mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
8ad69a6e8b
`environment-to-ini` still exec'd `/app/gitd/gitd`, which the same release
deleted. Proven on the running v1.26.20 pod:
/usr/local/bin/environment-to-ini: line 2: /app/gitd/gitd: No such file
exit=127
s6 `setup` calls it with no `set -e`, so boot swallowed the 127 and the server
came up on whatever app.ini the volume already had. Every deploy configures this
server through `GIT__<section>__<KEY>` env and nothing else, so the next config
change — or any boot on a fresh volume — would have been silently ignored.
`run` and `setup` referenced the same dead directory (`pushd`, `chown`, `chmod`),
all likewise swallowed.
The binary path was written in eight places; that is why moving it missed three.
`environment-to-ini` now goes through `/usr/local/bin/gitd`, the wrapper that
already owns the path, so the path is written only where the image places it
(two Dockerfiles) and where the wrappers resolve it (two scripts). Verified in
the live image: the wrapper form merges (`GIT__probe__CANARY` reached the ini,
exit 0) where the shipped script exits 127.
The merge is now fatal instead of swallowed: a server that starts without it is
running on config nobody declared.
Co-authored-by: Hanzo Dev <[email protected]>
74 lines
3.2 KiB
Bash
Executable File
74 lines
3.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
if [ ! -d /data/git/.ssh ]; then
|
|
mkdir -p /data/git/.ssh
|
|
fi
|
|
|
|
# Set the correct permissions on the .ssh directory and authorized_keys file,
|
|
# or sshd will refuse to use them and lead to clone/push/pull failures.
|
|
# It could happen when users have copied their data to a new volume and changed the file permission by accident,
|
|
# and it would be very hard to troubleshoot unless users know how to check the logs of sshd which is started by s6.
|
|
chmod 700 /data/git/.ssh
|
|
if [ -f /data/git/.ssh/authorized_keys ]; then
|
|
chmod 600 /data/git/.ssh/authorized_keys
|
|
fi
|
|
|
|
if [ ! -f /data/git/.ssh/environment ]; then
|
|
echo "GIT_CUSTOM=$GIT_CUSTOM" >| /data/git/.ssh/environment
|
|
chmod 600 /data/git/.ssh/environment
|
|
|
|
elif ! grep -q "^GIT_CUSTOM=$GIT_CUSTOM$" /data/git/.ssh/environment; then
|
|
sed -i /^GIT_CUSTOM=/d /data/git/.ssh/environment
|
|
echo "GIT_CUSTOM=$GIT_CUSTOM" >> /data/git/.ssh/environment
|
|
fi
|
|
|
|
if [ ! -f ${GIT_CUSTOM}/conf/app.ini ]; then
|
|
mkdir -p ${GIT_CUSTOM}/conf
|
|
|
|
# Set INSTALL_LOCK to true only if SECRET_KEY is not empty and
|
|
# INSTALL_LOCK is empty
|
|
if [ -n "$SECRET_KEY" ] && [ -z "$INSTALL_LOCK" ]; then
|
|
INSTALL_LOCK=true
|
|
fi
|
|
|
|
# Substitute the environment variables in the template
|
|
# APP_NAME is passed through empty on purpose: the default lives in one place,
|
|
# setting.AppName, so the container cannot brand the site title differently.
|
|
APP_NAME=${APP_NAME:-""} \
|
|
RUN_MODE=${RUN_MODE:-"prod"} \
|
|
DOMAIN=${DOMAIN:-"localhost"} \
|
|
SSH_DOMAIN=${SSH_DOMAIN:-"localhost"} \
|
|
HTTP_PORT=${HTTP_PORT:-"3000"} \
|
|
ROOT_URL=${ROOT_URL:-""} \
|
|
DISABLE_SSH=${DISABLE_SSH:-"false"} \
|
|
SSH_PORT=${SSH_PORT:-"22"} \
|
|
SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-"${SSH_PORT}"} \
|
|
LFS_START_SERVER=${LFS_START_SERVER:-"false"} \
|
|
DB_TYPE=${DB_TYPE:-"sqlite3"} \
|
|
DB_HOST=${DB_HOST:-"localhost:3306"} \
|
|
DB_NAME=${DB_NAME:-"hanzo_git"} \
|
|
DB_USER=${DB_USER:-"root"} \
|
|
DB_PASSWD=${DB_PASSWD:-""} \
|
|
INSTALL_LOCK=${INSTALL_LOCK:-"false"} \
|
|
DISABLE_REGISTRATION=${DISABLE_REGISTRATION:-"false"} \
|
|
REQUIRE_SIGNIN_VIEW=${REQUIRE_SIGNIN_VIEW:-"false"} \
|
|
SECRET_KEY=${SECRET_KEY:-""} \
|
|
envsubst < /etc/templates/app.ini > ${GIT_CUSTOM}/conf/app.ini
|
|
|
|
chown ${USER}:git ${GIT_CUSTOM}/conf/app.ini
|
|
fi
|
|
|
|
# Replace app.ini settings with env variables in the form GIT__SECTION_NAME__KEY_NAME
|
|
# Fatal on failure: every deploy configures this server through GIT__* env alone,
|
|
# so a server that starts without the merge runs on whatever app.ini the volume
|
|
# happened to keep — the failure this line used to swallow.
|
|
environment-to-ini --config ${GIT_CUSTOM}/conf/app.ini || exit 1
|
|
|
|
# only chown if current owner is not already the ${USER}. No recursive check to save time
|
|
# (/data/gitea is the durable volume layout and stays put; /app/git is where the
|
|
# daemon binary lives.)
|
|
if ! [[ $(ls -ld /data/gitea | awk '{print $3}') = ${USER} ]]; then chown -R ${USER}:git /data/gitea; fi
|
|
if ! [[ $(ls -ld /app/git | awk '{print $3}') = ${USER} ]]; then chown -R ${USER}:git /app/git; fi
|
|
if ! [[ $(ls -ld /data/git | awk '{print $3}') = ${USER} ]]; then chown -R ${USER}:git /data/git; fi
|
|
chmod 0755 /data/gitea /app/git /data/git
|