prod/AWG2_harness
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Полный продакшн-фикс: hardened build/install, drift/firewall/wg проверки и актуализация документации

Browse Source
This commit is contained in:
Crimson
2026-05-10 15:41:44 +05:00
parent 535c1dbc33
commit b3dad5974c
11 changed files with 410 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/build.sh
+34 -7
View File
@@ -4,6 +4,7 @@ set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
CRATE_MANIFEST="$ROOT_DIR/traffic_core/Cargo.toml"
TARGET_BIN="$ROOT_DIR/traffic_core/target/release/awg2-harness"
MIN_RUSTC="1.85.0"
AUTO_INSTALL=false
SKIP_FMT=false
@@ -20,6 +21,12 @@ require_cmd() {
command -v "$1" >/dev/null 2>&1 || { echo "Missing command: $1"; exit 1; }
}
version_ge() {
local have="$1"
local need="$2"
[[ "$(printf '%s\n' "$need" "$have" | sort -V | head -n1)" == "$need" ]]
}
if [[ -f /etc/os-release ]]; then
# shellcheck disable=SC1091
source /etc/os-release
@@ -40,6 +47,14 @@ if ! command -v cargo >/dev/null 2>&1; then
exit 1
fi
require_cmd rustc
RUSTC_VERSION="$(rustc --version | awk '{print $2}')"
if ! version_ge "$RUSTC_VERSION" "$MIN_RUSTC"; then
echo "rustc $RUSTC_VERSION is too old. Require >= $MIN_RUSTC"
exit 1
fi
for cmd in gcc pkg-config; do
require_cmd "$cmd"
done
@@ -48,9 +63,9 @@ if [[ "$SKIP_FMT" != true ]]; then
cargo fmt --manifest-path "$CRATE_MANIFEST" --all --check
fi
cargo clippy --manifest-path "$CRATE_MANIFEST" --all-targets -- -D warnings
cargo test --manifest-path "$CRATE_MANIFEST" --release
cargo build --manifest-path "$CRATE_MANIFEST" --release
cargo clippy --locked --manifest-path "$CRATE_MANIFEST" --all-targets -- -D warnings
cargo test --locked --manifest-path "$CRATE_MANIFEST" --release
cargo build --locked --manifest-path "$CRATE_MANIFEST" --release
require_cmd file
require_cmd ldd
@@ -64,16 +79,28 @@ ls -lh "$TARGET_BIN"
if [[ "$AUTO_INSTALL" == true ]]; then
require_cmd install
sudo install -m 0755 "$TARGET_BIN" /usr/local/bin/awg2-harness
sudo mkdir -p /etc/awg2-harness
RUN_AS_ROOT=( )
if [[ "$(id -u)" -eq 0 ]]; then
RUN_AS_ROOT=( )
else
require_cmd sudo
RUN_AS_ROOT=(sudo)
fi
"${RUN_AS_ROOT[@]}" install -m 0755 "$TARGET_BIN" /usr/local/bin/awg2-harness
"${RUN_AS_ROOT[@]}" mkdir -p /etc/awg2-harness
if [[ ! -f /etc/awg2-harness/config.toml ]]; then
echo "Missing /etc/awg2-harness/config.toml"
echo "Refusing to install example config as production config."
echo "Create config manually from $ROOT_DIR/config.example.toml and re-run with --install."
exit 1
fi
sudo install -m 0644 "$ROOT_DIR/awg2-harness.service" /etc/systemd/system/awg2-harness.service
sudo systemctl daemon-reload
"${RUN_AS_ROOT[@]}" install -m 0644 "$ROOT_DIR/awg2-harness.service" /etc/systemd/system/awg2-harness.service
if command -v systemd-analyze >/dev/null 2>&1; then
"${RUN_AS_ROOT[@]}" systemd-analyze verify /etc/systemd/system/awg2-harness.service
fi
"${RUN_AS_ROOT[@]}" systemctl daemon-reload
fi
echo "Build completed: $TARGET_BIN"