100 lines
3.0 KiB
Bash
100 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
log(){ echo "[nats-registration][entrypoint] $*"; }
|
|
err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
|
|
|
|
# ---- Tool sanity (only what we use)
|
|
for bin in curl python; do
|
|
if ! command -v "$bin" >/dev/null 2>&1; then
|
|
err "Missing $bin"
|
|
exit 2
|
|
fi
|
|
done
|
|
|
|
# ---- Paths
|
|
APP_DIR="${APP_DIR:-/opt/containers/nats-registration-listener}"
|
|
DATA_DIR="${DATA_DIR:-$APP_DIR/data}"
|
|
mkdir -p "$DATA_DIR"
|
|
|
|
# ---- Required env
|
|
: "${NATS_SERVERS:?NATS_SERVERS required (e.g. 'nats://host:4222' or 'tls://host:4222')}"
|
|
: "${NATS_SUBJECT:=v1.registration}" # default to common registration subject
|
|
|
|
# ---- Optional env
|
|
NATS_NAME="${NATS_NAME:-registration-listener}"
|
|
PRINT_RAW="${PRINT_RAW:-}"
|
|
NATS_QUEUE="${NATS_QUEUE:-}"
|
|
|
|
# TLS inputs (all optional)
|
|
TLS_CA="${TLS_CA:-}"
|
|
TLS_CA_PEM="${TLS_CA_PEM:-}"
|
|
TLS_CA_PEM_B64="${TLS_CA_PEM_B64:-}"
|
|
TLS_CA_URL="${TLS_CA_URL:-}"
|
|
TLS_INSECURE="${TLS_INSECURE:-}"
|
|
|
|
# Auth (all optional)
|
|
NATS_USER="${NATS_USER:-}"
|
|
NATS_PASS="${NATS_PASS:-}"
|
|
NATS_TOKEN="${NATS_TOKEN:-}"
|
|
NATS_CREDS="${NATS_CREDS:-}"
|
|
NATS_CREDS_B64="${NATS_CREDS_B64:-}"
|
|
|
|
CA_TARGET="${DATA_DIR}/tls-ca.pem"
|
|
CREDS_TARGET="${DATA_DIR}/user.creds"
|
|
|
|
# ---- Materialize TLS CA (if a path not already provided)
|
|
materialized_ca=0
|
|
if [ -z "$TLS_CA" ]; then
|
|
if [ -n "$TLS_CA_PEM" ]; then
|
|
log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
|
|
printf '%s\n' "$TLS_CA_PEM" > "$CA_TARGET"
|
|
chmod 0644 "$CA_TARGET"
|
|
TLS_CA="$CA_TARGET"
|
|
materialized_ca=1
|
|
elif [ -n "$TLS_CA_PEM_B64" ]; then
|
|
log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
|
|
echo "$TLS_CA_PEM_B64" | base64 -d > "$CA_TARGET"
|
|
chmod 0644 "$CA_TARGET"
|
|
TLS_CA="$CA_TARGET"
|
|
materialized_ca=1
|
|
elif [ -n "$TLS_CA_URL" ]; then
|
|
log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
|
|
curl -fsSL "$TLS_CA_URL" -o "$CA_TARGET"
|
|
chmod 0644 "$CA_TARGET"
|
|
TLS_CA="$CA_TARGET"
|
|
materialized_ca=1
|
|
fi
|
|
fi
|
|
|
|
# ---- Validate CA if present
|
|
if [ -n "$TLS_CA" ]; then
|
|
if [ ! -s "$TLS_CA" ]; then
|
|
err "TLS_CA='$TLS_CA' not found or empty"
|
|
exit 3
|
|
fi
|
|
if ! grep -q "BEGIN CERTIFICATE" "$TLS_CA"; then
|
|
err "TLS_CA does not look like a PEM certificate: $TLS_CA"
|
|
exit 3
|
|
fi
|
|
log "Using TLS CA at $TLS_CA (materialized=${materialized_ca})"
|
|
fi
|
|
|
|
# ---- Materialize .creds if provided as base64
|
|
if [ -z "$NATS_CREDS" ] && [ -n "$NATS_CREDS_B64" ]; then
|
|
log "Materializing NATS .creds from NATS_CREDS_B64 -> ${CREDS_TARGET}"
|
|
echo "$NATS_CREDS_B64" | base64 -d > "$CREDS_TARGET"
|
|
chmod 0600 "$CREDS_TARGET"
|
|
NATS_CREDS="$CREDS_TARGET"
|
|
fi
|
|
|
|
log "servers='${NATS_SERVERS}' subject='${NATS_SUBJECT}' queue='${NATS_QUEUE:- -}' name='${NATS_NAME}' tls_ca='${TLS_CA:-}'"
|
|
|
|
# Export variables for the runner script
|
|
export TLS_CA NATS_CREDS NATS_SERVERS NATS_SUBJECT NATS_NAME PRINT_RAW NATS_QUEUE \
|
|
NATS_USER NATS_PASS NATS_TOKEN TLS_INSECURE
|
|
|
|
# Hand off to main script
|
|
exec /opt/containers/nats-registration-listener/app/bin/nats-registration-listener.sh
|
|
|