awaioi/ERP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 8 Wiki Activity
Files
5d7112ce3143cba5b6937f126eae31332fdd2855
ERP/install.sh
T

655 lines
24 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
set -euo pipefail
GITEA_BASE_URL="${ERP_GITEA_BASE_URL:-https://git.awaioi.com}"
REPOSITORY="${ERP_UPDATE_REPOSITORY:-awaioi/ERP}"
REQUESTED_VERSION="${ERP_INSTALL_VERSION:-}"
INSTALL_ROOT="${ERP_INSTALL_ROOT:-}"
ALLOW_INSECURE="${ERP_UPDATE_ALLOW_INSECURE_HTTP:-0}"
NO_SERVICE="${ERP_INSTALL_NO_SERVICE:-0}"
TOKEN="${ERP_GITEA_TOKEN:-${OA_UPDATE_TOKEN:-}}"
PUBLIC_URL="${ERP_PUBLIC_URL:-}"
PUBLIC_KEY='-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAaErhcY8WZIZvPILmYnfjndVBAdOuWkvhaoHIWqNNdxI=
-----END PUBLIC KEY-----'
TMP_DIR=""
say() { printf '[ERP Install] %s\n' "$*"; }
fail() { printf '[ERP Install] ERROR: %s\n' "$*" >&2; exit 1; }
usage() {
cat <<'EOF'
Usage: install.sh [options]
--gitea-url URL Gitea public base URL (default: https://git.awaioi.com)
--repository O/R Release repository (default: awaioi/ERP)
--version VERSION Install one exact stable release
--install-root PATH Override installation directory
--public-url URL Public URL used for the one-time web setup link
--allow-insecure Development only: allow plain HTTP release URLs
--no-service Start without systemd/launchd; online update stays disabled
EOF
}
while [[ $# -gt 0 ]]; do
case "$1" in
--gitea-url) [[ $# -ge 2 ]] || fail '--gitea-url requires a value'; GITEA_BASE_URL="$2"; shift 2 ;;
--repository) [[ $# -ge 2 ]] || fail '--repository requires a value'; REPOSITORY="$2"; shift 2 ;;
--version) [[ $# -ge 2 ]] || fail '--version requires a value'; REQUESTED_VERSION="$2"; shift 2 ;;
--install-root) [[ $# -ge 2 ]] || fail '--install-root requires a value'; INSTALL_ROOT="$2"; shift 2 ;;
--public-url) [[ $# -ge 2 ]] || fail '--public-url requires a value'; PUBLIC_URL="$2"; shift 2 ;;
--allow-insecure) ALLOW_INSECURE=1; shift ;;
--no-service) NO_SERVICE=1; shift ;;
-h|--help) usage; exit 0 ;;
*) fail "unknown option: $1" ;;
esac
done
cleanup() {
if [[ -n "$TMP_DIR" && -d "$TMP_DIR" ]]; then
rm -rf "$TMP_DIR"
fi
}
trap cleanup EXIT
detect_platform() {
case "$(uname -s)" in
Linux) PLATFORM=linux ;;
Darwin) PLATFORM=darwin ;;
*) fail "unsupported operating system: $(uname -s)" ;;
esac
case "$(uname -m)" in
x86_64|amd64) ARCH=amd64 ;;
arm64|aarch64) ARCH=arm64 ;;
*) fail "unsupported CPU architecture: $(uname -m); 32-bit systems are not supported" ;;
esac
if [[ "$PLATFORM" == "linux" && "$(id -u)" != "0" ]]; then
fail 'Linux installation requires root; use: curl ... | sudo -E bash'
fi
}
validate_service_manager() {
[[ "$PLATFORM" != "linux" || "$NO_SERVICE" == "1" ]] && return 0
command -v systemctl >/dev/null 2>&1 \
|| fail 'systemd is required for a production Linux install; use --no-service only for development'
[[ -d /run/systemd/system ]] \
|| fail 'systemd is not running on this Linux host; use --no-service only for development'
}
java_major() {
local java_bin="${1:-java}"
"$java_bin" -version 2>&1 | awk -F'[".]' '/version/ {print $2; exit}'
}
has_java_17() {
command -v java >/dev/null 2>&1 || return 1
local major
major="$(java_major "$(command -v java)")"
[[ "$major" =~ ^[0-9]+$ && "$major" -ge 17 ]]
}
has_openssl_3_ed25519() {
command -v openssl >/dev/null 2>&1 || return 1
local version algorithms
version="$(openssl version 2>/dev/null || true)"
[[ "$version" =~ ^OpenSSL[[:space:]]3\. ]] || return 1
algorithms="$(openssl list -public-key-algorithms 2>/dev/null || true)"
grep -qi ED25519 <<< "$algorithms"
}
install_linux_dependencies() {
local need_java="$1"
local packages=(ca-certificates)
command -v curl >/dev/null 2>&1 || packages+=(curl)
command -v tar >/dev/null 2>&1 || packages+=(tar)
command -v python3 >/dev/null 2>&1 || packages+=(python3)
has_openssl_3_ed25519 || packages+=(openssl)
if command -v apt-get >/dev/null 2>&1; then
[[ "$need_java" == "0" ]] || packages+=(openjdk-17-jre-headless)
say 'Installing missing runtime packages with apt-get...'
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y "${packages[@]}"
elif command -v dnf >/dev/null 2>&1; then
[[ "$need_java" == "0" ]] || packages+=(java-17-openjdk-headless)
say 'Installing missing runtime packages with dnf...'
dnf install -y "${packages[@]}"
elif command -v yum >/dev/null 2>&1; then
[[ "$need_java" == "0" ]] || packages+=(java-17-openjdk-headless)
say 'Installing missing runtime packages with yum...'
yum install -y "${packages[@]}"
elif command -v zypper >/dev/null 2>&1; then
[[ "$need_java" == "0" ]] || packages+=(java-17-openjdk-headless)
say 'Installing missing runtime packages with zypper...'
zypper --non-interactive install "${packages[@]}"
else
fail 'no supported package manager found (apt-get, dnf, yum, or zypper is required)'
fi
}
install_macos_dependencies() {
command -v brew >/dev/null 2>&1 || fail 'Homebrew is required to install missing macOS packages'
local packages=()
has_java_17 || packages+=(openjdk@17)
command -v python3 >/dev/null 2>&1 || packages+=(python@3)
has_openssl_3_ed25519 || packages+=(openssl@3)
if (( ${#packages[@]} > 0 )); then
say 'Installing missing runtime packages with Homebrew...'
brew install "${packages[@]}"
fi
local java_prefix openssl_prefix
java_prefix="$(brew --prefix openjdk@17 2>/dev/null || true)"
openssl_prefix="$(brew --prefix openssl@3 2>/dev/null || true)"
[[ -z "$java_prefix" ]] || export PATH="$java_prefix/bin:$PATH"
[[ -z "$openssl_prefix" ]] || export PATH="$openssl_prefix/bin:$PATH"
}
check_and_install_dependencies() {
local need_install=0 need_java=0
has_java_17 || { need_install=1; need_java=1; }
command -v curl >/dev/null 2>&1 || need_install=1
command -v tar >/dev/null 2>&1 || need_install=1
command -v python3 >/dev/null 2>&1 || need_install=1
has_openssl_3_ed25519 || need_install=1
if [[ "$need_install" == "1" ]]; then
if [[ "$PLATFORM" == "linux" ]]; then
install_linux_dependencies "$need_java"
else
install_macos_dependencies
fi
fi
for command in curl tar python3 openssl java; do
command -v "$command" >/dev/null 2>&1 || fail "missing command after installation: $command"
done
has_java_17 || fail 'Java 17 or newer is required and could not be installed'
has_openssl_3_ed25519 || fail 'OpenSSL 3 with Ed25519 support is required and could not be installed'
JAVA_BIN="$(command -v java)"
say "Using Java $(java_major "$JAVA_BIN") at $JAVA_BIN"
}
validate_download_url() {
case "$1" in
https://*) return 0 ;;
http://*) [[ "$ALLOW_INSECURE" == "1" || "$ALLOW_INSECURE" == "true" ]] && return 0 ;;
esac
fail 'release server must use HTTPS (use --allow-insecure only for an isolated test server)'
}
create_curl_config() {
CURL_CONFIG="$TMP_DIR/curl.conf"
{
printf 'silent\nshow-error\nfail\nlocation\nconnect-timeout = 15\nmax-time = 900\n'
if [[ "$ALLOW_INSECURE" == "1" || "$ALLOW_INSECURE" == "true" ]]; then
printf 'proto = "=http,https"\nproto-redir = "=http,https"\n'
else
printf 'proto = "=https"\nproto-redir = "=https"\n'
fi
if [[ -n "$TOKEN" ]]; then
[[ "$TOKEN" =~ ^[A-Za-z0-9._-]+$ ]] || fail 'invalid Gitea token format'
printf 'header = "Authorization: token %s"\n' "$TOKEN"
fi
} > "$CURL_CONFIG"
chmod 600 "$CURL_CONFIG"
}
download() {
validate_download_url "$1"
curl --config "$CURL_CONFIG" --output "$2" "$1"
}
download_release() {
[[ "$REPOSITORY" =~ ^[^/[:space:]]+/[^/[:space:]]+$ ]] || fail 'invalid Gitea repository'
local owner="${REPOSITORY%%/*}" repo="${REPOSITORY#*/}"
local release_json="$TMP_DIR/release.json"
download "${GITEA_BASE_URL%/}/api/v1/repos/$owner/$repo/releases/latest" "$release_json" \
|| fail 'unable to read the latest Gitea Release'
local selection="$TMP_DIR/selection" selection_error="$TMP_DIR/selection-error"
if ! python3 - "$release_json" "$REQUESTED_VERSION" > "$selection" 2> "$selection_error" <<'PY'
import json, re, sys
try:
with open(sys.argv[1], encoding="utf-8") as handle:
release = json.load(handle)
except (OSError, json.JSONDecodeError):
raise SystemExit("invalid release JSON")
tag = str(release.get("tag_name") or "").strip()
match = re.fullmatch(r"v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)", tag)
if not match or release.get("draft") or release.get("prerelease"):
raise SystemExit("invalid stable release")
version = match.group(1)
if "-" in version.split("+", 1)[0]:
raise SystemExit("prerelease rejected by stable installer")
requested = sys.argv[2].removeprefix("v")
if requested and requested != version:
raise SystemExit("requested version does not match latest release")
assets = {str(a.get("name")): str(a.get("browser_download_url") or "") for a in release.get("assets", [])}
names = [
f"kaidi-erp-{version}.tar.gz",
f"kaidi-erp-installer-{version}.jar",
"SHA256SUMS",
"SHA256SUMS.sig",
]
urls = [assets.get(name, "") for name in names]
if any(not url or any(ch.isspace() for ch in url) for url in urls):
raise SystemExit("release assets missing")
print("\t".join([version, *urls]))
PY
then
local reason="invalid Release metadata"
[[ ! -s "$selection_error" ]] || reason="$(<"$selection_error")"
fail "$reason"
fi
local archive_url installer_url sums_url signature_url
IFS=$'\t' read -r VERSION archive_url installer_url sums_url signature_url < "$selection"
ARCHIVE_NAME="kaidi-erp-${VERSION}.tar.gz"
INSTALLER_NAME="kaidi-erp-installer-${VERSION}.jar"
ARCHIVE_PATH="$TMP_DIR/$ARCHIVE_NAME"
INSTALLER_PATH="$TMP_DIR/$INSTALLER_NAME"
download "$archive_url" "$ARCHIVE_PATH"
download "$installer_url" "$INSTALLER_PATH"
download "$sums_url" "$TMP_DIR/SHA256SUMS"
download "$signature_url" "$TMP_DIR/SHA256SUMS.sig"
}
checksum_for() {
python3 - "$TMP_DIR/SHA256SUMS" "$1" <<'PY'
import re, sys
for line in open(sys.argv[1], encoding="utf-8"):
match = re.fullmatch(r"([0-9a-fA-F]{64})\s+\*?(.+?)\s*", line)
if match and match.group(2) == sys.argv[2]:
print(match.group(1).lower())
break
PY
}
actual_checksum() {
if command -v sha256sum >/dev/null 2>&1; then
sha256sum "$1" | awk '{print $1}'
else
shasum -a 256 "$1" | awk '{print $1}'
fi
}
verify_release() {
printf '%s\n' "$PUBLIC_KEY" > "$TMP_DIR/release-public-key.pem"
openssl pkeyutl -verify -rawin -pubin -inkey "$TMP_DIR/release-public-key.pem" \
-sigfile "$TMP_DIR/SHA256SUMS.sig" -in "$TMP_DIR/SHA256SUMS" >/dev/null \
|| fail 'Release Ed25519 signature verification failed'
local name path expected actual
for name in "$ARCHIVE_NAME" "$INSTALLER_NAME"; do
if [[ "$name" == "$ARCHIVE_NAME" ]]; then path="$ARCHIVE_PATH"; else path="$INSTALLER_PATH"; fi
expected="$(checksum_for "$name")"
[[ "$expected" =~ ^[0-9a-f]{64}$ ]] || fail "release checksum is missing for $name"
actual="$(actual_checksum "$path")"
[[ "$actual" == "$expected" ]] || fail "release checksum verification failed for $name"
done
python3 - "$ARCHIVE_PATH" <<'PY'
import pathlib, sys, tarfile
with tarfile.open(sys.argv[1], "r:gz") as archive:
for item in archive.getmembers():
path = pathlib.PurePosixPath(item.name)
if path.is_absolute() or ".." in path.parts or item.issym() or item.islnk():
raise SystemExit(f"unsafe archive member: {item.name}")
PY
}
shell_setting() {
printf '%s=' "$1"
printf '%q\n' "$2"
}
prepare_layout() {
if [[ "$PLATFORM" == "linux" ]]; then
ERP_USER="${ERP_SERVICE_USER:-kaidi-erp}"
[[ "$ERP_USER" =~ ^[a-z_][a-z0-9_-]*[$]?$ ]] || fail 'invalid Linux service user name'
id "$ERP_USER" >/dev/null 2>&1 \
|| useradd --system --home-dir "$INSTALL_ROOT" --shell /usr/sbin/nologin "$ERP_USER"
ERP_GROUP="$(id -gn "$ERP_USER" 2>/dev/null)" \
|| fail "unable to resolve the primary group for Linux service user: $ERP_USER"
CONFIG_ROOT="${ERP_CONFIG_ROOT:-/etc/kaidi-erp}"
STATE_ROOT="${ERP_STATE_ROOT:-/var/lib/kaidi-erp}"
LOG_ROOT="${ERP_LOG_ROOT:-/var/log/kaidi-erp}"
local path
for path in "$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT"; do
[[ "$path" =~ ^/[A-Za-z0-9._/@:+-]+$ ]] \
|| fail "Linux installation paths must be absolute and contain only safe characters: $path"
done
else
ERP_USER="$(id -un)"
ERP_GROUP="$(id -gn)"
CONFIG_ROOT="${ERP_CONFIG_ROOT:-$INSTALL_ROOT/config}"
STATE_ROOT="${ERP_STATE_ROOT:-$INSTALL_ROOT/state}"
LOG_ROOT="${ERP_LOG_ROOT:-$HOME/Library/Logs/KaidiERP}"
fi
mkdir -p "$INSTALL_ROOT/releases" "$INSTALL_ROOT/installer" "$INSTALL_ROOT/run" \
"$INSTALL_ROOT/backups" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT"
if [[ "$PLATFORM" == "linux" ]]; then
chown -R "$ERP_USER:$ERP_GROUP" "$INSTALL_ROOT" "$CONFIG_ROOT" "$STATE_ROOT" "$LOG_ROOT"
chmod 750 "$CONFIG_ROOT" "$STATE_ROOT"
fi
[[ ! -e "$STATE_ROOT/install.lock" ]] || fail 'Kaidi ERP is already installed; use the system update page'
[[ ! -e "$STATE_ROOT/install.pending" ]] || fail 'a previous installation is still pending; inspect the service before retrying'
}
install_release_files() {
local unpack="$TMP_DIR/unpack"
mkdir -p "$unpack"
tar -xzf "$ARCHIVE_PATH" -C "$unpack"
local source="$unpack/kaidi-erp-${VERSION}"
[[ -r "$source/app/kaidi-erp.jar" && -x "$source/bin/erp-run" && -x "$source/bin/erp-update" ]] \
|| fail 'release archive is incomplete'
[[ -r "$source/VERSION" && "$(<"$source/VERSION")" == "$VERSION" ]] \
|| fail 'release archive version mismatch'
local destination="$INSTALL_ROOT/releases/$VERSION" replaced=""
if [[ -e "$destination" ]]; then
replaced="${destination}.replaced-$$"
mv "$destination" "$replaced"
fi
if ! mv "$source" "$destination"; then
[[ -z "$replaced" || ! -e "$replaced" ]] || mv "$replaced" "$destination"
fail 'unable to write the release directory'
fi
[[ -z "$replaced" ]] || rm -rf "$replaced"
local installer_tmp="$INSTALL_ROOT/installer/.kaidi-erp-installer.jar.tmp-$$"
cp "$INSTALLER_PATH" "$installer_tmp"
chmod 600 "$installer_tmp"
mv "$installer_tmp" "$INSTALL_ROOT/installer/kaidi-erp-installer.jar"
python3 - "$INSTALL_ROOT/current" "releases/$VERSION" <<'PY'
import os, sys
link, target = sys.argv[1:]
temporary = f"{link}.new-{os.getpid()}"
try:
os.symlink(target, temporary)
os.replace(temporary, link)
finally:
if os.path.lexists(temporary):
os.unlink(temporary)
PY
if [[ "$PLATFORM" == "linux" ]]; then
chown -R "$ERP_USER:$ERP_GROUP" "$destination" "$INSTALL_ROOT/installer" "$INSTALL_ROOT/current"
fi
}
write_bootstrap_configuration() {
CONFIG_FILE="$CONFIG_ROOT/erp.env"
PUBLIC_KEY_FILE="$CONFIG_ROOT/release-public-key.pem"
PENDING_FILE="$STATE_ROOT/install.pending"
INSTALL_LOCK_FILE="$STATE_ROOT/install.lock"
OPERATION_LOCK_FILE="$STATE_ROOT/install-operation.lock"
SETUP_TOKEN="$(openssl rand -hex 32)" || fail 'unable to generate the one-time setup token'
local update_enabled=true port="${ERP_SERVER_PORT:-8091}"
[[ "$NO_SERVICE" != "1" ]] || update_enabled=false
printf '%s\n' "$PUBLIC_KEY" > "$PUBLIC_KEY_FILE"
{
shell_setting ERP_INSTALL_ROOT "$INSTALL_ROOT"
shell_setting ERP_CONFIG_FILE "$CONFIG_FILE"
shell_setting ERP_RUN_DIR "$INSTALL_ROOT/run"
shell_setting ERP_STATE_FILE "$STATE_ROOT/update-state.json"
shell_setting ERP_INSTALL_PENDING_FILE "$PENDING_FILE"
shell_setting ERP_INSTALL_LOCK_FILE "$INSTALL_LOCK_FILE"
shell_setting ERP_INSTALL_OPERATION_LOCK_FILE "$OPERATION_LOCK_FILE"
shell_setting ERP_INSTALL_LOG_FILE "$STATE_ROOT/install-formal.log"
shell_setting ERP_INSTALL_HEALTH_TIMEOUT_SECONDS "${ERP_INSTALL_HEALTH_TIMEOUT_SECONDS:-240}"
shell_setting ERP_SETUP_TOKEN "$SETUP_TOKEN"
shell_setting ERP_INSTALLER_JAR "$INSTALL_ROOT/installer/kaidi-erp-installer.jar"
shell_setting ERP_JAR_PATH "$INSTALL_ROOT/current/app/kaidi-erp.jar"
shell_setting ERP_JAVA_BIN "$JAVA_BIN"
shell_setting ERP_RELEASE_VERSION "$VERSION"
shell_setting ERP_HEALTH_URL "http://127.0.0.1:${port}/api/oa/health"
shell_setting ERP_UPDATE_PUBLIC_KEY_FILE "$PUBLIC_KEY_FILE"
shell_setting ERP_UPDATE_REQUIRE_SIGNATURE true
shell_setting ERP_UPDATE_BACKUP_MODE "${ERP_UPDATE_BACKUP_MODE:-none}"
shell_setting ERP_UPDATE_HEALTH_TIMEOUT_SECONDS "${ERP_UPDATE_HEALTH_TIMEOUT_SECONDS:-120}"
shell_setting ERP_UPDATE_HEALTH_POLL_SECONDS "${ERP_UPDATE_HEALTH_POLL_SECONDS:-2}"
shell_setting SERVER_PORT "$port"
shell_setting OA_UPDATE_ENABLED "$update_enabled"
shell_setting OA_UPDATE_GITEA_BASE_URL "$GITEA_BASE_URL"
shell_setting OA_UPDATE_REPOSITORY "$REPOSITORY"
shell_setting OA_UPDATE_CHANNEL stable
shell_setting OA_UPDATE_TOKEN "$TOKEN"
shell_setting OA_UPDATE_HELPER_COMMAND "$INSTALL_ROOT/current/bin/erp-update"
shell_setting OA_UPDATE_STATE_FILE "$STATE_ROOT/update-state.json"
shell_setting OA_UPDATE_ALLOW_INSECURE_HTTP "$ALLOW_INSECURE"
} > "$CONFIG_FILE"
if [[ "$PLATFORM" == "linux" ]]; then
chown "$ERP_USER:$ERP_GROUP" "$CONFIG_FILE" "$PUBLIC_KEY_FILE"
fi
chmod 600 "$CONFIG_FILE" "$PUBLIC_KEY_FILE"
}
start_service() {
if [[ "$NO_SERVICE" == "1" ]]; then
nohup env ERP_INSTALL_ROOT="$INSTALL_ROOT" ERP_CONFIG_FILE="$CONFIG_FILE" \
"$INSTALL_ROOT/current/bin/erp-run" >> "$LOG_ROOT/erp.log" 2>> "$LOG_ROOT/erp-error.log" &
printf '%s\n' "$!" > "$INSTALL_ROOT/run/launcher.pid"
return 0
fi
if [[ "$PLATFORM" == "linux" ]]; then
# The updater shares this service cgroup and must outlive the Java process
# to verify the restarted release and roll back a failed health check.
cat > /etc/systemd/system/kaidi-erp.service <<EOF
[Unit]
Description=Kaidi ERP
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
KillMode=process
User=$ERP_USER
Group=$ERP_GROUP
Environment="ERP_INSTALL_ROOT=$INSTALL_ROOT"
Environment="ERP_CONFIG_FILE=$CONFIG_FILE"
WorkingDirectory=$INSTALL_ROOT
ExecStart=$INSTALL_ROOT/current/bin/erp-run
Restart=always
RestartSec=3
TimeoutStopSec=90
SuccessExitStatus=143
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=true
ReadWritePaths=$INSTALL_ROOT $CONFIG_ROOT $STATE_ROOT $LOG_ROOT
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
if command -v systemd-analyze >/dev/null 2>&1; then
systemd-analyze verify /etc/systemd/system/kaidi-erp.service \
|| fail 'generated systemd unit is invalid; run systemd-analyze verify /etc/systemd/system/kaidi-erp.service'
fi
systemctl enable kaidi-erp.service
systemctl restart kaidi-erp.service
else
local agents="$HOME/Library/LaunchAgents" plist="$HOME/Library/LaunchAgents/com.kaidi.erp.plist"
mkdir -p "$agents"
python3 - "$plist" "$INSTALL_ROOT" "$CONFIG_FILE" "$LOG_ROOT" <<'PY'
import plistlib, sys
path, root, config, logs = sys.argv[1:]
payload = {
"Label": "com.kaidi.erp",
"ProgramArguments": [f"{root}/current/bin/erp-run"],
"EnvironmentVariables": {"ERP_INSTALL_ROOT": root, "ERP_CONFIG_FILE": config},
"WorkingDirectory": root,
"RunAtLoad": True,
"KeepAlive": True,
"ThrottleInterval": 3,
"StandardOutPath": f"{logs}/erp.log",
"StandardErrorPath": f"{logs}/erp-error.log",
}
with open(path, "wb") as handle:
plistlib.dump(payload, handle)
PY
launchctl bootout "gui/$(id -u)/com.kaidi.erp" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$plist"
fi
}
wait_for_installer() {
local url="http://127.0.0.1:${ERP_SERVER_PORT:-8091}/api/install/status"
local deadline=$((SECONDS + 120))
while (( SECONDS < deadline )); do
if curl -fsS --connect-timeout 2 --max-time 5 \
-H "X-Setup-Token: $SETUP_TOKEN" "$url" >/dev/null 2>&1; then
return 0
fi
sleep 2
done
fail 'the web installer did not start within 120 seconds; inspect the kaidi-erp service log'
}
detect_lan_address() {
local address=""
if command -v hostname >/dev/null 2>&1; then
address="$(hostname -I 2>/dev/null | awk '{for (i=1; i<=NF; i++) if ($i ~ /^[0-9]+\./) {print $i; exit}}' || true)"
fi
if [[ -z "$address" && "$PLATFORM" == "linux" ]] && command -v ip >/dev/null 2>&1; then
address="$(ip route get 1.1.1.1 2>/dev/null | awk '/src/ {for (i=1; i<=NF; i++) if ($i=="src") {print $(i+1); exit}}' || true)"
fi
if [[ -z "$address" && "$PLATFORM" == "darwin" ]] && command -v ipconfig >/dev/null 2>&1; then
address="$(ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null || true)"
fi
printf '%s' "${address:-127.0.0.1}"
}
is_ip_address() {
python3 - "$1" <<'PY' >/dev/null 2>&1
import ipaddress, sys
ipaddress.ip_address(sys.argv[1])
PY
}
detect_public_address() {
local endpoint address
for endpoint in \
https://api.ipify.org \
https://ifconfig.me/ip \
https://icanhazip.com; do
address="$(curl --silent --show-error --fail --location \
--proto '=https' --proto-redir '=https' \
--connect-timeout 3 --max-time 5 "$endpoint" 2>/dev/null \
| tr -d '[:space:]' | head -c 128 || true)"
if [[ -n "$address" ]] && is_ip_address "$address"; then
printf '%s' "$address"
return 0
fi
done
return 1
}
normalize_public_url() {
python3 - "$1" <<'PY'
import sys
from urllib.parse import urlsplit, urlunsplit
value = sys.argv[1].strip()
try:
parsed = urlsplit(value)
port = parsed.port
except ValueError:
raise SystemExit("invalid public URL")
if parsed.scheme.lower() not in {"http", "https"} or not parsed.hostname:
raise SystemExit("public URL must use http or https")
if parsed.username is not None or parsed.password is not None:
raise SystemExit("public URL must not contain credentials")
if port is not None and not 1 <= port <= 65535:
raise SystemExit("invalid public URL port")
path = parsed.path or "/"
print(urlunsplit((parsed.scheme.lower(), parsed.netloc, path, parsed.query, parsed.fragment)))
PY
}
ip_setup_base_url() {
python3 - "$1" "$2" <<'PY'
import ipaddress, sys
address = ipaddress.ip_address(sys.argv[1])
host = f"[{address}]" if address.version == 6 else str(address)
print(f"http://{host}:{int(sys.argv[2])}/")
PY
}
append_setup_token() {
python3 - "$1" "$2" <<'PY'
import sys
from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
parsed = urlsplit(sys.argv[1])
query = [(key, value) for key, value in parse_qsl(parsed.query, keep_blank_values=True) if key != "token"]
query.append(("token", sys.argv[2]))
print(urlunsplit((parsed.scheme, parsed.netloc, parsed.path or "/", urlencode(query), parsed.fragment)))
PY
}
main() {
detect_platform
validate_service_manager
if [[ -z "$INSTALL_ROOT" ]]; then
if [[ "$PLATFORM" == "linux" ]]; then
INSTALL_ROOT=/opt/kaidi-erp
else
INSTALL_ROOT="$HOME/Library/Application Support/KaidiERP"
fi
fi
[[ -n "$GITEA_BASE_URL" ]] || fail 'Gitea URL is required; use --gitea-url or ERP_GITEA_BASE_URL'
validate_download_url "$GITEA_BASE_URL"
if [[ -n "$PUBLIC_URL" ]]; then
case "$PUBLIC_URL" in
http://*|https://*) ;;
*) fail 'public URL must start with http:// or https://' ;;
esac
fi
say "Detected $PLATFORM/$ARCH"
check_and_install_dependencies
if [[ -n "$PUBLIC_URL" ]]; then
PUBLIC_URL="$(normalize_public_url "$PUBLIC_URL")" || fail 'invalid public URL'
fi
TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/kaidi-erp-install.XXXXXX")"
create_curl_config
say 'Downloading and verifying the signed release...'
download_release
verify_release
prepare_layout
install_release_files
write_bootstrap_configuration
start_service
wait_for_installer
local port="${ERP_SERVER_PORT:-8091}" lan_address public_address setup_base local_base lan_base
lan_address="$(detect_lan_address)"
local_base="http://127.0.0.1:${port}/"
lan_base="$(ip_setup_base_url "$lan_address" "$port")"
if [[ -n "$PUBLIC_URL" ]]; then
setup_base="$PUBLIC_URL"
elif public_address="$(detect_public_address)"; then
setup_base="$(ip_setup_base_url "$public_address" "$port")"
else
setup_base="$lan_base"
say 'Public IP detection was unavailable; using the LAN address'
fi
say "Kaidi ERP $VERSION installer is running"
say "Setup URL: $(append_setup_token "$setup_base" "$SETUP_TOKEN")"
say "Local URL: $(append_setup_token "$local_base" "$SETUP_TOKEN")"
if [[ "$lan_address" != "127.0.0.1" && "$lan_base" != "$setup_base" ]]; then
say "LAN URL: $(append_setup_token "$lan_base" "$SETUP_TOKEN")"
fi
say 'Complete PostgreSQL and administrator setup in the browser. The installer will remove itself after the formal service is healthy.'
}
if [[ "${BASH_SOURCE[0]:-$0}" == "$0" ]]; then
main "$@"
fi
Reference in New Issue View Git Blame Copy Permalink