feat(haproxy): allowlist rds-allowed для RDS из ipdeny RU (0.7.5).
This commit is contained in:
PTah
@@ -0,0 +1,178 @@
|
||||
#!/usr/bin/env bash
|
||||
# Deploy /etc/haproxy/rds-allowed from ipdeny.com ru.zone + rds-allowed-static.
|
||||
#
|
||||
# Адаптация scripts/mikrotik-ru-ipdeny/mikrotik-649-ru-ipdeny-deploy.sh (Answer.and.other.shit)
|
||||
# для HAProxy на haproxy.kalinamall.ru — вместо MikroTik: merge static, haproxy -c, reload.
|
||||
#
|
||||
# Установка:
|
||||
# install -m 0755 haproxy-rds-allowed-deploy.sh haproxy_ru_ipdeny_lib.sh /usr/local/bin/
|
||||
#
|
||||
# Cron (ежедневно 01:00): scripts/haproxy-rds-allowed.cron -> /etc/cron.d/haproxy-rds-allowed
|
||||
# 0 1 * * * root /usr/local/bin/haproxy-rds-allowed-deploy.sh >> /var/log/haproxy-rds-allowed-deploy.log 2>&1
|
||||
#
|
||||
# Examples:
|
||||
# ./haproxy-rds-allowed-deploy.sh
|
||||
# ./haproxy-rds-allowed-deploy.sh --generate-only -o /tmp/rds-allowed
|
||||
set -Eeuo pipefail
|
||||
|
||||
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
||||
# shellcheck source=haproxy_ru_ipdeny_lib.sh
|
||||
source "$SCRIPT_DIR/haproxy_ru_ipdeny_lib.sh"
|
||||
|
||||
ENV_FILE=${HAPROXY_ENV_FILE:-${SCRIPT_DIR}/env}
|
||||
ALLOWLIST=${HAPROXY_RDS_ALLOWED:-/etc/haproxy/rds-allowed}
|
||||
STATIC=${HAPROXY_RDS_STATIC:-/etc/haproxy/rds-allowed-static}
|
||||
HAPROXY_CFG=${HAPROXY_CFG:-/etc/haproxy/haproxy.cfg}
|
||||
LOCK_FILE=${HAPROXY_RDS_LOCK:-/run/lock/haproxy-rds-allowed-deploy.lock}
|
||||
LOG_TAG=haproxy-rds-allowed-deploy
|
||||
|
||||
load_env_file() {
|
||||
local file_path=$1
|
||||
[[ -f $file_path ]] || return 0
|
||||
set -a
|
||||
# shellcheck source=/dev/null
|
||||
source "$file_path"
|
||||
set +a
|
||||
}
|
||||
|
||||
log() {
|
||||
logger -t "$LOG_TAG" "$*"
|
||||
echo "$*"
|
||||
}
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage: haproxy-rds-allowed-deploy.sh [options]
|
||||
|
||||
--allowlist PATH output allowlist (default: /etc/haproxy/rds-allowed)
|
||||
--static PATH static IP/CIDR file (default: /etc/haproxy/rds-allowed-static)
|
||||
--haproxy-cfg PATH haproxy config for -c (default: /etc/haproxy/haproxy.cfg)
|
||||
--zone-url URL ipdeny zone URL (default: ru.zone)
|
||||
--min-entries N minimum subnet count from zone (default: 8000)
|
||||
--env-file PATH optional env (HAPROXY_* overrides)
|
||||
-o, --output PATH keep generated list at this path
|
||||
--generate-only download/merge only; no install/reload
|
||||
-h, --help
|
||||
EOF
|
||||
}
|
||||
|
||||
install_allowlist() {
|
||||
local new_list=$1
|
||||
local line_count=${2:-0}
|
||||
|
||||
if [[ -f $ALLOWLIST ]]; then
|
||||
cp -a "$ALLOWLIST" "${ALLOWLIST}.bak-$(date +%Y%m%d-%H%M%S)"
|
||||
fi
|
||||
|
||||
install -m 0644 -o root -g root "$new_list" "$ALLOWLIST"
|
||||
|
||||
if ! haproxy -c -f "$HAPROXY_CFG" >/tmp/haproxy-rds-check.log 2>&1; then
|
||||
log "ERROR: haproxy -c failed: $(tail -3 /tmp/haproxy-rds-check.log | tr '\n' ' ')"
|
||||
local latest_bak
|
||||
latest_bak=$(ls -t "${ALLOWLIST}.bak-"* 2>/dev/null | head -1 || true)
|
||||
if [[ -n $latest_bak ]]; then
|
||||
cp -a "$latest_bak" "$ALLOWLIST"
|
||||
fi
|
||||
die "haproxy config check failed; restored previous allowlist if backup exists"
|
||||
fi
|
||||
|
||||
systemctl reload haproxy
|
||||
log "done: allowlist=${ALLOWLIST} total=${line_count} zone_entries=${GENERATED_ZONE_ENTRIES} bytes=${GENERATED_BYTES}"
|
||||
}
|
||||
|
||||
main() {
|
||||
local zone_url=$DEFAULT_ZONE_URL
|
||||
local min_entries=$DEFAULT_MIN_LINES
|
||||
local output_path=
|
||||
local generate_only=0
|
||||
local temp_list=
|
||||
local remove_temp_list=0
|
||||
|
||||
load_env_file "$ENV_FILE"
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--allowlist)
|
||||
ALLOWLIST=$2
|
||||
shift 2
|
||||
;;
|
||||
--static)
|
||||
STATIC=$2
|
||||
shift 2
|
||||
;;
|
||||
--haproxy-cfg)
|
||||
HAPROXY_CFG=$2
|
||||
shift 2
|
||||
;;
|
||||
--zone-url)
|
||||
zone_url=$2
|
||||
shift 2
|
||||
;;
|
||||
--min-entries)
|
||||
min_entries=$2
|
||||
shift 2
|
||||
;;
|
||||
--env-file)
|
||||
ENV_FILE=$2
|
||||
load_env_file "$ENV_FILE"
|
||||
shift 2
|
||||
;;
|
||||
-o | --output)
|
||||
output_path=$2
|
||||
shift 2
|
||||
;;
|
||||
--generate-only)
|
||||
generate_only=1
|
||||
shift
|
||||
;;
|
||||
-h | --help)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
die "unknown option: $1"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
command -v curl >/dev/null 2>&1 || die "curl not found (apt install curl)"
|
||||
|
||||
exec 9>"$LOCK_FILE"
|
||||
if ! flock -n 9; then
|
||||
log "already running, exit"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ -z $output_path ]]; then
|
||||
if [[ $generate_only -eq 1 ]]; then
|
||||
die "use -o/--output with --generate-only"
|
||||
fi
|
||||
temp_list=$(mktemp)
|
||||
output_path=$temp_list
|
||||
remove_temp_list=1
|
||||
trap "rm -f '${temp_list}'" EXIT
|
||||
fi
|
||||
|
||||
echo "downloading zone: ${zone_url}"
|
||||
generate_allowlist_bundle "$zone_url" "$output_path" "$STATIC" "$min_entries"
|
||||
echo "generated entries=${GENERATED_ENTRIES} zone_entries=${GENERATED_ZONE_ENTRIES} bytes=${GENERATED_BYTES}"
|
||||
|
||||
if [[ $generate_only -eq 1 ]]; then
|
||||
echo "wrote ${output_path}"
|
||||
if [[ $remove_temp_list -eq 1 ]]; then
|
||||
rm -f "$temp_list"
|
||||
trap - EXIT
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
command -v haproxy >/dev/null 2>&1 || die "haproxy not found"
|
||||
install_allowlist "$output_path" "$GENERATED_ENTRIES"
|
||||
|
||||
if [[ $remove_temp_list -eq 1 ]]; then
|
||||
rm -f "$temp_list"
|
||||
trap - EXIT
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
Reference in New Issue
Block a user