pavel/nats-scheduler
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial codes try 8

Browse Source
This commit is contained in:
pavel
2025-10-28 06:43:30 +02:00
parent 25b81dcfc7
commit 8f8ee3433b
1 changed files with 75 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
files/entrypoint.sh
View File

@@ -4,72 +4,95 @@ set -euo pipefail
log(){ echo "[nats-registration][entrypoint] $*"; } log(){ echo "[nats-registration][entrypoint] $*"; }
err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; } err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
# Sanity: tools # ---- Tool sanity (only what we use)
for bin in curl python; do for bin in curl python; do
command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; } if ! command -v "$bin" >/dev/null 2>&1; then
err "Missing $bin"
exit 2
fi
done done
# Paths (match Dockerfile ENV) # ---- Paths
: "${APP_DIR:=/opt/containers/nats-registration-listener}" APP_DIR="${APP_DIR:-/opt/containers/nats-registration-listener}"
: "${DATA_DIR:=${APP_DIR}/data}" DATA_DIR="${DATA_DIR:-$APP_DIR/data}"
mkdir -p "${DATA_DIR}" mkdir -p "$DATA_DIR"
# Required (fed from .env via compose) # ---- Required env
: "${NATS_SERVERS:?NATS_SERVERS required (space-separated NATS URLs, e.g. 'tls://nats01:4222')}" : "${NATS_SERVERS:?NATS_SERVERS required (e.g. 'nats://host:4222' or 'tls://host:4222')}"
: "${NATS_SUBJECT:?NATS_SUBJECT required (e.g. 'v1.registration')}" : "${NATS_SUBJECT:=v1.registration}" # default to common registration subject
# Optional with defaults # ---- Optional env
: "${NATS_NAME:=registration-listener}" NATS_NAME="${NATS_NAME:-registration-listener}"
: "${PRINT_RAW:=}" PRINT_RAW="${PRINT_RAW:-}"
: "${NATS_QUEUE:=}" NATS_QUEUE="${NATS_QUEUE:-}"
# TLS input options (dynamic) # TLS inputs (all optional)
# Priority: TLS_CA="${TLS_CA:-}"
# 1) TLS_CA -> use as a path (pre-mounted file) TLS_CA_PEM="${TLS_CA_PEM:-}"
# 2) TLS_CA_PEM -> write PEM content to ${DATA_DIR}/tls-ca.pem TLS_CA_PEM_B64="${TLS_CA_PEM_B64:-}"
# 3) TLS_CA_PEM_B64 -> base64 decode to ${DATA_DIR}/tls-ca.pem TLS_CA_URL="${TLS_CA_URL:-}"
# 4) TLS_CA_URL -> curl to ${DATA_DIR}/tls-ca.pem TLS_INSECURE="${TLS_INSECURE:-}"
: "${TLS_CA:=}"
: "${TLS_CA_PEM:=}"
: "${TLS_CA_PEM_B64:=}"
: "${TLS_CA_URL:=}"
: "${TLS_INSECURE:=}"
# Auth (optional) # Auth (all optional)
: "${NATS_USER:=}" NATS_USER="${NATS_USER:-}"
: "${NATS_PASS:=}" NATS_PASS="${NATS_PASS:-}"
: "${NATS_TOKEN:=}" NATS_TOKEN="${NATS_TOKEN:-}"
: "${NATS_CREDS:=}" # path to a .creds file if you have one NATS_CREDS="${NATS_CREDS:-}"
: "${NATS_CREDS_B64:=}" # optional: base64-encoded creds; will be written to DATA_DIR NATS_CREDS_B64="${NATS_CREDS_B64:-}"
# ---- Dynamic materialization of CA (and optional .creds) ----
CA_TARGET="${DATA_DIR}/tls-ca.pem" CA_TARGET="${DATA_DIR}/tls-ca.pem"
CREDS_TARGET="${DATA_DIR}/user.creds" CREDS_TARGET="${DATA_DIR}/user.creds"
materialized_ca="" # ---- Materialize TLS CA (if a path not already provided)
materialized_ca=0
if [[ -z "${TLS_CA}" ]]; then if [ -z "$TLS_CA" ]; then
if [[ -n "${TLS_CA_PEM}" ]]; then if [ -n "$TLS_CA_PEM" ]; then
log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}" log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
printf '%s\n' "${TLS_CA_PEM}" > "${CA_TARGET}" printf '%s\n' "$TLS_CA_PEM" > "$CA_TARGET"
chmod 0644 "${CA_TARGET}" chmod 0644 "$CA_TARGET"
TLS_CA="${CA_TARGET}" TLS_CA="$CA_TARGET"
materialized_ca="1" materialized_ca=1
elif [[ -n "${TLS_CA_PEM_B64}" ]]; then elif [ -n "$TLS_CA_PEM_B64" ]; then
log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}" log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
echo "${TLS_CA_PEM_B64}" | base64 -d > "${CA_TARGET}" echo "$TLS_CA_PEM_B64" | base64 -d > "$CA_TARGET"
chmod 0644 "${CA_TARGET}" chmod 0644 "$CA_TARGET"
TLS_CA="${CA_TARGET}" TLS_CA="$CA_TARGET"
materialized_ca="1" materialized_ca=1
elif [[ -n "${TLS_CA_URL}" ]]; then elif [ -n "$TLS_CA_URL" ]; then
log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}" log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
curl -fsSL "${TLS_CA_URL}" -o "${CA_TARGET}" curl -fsSL "$TLS_CA_URL" -o "$CA_TARGET"
chmod 0644 "${CA_TARGET}" chmod 0644 "$CA_TARGET"
TLS_CA="${CA_TARGET}" TLS_CA="$CA_TARGET"
materialized_ca="1" materialized_ca=1
fi fi
fi fi
# Validate CA if present # ---- Validate CA if present
if [[ -n "${TLS_CA}" ]]; then if [ -n "$TLS_CA" ]; then
if [[ ! -s "${TLS_CA}" ]_]()]() if [ ! -s "$TLS_CA" ]; then
err "TLS_CA='$TLS_CA' not found or empty"
exit 3
fi
if ! grep -q "BEGIN CERTIFICATE" "$TLS_CA"; then
err "TLS_CA does not look like a PEM certificate: $TLS_CA"
exit 3
fi
log "Using TLS CA at $TLS_CA (materialized=${materialized_ca})"
fi
# ---- Materialize .creds if provided as base64
if [ -z "$NATS_CREDS" ] && [ -n "$NATS_CREDS_B64" ]; then
log "Materializing NATS .creds from NATS_CREDS_B64 -> ${CREDS_TARGET}"
echo "$NATS_CREDS_B64" | base64 -d > "$CREDS_TARGET"
chmod 0600 "$CREDS_TARGET"
NATS_CREDS="$CREDS_TARGET"
fi
log "servers='${NATS_SERVERS}' subject='${NATS_SUBJECT}' queue='${NATS_QUEUE:- -}' name='${NATS_NAME}' tls_ca='${TLS_CA:-}'"
# Export variables for the runner script
export TLS_CA NATS_CREDS NATS_SERVERS NATS_SUBJECT NATS_NAME PRINT_RAW NATS_QUEUE \
NATS_USER NATS_PASS NATS_TOKEN TLS_INSECURE
# Hand off to main script
exec "$@"