prod/HY2XS_flamy
5
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Production hardening: host-aware install, ownership contracts, firewall safety

Browse Source
This commit is contained in:
Crimson
2026-04-30 03:26:14 +05:00
parent 0545990968
commit c10ab1fafd
25 changed files with 190 additions and 262 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/build/lib/package.sh
+6 -1
View File
@@ -11,6 +11,11 @@ prepare_stage() {
rm -rf "$STAGE_DIR"
mkdir -p "$STAGE_DIR" "dist"
copy_dir_contents "package" "$STAGE_DIR"
chmod 0755 "$STAGE_DIR/install.sh"
find "$STAGE_DIR" -type d -exec chmod 0755 {} +
find "$STAGE_DIR" -type f -name "*.service" -exec chmod 0644 {} +
find "$STAGE_DIR" -type f -name "*.tpl" -exec chmod 0644 {} +
find "$STAGE_DIR/config" -type f -exec chmod 0644 {} +
rm -rf "$STAGE_DIR/orchestrator" "$STAGE_DIR/ui" "$STAGE_DIR/metadata"
mkdir -p "$STAGE_DIR/orchestrator" "$STAGE_DIR/ui/hy2xs-admin" "$STAGE_DIR/metadata"
@@ -87,5 +92,5 @@ create_archive() {
local archive="dist/hy2xs-install-${version}.tar.gz"
rm -f "$archive"
tar -C "tools/build/output" -czf "$archive" "hy2xs-install"
tar --owner=0 --group=0 --numeric-owner -C "tools/build/output" -czf "$archive" "hy2xs-install"
}
tools/build/lib/verify.sh
+8
View File
@@ -40,4 +40,12 @@ verify_archive() {
env_content="$(tar -xOzf "$archive" hy2xs-install/config/hy2xs.env)"
printf '%s\n' "$env_content" | grep -q 'replace-with-your-domain.example' && fail "packaged hy2xs.env contains placeholder domain"
printf '%s\n' "$env_content" | grep -q 'replace-with-your-email@example.com' && fail "packaged hy2xs.env contains placeholder email"
local tmp
tmp="$(mktemp -d)"
tar -xzf "$archive" -C "$tmp"
[ -x "$tmp/hy2xs-install/install.sh" ] || fail "install.sh is not executable"
[ -x "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" ] || fail "orchestrator is not executable"
[ -x "$tmp/hy2xs-install/ui/hy2xs-admin/hy2xs-admin" ] || fail "hy2xs-admin is not executable"
rm -rf "$tmp"
}