initial codes try 8
This commit is contained in:
@@ -4,72 +4,95 @@ set -euo pipefail
|
||||
log(){ echo "[nats-registration][entrypoint] $*"; }
|
||||
err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
|
||||
|
||||
# Sanity: tools
|
||||
# ---- Tool sanity (only what we use)
|
||||
for bin in curl python; do
|
||||
command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; }
|
||||
if ! command -v "$bin" >/dev/null 2>&1; then
|
||||
err "Missing $bin"
|
||||
exit 2
|
||||
fi
|
||||
done
|
||||
|
||||
# Paths (match Dockerfile ENV)
|
||||
: "${APP_DIR:=/opt/containers/nats-registration-listener}"
|
||||
: "${DATA_DIR:=${APP_DIR}/data}"
|
||||
mkdir -p "${DATA_DIR}"
|
||||
# ---- Paths
|
||||
APP_DIR="${APP_DIR:-/opt/containers/nats-registration-listener}"
|
||||
DATA_DIR="${DATA_DIR:-$APP_DIR/data}"
|
||||
mkdir -p "$DATA_DIR"
|
||||
|
||||
# Required (fed from .env via compose)
|
||||
: "${NATS_SERVERS:?NATS_SERVERS required (space-separated NATS URLs, e.g. 'tls://nats01:4222')}"
|
||||
: "${NATS_SUBJECT:?NATS_SUBJECT required (e.g. 'v1.registration')}"
|
||||
# ---- Required env
|
||||
: "${NATS_SERVERS:?NATS_SERVERS required (e.g. 'nats://host:4222' or 'tls://host:4222')}"
|
||||
: "${NATS_SUBJECT:=v1.registration}" # default to common registration subject
|
||||
|
||||
# Optional with defaults
|
||||
: "${NATS_NAME:=registration-listener}"
|
||||
: "${PRINT_RAW:=}"
|
||||
: "${NATS_QUEUE:=}"
|
||||
# ---- Optional env
|
||||
NATS_NAME="${NATS_NAME:-registration-listener}"
|
||||
PRINT_RAW="${PRINT_RAW:-}"
|
||||
NATS_QUEUE="${NATS_QUEUE:-}"
|
||||
|
||||
# TLS input options (dynamic)
|
||||
# Priority:
|
||||
# 1) TLS_CA -> use as a path (pre-mounted file)
|
||||
# 2) TLS_CA_PEM -> write PEM content to ${DATA_DIR}/tls-ca.pem
|
||||
# 3) TLS_CA_PEM_B64 -> base64 decode to ${DATA_DIR}/tls-ca.pem
|
||||
# 4) TLS_CA_URL -> curl to ${DATA_DIR}/tls-ca.pem
|
||||
: "${TLS_CA:=}"
|
||||
: "${TLS_CA_PEM:=}"
|
||||
: "${TLS_CA_PEM_B64:=}"
|
||||
: "${TLS_CA_URL:=}"
|
||||
: "${TLS_INSECURE:=}"
|
||||
# TLS inputs (all optional)
|
||||
TLS_CA="${TLS_CA:-}"
|
||||
TLS_CA_PEM="${TLS_CA_PEM:-}"
|
||||
TLS_CA_PEM_B64="${TLS_CA_PEM_B64:-}"
|
||||
TLS_CA_URL="${TLS_CA_URL:-}"
|
||||
TLS_INSECURE="${TLS_INSECURE:-}"
|
||||
|
||||
# Auth (optional)
|
||||
: "${NATS_USER:=}"
|
||||
: "${NATS_PASS:=}"
|
||||
: "${NATS_TOKEN:=}"
|
||||
: "${NATS_CREDS:=}" # path to a .creds file if you have one
|
||||
: "${NATS_CREDS_B64:=}" # optional: base64-encoded creds; will be written to DATA_DIR
|
||||
# Auth (all optional)
|
||||
NATS_USER="${NATS_USER:-}"
|
||||
NATS_PASS="${NATS_PASS:-}"
|
||||
NATS_TOKEN="${NATS_TOKEN:-}"
|
||||
NATS_CREDS="${NATS_CREDS:-}"
|
||||
NATS_CREDS_B64="${NATS_CREDS_B64:-}"
|
||||
|
||||
# ---- Dynamic materialization of CA (and optional .creds) ----
|
||||
CA_TARGET="${DATA_DIR}/tls-ca.pem"
|
||||
CREDS_TARGET="${DATA_DIR}/user.creds"
|
||||
|
||||
materialized_ca=""
|
||||
|
||||
if [[ -z "${TLS_CA}" ]]; then
|
||||
if [[ -n "${TLS_CA_PEM}" ]]; then
|
||||
# ---- Materialize TLS CA (if a path not already provided)
|
||||
materialized_ca=0
|
||||
if [ -z "$TLS_CA" ]; then
|
||||
if [ -n "$TLS_CA_PEM" ]; then
|
||||
log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
|
||||
printf '%s\n' "${TLS_CA_PEM}" > "${CA_TARGET}"
|
||||
chmod 0644 "${CA_TARGET}"
|
||||
TLS_CA="${CA_TARGET}"
|
||||
materialized_ca="1"
|
||||
elif [[ -n "${TLS_CA_PEM_B64}" ]]; then
|
||||
printf '%s\n' "$TLS_CA_PEM" > "$CA_TARGET"
|
||||
chmod 0644 "$CA_TARGET"
|
||||
TLS_CA="$CA_TARGET"
|
||||
materialized_ca=1
|
||||
elif [ -n "$TLS_CA_PEM_B64" ]; then
|
||||
log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
|
||||
echo "${TLS_CA_PEM_B64}" | base64 -d > "${CA_TARGET}"
|
||||
chmod 0644 "${CA_TARGET}"
|
||||
TLS_CA="${CA_TARGET}"
|
||||
materialized_ca="1"
|
||||
elif [[ -n "${TLS_CA_URL}" ]]; then
|
||||
echo "$TLS_CA_PEM_B64" | base64 -d > "$CA_TARGET"
|
||||
chmod 0644 "$CA_TARGET"
|
||||
TLS_CA="$CA_TARGET"
|
||||
materialized_ca=1
|
||||
elif [ -n "$TLS_CA_URL" ]; then
|
||||
log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
|
||||
curl -fsSL "${TLS_CA_URL}" -o "${CA_TARGET}"
|
||||
chmod 0644 "${CA_TARGET}"
|
||||
TLS_CA="${CA_TARGET}"
|
||||
materialized_ca="1"
|
||||
curl -fsSL "$TLS_CA_URL" -o "$CA_TARGET"
|
||||
chmod 0644 "$CA_TARGET"
|
||||
TLS_CA="$CA_TARGET"
|
||||
materialized_ca=1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Validate CA if present
|
||||
if [[ -n "${TLS_CA}" ]]; then
|
||||
if [[ ! -s "${TLS_CA}" ]_]()]()
|
||||
# ---- Validate CA if present
|
||||
if [ -n "$TLS_CA" ]; then
|
||||
if [ ! -s "$TLS_CA" ]; then
|
||||
err "TLS_CA='$TLS_CA' not found or empty"
|
||||
exit 3
|
||||
fi
|
||||
if ! grep -q "BEGIN CERTIFICATE" "$TLS_CA"; then
|
||||
err "TLS_CA does not look like a PEM certificate: $TLS_CA"
|
||||
exit 3
|
||||
fi
|
||||
log "Using TLS CA at $TLS_CA (materialized=${materialized_ca})"
|
||||
fi
|
||||
|
||||
# ---- Materialize .creds if provided as base64
|
||||
if [ -z "$NATS_CREDS" ] && [ -n "$NATS_CREDS_B64" ]; then
|
||||
log "Materializing NATS .creds from NATS_CREDS_B64 -> ${CREDS_TARGET}"
|
||||
echo "$NATS_CREDS_B64" | base64 -d > "$CREDS_TARGET"
|
||||
chmod 0600 "$CREDS_TARGET"
|
||||
NATS_CREDS="$CREDS_TARGET"
|
||||
fi
|
||||
|
||||
log "servers='${NATS_SERVERS}' subject='${NATS_SUBJECT}' queue='${NATS_QUEUE:- -}' name='${NATS_NAME}' tls_ca='${TLS_CA:-}'"
|
||||
|
||||
# Export variables for the runner script
|
||||
export TLS_CA NATS_CREDS NATS_SERVERS NATS_SUBJECT NATS_NAME PRINT_RAW NATS_QUEUE \
|
||||
NATS_USER NATS_PASS NATS_TOKEN TLS_INSECURE
|
||||
|
||||
# Hand off to main script
|
||||
exec "$@"
|
||||
|
||||
Reference in New Issue
Block a user