feat: workspace-bootstrap — init SSH/git/Cursor для Mac и Windows

Единый workspace.local.env для адресов и паролей, init-machine, Set-GitRemotes, push-safe и check-no-secrets для политики kalinamall/github.
2026-06-14 19:34:52 +10:00
parent 8e2a4ac1b9
commit 834595df6b
18 changed files with 813 additions and 8 deletions
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=lib/common.sh
+source "$ROOT/lib/common.sh"
+
+VERIFY=0
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --verify) VERIFY=1; shift ;;
+        -h | --help)
+            echo "Usage: init-machine.sh [--verify]"
+            exit 0
+            ;;
+        *) die "unknown option: $1" ;;
+    esac
+done
+
+load_workspace_env
+
+log "профиль: ${MACHINE_PROFILE:-?}, OS: $(detect_os)"
+
+# --- SSH key ---
+KEY_PATH=$(ssh_key_path)
+mkdir -p "$(ssh_home)"
+if [[ ! -f $KEY_PATH ]]; then
+    log "создаю ключ $KEY_PATH"
+    ssh-keygen -t ed25519 -C "${SSH_KEY_COMMENT:-papatramp}@$(hostname -s 2>/dev/null || hostname)" -f "$KEY_PATH" -N ""
+    log "добавьте публичный ключ в Gitea (kalinamall + home) и GitHub:"
+    echo "----------"
+    cat "${KEY_PATH}.pub"
+    echo "----------"
+else
+    log "ключ уже есть: $KEY_PATH"
+fi
+
+# --- ssh config ---
+TMP_BLOCK=$(mktemp)
+render_template "$ROOT/config/ssh-config.template" "$TMP_BLOCK"
+merge_ssh_config "$TMP_BLOCK"
+rm -f "$TMP_BLOCK"
+log "обновлён $(ssh_home)/config"
+
+# --- known_hosts ---
+for target in "${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}" \
+    "${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}" "github.com"; do
+    host=${target%%:*}
+    port=${target##*:}
+    if [[ $host == $port ]]; then port=22; fi
+    log "ssh-keyscan $host:$port"
+    ssh-keyscan -p "$port" "$host" 2>/dev/null >>"$(ssh_home)/known_hosts" || true
+done
+
+# --- git global: только SSH, без credential prompts ---
+if [[ -n ${GIT_USER_NAME:-} ]]; then
+    git config --global user.name "$GIT_USER_NAME"
+fi
+if [[ -n ${GIT_USER_EMAIL:-} ]]; then
+    git config --global user.email "$GIT_USER_EMAIL"
+fi
+git config --global credential.helper ""
+git config --global url."git@github.com:".insteadOf "https://github.com/"
+git config --global url."ssh://git@${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}/".insteadOf "https://${GITEA_KALINAMALL_HOST_PUBLIC}/"
+git config --global url."ssh://git@${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}/".insteadOf "https://${GITEA_HOME_HOST_PUBLIC}/"
+log "git global: SSH-only, credential.helper отключён"
+
+# --- hosts (optional) ---
+if [[ ${UPDATE_HOSTS:-no} == yes ]]; then
+    HOSTS_TMP=$(mktemp)
+    sed \
+        -e "s|__GITEA_KALINAMALL_IP__|${GITEA_KALINAMALL_IP}|g" \
+        -e "s|__GITEA_KALINAMALL_HOST__|${GITEA_KALINAMALL_HOST}|g" \
+        -e "s|__GITEA_KALINAMALL_HOST_PUBLIC__|${GITEA_KALINAMALL_HOST_PUBLIC}|g" \
+        "$ROOT/config/hosts.template" >"$HOSTS_TMP"
+    if [[ $(detect_os) == mac ]]; then
+        log "добавление в /etc/hosts (нужен sudo)"
+        while read -r line; do
+            [[ -z $line || $line == \#* ]] && continue
+            grep -qF "$line" /etc/hosts 2>/dev/null || echo "$line" | sudo tee -a /etc/hosts >/dev/null
+        done <"$HOSTS_TMP"
+    elif [[ $(detect_os) == win ]]; then
+        log "Windows: добавьте вручную в C:\\Windows\\System32\\drivers\\etc\\hosts:"
+        cat "$HOSTS_TMP"
+    fi
+    rm -f "$HOSTS_TMP"
+fi
+
+# --- clone + remotes ---
+PROJ=$(projects_dir)
+mkdir -p "$PROJ"
+while read -r repo has_gh; do
+    [[ -z $repo ]] && continue
+    dest="$PROJ/$repo"
+    if [[ ! -d $dest/.git ]]; then
+        log "клонирование $repo"
+        git clone "$(kalinamall_remote_url "$repo")" "$dest" || log "клон не удался (сеть/ключ?) — настройте ключ и повторите"
+    fi
+    if [[ -d $dest/.git ]]; then
+        bash "$ROOT/scripts/Set-GitRemotes.sh" --repo-dir "$dest" "$repo" "$has_gh"
+        # pre-push hook для github
+        if [[ $has_gh == 1 && -f $ROOT/hooks/pre-push ]]; then
+            install -m 755 "$ROOT/hooks/pre-push" "$dest/.git/hooks/pre-push"
+        fi
+    fi
+done < <(each_repo)
+
+if [[ $VERIFY == 1 ]]; then
+    log "проверка SSH (BatchMode — без запроса пароля)"
+    ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_KALINAMALL_SSH_PORT" -T "git@${GITEA_KALINAMALL_HOST}" 2>&1 | head -3 || true
+    ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_HOME_SSH_PORT" -T "git@${GITEA_HOME_HOST}" 2>&1 | head -3 || true
+    ssh -o BatchMode=yes -o ConnectTimeout=8 -T git@github.com 2>&1 | head -3 || true
+    log "если выше «Permission denied» — добавьте .pub в Gitea/GitHub и повторите --verify"
+fi
+
+log "готово"