Усилен firewall rollback lifecycle и безопасная запись конфигов/секретов

2026-05-01 21:42:26 +05:00
parent 7c0b79588f
commit 18ff86058a
6 changed files with 152 additions and 58 deletions
@@ -1,41 +1,62 @@
 import type { InstallContext } from "../types/context";
-import { runRawVisible, runVisible } from "../lib/process";
+import { run } from "../lib/process";
+
+async function userExists(user: string): Promise<boolean> {
+  try {
+    await run`id -u ${user} >/dev/null 2>&1`;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function getUserField(user: string, field: number): Promise<string> {
+  return (await run`getent passwd ${user} | cut -d: -f${field}`).trim();
+}
+
+async function getPrimaryGroup(user: string): Promise<string> {
+  return (await run`id -gn ${user}`).trim();
+}
+
+async function ensureDir(path: string, mode: string, ownerGroup: string): Promise<void> {
+  await run`install -d -m ${mode} -o ${ownerGroup.split(":")[0]} -g ${ownerGroup.split(":")[1]} ${path}`;
+}
+
+async function makeUser(user: string, expectedHome: string): Promise<void> {
+  await run`useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}`;
+}

 async function ensureRuntimeIdentity(user: string, expectedHome: string): Promise<void> {
-  const checkCmd = `
-if id -u ${user} >/dev/null 2>&1; then
-  shell="$(getent passwd ${user} | cut -d: -f7)"
-  home="$(getent passwd ${user} | cut -d: -f6)"
-  group="$(id -gn ${user})"
-  if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then
-    echo "existing user '${user}' has unsupported shell: $shell" >&2
-    exit 1
-  fi
-  if [ "$group" != "${user}" ]; then
-    echo "existing user '${user}' must have primary group '${user}', got: $group" >&2
-    exit 1
-  fi
-  if [ "$home" != "${expectedHome}" ]; then
-    echo "existing user '${user}' has unexpected home: $home (expected ${expectedHome})" >&2
-    exit 1
-  fi
-else
-  useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}
-fi
-`;
-  await runRawVisible(checkCmd);
+  if (!(await userExists(user))) {
+    await makeUser(user, expectedHome);
+    return;
+  }
+
+  const shell = await getUserField(user, 7);
+  const home = await getUserField(user, 6);
+  const group = await getPrimaryGroup(user);
+
+  if (shell !== "/usr/sbin/nologin" && shell !== "/bin/false") {
+    throw new Error(`existing user '${user}' has unsupported shell: ${shell}`);
+  }
+  if (group !== user) {
+    throw new Error(`existing user '${user}' must have primary group '${user}', got: ${group}`);
+  }
+  if (home !== expectedHome) {
+    throw new Error(`existing user '${user}' has unexpected home: ${home} (expected ${expectedHome})`);
+  }
 }

 export async function prepareFilesystem(context: InstallContext): Promise<void> {
  await ensureRuntimeIdentity("hysteria", "/var/lib/hysteria");
  await ensureRuntimeIdentity("hy2xs-admin", context.config.dataDir);
-  await runVisible`install -d -m 0700 -o root -g root /etc/hy2xs`;
-  await runVisible`install -d -m 0755 -o root -g root /etc/hysteria`;
-  await runVisible`install -d -m 0750 -o hysteria -g hysteria /var/lib/hysteria`;
-  await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.dataDir}`;
-  await runVisible`install -d -m 0750 -o hy2xs-admin -g hy2xs-admin ${context.config.logDir}`;
-  await runVisible`install -d -m 0755 -o root -g root ${context.config.installDir}`;
-  await runVisible`install -d -m 0755 -o root -g root /usr/local/lib/hy2xs`;
-  await runVisible`install -d -m 0755 -o root -g root /etc/nftables.d`;
-  await runVisible`chmod -R go-w ${context.config.installDir}`;
+  await ensureDir("/etc/hy2xs", "0700", "root:root");
+  await ensureDir("/etc/hysteria", "0755", "root:root");
+  await ensureDir("/var/lib/hysteria", "0750", "hysteria:hysteria");
+  await ensureDir(context.config.dataDir, "0750", "hy2xs-admin:hy2xs-admin");
+  await ensureDir(context.config.logDir, "0750", "hy2xs-admin:hy2xs-admin");
+  await ensureDir(context.config.installDir, "0755", "root:root");
+  await ensureDir("/usr/local/lib/hy2xs", "0755", "root:root");
+  await ensureDir("/etc/nftables.d", "0755", "root:root");
+  await run`chmod -R go-w ${context.config.installDir}`;
 }