mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-23 08:01:00 +00:00
124 lines
3.8 KiB
Bash
Executable File
124 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
|
|
ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
|
|
DOCKER_BIN="${DOCKER_BIN:-docker}"
|
|
IMAGE='wealthfolio/wealthfolio:3.6.2@sha256:f24c607692c1b494a477382aa3dfedc11ede1b433768b66546940c8f6b8a474f'
|
|
|
|
read_env_value() {
|
|
local key="$1"
|
|
[[ -f "$ENV_FILE" ]] || return 0
|
|
local value
|
|
value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
|
|
case "$value" in
|
|
\"*\") value="${value#\"}"; value="${value%\"}" ;;
|
|
\'*\') value="${value#\'}"; value="${value%\'}" ;;
|
|
esac
|
|
printf '%s\n' "$value"
|
|
}
|
|
|
|
configured_value() {
|
|
local key="$1"
|
|
local default_value="$2"
|
|
local value="${!key:-}"
|
|
if [[ -z "$value" ]]; then
|
|
value="$(read_env_value "$key")"
|
|
fi
|
|
printf '%s\n' "${value:-$default_value}"
|
|
}
|
|
|
|
replace_env_value() {
|
|
local key="$1"
|
|
local value="$2"
|
|
local temporary
|
|
[[ "$value" != *"'"* && "$value" != *$'\n'* && "$value" != *$'\r'* ]] || {
|
|
printf 'Cannot safely store %s in the environment file\n' "$key" >&2
|
|
exit 1
|
|
}
|
|
temporary="$(mktemp "${ENV_FILE}.tmp.XXXXXX")"
|
|
awk -v prefix="${key}=" 'index($0, prefix) != 1 { print }' "$ENV_FILE" >"$temporary"
|
|
printf "%s='%s'\n" "$key" "$value" >>"$temporary"
|
|
chmod --reference="$ENV_FILE" "$temporary"
|
|
mv -f -- "$temporary" "$ENV_FILE"
|
|
}
|
|
|
|
data_raw="$(configured_value APP_DATA_DIR ./data)"
|
|
admin_password="$(configured_value ADMIN_PASSWORD '')"
|
|
secret_input="$(configured_value WF_SECRET_KEY '')"
|
|
|
|
[[ -n "$data_raw" && "$data_raw" != /* ]] || {
|
|
printf '%s\n' 'APP_DATA_DIR must be a non-empty relative path' >&2
|
|
exit 1
|
|
}
|
|
data_dir="$(realpath -m -- "$ROOT_DIR/${data_raw#./}")"
|
|
case "$data_dir" in
|
|
"$ROOT_DIR"/*) ;;
|
|
*)
|
|
printf '%s\n' 'APP_DATA_DIR must remain inside the application version directory' >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
[[ ${#admin_password} -ge 16 && ${#admin_password} -le 256 ]] || {
|
|
printf '%s\n' 'ADMIN_PASSWORD must contain 16 to 256 characters' >&2
|
|
exit 1
|
|
}
|
|
if [[ "$admin_password" == *$'\n'* || "$admin_password" == *$'\r'* ]]; then
|
|
printf '%s\n' 'ADMIN_PASSWORD must not contain line breaks' >&2
|
|
exit 1
|
|
fi
|
|
|
|
[[ ${#secret_input} -ge 16 && ${#secret_input} -le 256 ]] || {
|
|
printf '%s\n' 'WF_SECRET_KEY must contain 16 to 256 characters' >&2
|
|
exit 1
|
|
}
|
|
if decoded_length="$(printf '%s' "$secret_input" | base64 -d 2>/dev/null | wc -c)" &&
|
|
[[ "$decoded_length" -eq 32 && "$secret_input" != *"'"* ]]; then
|
|
secret_key="$secret_input"
|
|
elif [[ "$secret_input" =~ ^[A-Za-z0-9._~-]{32}$ && "$secret_input" =~ [._~-] ]]; then
|
|
secret_key="$secret_input"
|
|
else
|
|
secret_key="wf_$(printf '%s' "$secret_input" | sha256sum | cut -c1-29)"
|
|
fi
|
|
|
|
command -v "$DOCKER_BIN" >/dev/null 2>&1 || {
|
|
printf '%s\n' 'Docker is required to generate the Wealthfolio Argon2id password hash' >&2
|
|
exit 1
|
|
}
|
|
salt="$(printf '%s' "$secret_key" | sha256sum | cut -c1-16)"
|
|
# shellcheck disable=SC2016
|
|
auth_hash="$(
|
|
printf '%s' "$admin_password" |
|
|
"$DOCKER_BIN" run --rm -i --user 0:0 --entrypoint /bin/sh "$IMAGE" -ec \
|
|
'apk add --no-cache argon2 >/dev/null; exec argon2 "$1" -id -e -t 3 -m 16 -p 1' \
|
|
sh "$salt"
|
|
)"
|
|
[[ "$auth_hash" =~ ^\$argon2id\$v=19\$m=65536,t=3,p=1\$[A-Za-z0-9+/]+={0,2}\$[A-Za-z0-9+/]+={0,2}$ ]] || {
|
|
printf '%s\n' 'Failed to generate a valid Argon2id password hash' >&2
|
|
exit 1
|
|
}
|
|
|
|
replace_env_value WF_SECRET_KEY "$secret_key"
|
|
|
|
install -d -m 0750 "$data_dir"
|
|
data_dir="$(realpath -e -- "$data_dir")"
|
|
case "$data_dir" in
|
|
"$ROOT_DIR"/*) ;;
|
|
*)
|
|
printf '%s\n' 'APP_DATA_DIR resolves outside the application version directory' >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
chmod 0750 "$data_dir"
|
|
|
|
runtime_env="$data_dir/.runtime-env"
|
|
runtime_temporary="$(mktemp "$data_dir/.runtime-env.tmp.XXXXXX")"
|
|
umask 077
|
|
{
|
|
printf "WF_SECRET_KEY='%s'\n" "$secret_key"
|
|
printf "WF_AUTH_PASSWORD_HASH='%s'\n" "$auth_hash"
|
|
} >"$runtime_temporary"
|
|
chmod 0600 "$runtime_temporary"
|
|
mv -f -- "$runtime_temporary" "$runtime_env"
|