prod/HY2XS_flamy
5
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Усилен firewall rollback lifecycle и безопасная запись конфигов/секретов

Browse Source
This commit is contained in:
Crimson
2026-05-01 21:42:26 +05:00
parent 7c0b79588f
commit 18ff86058a
6 changed files with 152 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
orchestrator/src/steps/firewall.ts
+14 -6
View File
@@ -10,8 +10,15 @@ const FW_BACKUP_FILES = [
"/etc/nftables.d/hy2xs.nft.candidate",
"/etc/nftables.d/hy2xs.nft.existed",
"/etc/nftables.d/hy2xs.nft.include.existed",
"/etc/nftables.d/nftables.conf.existed"
].join(" ");
"/etc/nftables.d/nftables.conf.existed",
"/etc/nftables.d/hy2xs.rollback.prepared"
];
async function cleanupFirewallBackupFiles(): Promise<void> {
for (const file of FW_BACKUP_FILES) {
await runVisible`rm -f ${file}`;
}
}
function stripNftComments(content: string): string {
return content
@@ -62,6 +69,7 @@ export async function applyFirewall(context: RuntimeContext): Promise<void> {
fail("existing non-HY2XS nftables.conf found; set HY2XS_FIREWALL_ALLOW_TAKEOVER=true or HY2XS_FIREWALL_ENABLED=false");
}
await runVisible`touch /etc/nftables.d/hy2xs.rollback.prepared`;
await runVisible`cp -a /etc/nftables.conf /etc/nftables.conf.hy2xs.bak 2>/dev/null || true`;
await runVisible`cp -a /etc/nftables.d/hy2xs.nft /etc/nftables.d/hy2xs.nft.bak 2>/dev/null || true`;
await runVisible`test -f /etc/nftables.conf && echo 1 > /etc/nftables.d/nftables.conf.existed || rm -f /etc/nftables.d/nftables.conf.existed`;
@@ -95,7 +103,7 @@ include "/etc/nftables.d/hy2xs.nft"
await runVisible`nft -c -f /etc/nftables.conf`;
if (context.config.firewallStagedApply) {
await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; nft -f /etc/nftables.conf >/dev/null 2>&1 || true'`;
await runVisible`systemd-run --unit hy2xs-fw-rollback --on-active=45s /bin/sh -c 'if [ -f /etc/nftables.d/hy2xs.rollback.prepared ]; then if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi; if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi; if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi; fi'`;
}
await runVisible`nft -f /etc/nftables.conf`;
@@ -116,7 +124,7 @@ export async function cancelFirewallRollback(context: RuntimeContext): Promise<v
await runVisible`systemctl reset-failed hy2xs-fw-rollback || true`;
}
await runVisible`rm -f ${FW_BACKUP_FILES}`;
await cleanupFirewallBackupFiles();
}
export async function rollbackFirewallNow(context: RuntimeContext): Promise<void> {
@@ -124,7 +132,7 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise<void
return;
}
if (!(await exists("/etc/nftables.d/nftables.conf.existed")) && !(await exists("/etc/nftables.d/hy2xs.nft.existed"))) {
if (!(await exists("/etc/nftables.d/hy2xs.rollback.prepared"))) {
info("firewall rollback skipped: no HY2XS rollback markers found");
return;
}
@@ -137,5 +145,5 @@ export async function rollbackFirewallNow(context: RuntimeContext): Promise<void
await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then cp -a /etc/nftables.conf.hy2xs.bak /etc/nftables.conf 2>/dev/null || true; else rm -f /etc/nftables.conf; fi`;
await runVisible`if [ -f /etc/nftables.d/hy2xs.nft.existed ]; then cp -a /etc/nftables.d/hy2xs.nft.bak /etc/nftables.d/hy2xs.nft 2>/dev/null || true; else rm -f /etc/nftables.d/hy2xs.nft; fi`;
await runVisible`if [ -f /etc/nftables.d/nftables.conf.existed ]; then nft -f /etc/nftables.conf >/dev/null 2>&1 || true; else nft flush ruleset >/dev/null 2>&1 || true; fi`;
await runVisible`rm -f ${FW_BACKUP_FILES}`;
await cleanupFirewallBackupFiles();
}