fix: load git mirror scripts from files
This commit is contained in:
Codex
@@ -0,0 +1,129 @@
|
||||
import { readFileSync } from "node:fs";
|
||||
import { rootPath } from "./config";
|
||||
import type { ControlPlaneNodeSpec, ControlPlaneTargetSpec } from "./hwlab-node-control-plane-model";
|
||||
|
||||
const SCRIPT_ROOT = "scripts/src/hwlab-node-control-plane";
|
||||
|
||||
export function gitMirrorSyncShell(node: ControlPlaneNodeSpec, target: ControlPlaneTargetSpec): string {
|
||||
return renderShellTemplate("git-mirror-sync.sh", {
|
||||
GIT_MIRROR_PROXY_PRELUDE: gitMirrorProxyPrelude(node, target),
|
||||
});
|
||||
}
|
||||
|
||||
export function gitMirrorFlushShell(node: ControlPlaneNodeSpec, target: ControlPlaneTargetSpec): string {
|
||||
return renderShellTemplate("git-mirror-flush.sh", {
|
||||
GIT_MIRROR_PROXY_PRELUDE: gitMirrorProxyPrelude(node, target),
|
||||
});
|
||||
}
|
||||
|
||||
function renderShellTemplate(fileName: string, replacements: Record<string, string>): string {
|
||||
let script = readScript(fileName);
|
||||
for (const [key, value] of Object.entries(replacements)) script = script.replaceAll(`__${key}__`, value.trimEnd());
|
||||
if (/__[A-Z0-9_]+__/u.test(script)) throw new Error(`unresolved git-mirror script template marker in ${fileName}`);
|
||||
return script.endsWith("\n") ? script : `${script}\n`;
|
||||
}
|
||||
|
||||
function readScript(fileName: string): string {
|
||||
return readFileSync(rootPath(SCRIPT_ROOT, fileName), "utf8");
|
||||
}
|
||||
|
||||
function gitMirrorProxyPrelude(node: ControlPlaneNodeSpec, target: ControlPlaneTargetSpec): string {
|
||||
const gitMirrorProxy = target.gitMirror.egressProxy;
|
||||
const transport = target.gitMirror.githubTransport;
|
||||
const useDirect = gitMirrorProxy?.mode === "direct";
|
||||
const proxyRequired = gitMirrorProxy?.required === true;
|
||||
if (!useDirect && gitMirrorProxy?.mode !== "node-global" && gitMirrorProxy?.mode !== "host-route") throw new Error(`targets.${target.id}.gitMirror.egressProxy.mode must be node-global, host-route, or direct`);
|
||||
if (!useDirect && proxyRequired && node.egressProxy === null) throw new Error(`nodes.${node.id}.egressProxy is required by targets.${target.id}.gitMirror.egressProxy`);
|
||||
if (!useDirect && node.egressProxy === null) throw new Error(`nodes.${node.id}.egressProxy is missing; git-mirror GitHub transport cannot use node-global proxy`);
|
||||
if (!useDirect && gitMirrorProxy?.mode === "node-global" && node.egressProxy?.mode !== "k8s-service-cluster-ip") throw new Error(`targets.${target.id}.gitMirror.egressProxy.mode=node-global requires nodes.${node.id}.egressProxy.mode=k8s-service-cluster-ip`);
|
||||
if (!useDirect && gitMirrorProxy?.mode === "host-route" && node.egressProxy?.mode !== "host-route") throw new Error(`targets.${target.id}.gitMirror.egressProxy.mode=host-route requires nodes.${node.id}.egressProxy.mode=host-route`);
|
||||
const hostRouteUrl = !useDirect && node.egressProxy?.mode === "host-route" ? new URL(node.egressProxy.proxyUrl) : null;
|
||||
const proxyHost = useDirect || node.egressProxy === null ? "" : node.egressProxy.mode === "host-route" ? hostRouteUrl!.hostname : `${node.egressProxy.serviceName}.${node.egressProxy.namespace}.svc.cluster.local`;
|
||||
const proxyPort = useDirect || node.egressProxy === null ? 0 : node.egressProxy.mode === "host-route" ? Number(hostRouteUrl!.port) : node.egressProxy.port;
|
||||
const proxyUrl = useDirect || node.egressProxy === null ? "" : node.egressProxy.mode === "host-route" ? node.egressProxy.proxyUrl : `http://${proxyHost}:${proxyPort}`;
|
||||
const noProxy = useDirect || node.egressProxy === null ? "" : node.egressProxy.noProxy.join(",");
|
||||
const proxySource = useDirect || node.egressProxy === null
|
||||
? "sourceType=direct sourceRef=- sourceFingerprint=-"
|
||||
: node.egressProxy.mode === "host-route"
|
||||
? `sourceType=host-route hostProxyConfigRef=${node.egressProxy.hostProxyConfigRef} sourceFingerprint=-`
|
||||
: `sourceType=${node.egressProxy.sourceType} sourceRef=${node.egressProxy.sourceRef} sourceFingerprint=${node.egressProxy.sourceFingerprint ?? "-"}`;
|
||||
const proxySummary = useDirect
|
||||
? `git-mirror-egress-proxy mode=direct required=false transport=${transport.mode} source=yaml`
|
||||
: transport.mode === "https"
|
||||
? `git-mirror-egress-proxy client=${node.egressProxy?.clientName} mode=${node.egressProxy?.mode} required=${proxyRequired ? "true" : "false"} host=${proxyHost} port=${proxyPort} transport=https proxy=HTTP_PROXY authSecret=${transport.tokenSecretName} authKey=${transport.tokenSecretKey} authSourceRef=${transport.tokenSourceRef} ${proxySource} source=yaml`
|
||||
: `git-mirror-egress-proxy client=${node.egressProxy?.clientName} mode=${node.egressProxy?.mode} required=${proxyRequired ? "true" : "false"} host=${proxyHost} port=${proxyPort} transport=ssh ssh=GIT_SSH-wrapper ${proxySource} source=yaml`;
|
||||
const common = [
|
||||
`printf '%s\\n' ${shQuote(proxySummary)} >&2`,
|
||||
useDirect ? "unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy" : `export HTTP_PROXY=${shQuote(proxyUrl)}`,
|
||||
useDirect ? "export NO_PROXY='*'" : `export HTTPS_PROXY=${shQuote(proxyUrl)}`,
|
||||
useDirect ? "export no_proxy='*'" : `export ALL_PROXY=${shQuote(proxyUrl)}`,
|
||||
useDirect ? "" : `export http_proxy=${shQuote(proxyUrl)}`,
|
||||
useDirect ? "" : `export https_proxy=${shQuote(proxyUrl)}`,
|
||||
useDirect ? "" : `export all_proxy=${shQuote(proxyUrl)}`,
|
||||
useDirect ? "" : `export NO_PROXY=${shQuote(noProxy)}`,
|
||||
useDirect ? "" : `export no_proxy=${shQuote(noProxy)}`,
|
||||
`repository=${shQuote(target.source.repository)}`,
|
||||
`source_branch=${shQuote(target.source.branch)}`,
|
||||
`source_stage_ref_prefix=${shQuote(target.source.sourceSnapshot.stageRefPrefix.replaceAll("{branch}", target.source.branch))}`,
|
||||
`gitops_branch=${shQuote(target.gitops.branch)}`,
|
||||
"repo=\"/cache/${repository}.git\"",
|
||||
].filter(Boolean);
|
||||
if (transport.mode === "https") {
|
||||
return [
|
||||
...common,
|
||||
"if [ -z \"${GITHUB_TOKEN:-}\" ]; then echo 'hwlab git-mirror https auth: missing GITHUB_TOKEN secret env' >&2; exit 64; fi",
|
||||
"cat > /tmp/hwlab-git-askpass.sh <<'SH_ASKPASS'",
|
||||
"#!/bin/sh",
|
||||
"case \"$1\" in",
|
||||
" *Username*) printf '%s\\n' \"${GITHUB_USERNAME:-x-access-token}\" ;;",
|
||||
" *Password*) printf '%s\\n' \"$GITHUB_TOKEN\" ;;",
|
||||
" *) printf '\\n' ;;",
|
||||
"esac",
|
||||
"SH_ASKPASS",
|
||||
"chmod 0700 /tmp/hwlab-git-askpass.sh",
|
||||
`export GITHUB_USERNAME=${shQuote(transport.username)}`,
|
||||
"export GIT_ASKPASS=/tmp/hwlab-git-askpass.sh",
|
||||
"export GIT_TERMINAL_PROMPT=0",
|
||||
"unset GIT_SSH",
|
||||
"unset GIT_SSH_COMMAND",
|
||||
"remote=\"https://github.com/${repository}.git\"",
|
||||
].join("\n");
|
||||
}
|
||||
const proxyCommand = useDirect ? "" : `ProxyCommand=node /tmp/hwlab-github-proxy-connect.cjs ${proxyHost} ${proxyPort} %h %p`;
|
||||
const privateKeyPath = transport.mode === "ssh" ? `/git-ssh/${transport.privateKeySecretKey}` : "/git-ssh/ssh-privatekey";
|
||||
const knownHostsCopy = transport.mode === "ssh" && transport.knownHostsSecretKey !== null
|
||||
? [`cp ${shQuote(`/git-ssh/${transport.knownHostsSecretKey}`)} /root/.ssh/known_hosts`, "chmod 0600 /root/.ssh/known_hosts"]
|
||||
: [];
|
||||
return [
|
||||
"mkdir -p /root/.ssh",
|
||||
`cp ${shQuote(privateKeyPath)} /root/.ssh/id_rsa`,
|
||||
"chmod 0400 /root/.ssh/id_rsa",
|
||||
...knownHostsCopy,
|
||||
...common,
|
||||
...proxyConnectBlock(useDirect),
|
||||
"cat > /tmp/hwlab-git-ssh-proxy.sh <<'SH_PROXY'",
|
||||
"#!/bin/sh",
|
||||
useDirect
|
||||
? `exec ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 "$@"`
|
||||
: `exec ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 -o ${shQuote(proxyCommand)} "$@"`,
|
||||
"SH_PROXY",
|
||||
"chmod 0700 /tmp/hwlab-git-ssh-proxy.sh",
|
||||
"export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh",
|
||||
"unset GIT_SSH_COMMAND",
|
||||
"remote=\"ssh://git@ssh.github.com:443/${repository}.git\"",
|
||||
].filter(Boolean).join("\n");
|
||||
}
|
||||
|
||||
function proxyConnectBlock(useDirect: boolean): string[] {
|
||||
if (useDirect) return [];
|
||||
return [
|
||||
"cat > /tmp/hwlab-github-proxy-connect.cjs <<'NODE_PROXY'",
|
||||
readScript("git-mirror-proxy-connect.cjs").trimEnd(),
|
||||
"NODE_PROXY",
|
||||
"chmod 0700 /tmp/hwlab-github-proxy-connect.cjs",
|
||||
];
|
||||
}
|
||||
|
||||
function shQuote(value: string): string {
|
||||
return `'${value.replace(/'/gu, `'"'"'`)}'`;
|
||||
}
|
||||
Reference in New Issue
Block a user