mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-23 16:01:01 +00:00
114 lines
3.4 KiB
Bash
Executable File
114 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
|
|
ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
|
|
|
|
read_env_value() {
|
|
local key="$1"
|
|
[[ -f "$ENV_FILE" ]] || return 0
|
|
local value
|
|
value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
|
|
case "$value" in
|
|
\"*\") value="${value#\"}"; value="${value%\"}" ;;
|
|
\'*\') value="${value#\'}"; value="${value%\'}" ;;
|
|
esac
|
|
printf '%s\n' "$value"
|
|
}
|
|
|
|
configured_value() {
|
|
local key="$1"
|
|
local default_value="$2"
|
|
local value="${!key:-}"
|
|
if [[ -z "$value" ]]; then
|
|
value="$(read_env_value "$key")"
|
|
fi
|
|
printf '%s\n' "${value:-$default_value}"
|
|
}
|
|
|
|
prepare_data_dir() {
|
|
local raw path secrets_file temp_file jwt_secret totp_key
|
|
raw="$(configured_value APP_DATA_DIR ./data)"
|
|
|
|
[[ -n "$raw" ]] || {
|
|
printf '%s\n' 'APP_DATA_DIR must not be empty' >&2
|
|
exit 1
|
|
}
|
|
if [[ "$raw" = /* ]]; then
|
|
printf '%s\n' 'APP_DATA_DIR must be relative to the application version directory' >&2
|
|
exit 1
|
|
fi
|
|
|
|
path="$(realpath -m -- "$ROOT_DIR/${raw#./}")"
|
|
case "$path" in
|
|
"$ROOT_DIR"/*) ;;
|
|
*)
|
|
printf '%s\n' 'APP_DATA_DIR must remain inside the application version directory' >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
install -d -m 0750 "$path"
|
|
path="$(realpath -e -- "$path")"
|
|
case "$path" in
|
|
"$ROOT_DIR"/*) ;;
|
|
*)
|
|
printf '%s\n' 'APP_DATA_DIR resolves outside the application version directory' >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
chmod 0750 "$path"
|
|
chown -R --no-dereference 1000:1000 "$path"
|
|
|
|
secrets_file="$path/.leafwiki-secrets.env"
|
|
if [[ -L "$secrets_file" ]]; then
|
|
printf '%s\n' 'LeafWiki secrets file must not be a symbolic link' >&2
|
|
exit 1
|
|
fi
|
|
if [[ ! -e "$secrets_file" ]]; then
|
|
umask 077
|
|
jwt_secret="$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')"
|
|
totp_key="$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')"
|
|
[[ ${#jwt_secret} -eq 64 && ${#totp_key} -eq 64 ]] || {
|
|
printf '%s\n' 'Failed to generate LeafWiki secrets' >&2
|
|
exit 1
|
|
}
|
|
temp_file="$(mktemp "$path/.leafwiki-secrets.env.tmp.XXXXXX")"
|
|
trap 'rm -f -- "${temp_file:-}"' EXIT
|
|
printf 'LEAFWIKI_JWT_SECRET=%s\nLEAFWIKI_TOTP_ENCRYPTION_KEY=%s\n' \
|
|
"$jwt_secret" "$totp_key" >"$temp_file"
|
|
chmod 0600 "$temp_file"
|
|
chown 1000:1000 "$temp_file"
|
|
mv -f -- "$temp_file" "$secrets_file"
|
|
trap - EXIT
|
|
fi
|
|
[[ -f "$secrets_file" ]] || {
|
|
printf '%s\n' 'LeafWiki secrets path must be a regular file' >&2
|
|
exit 1
|
|
}
|
|
[[ "$(grep -c '^LEAFWIKI_JWT_SECRET=' "$secrets_file")" -eq 1 ]] || {
|
|
printf '%s\n' 'LeafWiki secrets file must contain exactly one JWT secret' >&2
|
|
exit 1
|
|
}
|
|
[[ "$(grep -c '^LEAFWIKI_TOTP_ENCRYPTION_KEY=' "$secrets_file")" -eq 1 ]] || {
|
|
printf '%s\n' 'LeafWiki secrets file must contain exactly one TOTP encryption key' >&2
|
|
exit 1
|
|
}
|
|
jwt_secret="$(sed -n 's/^LEAFWIKI_JWT_SECRET=//p' "$secrets_file")"
|
|
totp_key="$(sed -n 's/^LEAFWIKI_TOTP_ENCRYPTION_KEY=//p' "$secrets_file")"
|
|
[[ "$jwt_secret" =~ ^[0-9a-f]{64}$ ]] || {
|
|
printf '%s\n' 'LeafWiki JWT secret must be a 256-bit hexadecimal value' >&2
|
|
exit 1
|
|
}
|
|
[[ "$totp_key" =~ ^[0-9a-f]{64}$ ]] || {
|
|
printf '%s\n' 'LeafWiki TOTP encryption key must be a 256-bit hexadecimal value' >&2
|
|
exit 1
|
|
}
|
|
[[ "$(stat -c '%a' -- "$secrets_file")" = 600 ]] || {
|
|
printf '%s\n' 'LeafWiki secrets file permissions must be 0600' >&2
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
prepare_data_dir
|