Andrey Lutsenko
834595df6b
Единый workspace.local.env для адресов и паролей, init-machine, Set-GitRemotes, push-safe и check-no-secrets для политики kalinamall/github.
117 lines
4.4 KiB
Bash
Executable File
117 lines
4.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "$ROOT/lib/common.sh"
|
|
|
|
VERIFY=0
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--verify) VERIFY=1; shift ;;
|
|
-h | --help)
|
|
echo "Usage: init-machine.sh [--verify]"
|
|
exit 0
|
|
;;
|
|
*) die "unknown option: $1" ;;
|
|
esac
|
|
done
|
|
|
|
load_workspace_env
|
|
|
|
log "профиль: ${MACHINE_PROFILE:-?}, OS: $(detect_os)"
|
|
|
|
# --- SSH key ---
|
|
KEY_PATH=$(ssh_key_path)
|
|
mkdir -p "$(ssh_home)"
|
|
if [[ ! -f $KEY_PATH ]]; then
|
|
log "создаю ключ $KEY_PATH"
|
|
ssh-keygen -t ed25519 -C "${SSH_KEY_COMMENT:-papatramp}@$(hostname -s 2>/dev/null || hostname)" -f "$KEY_PATH" -N ""
|
|
log "добавьте публичный ключ в Gitea (kalinamall + home) и GitHub:"
|
|
echo "----------"
|
|
cat "${KEY_PATH}.pub"
|
|
echo "----------"
|
|
else
|
|
log "ключ уже есть: $KEY_PATH"
|
|
fi
|
|
|
|
# --- ssh config ---
|
|
TMP_BLOCK=$(mktemp)
|
|
render_template "$ROOT/config/ssh-config.template" "$TMP_BLOCK"
|
|
merge_ssh_config "$TMP_BLOCK"
|
|
rm -f "$TMP_BLOCK"
|
|
log "обновлён $(ssh_home)/config"
|
|
|
|
# --- known_hosts ---
|
|
for target in "${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}" \
|
|
"${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}" "github.com"; do
|
|
host=${target%%:*}
|
|
port=${target##*:}
|
|
if [[ $host == $port ]]; then port=22; fi
|
|
log "ssh-keyscan $host:$port"
|
|
ssh-keyscan -p "$port" "$host" 2>/dev/null >>"$(ssh_home)/known_hosts" || true
|
|
done
|
|
|
|
# --- git global: только SSH, без credential prompts ---
|
|
if [[ -n ${GIT_USER_NAME:-} ]]; then
|
|
git config --global user.name "$GIT_USER_NAME"
|
|
fi
|
|
if [[ -n ${GIT_USER_EMAIL:-} ]]; then
|
|
git config --global user.email "$GIT_USER_EMAIL"
|
|
fi
|
|
git config --global credential.helper ""
|
|
git config --global url."git@github.com:".insteadOf "https://github.com/"
|
|
git config --global url."ssh://git@${GITEA_KALINAMALL_HOST}:${GITEA_KALINAMALL_SSH_PORT}/".insteadOf "https://${GITEA_KALINAMALL_HOST_PUBLIC}/"
|
|
git config --global url."ssh://git@${GITEA_HOME_HOST}:${GITEA_HOME_SSH_PORT}/".insteadOf "https://${GITEA_HOME_HOST_PUBLIC}/"
|
|
log "git global: SSH-only, credential.helper отключён"
|
|
|
|
# --- hosts (optional) ---
|
|
if [[ ${UPDATE_HOSTS:-no} == yes ]]; then
|
|
HOSTS_TMP=$(mktemp)
|
|
sed \
|
|
-e "s|__GITEA_KALINAMALL_IP__|${GITEA_KALINAMALL_IP}|g" \
|
|
-e "s|__GITEA_KALINAMALL_HOST__|${GITEA_KALINAMALL_HOST}|g" \
|
|
-e "s|__GITEA_KALINAMALL_HOST_PUBLIC__|${GITEA_KALINAMALL_HOST_PUBLIC}|g" \
|
|
"$ROOT/config/hosts.template" >"$HOSTS_TMP"
|
|
if [[ $(detect_os) == mac ]]; then
|
|
log "добавление в /etc/hosts (нужен sudo)"
|
|
while read -r line; do
|
|
[[ -z $line || $line == \#* ]] && continue
|
|
grep -qF "$line" /etc/hosts 2>/dev/null || echo "$line" | sudo tee -a /etc/hosts >/dev/null
|
|
done <"$HOSTS_TMP"
|
|
elif [[ $(detect_os) == win ]]; then
|
|
log "Windows: добавьте вручную в C:\\Windows\\System32\\drivers\\etc\\hosts:"
|
|
cat "$HOSTS_TMP"
|
|
fi
|
|
rm -f "$HOSTS_TMP"
|
|
fi
|
|
|
|
# --- clone + remotes ---
|
|
PROJ=$(projects_dir)
|
|
mkdir -p "$PROJ"
|
|
while read -r repo has_gh; do
|
|
[[ -z $repo ]] && continue
|
|
dest="$PROJ/$repo"
|
|
if [[ ! -d $dest/.git ]]; then
|
|
log "клонирование $repo"
|
|
git clone "$(kalinamall_remote_url "$repo")" "$dest" || log "клон не удался (сеть/ключ?) — настройте ключ и повторите"
|
|
fi
|
|
if [[ -d $dest/.git ]]; then
|
|
bash "$ROOT/scripts/Set-GitRemotes.sh" --repo-dir "$dest" "$repo" "$has_gh"
|
|
# pre-push hook для github
|
|
if [[ $has_gh == 1 && -f $ROOT/hooks/pre-push ]]; then
|
|
install -m 755 "$ROOT/hooks/pre-push" "$dest/.git/hooks/pre-push"
|
|
fi
|
|
fi
|
|
done < <(each_repo)
|
|
|
|
if [[ $VERIFY == 1 ]]; then
|
|
log "проверка SSH (BatchMode — без запроса пароля)"
|
|
ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_KALINAMALL_SSH_PORT" -T "git@${GITEA_KALINAMALL_HOST}" 2>&1 | head -3 || true
|
|
ssh -o BatchMode=yes -o ConnectTimeout=8 -p "$GITEA_HOME_SSH_PORT" -T "git@${GITEA_HOME_HOST}" 2>&1 | head -3 || true
|
|
ssh -o BatchMode=yes -o ConnectTimeout=8 -T git@github.com 2>&1 | head -3 || true
|
|
log "если выше «Permission denied» — добавьте .pub в Gitea/GitHub и повторите --verify"
|
|
fi
|
|
|
|
log "готово"
|