Продакшн-фиксы install/reconfigure: rollback, firewall lifecycle, preflight и runbook

orchestrator/src/steps/filesystem.ts

@@ -1,9 +1,34 @@
 import type { InstallContext } from "../types/context";
 import { runVisible } from "../lib/process";
 
+async function ensureRuntimeIdentity(user: string, expectedHome: string): Promise<void> {
+  const checkCmd = `
+if id -u ${user} >/dev/null 2>&1; then
+  shell="$(getent passwd ${user} | cut -d: -f7)"
+  home="$(getent passwd ${user} | cut -d: -f6)"
+  group="$(id -gn ${user})"
+  if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then
+    echo "existing user '${user}' has unsupported shell: $shell" >&2
+    exit 1
+  fi
+  if [ "$group" != "${user}" ]; then
+    echo "existing user '${user}' must have primary group '${user}', got: $group" >&2
+    exit 1
+  fi
+  if [ "$home" != "${expectedHome}" ]; then
+    echo "existing user '${user}' has unexpected home: $home (expected ${expectedHome})" >&2
+    exit 1
+  fi
+else
+  useradd --system --home ${expectedHome} --shell /usr/sbin/nologin ${user}
+fi
+`;
+  await runVisible`${checkCmd}`;
+}
+
 export async function prepareFilesystem(context: InstallContext): Promise<void> {
-  await runVisible`id -u hysteria >/dev/null 2>&1 || useradd --system --home /var/lib/hysteria --shell /usr/sbin/nologin hysteria`;
-  await runVisible`id -u hy2xs-admin >/dev/null 2>&1 || useradd --system --home ${context.config.dataDir} --shell /usr/sbin/nologin hy2xs-admin`;
+  await ensureRuntimeIdentity("hysteria", "/var/lib/hysteria");
+  await ensureRuntimeIdentity("hy2xs-admin", context.config.dataDir);
   await runVisible`install -d -m 0700 -o root -g root /etc/hy2xs`;
   await runVisible`install -d -m 0755 -o root -g root /etc/hysteria`;
   await runVisible`install -d -m 0750 -o hysteria -g hysteria /var/lib/hysteria`;