55 lines
1.9 KiB
Bash
55 lines
1.9 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -Eeuo pipefail
|
||
|
|
|
||
|
|
# shellcheck source=lib.sh
|
||
|
|
source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"
|
||
|
|
|
||
|
|
env_file="${1:-/etc/lehuo/lehuo.env}"
|
||
|
|
require_command docker
|
||
|
|
require_command curl
|
||
|
|
require_command openssl
|
||
|
|
require_env_file "$env_file"
|
||
|
|
|
||
|
|
docker version >/dev/null
|
||
|
|
docker compose version >/dev/null
|
||
|
|
|
||
|
|
required_keys=(IMAGE_TAG PUBLIC_HOST FILES_HOST TLS_CERT_PATH TLS_KEY_PATH BACKUP_DIR DATABASE_URL REDIS_URL FIELD_ENCRYPTION_KEY ADMIN_WEB_ORIGIN)
|
||
|
|
for key in "${required_keys[@]}"; do
|
||
|
|
value="$(env_value "$env_file" "$key")"
|
||
|
|
[[ -n "$value" && "$value" != replace-* ]] || {
|
||
|
|
printf '环境变量缺失或仍为占位值：%s\n' "$key" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
done
|
||
|
|
|
||
|
|
image_tag="$(env_value "$env_file" IMAGE_TAG)"
|
||
|
|
[[ "$image_tag" != 'latest' ]] || { echo '禁止使用 latest 镜像标签。' >&2; exit 1; }
|
||
|
|
|
||
|
|
public_host="$(env_value "$env_file" PUBLIC_HOST)"
|
||
|
|
files_host="$(env_value "$env_file" FILES_HOST)"
|
||
|
|
[[ "$public_host" != "$files_host" ]] || { echo 'PUBLIC_HOST 与 FILES_HOST 必须不同。' >&2; exit 1; }
|
||
|
|
|
||
|
|
cert_path="$(env_value "$env_file" TLS_CERT_PATH)"
|
||
|
|
key_path="$(env_value "$env_file" TLS_KEY_PATH)"
|
||
|
|
[[ -r "$cert_path" && -r "$key_path" ]] || { echo 'TLS 证书或私钥不存在/不可读。' >&2; exit 1; }
|
||
|
|
openssl x509 -in "$cert_path" -noout -checkend 604800 >/dev/null || {
|
||
|
|
echo 'TLS 证书将在 7 天内过期或无效。' >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
openssl x509 -in "$cert_path" -noout -checkhost "$public_host" >/dev/null || {
|
||
|
|
printf 'TLS 证书不包含管理端域名：%s\n' "$public_host" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
openssl x509 -in "$cert_path" -noout -checkhost "$files_host" >/dev/null || {
|
||
|
|
printf 'TLS 证书不包含文件域名：%s\n' "$files_host" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
openssl pkey -in "$key_path" -noout -check >/dev/null
|
||
|
|
|
||
|
|
compose "$env_file" config --quiet
|
||
|
|
|
||
|
|
available_kb="$(df -Pk "$(repo_root)" | awk 'NR==2 {print $4}')"
|
||
|
|
((available_kb >= 10 * 1024 * 1024)) || { echo '可用磁盘不足 10 GiB。' >&2; exit 1; }
|
||
|
|
|
||
|
|
echo 'Ubuntu 生产部署预检通过。'
|