index" "$temporary" || return 1
|
||
mv -Tf -- "$temporary" "$path" || {
|
||
rm -rf -- "$temporary"
|
||
return 1
|
||
}
|
||
else
|
||
rm -rf -- "$path"
|
||
fi
|
||
}
|
||
|
||
rollback_install() {
|
||
local index=0 path rollback_failed=false layout_path service_uid
|
||
set +e
|
||
log "Installation failed; restoring the previous managed state"
|
||
systemctl stop kaidi-update.path kaidi-finance.service >/dev/null 2>&1 || true
|
||
for path in "${MANAGED_PATHS[@]}"; do
|
||
restore_managed_path "$path" "$index" || rollback_failed=true
|
||
index=$((index + 1))
|
||
done
|
||
if [ -n "$RELEASE_DIR" ]; then
|
||
rm -rf -- "$RELEASE_DIR" || rollback_failed=true
|
||
fi
|
||
if [ -d "$JAVA_PREVIOUS_DIR" ] || [ -L "$JAVA_PREVIOUS_DIR" ]; then
|
||
rm -rf -- "$APP_ROOT/runtime/java" || rollback_failed=true
|
||
mkdir -p "$APP_ROOT/runtime" || rollback_failed=true
|
||
mv "$JAVA_PREVIOUS_DIR" "$APP_ROOT/runtime/java" || rollback_failed=true
|
||
elif [ "$JAVA_ACTIVATED" = true ]; then
|
||
rm -rf -- "$APP_ROOT/runtime/java" || rollback_failed=true
|
||
fi
|
||
if [ "$SERVICE_USER_CREATED" = true ]; then
|
||
service_uid=$(id -u "$SERVICE_USER" 2>/dev/null || true)
|
||
if [ -n "$service_uid" ]; then
|
||
userdel --force "$SERVICE_USER" >/dev/null 2>&1 || rollback_failed=true
|
||
fi
|
||
fi
|
||
if [ "$SERVICE_GROUP_CREATED" = true ] && getent group "$SERVICE_GROUP" >/dev/null 2>&1; then
|
||
groupdel "$SERVICE_GROUP" >/dev/null 2>&1 || rollback_failed=true
|
||
fi
|
||
for ((index=${#CREATED_LAYOUT_PATHS[@]} - 1; index >= 0; index--)); do
|
||
layout_path=${CREATED_LAYOUT_PATHS[$index]}
|
||
rmdir -- "$layout_path" >/dev/null 2>&1 || true
|
||
done
|
||
systemctl daemon-reload >/dev/null 2>&1 || rollback_failed=true
|
||
restore_unit_state kaidi-finance.service "$PREVIOUS_APP_ENABLED" "$PREVIOUS_APP_ACTIVE" \
|
||
|| rollback_failed=true
|
||
restore_unit_state kaidi-update.path "$PREVIOUS_UPDATE_ENABLED" "$PREVIOUS_UPDATE_ACTIVE" \
|
||
|| rollback_failed=true
|
||
set -e
|
||
[ "$rollback_failed" = false ]
|
||
}
|
||
|
||
cleanup() {
|
||
local result=$?
|
||
trap - EXIT
|
||
if [ "$result" -ne 0 ] && [ "$INSTALL_TRANSACTION_ARMED" = true ] \
|
||
&& [ "$INSTALL_COMMITTED" != true ]; then
|
||
rollback_install || log "ERROR: rollback was incomplete; inspect the managed systemd state"
|
||
fi
|
||
[ -z "$WORK_DIR" ] || rm -rf "$WORK_DIR"
|
||
exit "$result"
|
||
}
|
||
|
||
main() {
|
||
trap cleanup EXIT
|
||
|
||
validate_inputs
|
||
validate_database_backup_mode
|
||
configure_app_port
|
||
preflight_host
|
||
install_packages
|
||
preflight_runtime_commands
|
||
|
||
BASE=${RELEASE_BASE_URL%/}
|
||
WORK_DIR=$(mktemp -d)
|
||
if [ -n "$RELEASE_TOKEN" ]; then
|
||
RELEASE_AUTH_HEADER_FILE="$WORK_DIR/release-auth-header"
|
||
printf 'Authorization: token %s\n' "$RELEASE_TOKEN" > "$RELEASE_AUTH_HEADER_FILE"
|
||
chmod 0600 "$RELEASE_AUTH_HEADER_FILE"
|
||
fi
|
||
if [ -n "$RELEASE_API_URL" ]; then
|
||
download_release_url "$RELEASE_API_URL" "$WORK_DIR/release-api.json"
|
||
fi
|
||
download_release_asset release-public.pem "$WORK_DIR/release-public.pem"
|
||
ACTUAL_PUBLIC_KEY_SHA256=$(sha256_file "$WORK_DIR/release-public.pem" | tr '[:upper:]' '[:lower:]')
|
||
EXPECTED_PUBLIC_KEY_SHA256=$(printf '%s' "$TRUSTED_PUBLIC_KEY_SHA256" | tr '[:upper:]' '[:lower:]')
|
||
[ "$ACTUAL_PUBLIC_KEY_SHA256" = "$EXPECTED_PUBLIC_KEY_SHA256" ] \
|
||
|| die "Release public-key SHA-256 does not match the trusted fingerprint"
|
||
download_release_asset release-manifest.json "$WORK_DIR/release-manifest.json"
|
||
download_release_asset release-manifest.sig "$WORK_DIR/release-manifest.sig"
|
||
openssl dgst -sha256 -verify "$WORK_DIR/release-public.pem" -signature "$WORK_DIR/release-manifest.sig" \
|
||
"$WORK_DIR/release-manifest.json" >/dev/null 2>&1 || die "Release manifest signature verification failed"
|
||
|
||
VERSION=$(jq -er '.version | strings | select(length > 0 and length <= 128)' \
|
||
"$WORK_DIR/release-manifest.json") || die "Release version is invalid"
|
||
is_semver "$VERSION" || die "Release version is invalid"
|
||
ARTIFACT=$(jq -er '.artifact | strings | select(test("^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}\\.tar\\.gz$"))' \
|
||
"$WORK_DIR/release-manifest.json") || die "Release artifact name is invalid"
|
||
EXPECTED_SHA=$(jq -er '.sha256 | strings | ascii_downcase | select(test("^[0-9a-f]{64}$"))' \
|
||
"$WORK_DIR/release-manifest.json") || die "Release SHA-256 is invalid"
|
||
download_release_asset "$ARTIFACT" "$WORK_DIR/release.tar.gz"
|
||
ACTUAL_SHA=$(sha256sum "$WORK_DIR/release.tar.gz" | awk '{print $1}')
|
||
[ "$ACTUAL_SHA" = "$EXPECTED_SHA" ] || die "Release artifact SHA-256 verification failed"
|
||
tar -tzf "$WORK_DIR/release.tar.gz" > "$WORK_DIR/archive.list"
|
||
grep -Eq '(^/|(^|/)\.\.(/|$))' "$WORK_DIR/archive.list" \
|
||
&& die "Release archive contains an unsafe path"
|
||
mkdir "$WORK_DIR/extracted"
|
||
tar -xzf "$WORK_DIR/release.tar.gz" -C "$WORK_DIR/extracted"
|
||
find "$WORK_DIR/extracted" -type l -print -quit | grep -q . \
|
||
&& die "Release archive must not contain symbolic links"
|
||
[ -s "$WORK_DIR/extracted/app.jar" ] || die "Release app.jar is missing"
|
||
[ -s "$WORK_DIR/extracted/public/index.html" ] || die "Release frontend is missing"
|
||
[ "$(cat "$WORK_DIR/extracted/VERSION")" = "$VERSION" ] || die "Release version mismatch"
|
||
[ -x "$WORK_DIR/extracted/ops/update.sh" ] || die "Release updater is missing"
|
||
[ -x "$WORK_DIR/extracted/ops/baota-start.sh" ] || die "Baota Spring Boot launcher is missing"
|
||
bash -n "$WORK_DIR/extracted/ops/baota-start.sh" || die "Baota Spring Boot launcher is invalid"
|
||
|
||
configure_database
|
||
preflight_database
|
||
ensure_service_identity
|
||
prepare_managed_layout
|
||
prepare_java
|
||
|
||
RELEASE_DIR="$APP_ROOT/releases/$VERSION"
|
||
[ ! -e "$RELEASE_DIR" ] || RELEASE_DIR="$APP_ROOT/releases/${VERSION}-reinstall-$(date -u +%Y%m%dT%H%M%SZ)"
|
||
backup_managed_state
|
||
activate_java
|
||
mv "$WORK_DIR/extracted" "$RELEASE_DIR"
|
||
secure_release_tree "$RELEASE_DIR"
|
||
ln -sfn "$RELEASE_DIR" "$APP_ROOT/current.next"
|
||
mv -Tf "$APP_ROOT/current.next" "$APP_ROOT/current"
|
||
install -m 0755 "$RELEASE_DIR/ops/update.sh" "$APP_ROOT/bin/update.sh"
|
||
install -m 0644 "$WORK_DIR/release-public.pem" "$CONFIG_ROOT/release-public.pem"
|
||
|
||
if [ "$REINSTALL" = true ]; then
|
||
FIELD_KEY=$(read_existing_env FIELD_ENCRYPTION_KEY)
|
||
[ -n "$FIELD_KEY" ] || die "The existing FIELD_ENCRYPTION_KEY is missing"
|
||
ADMIN_PASSWORD=
|
||
SESSION_COOKIE_SECURE=${KAIDI_SESSION_COOKIE_SECURE:-$(read_existing_env SESSION_COOKIE_SECURE)}
|
||
FILE_STORAGE_ROOT_VALUE=$(read_existing_env FILE_STORAGE_ROOT)
|
||
FILE_STORAGE_TEMP_VALUE=$(read_existing_env FILE_STORAGE_TEMP)
|
||
FILE_SCANNER_ENABLED_VALUE=$(read_existing_env FILE_SCANNER_ENABLED)
|
||
[ -n "$SESSION_COOKIE_SECURE" ] || SESSION_COOKIE_SECURE=false
|
||
[ -n "$FILE_STORAGE_ROOT_VALUE" ] || FILE_STORAGE_ROOT_VALUE="$STATE_ROOT/files"
|
||
[ -n "$FILE_STORAGE_TEMP_VALUE" ] || FILE_STORAGE_TEMP_VALUE="$STATE_ROOT/tmp"
|
||
[ -n "$FILE_SCANNER_ENABLED_VALUE" ] || FILE_SCANNER_ENABLED_VALUE=false
|
||
else
|
||
FIELD_KEY=$(openssl rand -base64 32 | tr -d '\n')
|
||
if [ "$SETUP_WIZARD" = true ]; then
|
||
ADMIN_PASSWORD=
|
||
else
|
||
ADMIN_PASSWORD="Kaidi!$(random_secret)Aa1"
|
||
fi
|
||
SESSION_COOKIE_SECURE=${KAIDI_SESSION_COOKIE_SECURE:-false}
|
||
FILE_STORAGE_ROOT_VALUE="$STATE_ROOT/files"
|
||
FILE_STORAGE_TEMP_VALUE="$STATE_ROOT/tmp"
|
||
FILE_SCANNER_ENABLED_VALUE=${KAIDI_FILE_SCANNER_ENABLED:-false}
|
||
fi
|
||
BOOTSTRAP_ENABLED=true
|
||
SETUP_CODE=
|
||
SETUP_TOKEN_SHA256=
|
||
if [ "$REINSTALL" = true ] || [ "$SETUP_WIZARD" = true ]; then
|
||
BOOTSTRAP_ENABLED=false
|
||
fi
|
||
if [ "$SETUP_WIZARD" = true ]; then
|
||
SETUP_CODE="KD-$(random_secret)"
|
||
SETUP_TOKEN_SHA256=$(printf '%s' "$SETUP_CODE" | sha256sum | awk '{print $1}')
|
||
fi
|
||
write_env_file_preserving_unknown "$CONFIG_ROOT/kaidi.env" \
|
||
SPRING_PROFILES_ACTIVE production \
|
||
KAIDI_JAVA_BIN "$JAVA_BIN" \
|
||
SERVER_PORT "$APP_PORT" \
|
||
SERVER_ADDRESS "$SERVER_ADDRESS" \
|
||
SESSION_COOKIE_SECURE "$SESSION_COOKIE_SECURE" \
|
||
DB_URL "$DB_URL" \
|
||
DB_USERNAME "$DB_USERNAME" \
|
||
DB_PASSWORD "$DB_PASSWORD" \
|
||
FIELD_ENCRYPTION_KEY "$FIELD_KEY" \
|
||
FILE_STORAGE_ROOT "$FILE_STORAGE_ROOT_VALUE" \
|
||
FILE_STORAGE_TEMP "$FILE_STORAGE_TEMP_VALUE" \
|
||
FILE_SCANNER_ENABLED "$FILE_SCANNER_ENABLED_VALUE" \
|
||
FINANCE_BOOTSTRAP_ENABLED "$BOOTSTRAP_ENABLED" \
|
||
FINANCE_BOOTSTRAP_PASSWORD "$ADMIN_PASSWORD" \
|
||
FINANCE_SETUP_ENABLED "$SETUP_WIZARD" \
|
||
FINANCE_SETUP_TOKEN_SHA256 "$SETUP_TOKEN_SHA256" \
|
||
FINANCE_SETUP_ENV_FILE "$STATE_ROOT/setup/application.env" \
|
||
FINANCE_SETUP_MARKER_FILE "$STATE_ROOT/setup/locked" \
|
||
FINANCE_SETUP_RESTART_AFTER_COMPLETE true \
|
||
APP_VERSION "$VERSION" \
|
||
UPDATE_CURRENT_VERSION_FILE "$APP_ROOT/current/VERSION" \
|
||
FINANCE_UPDATE_ENABLED true \
|
||
UPDATE_RELEASE_BASE_URL "$([ -n "$RELEASE_API_URL" ] && printf '' || printf '%s/' "$BASE")" \
|
||
UPDATE_RELEASE_API_URL "$RELEASE_API_URL" \
|
||
UPDATE_RELEASE_TOKEN "$RELEASE_TOKEN" \
|
||
UPDATE_REQUEST_FILE "$UPDATE_STATE_ROOT/inbox/request.json" \
|
||
UPDATE_STATUS_FILE "$UPDATE_STATE_ROOT/status.json"
|
||
chmod 0600 "$CONFIG_ROOT/kaidi.env"
|
||
|
||
write_env_file "$CONFIG_ROOT/update.env" \
|
||
UPDATE_RELEASE_BASE_URL "$([ -n "$RELEASE_API_URL" ] && printf '' || printf '%s/' "$BASE")" \
|
||
UPDATE_RELEASE_API_URL "$RELEASE_API_URL" \
|
||
UPDATE_RELEASE_TOKEN "$RELEASE_TOKEN" \
|
||
UPDATE_REQUEST_FILE "$UPDATE_STATE_ROOT/inbox/request.json" \
|
||
UPDATE_STATUS_FILE "$UPDATE_STATE_ROOT/status.json" \
|
||
UPDATE_PUBLIC_KEY "$CONFIG_ROOT/release-public.pem" \
|
||
KAIDI_APP_ROOT "$APP_ROOT" \
|
||
KAIDI_UPDATE_STATE_ROOT "$UPDATE_STATE_ROOT" \
|
||
KAIDI_SERVICE_NAME kaidi-finance.service \
|
||
KAIDI_JAVA_BIN "$JAVA_BIN" \
|
||
KAIDI_HEALTH_URL "$HEALTH_URL" \
|
||
KAIDI_APP_INDEX_URL "$APP_INDEX_URL" \
|
||
KAIDI_DB_HOST "$(database_host)" \
|
||
KAIDI_DB_PORT "$(database_port)" \
|
||
KAIDI_DB_NAME "$(database_name)" \
|
||
KAIDI_DB_USERNAME "$DB_USERNAME" \
|
||
KAIDI_DB_PASSWORD "$DB_PASSWORD" \
|
||
KAIDI_MYSQLDUMP_BIN "${KAIDI_MYSQLDUMP_BIN:-}" \
|
||
KAIDI_DB_BACKUP_MODE "${KAIDI_DB_BACKUP_MODE:-skip}"
|
||
chmod 0600 "$CONFIG_ROOT/update.env"
|
||
|
||
install -m 0644 "$RELEASE_DIR/ops/kaidi-finance.service" /etc/systemd/system/kaidi-finance.service
|
||
install -m 0644 "$RELEASE_DIR/ops/kaidi-update.service" /etc/systemd/system/kaidi-update.service
|
||
install -m 0644 "$RELEASE_DIR/ops/kaidi-update.path" /etc/systemd/system/kaidi-update.path
|
||
restore_security_contexts
|
||
verify_service_access
|
||
systemd-analyze verify \
|
||
/etc/systemd/system/kaidi-finance.service \
|
||
/etc/systemd/system/kaidi-update.service \
|
||
/etc/systemd/system/kaidi-update.path >/dev/null \
|
||
|| die "Installed systemd units failed validation"
|
||
systemctl daemon-reload
|
||
systemctl reset-failed kaidi-finance.service >/dev/null 2>&1 || true
|
||
systemctl enable kaidi-finance.service
|
||
systemctl restart kaidi-finance.service
|
||
wait_for_health
|
||
curl -fsS "$APP_INDEX_URL" | grep -Eiq '<!doctype|<html' \
|
||
|| die "Application frontend entry point is unavailable"
|
||
|
||
if [ "$SETUP_WIZARD" != true ]; then
|
||
sed -i 's/^FINANCE_BOOTSTRAP_ENABLED="true"$/FINANCE_BOOTSTRAP_ENABLED="false"/' "$CONFIG_ROOT/kaidi.env"
|
||
sed -i 's/^FINANCE_BOOTSTRAP_PASSWORD=.*$/FINANCE_BOOTSTRAP_PASSWORD=""/' "$CONFIG_ROOT/kaidi.env"
|
||
fi
|
||
jq -n --arg version "$VERSION" --arg updatedAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
||
'{state:"CURRENT",message:"初始版本正在运行",targetVersion:$version,updatedAt:$updatedAt}' \
|
||
> "$UPDATE_STATE_ROOT/status.json"
|
||
chmod 0644 "$UPDATE_STATE_ROOT/status.json"
|
||
systemctl enable --now kaidi-update.path
|
||
|
||
if [ "$SETUP_WIZARD" = true ]; then
|
||
cat > /root/kaidi-first-login.txt <<EOF
|
||
反向代理访问地址：http://SERVER_IP/setup
|
||
反向代理目标：$PROXY_TARGET
|
||
安装码：$SETUP_CODE
|
||
版本：$VERSION
|
||
EOF
|
||
chmod 0600 /root/kaidi-first-login.txt
|
||
elif [ "$REINSTALL" != true ]; then
|
||
cat > /root/kaidi-first-login.txt <<EOF
|
||
反向代理访问地址：http://SERVER_IP/
|
||
反向代理目标：$PROXY_TARGET
|
||
管理员账号：admin
|
||
临时密码：$ADMIN_PASSWORD
|
||
版本：$VERSION
|
||
EOF
|
||
chmod 0600 /root/kaidi-first-login.txt
|
||
fi
|
||
INSTALL_COMMITTED=true
|
||
INSTALL_TRANSACTION_ARMED=false
|
||
|
||
log "Kaidi Finance $VERSION is installed"
|
||
if [ "$SETUP_WIZARD" = true ]; then
|
||
log "Configure your reverse proxy to $PROXY_TARGET"
|
||
log "Open /setup through your reverse-proxy domain and complete the first-run wizard"
|
||
log "Setup code: /root/kaidi-first-login.txt"
|
||
else
|
||
log "Configure your reverse proxy to $PROXY_TARGET"
|
||
log "Open the reverse-proxy domain and sign in as admin"
|
||
fi
|
||
if [ "$REINSTALL" != true ] && [ "$SETUP_WIZARD" != true ]; then
|
||
log "Temporary credentials: /root/kaidi-first-login.txt"
|
||
log "Change the temporary password immediately after first sign-in"
|
||
fi
|
||
}
|
||
|
||
main "$@"
|