76 lines
2.3 KiB
Bash
76 lines
2.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
log(){ echo "[nats-registration][entrypoint] $*"; }
|
|
err(){ echo "[nats-registration][entrypoint][ERROR] $*" >&2; }
|
|
|
|
# Sanity: tools
|
|
for bin in curl jq python; do
|
|
command -v "$bin" >/dev/null 2>&1 || { err "Missing $bin"; exit 2; }
|
|
done
|
|
|
|
# Paths (match Dockerfile ENV)
|
|
: "${APP_DIR:=/opt/containers/nats-registration-listener}"
|
|
: "${DATA_DIR:=${APP_DIR}/data}"
|
|
mkdir -p "${DATA_DIR}"
|
|
|
|
# Required (fed from .env via compose)
|
|
: "${NATS_SERVERS:?NATS_SERVERS required (space-separated NATS URLs, e.g. 'tls://nats01:4222')}"
|
|
: "${NATS_SUBJECT:?NATS_SUBJECT required (e.g. 'v1.registration')}"
|
|
|
|
# Optional with defaults
|
|
: "${NATS_NAME:=registration-listener}"
|
|
: "${PRINT_RAW:=}"
|
|
: "${NATS_QUEUE:=}"
|
|
|
|
# TLS input options (dynamic)
|
|
# Priority:
|
|
# 1) TLS_CA -> use as a path (pre-mounted file)
|
|
# 2) TLS_CA_PEM -> write PEM content to ${DATA_DIR}/tls-ca.pem
|
|
# 3) TLS_CA_PEM_B64 -> base64 decode to ${DATA_DIR}/tls-ca.pem
|
|
# 4) TLS_CA_URL -> curl to ${DATA_DIR}/tls-ca.pem
|
|
: "${TLS_CA:=}"
|
|
: "${TLS_CA_PEM:=}"
|
|
: "${TLS_CA_PEM_B64:=}"
|
|
: "${TLS_CA_URL:=}"
|
|
: "${TLS_INSECURE:=}"
|
|
|
|
# Auth (optional)
|
|
: "${NATS_USER:=}"
|
|
: "${NATS_PASS:=}"
|
|
: "${NATS_TOKEN:=}"
|
|
: "${NATS_CREDS:=}" # path to a .creds file if you have one
|
|
: "${NATS_CREDS_B64:=}" # optional: base64-encoded creds; will be written to DATA_DIR
|
|
|
|
# ---- Dynamic materialization of CA (and optional .creds) ----
|
|
CA_TARGET="${DATA_DIR}/tls-ca.pem"
|
|
CREDS_TARGET="${DATA_DIR}/user.creds"
|
|
|
|
materialized_ca=""
|
|
|
|
if [[ -z "${TLS_CA}" ]]; then
|
|
if [[ -n "${TLS_CA_PEM}" ]]; then
|
|
log "Materializing TLS CA from TLS_CA_PEM -> ${CA_TARGET}"
|
|
printf '%s\n' "${TLS_CA_PEM}" > "${CA_TARGET}"
|
|
chmod 0644 "${CA_TARGET}"
|
|
TLS_CA="${CA_TARGET}"
|
|
materialized_ca="1"
|
|
elif [[ -n "${TLS_CA_PEM_B64}" ]]; then
|
|
log "Materializing TLS CA from TLS_CA_PEM_B64 -> ${CA_TARGET}"
|
|
echo "${TLS_CA_PEM_B64}" | base64 -d > "${CA_TARGET}"
|
|
chmod 0644 "${CA_TARGET}"
|
|
TLS_CA="${CA_TARGET}"
|
|
materialized_ca="1"
|
|
elif [[ -n "${TLS_CA_URL}" ]]; then
|
|
log "Fetching TLS CA from TLS_CA_URL -> ${CA_TARGET}"
|
|
curl -fsSL "${TLS_CA_URL}" -o "${CA_TARGET}"
|
|
chmod 0644 "${CA_TARGET}"
|
|
TLS_CA="${CA_TARGET}"
|
|
materialized_ca="1"
|
|
fi
|
|
fi
|
|
|
|
# Validate CA if present
|
|
if [[ -n "${TLS_CA}" ]]; then
|
|
if [[ ! -s "${TLS_CA}" ]_]()]()
|