74 lines
2.8 KiB
Bash
74 lines
2.8 KiB
Bash
 
|
#!/usr/bin/env bash
|
||
|
|
# Packet Station launcher on a VM. The native counterpart of docker/entrypoint.sh.
|
||
|
|
# The systemd units and ps-run start every packetstation command through it.
|
||
|
|
#
|
||
|
|
# Usage: ps-launch.sh app | worker | migrate | doctor [...] | job run <name> | version | healthcheck app|worker | ...
|
||
|
|
#
|
||
|
|
# It runs from a release folder, /opt/packetstation/<release>/deploy/vm/ps-launch.sh, and uses that
|
||
|
|
# release's venv and built frontend. systemd has already loaded /etc/packetstation/packetstation.env.
|
||
|
|
#
|
||
|
|
# Secrets: each unit hands its own secrets to the service as systemd credentials (LoadCredential=),
|
||
|
|
# so the app never sees the VISUAL or M-Files password. When $CREDENTIALS_DIRECTORY holds a known
|
||
|
|
# secret, the matching *_FILE setting is pointed at it. MFilesKit reads its password from the
|
||
|
|
# environment only, so MFILES_PASSWORD is exported from MFILES_PASSWORD_FILE, as the entrypoint does.
|
||
|
|
# No value is ever printed.
|
||
|
|
#
|
||
|
|
# Set here, over the env file: STATIC_DIR and PS_BUILD (from the release), WORKER_BEAT_FILE, TZ, LANG.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
self="$(readlink -f -- "${BASH_SOURCE[0]}")"
|
||
|
|
release="$(cd -- "$(dirname -- "$self")/../.." && pwd -P)"
|
||
|
|
venv="${PS_VENV:-$release/venv}"
|
||
|
|
|
||
|
|
# secret name (the credential id and the file name in /etc/packetstation/secrets) and its setting
|
||
|
|
cred_map='postgres_app_password PG_APP_PASSWORD_FILE
|
||
|
|
postgres_migrate_password PG_MIGRATE_PASSWORD_FILE
|
||
|
|
visualkit_password VISUAL_PASSWORD_FILE
|
||
|
|
mfileskit_password MFILES_PASSWORD_FILE
|
||
|
|
ldap_bind_password LDAP_PASSWORD_FILE
|
||
|
|
session_key SESSION_KEY_FILE
|
||
|
|
seal_key SEAL_KEY_FILE'
|
||
|
|
|
||
|
|
if [[ -n "${CREDENTIALS_DIRECTORY:-}" ]]; then
|
||
|
|
while read -r name var; do
|
||
|
|
if [[ -r "$CREDENTIALS_DIRECTORY/$name" ]]; then
|
||
|
|
export "$var=$CREDENTIALS_DIRECTORY/$name"
|
||
|
|
fi
|
||
|
|
done <<< "$cred_map"
|
||
|
|
fi
|
||
|
|
unset cred_map name var
|
||
|
|
|
||
|
|
mfiles_secret="${MFILES_PASSWORD_FILE:-}"
|
||
|
|
if [[ -n "$mfiles_secret" && -r "$mfiles_secret" ]]; then
|
||
|
|
MFILES_PASSWORD="$(<"$mfiles_secret")"
|
||
|
|
# Drop a trailing carriage return left by an editor on Windows.
|
||
|
|
MFILES_PASSWORD="${MFILES_PASSWORD%$'\r'}"
|
||
|
|
export MFILES_PASSWORD
|
||
|
|
fi
|
||
|
|
unset mfiles_secret
|
||
|
|
|
||
|
|
build="dev"
|
||
|
|
if [[ -r "$release/BUILD" ]]; then
|
||
|
|
build="$(head -n 1 -- "$release/BUILD")"
|
||
|
|
build="${build%$'\r'}"
|
||
|
|
fi
|
||
|
|
|
||
|
|
export PATH="$venv/bin:/usr/local/bin:/usr/bin:/bin"
|
||
|
|
export STATIC_DIR="$release/static"
|
||
|
|
export PS_BUILD="$build"
|
||
|
|
# The worker unit makes /run/packetstation (RuntimeDirectory=). The heartbeat lives there so
|
||
|
|
# `ps-run healthcheck worker` reads the same file the worker writes.
|
||
|
|
export WORKER_BEAT_FILE=/run/packetstation/worker.beat
|
||
|
|
# The same as the containers: UTC process clock, UTF-8, unbuffered logs to the journal.
|
||
|
|
export TZ=UTC
|
||
|
|
export LANG=C.UTF-8
|
||
|
|
export PYTHONUNBUFFERED=1
|
||
|
|
export PYTHONDONTWRITEBYTECODE=1
|
||
|
|
unset build self
|
||
|
|
|
||
|
|
if [[ $# -eq 0 ]]; then
|
||
|
|
set -- app
|
||
|
|
fi
|
||
|
|
|
||
|
|
exec "$venv/bin/packetstation" "$@"
|