Codex
324 lines
16 KiB
TypeScript
324 lines
16 KiB
TypeScript
import { readFileSync } from "node:fs";
|
|
|
|
import { rootPath } from "./config";
|
|
|
|
export const selfMediaConfigPath = rootPath("config", "selfmedia.yaml");
|
|
export const selfMediaConfigRef = "config/selfmedia.yaml";
|
|
|
|
export interface SelfMediaDeliveryTarget {
|
|
readonly id: string;
|
|
readonly node: string;
|
|
readonly lane: string;
|
|
readonly route: string;
|
|
readonly ci: {
|
|
readonly namespace: string;
|
|
readonly pipeline: string;
|
|
readonly pipelineRunPrefix: string;
|
|
readonly serviceAccountName: string;
|
|
readonly serviceAccountAutomount: false;
|
|
readonly roleBindingName: string;
|
|
readonly workspaceSize: string;
|
|
readonly pipelineTimeout: string;
|
|
readonly toolImage: string;
|
|
readonly buildkitImage: string;
|
|
};
|
|
readonly source: {
|
|
readonly repository: string;
|
|
readonly worktreeRemote: string;
|
|
readonly branch: string;
|
|
readonly readUrl: string;
|
|
readonly snapshotPrefix: string;
|
|
};
|
|
readonly build: Record<string, unknown> & {
|
|
readonly dockerfile: string;
|
|
readonly imageRepository: string;
|
|
readonly networkMode: string;
|
|
readonly proxy: Record<string, unknown>;
|
|
};
|
|
readonly gitops: Record<string, unknown> & {
|
|
readonly readUrl: string;
|
|
readonly writeUrl: string;
|
|
readonly branch: string;
|
|
readonly manifestPath: string;
|
|
readonly releaseStatePath: string;
|
|
readonly credentialSecretName: string;
|
|
readonly credentialTokenKey: string;
|
|
readonly credentialUsername: string;
|
|
};
|
|
readonly deployment: Record<string, unknown>;
|
|
}
|
|
|
|
export interface SelfMediaCutoverTarget {
|
|
readonly id: string;
|
|
readonly mode: "host-process-to-kubernetes";
|
|
readonly source: {
|
|
readonly workspace: string;
|
|
readonly publicAddress: string;
|
|
readonly healthUrl: string;
|
|
readonly stopCommand: readonly string[];
|
|
readonly startCommand: readonly string[];
|
|
readonly dataPaths: readonly string[];
|
|
readonly excludes: readonly string[];
|
|
};
|
|
readonly destination: {
|
|
readonly route: string;
|
|
readonly namespace: string;
|
|
readonly application: string;
|
|
readonly publicAddress: string;
|
|
readonly healthUrl: string;
|
|
readonly dataClaim: string;
|
|
readonly codexClaim: string;
|
|
};
|
|
readonly prepare: {
|
|
readonly requiresFinalConfirmation: true;
|
|
readonly phases: readonly string[];
|
|
};
|
|
readonly rollback: {
|
|
readonly phases: readonly string[];
|
|
readonly dataPolicy: string;
|
|
};
|
|
}
|
|
|
|
interface SelfMediaConfig {
|
|
readonly defaultTargetId: string;
|
|
readonly deliveryTargets: Readonly<Record<string, SelfMediaDeliveryTarget>>;
|
|
readonly cutoverTargets: Readonly<Record<string, SelfMediaCutoverTarget>>;
|
|
}
|
|
|
|
export function readSelfMediaConfig(): SelfMediaConfig {
|
|
const root = record(Bun.YAML.parse(readFileSync(selfMediaConfigPath, "utf8")), selfMediaConfigRef);
|
|
if (integer(root.version, "version") !== 1) throw new Error(`${selfMediaConfigRef}.version must be 1`);
|
|
if (text(root.kind, "kind") !== "selfmedia-platform-delivery") throw new Error(`${selfMediaConfigRef}.kind must be selfmedia-platform-delivery`);
|
|
const defaults = record(root.defaults, "defaults");
|
|
const delivery = record(root.delivery, "delivery");
|
|
const cutover = record(root.cutover, "cutover");
|
|
const deliveryRecords = record(delivery.targets, "delivery.targets");
|
|
const cutoverRecords = record(cutover.targets, "cutover.targets");
|
|
const deliveryTargets = Object.fromEntries(Object.entries(deliveryRecords).map(([id, value]) => [id, parseDeliveryTarget(id, record(value, `delivery.targets.${id}`))]));
|
|
const cutoverTargets = Object.fromEntries(Object.entries(cutoverRecords).map(([id, value]) => [id, parseCutoverTarget(id, record(value, `cutover.targets.${id}`))]));
|
|
const defaultTargetId = text(defaults.targetId, "defaults.targetId");
|
|
if (deliveryTargets[defaultTargetId] === undefined || cutoverTargets[defaultTargetId] === undefined) {
|
|
throw new Error(`${selfMediaConfigRef}.defaults.targetId must resolve in delivery.targets and cutover.targets`);
|
|
}
|
|
return { defaultTargetId, deliveryTargets, cutoverTargets };
|
|
}
|
|
|
|
export function resolveSelfMediaDeliveryTarget(targetId?: string | null): SelfMediaDeliveryTarget {
|
|
const config = readSelfMediaConfig();
|
|
const id = targetId ?? config.defaultTargetId;
|
|
const target = config.deliveryTargets[id];
|
|
if (target === undefined) throw new Error(`unknown selfmedia delivery target ${id}; known targets: ${Object.keys(config.deliveryTargets).join(", ")}`);
|
|
return target;
|
|
}
|
|
|
|
export function resolveSelfMediaCutoverTarget(targetId?: string | null): SelfMediaCutoverTarget {
|
|
const config = readSelfMediaConfig();
|
|
const id = targetId ?? config.defaultTargetId;
|
|
const target = config.cutoverTargets[id];
|
|
if (target === undefined) throw new Error(`unknown selfmedia cutover target ${id}; known targets: ${Object.keys(config.cutoverTargets).join(", ")}`);
|
|
return target;
|
|
}
|
|
|
|
export function selfMediaDeliveryConfigRef(targetId: string): string {
|
|
return `${selfMediaConfigRef}#delivery.targets.${targetId}`;
|
|
}
|
|
|
|
export function selfMediaEffectiveDeployment(target: SelfMediaDeliveryTarget): Record<string, unknown> {
|
|
return {
|
|
...structuredClone(target.deployment),
|
|
delivery: {
|
|
enabled: true,
|
|
source: {
|
|
branch: target.source.branch,
|
|
snapshotPrefix: target.source.snapshotPrefix,
|
|
readUrl: target.source.readUrl,
|
|
},
|
|
build: structuredClone(target.build),
|
|
gitops: structuredClone(target.gitops),
|
|
},
|
|
};
|
|
}
|
|
|
|
function parseDeliveryTarget(id: string, value: Record<string, unknown>): SelfMediaDeliveryTarget {
|
|
const path = `delivery.targets.${id}`;
|
|
const ci = record(value.ci, `${path}.ci`);
|
|
const source = record(value.source, `${path}.source`);
|
|
const build = record(value.build, `${path}.build`);
|
|
const proxy = record(build.proxy, `${path}.build.proxy`);
|
|
const gitops = record(value.gitops, `${path}.gitops`);
|
|
const deployment = record(value.deployment, `${path}.deployment`);
|
|
const target = record(deployment.target, `${path}.deployment.target`);
|
|
const publicExposure = record(deployment.publicExposure, `${path}.deployment.publicExposure`);
|
|
const noProxy = stringArray(proxy.noProxy, `${path}.build.proxy.noProxy`);
|
|
if (!noProxy.includes("hyueapi.com") || !noProxy.includes(".hyueapi.com")) throw new Error(`${path}.build.proxy.noProxy must preserve hyueapi.com and .hyueapi.com`);
|
|
if (text(value.node, `${path}.node`) !== id) throw new Error(`${path}.node must match target id ${id}`);
|
|
if (text(target.id, `${path}.deployment.target.id`) !== id) throw new Error(`${path}.deployment.target.id must match ${id}`);
|
|
if (text(source.repository, `${path}.source.repository`) !== "pikainc/selfmedia") throw new Error(`${path}.source.repository must be pikainc/selfmedia`);
|
|
if (!text(source.snapshotPrefix, `${path}.source.snapshotPrefix`).startsWith("refs/unidesk/snapshots/")) throw new Error(`${path}.source.snapshotPrefix must be immutable`);
|
|
if (boolean(ci.serviceAccountAutomount, `${path}.ci.serviceAccountAutomount`) !== false) throw new Error(`${path}.ci.serviceAccountAutomount must be false`);
|
|
if (boolean(publicExposure.enabled, `${path}.deployment.publicExposure.enabled`) !== true) throw new Error(`${path}.deployment.publicExposure.enabled must be true`);
|
|
if (integer(publicExposure.hostPort, `${path}.deployment.publicExposure.hostPort`) !== 4317) throw new Error(`${path}.deployment.publicExposure.hostPort must be 4317`);
|
|
validateAccessSecret(deployment, `${path}.deployment`);
|
|
const gitopsWriteUrl = text(gitops.writeUrl, `${path}.gitops.writeUrl`);
|
|
if (!gitopsWriteUrl.startsWith("http://gitea-http.")) throw new Error(`${path}.gitops.writeUrl must use internal Gitea authority`);
|
|
return {
|
|
id,
|
|
node: id,
|
|
lane: text(value.lane, `${path}.lane`),
|
|
route: text(value.route, `${path}.route`),
|
|
ci: {
|
|
namespace: kubernetesName(ci.namespace, `${path}.ci.namespace`),
|
|
pipeline: kubernetesName(ci.pipeline, `${path}.ci.pipeline`),
|
|
pipelineRunPrefix: kubernetesName(ci.pipelineRunPrefix, `${path}.ci.pipelineRunPrefix`),
|
|
serviceAccountName: kubernetesName(ci.serviceAccountName, `${path}.ci.serviceAccountName`),
|
|
serviceAccountAutomount: false,
|
|
roleBindingName: kubernetesName(ci.roleBindingName, `${path}.ci.roleBindingName`),
|
|
workspaceSize: text(ci.workspaceSize, `${path}.ci.workspaceSize`),
|
|
pipelineTimeout: text(ci.pipelineTimeout, `${path}.ci.pipelineTimeout`),
|
|
toolImage: text(ci.toolImage, `${path}.ci.toolImage`),
|
|
buildkitImage: text(ci.buildkitImage, `${path}.ci.buildkitImage`),
|
|
},
|
|
source: {
|
|
repository: "pikainc/selfmedia",
|
|
worktreeRemote: url(source.worktreeRemote, `${path}.source.worktreeRemote`),
|
|
branch: text(source.branch, `${path}.source.branch`),
|
|
readUrl: url(source.readUrl, `${path}.source.readUrl`),
|
|
snapshotPrefix: text(source.snapshotPrefix, `${path}.source.snapshotPrefix`),
|
|
},
|
|
build: {
|
|
...structuredClone(build),
|
|
dockerfile: relativePath(build.dockerfile, `${path}.build.dockerfile`),
|
|
imageRepository: text(build.imageRepository, `${path}.build.imageRepository`),
|
|
networkMode: text(build.networkMode, `${path}.build.networkMode`),
|
|
proxy: structuredClone(proxy),
|
|
},
|
|
gitops: {
|
|
...structuredClone(gitops),
|
|
readUrl: url(gitops.readUrl, `${path}.gitops.readUrl`),
|
|
writeUrl: url(gitops.writeUrl, `${path}.gitops.writeUrl`),
|
|
branch: text(gitops.branch, `${path}.gitops.branch`),
|
|
manifestPath: relativePath(gitops.manifestPath, `${path}.gitops.manifestPath`),
|
|
releaseStatePath: relativePath(gitops.releaseStatePath, `${path}.gitops.releaseStatePath`),
|
|
credentialSecretName: kubernetesName(gitops.credentialSecretName, `${path}.gitops.credentialSecretName`),
|
|
credentialTokenKey: text(gitops.credentialTokenKey, `${path}.gitops.credentialTokenKey`),
|
|
credentialUsername: text(gitops.credentialUsername, `${path}.gitops.credentialUsername`),
|
|
},
|
|
deployment: structuredClone(deployment),
|
|
};
|
|
}
|
|
|
|
function validateAccessSecret(deployment: Record<string, unknown>, path: string): void {
|
|
const secrets = record(deployment.secrets, `${path}.secrets`);
|
|
const access = record(secrets.access, `${path}.secrets.access`);
|
|
const target = record(access.target, `${path}.secrets.access.target`);
|
|
absolutePath(access.sourceRef, `${path}.secrets.access.sourceRef`);
|
|
kubernetesName(target.secretName, `${path}.secrets.access.target.secretName`);
|
|
if (boolean(target.readOnly, `${path}.secrets.access.target.readOnly`) !== true) {
|
|
throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.readOnly must be true`);
|
|
}
|
|
if (!Array.isArray(target.files) || target.files.length === 0) throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.files must be a non-empty array`);
|
|
const targetKeys = new Set<string>();
|
|
const mountPaths = new Set<string>();
|
|
target.files.forEach((value, index) => {
|
|
const file = record(value, `${path}.secrets.access.target.files[${index}]`);
|
|
const targetKey = text(file.targetKey, `${path}.secrets.access.target.files[${index}].targetKey`);
|
|
const mountPath = absolutePath(file.mountPath, `${path}.secrets.access.target.files[${index}].mountPath`);
|
|
if (targetKeys.has(targetKey)) throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.files contains duplicate targetKey ${targetKey}`);
|
|
if (mountPaths.has(mountPath)) throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.files contains duplicate mountPath ${mountPath}`);
|
|
targetKeys.add(targetKey);
|
|
mountPaths.add(mountPath);
|
|
});
|
|
}
|
|
|
|
function parseCutoverTarget(id: string, value: Record<string, unknown>): SelfMediaCutoverTarget {
|
|
const path = `cutover.targets.${id}`;
|
|
const source = record(value.source, `${path}.source`);
|
|
const destination = record(value.destination, `${path}.destination`);
|
|
const prepare = record(value.prepare, `${path}.prepare`);
|
|
const rollback = record(value.rollback, `${path}.rollback`);
|
|
const mode = text(value.mode, `${path}.mode`);
|
|
if (mode !== "host-process-to-kubernetes") throw new Error(`${path}.mode must be host-process-to-kubernetes`);
|
|
if (boolean(prepare.requiresFinalConfirmation, `${path}.prepare.requiresFinalConfirmation`) !== true) throw new Error(`${path}.prepare.requiresFinalConfirmation must be true`);
|
|
return {
|
|
id,
|
|
mode,
|
|
source: {
|
|
workspace: absolutePath(source.workspace, `${path}.source.workspace`),
|
|
publicAddress: url(source.publicAddress, `${path}.source.publicAddress`),
|
|
healthUrl: url(source.healthUrl, `${path}.source.healthUrl`),
|
|
stopCommand: stringArray(source.stopCommand, `${path}.source.stopCommand`),
|
|
startCommand: stringArray(source.startCommand, `${path}.source.startCommand`),
|
|
dataPaths: stringArray(source.dataPaths, `${path}.source.dataPaths`).map((item, index) => relativePath(item, `${path}.source.dataPaths[${index}]`)),
|
|
excludes: stringArray(source.excludes, `${path}.source.excludes`).map((item, index) => relativePath(item, `${path}.source.excludes[${index}]`)),
|
|
},
|
|
destination: {
|
|
route: text(destination.route, `${path}.destination.route`),
|
|
namespace: kubernetesName(destination.namespace, `${path}.destination.namespace`),
|
|
application: kubernetesName(destination.application, `${path}.destination.application`),
|
|
publicAddress: url(destination.publicAddress, `${path}.destination.publicAddress`),
|
|
healthUrl: url(destination.healthUrl, `${path}.destination.healthUrl`),
|
|
dataClaim: kubernetesName(destination.dataClaim, `${path}.destination.dataClaim`),
|
|
codexClaim: kubernetesName(destination.codexClaim, `${path}.destination.codexClaim`),
|
|
},
|
|
prepare: {
|
|
requiresFinalConfirmation: true,
|
|
phases: stringArray(prepare.phases, `${path}.prepare.phases`),
|
|
},
|
|
rollback: {
|
|
phases: stringArray(rollback.phases, `${path}.rollback.phases`),
|
|
dataPolicy: text(rollback.dataPolicy, `${path}.rollback.dataPolicy`),
|
|
},
|
|
};
|
|
}
|
|
|
|
function record(value: unknown, path: string): Record<string, unknown> {
|
|
if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${selfMediaConfigRef}.${path} must be an object`);
|
|
return value as Record<string, unknown>;
|
|
}
|
|
|
|
function text(value: unknown, path: string): string {
|
|
if (typeof value !== "string" || value.length === 0 || value.includes("\n")) throw new Error(`${selfMediaConfigRef}.${path} must be a non-empty single-line string`);
|
|
return value;
|
|
}
|
|
|
|
function integer(value: unknown, path: string): number {
|
|
if (!Number.isInteger(value)) throw new Error(`${selfMediaConfigRef}.${path} must be an integer`);
|
|
return value as number;
|
|
}
|
|
|
|
function boolean(value: unknown, path: string): boolean {
|
|
if (typeof value !== "boolean") throw new Error(`${selfMediaConfigRef}.${path} must be a boolean`);
|
|
return value;
|
|
}
|
|
|
|
function stringArray(value: unknown, path: string): string[] {
|
|
if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.length === 0 || item.includes("\n"))) throw new Error(`${selfMediaConfigRef}.${path} must be an array of non-empty single-line strings`);
|
|
return [...value] as string[];
|
|
}
|
|
|
|
function kubernetesName(value: unknown, path: string): string {
|
|
const result = text(value, path);
|
|
if (!/^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/u.test(result) || result.length > 63) throw new Error(`${selfMediaConfigRef}.${path} must be a Kubernetes name`);
|
|
return result;
|
|
}
|
|
|
|
function absolutePath(value: unknown, path: string): string {
|
|
const result = text(value, path);
|
|
if (!result.startsWith("/") || result.split("/").includes("..")) throw new Error(`${selfMediaConfigRef}.${path} must be an absolute path without ..`);
|
|
return result;
|
|
}
|
|
|
|
function relativePath(value: unknown, path: string): string {
|
|
const result = text(value, path);
|
|
if (result.startsWith("/") || result.split("/").includes("..")) throw new Error(`${selfMediaConfigRef}.${path} must be a relative path without ..`);
|
|
return result;
|
|
}
|
|
|
|
function url(value: unknown, path: string): string {
|
|
const result = text(value, path);
|
|
const parsed = new URL(result);
|
|
if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`${selfMediaConfigRef}.${path} must use http or https`);
|
|
if (parsed.username.length > 0 || parsed.password.length > 0) throw new Error(`${selfMediaConfigRef}.${path} must not contain credentials`);
|
|
return result;
|
|
}
|