259 lines
11 KiB
Bash
Executable File
259 lines
11 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
|
|
|
cp \
|
|
"$REPO_ROOT/start.sh" \
|
|
"$REPO_ROOT/https.sh" \
|
|
"$REPO_ROOT/docker-compose.yml" \
|
|
"$REPO_ROOT/.env.sample" \
|
|
"$REPO_ROOT/.env.tools.sample" \
|
|
"$REPO_ROOT/.env.ASG.sample" \
|
|
"$REPO_ROOT/.env.AMS.sample" \
|
|
"$REPO_ROOT/easyai-proxy.conf.sample" \
|
|
"$TMP_DIR/"
|
|
mkdir -p "$TMP_DIR/scripts"
|
|
cp \
|
|
"$REPO_ROOT/scripts/init-security-env.sh" \
|
|
"$REPO_ROOT/scripts/init-public-api-base-url.sh" \
|
|
"$REPO_ROOT/scripts/init-server-http-bind-ip.sh" \
|
|
"$TMP_DIR/scripts/"
|
|
|
|
cd "$TMP_DIR"
|
|
|
|
reset_case() {
|
|
rm -f \
|
|
.env \
|
|
.env.tools \
|
|
.env.ASG \
|
|
.env.AMS \
|
|
easyai-proxy.conf \
|
|
10.0.0.8.conf \
|
|
demo.example.com.conf
|
|
}
|
|
|
|
assert_compression_config() {
|
|
local config_file="$1"
|
|
grep -q '^ gzip on;' "$config_file"
|
|
grep -q '^ gzip_vary on;' "$config_file"
|
|
grep -q '^ gzip_min_length 1024;' "$config_file"
|
|
grep -q '^ application/javascript$' "$config_file"
|
|
grep -q '^ text/css$' "$config_file"
|
|
grep -q '^ text/javascript$' "$config_file"
|
|
if grep -q 'text/event-stream' "$config_file"; then
|
|
echo "Unexpected SSE compression type in $config_file" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_sandbox_public_access_disabled() {
|
|
local config_file="$1"
|
|
grep -q '^ location = /api/sandbox {' "$config_file"
|
|
grep -q '^ location \^~ /api/sandbox/ {' "$config_file"
|
|
grep -q '^ location = /jupyterlab {' "$config_file"
|
|
grep -q '^ location \^~ /jupyterlab/ {' "$config_file"
|
|
grep -q '^ location = /sandbox {' "$config_file"
|
|
grep -q '^ location \^~ /sandbox/ {' "$config_file"
|
|
if grep -Eq 'proxy_pass http://127\.0\.0\.1:(8081|8888)' "$config_file"; then
|
|
echo "Unexpected public Sandbox/Jupyter proxy in $config_file" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_high_risk_public_access_disabled() {
|
|
local config_file="$1"
|
|
grep -q '^ location = /api/integration/platform-api/execute {' "$config_file"
|
|
grep -q '^ location = /api/auth/sign/token {' "$config_file"
|
|
grep -q '^ location = /api/auth/verify/token {' "$config_file"
|
|
grep -q '^ location = /logs-web {' "$config_file"
|
|
grep -q '^ location \^~ /logs-web/ {' "$config_file"
|
|
if grep -Eq 'proxy_pass .*(:8080|platform-api/execute|auth/(sign|verify)/token)' "$config_file"; then
|
|
echo "Unexpected high-risk public proxy in $config_file" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_compose_exposure() {
|
|
local expected_server_host_ip="$1"
|
|
local expected_proxy_host_ip="$2"
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
expected_server = sys.argv[1]
|
|
expected_proxy = sys.argv[2]
|
|
config = json.load(sys.stdin)
|
|
sandbox_ports = config["services"]["sandbox"].get("ports") or []
|
|
assert sandbox_ports == [], f"sandbox ports published: {sandbox_ports}"
|
|
server_ports = config["services"]["easyai-server"].get("ports") or []
|
|
assert len(server_ports) == 1, server_ports
|
|
assert server_ports[0].get("host_ip") == expected_server, server_ports
|
|
for service in ("easyai-web", "ws-gateway", "easyai-asg"):
|
|
ports = config["services"][service].get("ports") or []
|
|
assert len(ports) == 1, (service, ports)
|
|
assert ports[0].get("host_ip") == expected_proxy, (service, ports)
|
|
' "$expected_server_host_ip" "$expected_proxy_host_ip"
|
|
}
|
|
|
|
assert_canvas_ws_auth_config() {
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
config = json.load(sys.stdin)
|
|
server_env = config["services"]["easyai-server"].get("environment") or {}
|
|
gateway_env = config["services"]["ws-gateway"].get("environment") or {}
|
|
server_secret = str(server_env.get("WS_AUTH_WS_TICKET_SECRET") or "")
|
|
gateway_secret = str(gateway_env.get("WS_AUTH_WS_TICKET_SECRET") or "")
|
|
assert len(server_secret.encode()) >= 32, "server-main WS ticket secret is missing or too short"
|
|
assert server_secret == gateway_secret, "server-main and ws-gateway WS ticket secrets differ"
|
|
methods = {item.strip() for item in str(gateway_env.get("WS_AUTH_METHODS") or "").split(",") if item.strip()}
|
|
assert "ws_ticket" in methods, f"ws-gateway does not advertise ws_ticket: {sorted(methods)}"
|
|
'
|
|
}
|
|
|
|
assert_compose_security() {
|
|
docker compose config --format json | python3 -c '
|
|
import json, sys
|
|
config = json.load(sys.stdin)
|
|
services = config["services"]
|
|
|
|
assert set(services["sandbox"]["networks"]) == {"sandbox-network"}, services["sandbox"]["networks"]
|
|
assert {"easyai", "sandbox-network"}.issubset(services["easyai-server"]["networks"]), services["easyai-server"]["networks"]
|
|
assert services["easyai-server"]["environment"]["GATEWAY_INBOUND_TCP_LISTEN_HOST"] == "172.21.0.6", services["easyai-server"]["environment"]["GATEWAY_INBOUND_TCP_LISTEN_HOST"]
|
|
assert services["mongo"].get("privileged") is not True, services["mongo"].get("privileged")
|
|
|
|
for service in ("mongo", "rabbitmq", "video-edit", "dozzle", "agent-memory"):
|
|
for port in services[service].get("ports") or []:
|
|
assert port.get("host_ip") == "127.0.0.1", (service, port)
|
|
|
|
watchtower = services["watchtower"]
|
|
command = " ".join(watchtower.get("command") or [])
|
|
assert "http-api-update" not in command, command
|
|
assert "WATCHTOWER_HTTP_API_TOKEN" not in (watchtower.get("environment") or {}), watchtower.get("environment")
|
|
assert services["dozzle"]["environment"]["DOZZLE_ENABLE_DOWNLOAD"] == "false", services["dozzle"]["environment"]
|
|
'
|
|
}
|
|
|
|
sed -i.bak 's/^SERVER_HTTP_PORT=.*/SERVER_HTTP_PORT=4100/' .env.sample
|
|
rm -f .env.sample.bak
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=ip \
|
|
DEPLOY_IP=10.0.0.8 \
|
|
bash start.sh > "$TMP_DIR/first-install.log"
|
|
grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
|
|
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://10.0.0.8/socket.io' .env
|
|
grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8/api' .env
|
|
grep -qx 'CONFIG_SECURITY_ORIGIN=http://10.0.0.8' .env
|
|
grep -qx 'EASYAI_PROXY_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'EASYAI_INFRA_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6' .env
|
|
grep -qx 'SERVER_HTTP_BIND_IP=127.0.0.1' .env
|
|
grep -q 'server_name 10.0.0.8;' 10.0.0.8.conf
|
|
if grep -q 'www.10.0.0.8' 10.0.0.8.conf; then
|
|
echo "IP proxy config must not contain the domain-only www redirect" >&2
|
|
exit 1
|
|
fi
|
|
grep -q 'proxy_pass http://127.0.0.1:3010/;' 10.0.0.8.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:4100/;' 10.0.0.8.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:3002;' 10.0.0.8.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:3003/;' 10.0.0.8.conf
|
|
grep -q 'location /socket.io {' 10.0.0.8.conf
|
|
assert_compression_config 10.0.0.8.conf
|
|
assert_sandbox_public_access_disabled 10.0.0.8.conf
|
|
assert_high_risk_public_access_disabled 10.0.0.8.conf
|
|
grep -Fq '访问地址: http://10.0.0.8' "$TMP_DIR/first-install.log"
|
|
initial_admin_password="$(awk -F= '$1 == "CONFIG_INITIAL_ADMIN_PASSWORD" { print $2; exit }' .env)"
|
|
[ "${#initial_admin_password}" -ge 12 ] || {
|
|
echo "Initial admin password was not generated" >&2
|
|
exit 1
|
|
}
|
|
grep -Fq '登录账号: admin' "$TMP_DIR/first-install.log"
|
|
grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/first-install.log"
|
|
grep -Fq '生命周期: 仅在数据库首次创建 admin 时使用；创建后修改 .env 不会重置密码。' "$TMP_DIR/first-install.log"
|
|
grep -Fq '有效期: 初始密码没有独立过期时间，在管理员修改密码前持续有效。' "$TMP_DIR/first-install.log"
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=ip \
|
|
DEPLOY_IP=10.0.0.8 \
|
|
bash start.sh > "$TMP_DIR/existing-env.log"
|
|
grep -Fq '管理员账号: admin（本次部署不会生成或重置已有密码）' "$TMP_DIR/existing-env.log"
|
|
if grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/existing-env.log"; then
|
|
echo "Existing-env deployment must not report CONFIG_INITIAL_ADMIN_PASSWORD as the current login password" >&2
|
|
exit 1
|
|
fi
|
|
if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
|
|
assert_compose_exposure 127.0.0.1 127.0.0.1
|
|
assert_canvas_ws_auth_config
|
|
assert_compose_security
|
|
fi
|
|
|
|
reset_case
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=domain \
|
|
DEPLOY_DOMAIN=demo.example.com \
|
|
DEPLOY_HTTPS=false \
|
|
bash start.sh >/dev/null
|
|
grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
|
|
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=ws://demo.example.com/socket.io' .env
|
|
grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://demo.example.com/api' .env
|
|
grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' demo.example.com.conf
|
|
grep -q 'proxy_set_header X-Forwarded-Port $server_port;' demo.example.com.conf
|
|
grep -q "proxy_set_header X-Original-Prefix '/api';" demo.example.com.conf
|
|
grep -q 'location = /api {' demo.example.com.conf
|
|
assert_compression_config demo.example.com.conf
|
|
assert_sandbox_public_access_disabled demo.example.com.conf
|
|
assert_high_risk_public_access_disabled demo.example.com.conf
|
|
grep -qx 'SERVER_HTTP_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'EASYAI_PROXY_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'EASYAI_INFRA_BIND_IP=127.0.0.1' .env
|
|
grep -qx 'GATEWAY_INBOUND_TCP_LISTEN_HOST=172.21.0.6' .env
|
|
if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
|
|
assert_compose_exposure 127.0.0.1 127.0.0.1
|
|
assert_compose_security
|
|
fi
|
|
|
|
# 直接验证 https.sh 的缺省配置生成函数会采用完整模板，而不是只代理 3010。
|
|
eval "$(awk '
|
|
/^create_conf_by_template\(\)/ { capture = 1 }
|
|
/^conf_contains_domain\(\)/ { capture = 0 }
|
|
capture { print }
|
|
' https.sh)"
|
|
create_conf_by_template demo.example.com easyai-proxy.conf
|
|
grep -q 'server_name demo.example.com;' easyai-proxy.conf
|
|
grep -q 'location = /api {' easyai-proxy.conf
|
|
grep -q 'location /api/ {' easyai-proxy.conf
|
|
grep -q 'proxy_pass http://127.0.0.1:3001/;' easyai-proxy.conf
|
|
grep -q 'location /socket.io {' easyai-proxy.conf
|
|
grep -q 'proxy_set_header X-Forwarded-Host $easyai_forwarded_host;' easyai-proxy.conf
|
|
assert_compression_config easyai-proxy.conf
|
|
assert_sandbox_public_access_disabled easyai-proxy.conf
|
|
assert_high_risk_public_access_disabled easyai-proxy.conf
|
|
|
|
reset_case
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=domain \
|
|
DEPLOY_DOMAIN=demo.example.com \
|
|
DEPLOY_HTTPS=true \
|
|
bash start.sh >/dev/null
|
|
grep -qx 'NUXT_PUBLIC_BASE_APIURL=/api' .env
|
|
grep -qx 'NUXT_PUBLIC_BASE_SOCKETURL=wss://demo.example.com/socket.io' .env
|
|
grep -qx 'NUXT_PUBLIC_SG_APIURL=/asg-api' .env
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://demo.example.com/api' .env
|
|
|
|
reset_case
|
|
DEPLOY_NON_INTERACTIVE=1 \
|
|
DEPLOY_DRY_RUN=1 \
|
|
DEPLOY_ACCESS=ip \
|
|
DEPLOY_IP=10.0.0.8 \
|
|
DEPLOY_PUBLIC_API_BASE_URL=https://edge.example.com:8443/custom-api \
|
|
bash start.sh >/dev/null
|
|
grep -qx 'CONFIG_PUBLIC_API_BASE_URL=https://edge.example.com:8443/custom-api' .env
|
|
|
|
echo "Deployment public URL dry-run tests passed"
|