Logan.LiandClaude
327e282356
前端: - src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector) - 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用 - index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲) 后端分层增强(保留包名): - 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave) - 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验) - 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突) - models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors) v2 优化移植与缺陷修复: - 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固 - 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷 - 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown) - 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐 - 补 crypto/jwt/repository 单元测试(含并发写回归) 验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过 Co-Authored-By: Claude <noreply@anthropic.com>
98 lines
3.5 KiB
Bash
Executable File
98 lines
3.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# ============================================================
|
|
# LokiDeploy Secure Entrypoint
|
|
# ============================================================
|
|
# Enforces required secrets at container startup
|
|
# Supports Docker Secrets file-based injection
|
|
# ============================================================
|
|
set -e
|
|
|
|
# ---- Docker Secrets support ----
|
|
# If *_FILE is provided, read the secret from that file path
|
|
# (Docker Swarm / Docker Compose secrets)
|
|
if [ -n "${JWT_SECRET_FILE:-}" ] && [ -r "$JWT_SECRET_FILE" ]; then
|
|
JWT_SECRET=$(cat "$JWT_SECRET_FILE")
|
|
export JWT_SECRET
|
|
fi
|
|
|
|
if [ -n "${ENCRYPTION_KEY_FILE:-}" ] && [ -r "$ENCRYPTION_KEY_FILE" ]; then
|
|
ENCRYPTION_KEY=$(cat "$ENCRYPTION_KEY_FILE")
|
|
export ENCRYPTION_KEY
|
|
fi
|
|
|
|
# ---- Runtime security validation ----
|
|
MISSING_VARS=()
|
|
|
|
# P0: JWT_SECRET must be provided at runtime
|
|
if [ -z "${JWT_SECRET:-}" ]; then
|
|
MISSING_VARS+=("JWT_SECRET")
|
|
fi
|
|
|
|
# P0: ENCRYPTION_KEY must be provided at runtime for AES credential encryption
|
|
if [ -z "${ENCRYPTION_KEY:-}" ]; then
|
|
MISSING_VARS+=("ENCRYPTION_KEY")
|
|
fi
|
|
|
|
if [ ${#MISSING_VARS[@]} -ne 0 ]; then
|
|
echo "============================================================" >&2
|
|
echo "FATAL: Missing required security environment variables" >&2
|
|
echo "============================================================" >&2
|
|
for var in "${MISSING_VARS[@]}"; do
|
|
echo " - $var" >&2
|
|
done
|
|
echo "" >&2
|
|
echo "These MUST be provided at runtime. Examples:" >&2
|
|
echo "" >&2
|
|
echo ' docker run -e JWT_SECRET="$(openssl rand -hex 32)" -e ENCRYPTION_KEY="$(openssl rand -hex 32)" lokideploy' >&2
|
|
echo "" >&2
|
|
echo "Or via docker-compose secrets (recommended for production):" >&2
|
|
echo ' secrets:' >&2
|
|
echo ' - jwt_secret' >&2
|
|
echo ' - encryption_key' >&2
|
|
echo ' environment:' >&2
|
|
echo ' JWT_SECRET_FILE: /run/secrets/jwt_secret' >&2
|
|
echo ' ENCRYPTION_KEY_FILE: /run/secrets/encryption_key' >&2
|
|
echo "============================================================" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# ---- Validate JWT_SECRET strength ----
|
|
SECRET_LEN=${#JWT_SECRET}
|
|
if [ "$SECRET_LEN" -lt 32 ]; then
|
|
echo "WARNING: JWT_SECRET should be at least 32 characters long (current: $SECRET_LEN)" >&2
|
|
echo " Generate with: openssl rand -hex 32" >&2
|
|
fi
|
|
|
|
# ---- Validate ENCRYPTION_KEY strength ----
|
|
# config.go 在 ENCRYPTION_KEY < 32 字符时会 log.Fatal 拒绝启动；
|
|
# 此处前置硬校验，避免容器进入"entrypoint 通过但 Go 进程崩溃"的死循环。
|
|
KEY_LEN=${#ENCRYPTION_KEY}
|
|
if [ "$KEY_LEN" -lt 32 ]; then
|
|
echo "============================================================" >&2
|
|
echo "FATAL: ENCRYPTION_KEY must be at least 32 characters (current: $KEY_LEN)" >&2
|
|
echo " Generate with: openssl rand -hex 32" >&2
|
|
echo "============================================================" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# ---- Signal handling for graceful shutdown ----
|
|
# Forward signals to the application
|
|
shutdown() {
|
|
echo "Entrypoint received shutdown signal, forwarding to application..."
|
|
kill -TERM "$child" 2>/dev/null || true
|
|
wait "$child" 2>/dev/null || true
|
|
exit 0
|
|
}
|
|
trap shutdown SIGTERM SIGINT
|
|
|
|
echo "LokiDeploy starting with security configuration OK"
|
|
echo "Data directory: ${DATA_DIR}"
|
|
echo "Server port: ${SERVER_PORT}"
|
|
|
|
# ---- Start the main application ----
|
|
# Use exec to properly forward signals, but wrap with background + wait
|
|
# so this script's trap handler can intercept signals
|
|
"$@" &
|
|
child=$!
|
|
wait "$child"
|