362 lines
16 KiB
Bash
Executable File
362 lines
16 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
cp \
|
|
"$REPO_ROOT/start.sh" \
|
|
"$REPO_ROOT/https.sh" \
|
|
"$REPO_ROOT/docker-compose.yml" \
|
|
"$REPO_ROOT/.env.sample" \
|
|
"$REPO_ROOT/.env.tools.sample" \
|
|
"$REPO_ROOT/.env.ASG.sample" \
|
|
"$REPO_ROOT/.env.AMS.sample" \
|
|
"$REPO_ROOT/easyai-proxy.conf.sample" \
|
|
"$TMP_DIR/"
|
|
mkdir -p "$TMP_DIR/scripts"
|
|
mkdir -p "$TMP_DIR/system-update"
|
|
cp \
|
|
"$REPO_ROOT/scripts/init-security-env.sh" \
|
|
"$REPO_ROOT/scripts/init-security-origin.sh" \
|
|
"$REPO_ROOT/scripts/init-public-api-base-url.sh" \
|
|
"$REPO_ROOT/scripts/init-server-http-bind-ip.sh" \
|
|
"$REPO_ROOT/scripts/check-redis-persistence.sh" \
|
|
"$TMP_DIR/scripts/"
|
|
cp "$REPO_ROOT/system-update/release-manifest.json" "$TMP_DIR/system-update/"
|
|
|
|
cd "$TMP_DIR"
|
|
|
|
reset_case() {
|
|
rm -f \
|
|
.env \
|
|
.env.tools \
|
|
.env.ASG \
|
|
.env.AMS \
|
|
easyai-proxy.conf \
|
|
10.0.0.8.conf \
|
|
demo.example.com.conf
|
|
}
|
|
|
|
assert_compression_config() {
|
|
local config_file="$1"
|
|
grep -q '^ gzip on;' "$config_file"
|
|
grep -q '^ gzip_vary on;' "$config_file"
|
|
grep -q '^ gzip_min_length 1024;' "$config_file"
|
|
grep -q '^ application/javascript$' "$config_file"
|
|
grep -q '^ text/css$' "$config_file"
|
|
grep -q '^ text/javascript$' "$config_file"
|
|
if grep -q 'text/event-stream' "$config_file"; then
|
|
echo "Unexpected SSE compression type in $config_file" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_sandbox_public_access_disabled() {
|
|
local config_file="$1"
|
|
grep -q '^ location = /api/sandbox {' "$config_file"
|
|
grep -q '^ location \^~ /api/sandbox/ {' "$config_file"
|
|
grep -q '^ location = /jupyterlab {' "$config_file"
|
|
grep -q '^ location \^~ /jupyterlab/ {' "$config_file"
|
|
grep -q '^ location = /sandbox {' "$config_file"
|
|
grep -q '^ location \^~ /sandbox/ {' "$config_file"
|
|
if grep -Eq 'proxy_pass http://127\.0\.0\.1:(8081|8888)' "$config_file"; then
|
|
echo "Unexpected public Sandbox/Jupyter proxy in $config_file" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_high_risk_public_access_disabled() {
|
|
local config_file="$1"
|
|
grep -q '^ location = /api/integration/platform-api/execute {' "$config_file"
|
|
grep -q '^ location = /api/auth/sign/token {' "$config_file"
|
|
grep -q '^ location = /api/auth/verify/token {' "$config_file"
|
|
grep -q '^ location = /logs-web {' "$config_file"
|
|
grep -q '^ location \^~ /logs-web/ {' "$config_file"
|
|
if grep -Eq 'proxy_pass .*(:8080|platform-api/execute|auth/(sign|verify)/token)' "$config_file"; then
|
|
echo "Unexpected high-risk public proxy in $config_file" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_compose_exposure() {
|
|
local expected_server_host_ip="$1"
|
|
local expected_proxy_host_ip="$2"
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
expected_server = sys.argv[1]
|
|
expected_proxy = sys.argv[2]
|
|
config = json.load(sys.stdin)
|
|
sandbox_ports = config["services"]["sandbox"].get("ports") or []
|
|
assert sandbox_ports == [], f"sandbox ports published: {sandbox_ports}"
|
|
server_ports = config["services"]["easyai-server"].get("ports") or []
|
|
assert len(server_ports) == 1, server_ports
|
|
assert server_ports[0].get("host_ip") == expected_server, server_ports
|
|
for service in ("easyai-web", "ws-gateway", "easyai-asg"):
|
|
ports = config["services"][service].get("ports") or []
|
|
assert len(ports) == 1, (service, ports)
|
|
assert ports[0].get("host_ip") == expected_proxy, (service, ports)
|
|
' "$expected_server_host_ip" "$expected_proxy_host_ip"
|
|
}
|
|
|
|
assert_canvas_ws_auth_config() {
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
config = json.load(sys.stdin)
|
|
server_env = config["services"]["easyai-server"].get("environment") or {}
|
|
gateway_env = config["services"]["ws-gateway"].get("environment") or {}
|
|
server_secret = str(server_env.get("WS_AUTH_WS_TICKET_SECRET") or "")
|
|
gateway_secret = str(gateway_env.get("WS_AUTH_WS_TICKET_SECRET") or "")
|
|
assert len(server_secret.encode()) >= 32, "server-main WS ticket secret is missing or too short"
|
|
assert server_secret == gateway_secret, "server-main and ws-gateway WS ticket secrets differ"
|
|
methods = {item.strip() for item in str(gateway_env.get("WS_AUTH_METHODS") or "").split(",") if item.strip()}
|
|
assert "ws_ticket" in methods, f"ws-gateway does not advertise ws_ticket: {sorted(methods)}"
|
|
'
|
|
}
|
|
|
|
assert_redis_startup_contract() {
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
services = json.load(sys.stdin)["services"]
|
|
redis = services["redis"]
|
|
assert any(volume.get("target") == "/data" for volume in redis.get("volumes") or []), redis.get("volumes")
|
|
assert redis["healthcheck"]["test"] == ["CMD", "redis-cli", "ping"]
|
|
assert services["easyai-server"]["depends_on"]["redis"]["condition"] == "service_healthy"
|
|
'
|
|
}
|
|
|
|
assert_compose_security() {
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
config = json.load(sys.stdin)
|
|
services = config["services"]
|
|
|
|
assert set(services["sandbox"]["networks"]) == {"sandbox-network"}, services["sandbox"]["networks"]
|
|
assert {"easyai", "sandbox-network"}.issubset(services["easyai-server"]["networks"]), services["easyai-server"]["networks"]
|
|
assert services["easyai-server"]["environment"]["GATEWAY_INBOUND_TCP_LISTEN_HOST"] == "172.21.0.6", services["easyai-server"]["environment"]["GATEWAY_INBOUND_TCP_LISTEN_HOST"]
|
|
assert services["mongo"].get("privileged") is not True, services["mongo"].get("privileged")
|
|
|
|
for service in ("mongo", "rabbitmq", "video-edit", "dozzle", "agent-memory"):
|
|
for port in services[service].get("ports") or []:
|
|
assert port.get("host_ip") == "127.0.0.1", (service, port)
|
|
|
|
watchtower = services["watchtower"]
|
|
command = " ".join(watchtower.get("command") or [])
|
|
assert "http-api-update" not in command, command
|
|
assert "WATCHTOWER_HTTP_API_TOKEN" not in (watchtower.get("environment") or {}), watchtower.get("environment")
|
|
watchtower_mounts = {(item.get("source"), item.get("target")) for item in watchtower.get("volumes") or []}
|
|
assert any(target == "/config.json" for _, target in watchtower_mounts), watchtower_mounts
|
|
assert services["dozzle"]["environment"]["DOZZLE_ENABLE_DOWNLOAD"] == "false", services["dozzle"]["environment"]
|
|
'
|
|
}
|
|
|
|
assert_managed_update_contract() {
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
services = json.load(sys.stdin)["services"]
|
|
updater = services["easyai-updater"]
|
|
server = services["easyai-server"]
|
|
watchtower = services["watchtower"]
|
|
|
|
assert updater.get("ports") in (None, []), updater.get("ports")
|
|
assert updater.get("read_only") is True, updater.get("read_only")
|
|
assert set(updater.get("cap_drop") or []) == {"ALL"}, updater.get("cap_drop")
|
|
assert "no-new-privileges:true" in (updater.get("security_opt") or []), updater.get("security_opt")
|
|
mounts = {(item.get("source"), item.get("target")) for item in updater.get("volumes") or []}
|
|
assert ("/var/run/docker.sock", "/var/run/docker.sock") in mounts, mounts
|
|
assert any(target == "/var/lib/easyai-updater" for _, target in mounts), mounts
|
|
assert any(target == "/run/secrets/docker-config.json" for _, target in mounts), mounts
|
|
assert any(target == "/etc/easyai-updater/release-manifest.json" for _, target in mounts), mounts
|
|
|
|
server_env = server.get("environment") or {}
|
|
updater_env = updater.get("environment") or {}
|
|
token = str(server_env.get("SYSTEM_UPDATE_INTERNAL_TOKEN") or "")
|
|
assert len(token.encode()) >= 32, "managed updater token is missing or too short"
|
|
assert token == str(updater_env.get("SYSTEM_UPDATE_INTERNAL_TOKEN") or ""), "server/updater tokens differ"
|
|
assert server_env.get("SYSTEM_UPDATE_MODE") == "managed", server_env.get("SYSTEM_UPDATE_MODE")
|
|
assert str(server_env.get("EASYAI_DEPLOYMENT_SCHEMA_VERSION")) == "2"
|
|
assert str(updater_env.get("UPDATE_HEALTH_TIMEOUT_MS")) == "300000"
|
|
assert updater_env.get("DOCKER_CONFIG_FILE") == "/run/secrets/docker-config.json"
|
|
assert updater_env.get("UPDATE_MANIFEST_FILE") == "/etc/easyai-updater/release-manifest.json"
|
|
assert updater.get("labels", {}).get("com.centurylinklabs.watchtower.enable") == "true"
|
|
assert watchtower.get("environment", {}).get("WATCHTOWER_POLL_INTERVAL") == "86400"
|
|
assert watchtower.get("environment", {}).get("WATCHTOWER_CLEANUP") == "true"
|
|
assert "easyai-updater" in (watchtower.get("command") or []), watchtower.get("command")
|
|
|
|
for service in ("easyai-server", "ws-gateway", "easyai-web"):
|
|
labels = services[service].get("labels") or {}
|
|
assert labels.get("com.centurylinklabs.watchtower.enable") == "false", (service, labels)
|
|
'
|
|
|
|
python3 - <<'PY'
|
|
import json
|
|
import re
|
|
from pathlib import Path
|
|
|
|
manifest = json.loads(Path("system-update/release-manifest.json").read_text())
|
|
assert manifest["schemaVersion"] == 1
|
|
assert manifest["channel"] == "stable"
|
|
assert manifest["platform"] == "linux/amd64"
|
|
assert manifest["managedUpdateAllowed"] is True
|
|
assert manifest["rollbackSafe"] is True
|
|
assert manifest["minimumUpdaterVersion"] == "1.0.0"
|
|
assert manifest["minimumDeploymentSchemaVersion"] == 2
|
|
assert int(manifest["requiredFreeBytes"]) > 0
|
|
components = {item["key"]: item for item in manifest["components"]}
|
|
assert set(components) == {"server-main", "ws-gateway", "web"}
|
|
expected_images = {
|
|
"server-main": "registry.cn-shanghai.aliyuncs.com/comfy-ai/comfy-server",
|
|
"ws-gateway": "registry.cn-shanghai.aliyuncs.com/easyaigc/wsgateway",
|
|
"web": "registry.cn-shanghai.aliyuncs.com/comfy-ai/one-ai",
|
|
}
|
|
for key, image in expected_images.items():
|
|
assert components[key]["image"] == image
|
|
assert re.fullmatch(r"sha256:[a-f0-9]{64}", components[key]["digest"])
|
|
assert int(components[key]["imageSizeBytes"]) > 0
|
|
PY
|
|
}
|
|
|
|
assert_legacy_update_contract() {
|
|
local legacy_env="$TMP_DIR/.env.legacy"
|
|
grep -Ev '^(SYSTEM_UPDATE_MODE|COMPOSE_PROFILES|WATCHTOWER_CORE_UPDATE_ENABLED|WATCHTOWER_UPDATE_TARGET|SYSTEM_UPDATER_UPDATE_INTERVAL_SECONDS|WATCHTOWER_CLEANUP|UPDATE_HEALTH_TIMEOUT_MS|DOCKER_CONFIG_FILE|SYSTEM_UPDATE_INTERNAL_TOKEN|EASYAI_DEPLOYMENT_SCHEMA_VERSION)=' .env > "$legacy_env"
|
|
docker compose --env-file "$legacy_env" config --format json 2>/dev/null | python3 -c '
|
|
import json, sys
|
|
services = json.load(sys.stdin)["services"]
|
|
assert "easyai-updater" not in services, sorted(services)
|
|
server_env = services["easyai-server"].get("environment") or {}
|
|
assert server_env.get("SYSTEM_UPDATE_MODE") == "legacy_watchtower", server_env.get("SYSTEM_UPDATE_MODE")
|
|
assert str(server_env.get("EASYAI_DEPLOYMENT_SCHEMA_VERSION")) == "1"
|
|
assert "easyai-updater" not in (services["watchtower"].get("command") or []), services["watchtower"].get("command")
|
|
for service in ("easyai-server", "ws-gateway", "easyai-web"):
|
|
labels = services[service].get("labels") or {}
|
|
assert labels.get("com.centurylinklabs.watchtower.enable") == "true", (service, labels)
|
|
'
|
|
}
|
|
|
|
sed -i.bak 's/^SERVER_HTTP_PORT=.*/SERVER_HTTP_PORT=4100/' .env.sample
|
|
rm -f .env.sample.bak
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=ip \
|
|
DEPLOY_IP=10.0.0.8 \
|
|
bash start.sh > "$TMP_DIR/first-install.log"
|
|
grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
|
|
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://10.0.0.8/socket.io' .env
|
|
grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8/api' .env
|
|
grep -qx 'CONFIG_SECURITY_ORIGIN=' .env
|
|
grep -qx 'EASYAI_PROXY_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'EASYAI_INFRA_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6' .env
|
|
grep -qx 'SERVER_HTTP_BIND_IP=127.0.0.1' .env
|
|
grep -q 'server_name 10.0.0.8;' 10.0.0.8.conf
|
|
if grep -q 'www.10.0.0.8' 10.0.0.8.conf; then
|
|
echo "IP proxy config must not contain the domain-only www redirect" >&2
|
|
exit 1
|
|
fi
|
|
grep -q 'proxy_pass http://127.0.0.1:3010/;' 10.0.0.8.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:4100/;' 10.0.0.8.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:3002;' 10.0.0.8.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:3003/;' 10.0.0.8.conf
|
|
grep -q 'location /socket.io {' 10.0.0.8.conf
|
|
assert_compression_config 10.0.0.8.conf
|
|
assert_sandbox_public_access_disabled 10.0.0.8.conf
|
|
assert_high_risk_public_access_disabled 10.0.0.8.conf
|
|
grep -Fq '访问地址: http://10.0.0.8' "$TMP_DIR/first-install.log"
|
|
initial_admin_password="$(awk -F= '$1 == "CONFIG_INITIAL_ADMIN_PASSWORD" { print $2; exit }' .env)"
|
|
[ "${#initial_admin_password}" -ge 12 ] || {
|
|
echo "Initial admin password was not generated" >&2
|
|
exit 1
|
|
}
|
|
grep -Fq '登录账号: admin' "$TMP_DIR/first-install.log"
|
|
grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/first-install.log"
|
|
grep -Fq '生命周期: 仅在数据库首次创建 admin 时使用；创建后修改 .env 不会重置密码。' "$TMP_DIR/first-install.log"
|
|
grep -Fq '有效期: 初始密码没有独立过期时间，在管理员修改密码前持续有效。' "$TMP_DIR/first-install.log"
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=ip \
|
|
DEPLOY_IP=10.0.0.8 \
|
|
bash start.sh > "$TMP_DIR/existing-env.log"
|
|
grep -Fq '管理员账号: admin（本次部署不会生成或重置已有密码）' "$TMP_DIR/existing-env.log"
|
|
if grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/existing-env.log"; then
|
|
echo "Existing-env deployment must not report CONFIG_INITIAL_ADMIN_PASSWORD as the current login password" >&2
|
|
exit 1
|
|
fi
|
|
if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
|
|
assert_compose_exposure 127.0.0.1 127.0.0.1
|
|
assert_canvas_ws_auth_config
|
|
assert_compose_security
|
|
assert_redis_startup_contract
|
|
assert_managed_update_contract
|
|
assert_legacy_update_contract
|
|
fi
|
|
|
|
reset_case
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=domain \
|
|
DEPLOY_DOMAIN=demo.example.com \
|
|
DEPLOY_HTTPS=false \
|
|
bash start.sh >/dev/null
|
|
grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
|
|
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://demo.example.com/socket.io' .env
|
|
grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://demo.example.com/api' .env
|
|
grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' demo.example.com.conf
|
|
grep -q 'proxy_set_header X-Forwarded-Port $server_port;' demo.example.com.conf
|
|
grep -q "proxy_set_header X-Original-Prefix '/api';" demo.example.com.conf
|
|
grep -q 'location = /api {' demo.example.com.conf
|
|
assert_compression_config demo.example.com.conf
|
|
assert_sandbox_public_access_disabled demo.example.com.conf
|
|
assert_high_risk_public_access_disabled demo.example.com.conf
|
|
grep -qx 'SERVER_HTTP_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'EASYAI_PROXY_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'EASYAI_INFRA_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6' .env
|
|
if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
|
|
assert_compose_exposure 127.0.0.1 127.0.0.1
|
|
assert_compose_security
|
|
fi
|
|
|
|
# 直接验证 https.sh 的缺省配置生成函数会采用完整模板，而不是只代理 3010。
|
|
eval "$(awk '
|
|
/^create_conf_by_template\(\)/ { capture = 1 }
|
|
/^conf_contains_domain\(\)/ { capture = 0 }
|
|
capture { print }
|
|
' https.sh)"
|
|
create_conf_by_template demo.example.com easyai-proxy.conf
|
|
grep -q 'server_name demo.example.com;' easyai-proxy.conf
|
|
grep -q 'location = /api {' easyai-proxy.conf
|
|
grep -q 'location /api/ {' easyai-proxy.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:3001/;' easyai-proxy.conf
|
|
grep -q 'location /socket.io {' easyai-proxy.conf
|
|
grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' easyai-proxy.conf
|
|
assert_compression_config easyai-proxy.conf
|
|
assert_sandbox_public_access_disabled easyai-proxy.conf
|
|
assert_high_risk_public_access_disabled easyai-proxy.conf
|
|
|
|
reset_case
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=domain \
|
|
DEPLOY_DOMAIN=demo.example.com \
|
|
DEPLOY_HTTPS=true \
|
|
bash start.sh >/dev/null
|
|
grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
|
|
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=wss://demo.example.com/socket.io' .env
|
|
grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://demo.example.com/api' .env
|
|
|
|
reset_case
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=ip \
|
|
DEPLOY_IP=10.0.0.8 \
|
|
DEPLOY_PUBLIC_API_BASE_URL=https://edge.example.com:8443/custom-api \
|
|
bash start.sh >/dev/null
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://edge.example.com:8443/custom-api' .env
|
|
|
|
echo "Deployment public URL dry-run tests passed"
|