Wanja Krah
525e9f9335
All checks were successful
Build, test and publish / verify (push) Successful in 6m34s
39 lines
1.6 KiB
Bash
39 lines
1.6 KiB
Bash
#!/bin/sh
|
|
# Account-level provisioning. Docker sudo must already be enabled separately.
|
|
set -eu
|
|
umask 077
|
|
root=$1
|
|
registry_user=$2
|
|
registry=$3
|
|
bind=$4
|
|
port=$5
|
|
docker=/usr/local/bin/docker
|
|
test -x "$docker"
|
|
sudo -n "$docker" compose version
|
|
sudo -n "$docker" info --format '{{.OSType}}/{{.Architecture}}'
|
|
test ! -L "$root"
|
|
mkdir -p "$root" "$root/docker-auth"
|
|
chmod 700 "$root" "$root/docker-auth"
|
|
if [ ! -f "$root/production.env" ]; then
|
|
# First provisioning must not take a port already occupied by another service.
|
|
command -v netstat >/dev/null
|
|
if netstat -lnt | awk -v port=":$port" '$4 ~ (port "$") { found=1 } END { exit !found }'; then
|
|
echo 'Frontend port is already occupied; production configuration unchanged' >&2
|
|
exit 1
|
|
fi
|
|
printf 'BIND_IP=%s\nFRONTEND_PORT=%s\nDOCKER_BIN=%s\nDOCKER_SUDO=1\nDOCKER_CONFIG=%s/docker-auth\n' \
|
|
"$bind" "$port" "$docker" "$root" > "$root/production.env"
|
|
chmod 600 "$root/production.env"
|
|
else
|
|
# Preserve existing config; refuse to silently rebind a configured deployment.
|
|
. "$root/production.env"
|
|
test "$BIND_IP" = "$bind" && test "$FRONTEND_PORT" = "$port" \
|
|
&& test "$DOCKER_CONFIG" = "$root/docker-auth" || {
|
|
echo 'Existing production.env differs; review it before provisioning' >&2
|
|
exit 1
|
|
}
|
|
fi
|
|
# Credential enters only via stdin. No password, environment or auth config is logged.
|
|
sudo -n "$docker" --config "$root/docker-auth" login "$registry" --username "$registry_user" --password-stdin
|
|
echo 'Production directory and dedicated registry login prepared; no containers were changed.'
|