mirror of
https://github.com/okxlin/appstore.git
synced 2026-09-24 16:01:02 +00:00
okxlin
ad1983b687
Build the documented Owncast factory Basic Auth value at runtime inside the network-isolated bootstrap service. This preserves initialization behavior while avoiding a static token-shaped credential that triggers secret scanning.
99 lines
2.8 KiB
Bash
Executable File
99 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
MARKER_FILE=/app/data/.1panel-bootstrap-complete
|
|
READY_FILE=/tmp/.1panel-bootstrap-ready
|
|
|
|
fail() {
|
|
printf '%s\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
validate_secret() {
|
|
name="$1"
|
|
value="$2"
|
|
minimum="$3"
|
|
maximum="$4"
|
|
case "$value" in
|
|
*[!A-Za-z0-9]*) fail "$name contains unsupported characters" ;;
|
|
esac
|
|
length=${#value}
|
|
if [ "$length" -lt "$minimum" ] || [ "$length" -gt "$maximum" ]; then
|
|
fail "$name has an invalid length"
|
|
fi
|
|
}
|
|
|
|
stay_ready() {
|
|
touch "$READY_FILE"
|
|
chmod 0600 "$READY_FILE"
|
|
unset OWNCAST_ADMIN_PASSWORD OWNCAST_STREAM_KEY
|
|
exec sleep infinity
|
|
}
|
|
|
|
[ -f "$MARKER_FILE" ] && stay_ready
|
|
validate_secret OWNCAST_ADMIN_PASSWORD "${OWNCAST_ADMIN_PASSWORD:-}" 16 72
|
|
validate_secret OWNCAST_STREAM_KEY "${OWNCAST_STREAM_KEY:-}" 24 128
|
|
|
|
owncast_pid=
|
|
cleanup() {
|
|
if [ -n "$owncast_pid" ] && kill -0 "$owncast_pid" 2>/dev/null; then
|
|
kill "$owncast_pid" 2>/dev/null || true
|
|
wait "$owncast_pid" 2>/dev/null || true
|
|
fi
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
/app/owncast \
|
|
-database /app/data/owncast.db \
|
|
-logdir /app/data/logs \
|
|
-backupdir /app/data/backups &
|
|
owncast_pid=$!
|
|
|
|
ready=false
|
|
attempt=0
|
|
while [ "$attempt" -lt 60 ]; do
|
|
if wget --quiet --spider http://127.0.0.1:8080/api/status; then
|
|
ready=true
|
|
break
|
|
fi
|
|
kill -0 "$owncast_pid" 2>/dev/null || fail "Owncast exited before bootstrap"
|
|
attempt=$((attempt + 1))
|
|
sleep 1
|
|
done
|
|
[ "$ready" = true ] || fail "Owncast did not become ready for bootstrap"
|
|
|
|
umask 077
|
|
stream_request=/tmp/owncast-stream-key.json
|
|
password_request=/tmp/owncast-admin-password.json
|
|
stream_response=/tmp/owncast-stream-key-response.json
|
|
password_response=/tmp/owncast-admin-password-response.json
|
|
|
|
# Owncast's public factory credential is used only inside the network-isolated init service.
|
|
default_authorization="$(printf '%s' 'admin:abc123' | base64 | tr -d '\n')"
|
|
|
|
printf '{"value":[{"key":"%s","comment":"1Panel generated stream key"}]}' \
|
|
"$OWNCAST_STREAM_KEY" > "$stream_request"
|
|
wget --quiet -O "$stream_response" \
|
|
--header "Authorization: Basic $default_authorization" \
|
|
--header 'Content-Type: application/json' \
|
|
--post-file "$stream_request" \
|
|
http://127.0.0.1:8080/api/admin/config/streamkeys
|
|
grep -Eq '"success"[[:space:]]*:[[:space:]]*true' "$stream_response" ||
|
|
fail "Owncast rejected the generated stream key"
|
|
|
|
printf '{"value":"%s"}' "$OWNCAST_ADMIN_PASSWORD" > "$password_request"
|
|
wget --quiet -O "$password_response" \
|
|
--header "Authorization: Basic $default_authorization" \
|
|
--header 'Content-Type: application/json' \
|
|
--post-file "$password_request" \
|
|
http://127.0.0.1:8080/api/admin/config/adminpass
|
|
grep -Eq '"success"[[:space:]]*:[[:space:]]*true' "$password_response" ||
|
|
fail "Owncast rejected the generated administrator password"
|
|
|
|
cleanup
|
|
owncast_pid=
|
|
touch "$MARKER_FILE"
|
|
chmod 0600 "$MARKER_FILE"
|
|
trap - EXIT INT TERM
|
|
stay_ready
|