reverse-proxy/scripts/haproxy-rds-allowed-deploy.sh

#!/usr/bin/env bash
# Deploy /etc/haproxy/rds-allowed from ipdeny.com ru.zone + rds-allowed-static.
#
# Адаптация scripts/mikrotik-ru-ipdeny/mikrotik-649-ru-ipdeny-deploy.sh (Answer.and.other.shit)
# для HAProxy на haproxy.kalinamall.ru — вместо MikroTik: merge static, haproxy -c, reload.
#
# Установка:
#   install -m 0755 haproxy-rds-allowed-deploy.sh haproxy_ru_ipdeny_lib.sh /usr/local/bin/
#
# Cron (ежедневно 01:00): scripts/haproxy-rds-allowed.cron -> /etc/cron.d/haproxy-rds-allowed
#   0 1 * * * root /usr/local/bin/haproxy-rds-allowed-deploy.sh >> /var/log/haproxy-rds-allowed-deploy.log 2>&1
#
# Examples:
#   ./haproxy-rds-allowed-deploy.sh
#   ./haproxy-rds-allowed-deploy.sh --generate-only -o /tmp/rds-allowed
set -Eeuo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck source=haproxy_ru_ipdeny_lib.sh
source "$SCRIPT_DIR/haproxy_ru_ipdeny_lib.sh"

ENV_FILE=${HAPROXY_ENV_FILE:-${SCRIPT_DIR}/env}
ALLOWLIST=${HAPROXY_RDS_ALLOWED:-/etc/haproxy/rds-allowed}
STATIC=${HAPROXY_RDS_STATIC:-/etc/haproxy/rds-allowed-static}
HAPROXY_CFG=${HAPROXY_CFG:-/etc/haproxy/haproxy.cfg}
LOCK_FILE=${HAPROXY_RDS_LOCK:-/run/lock/haproxy-rds-allowed-deploy.lock}
LOG_TAG=haproxy-rds-allowed-deploy

load_env_file() {
    local file_path=$1
    [[ -f $file_path ]] || return 0
    set -a
    # shellcheck source=/dev/null
    source "$file_path"
    set +a
}

log() {
    logger -t "$LOG_TAG" "$*"
    echo "$*"
}

usage() {
    cat <<'EOF'
Usage: haproxy-rds-allowed-deploy.sh [options]

  --allowlist PATH       output allowlist (default: /etc/haproxy/rds-allowed)
  --static PATH          static IP/CIDR file (default: /etc/haproxy/rds-allowed-static)
  --haproxy-cfg PATH     haproxy config for -c (default: /etc/haproxy/haproxy.cfg)
  --zone-url URL         ipdeny zone URL (default: ru.zone)
  --min-entries N        minimum subnet count from zone (default: 8000)
  --env-file PATH        optional env (HAPROXY_* overrides)
  -o, --output PATH      keep generated list at this path
  --generate-only        download/merge only; no install/reload
  -h, --help
EOF
}

install_allowlist() {
    local new_list=$1
    local line_count=${2:-0}

    if [[ -f $ALLOWLIST ]]; then
        cp -a "$ALLOWLIST" "${ALLOWLIST}.bak-$(date +%Y%m%d-%H%M%S)"
    fi

    install -m 0644 -o root -g root "$new_list" "$ALLOWLIST"

    if ! haproxy -c -f "$HAPROXY_CFG" >/tmp/haproxy-rds-check.log 2>&1; then
        log "ERROR: haproxy -c failed: $(tail -3 /tmp/haproxy-rds-check.log | tr '\n' ' ')"
        local latest_bak
        latest_bak=$(ls -t "${ALLOWLIST}.bak-"* 2>/dev/null | head -1 || true)
        if [[ -n $latest_bak ]]; then
            cp -a "$latest_bak" "$ALLOWLIST"
        fi
        die "haproxy config check failed; restored previous allowlist if backup exists"
    fi

    systemctl reload haproxy
    log "done: allowlist=${ALLOWLIST} total=${line_count} zone_entries=${GENERATED_ZONE_ENTRIES} bytes=${GENERATED_BYTES}"
}

main() {
    local zone_url=$DEFAULT_ZONE_URL
    local min_entries=$DEFAULT_MIN_LINES
    local output_path=
    local generate_only=0
    local temp_list=
    local remove_temp_list=0

    load_env_file "$ENV_FILE"

    while [[ $# -gt 0 ]]; do
        case "$1" in
            --allowlist)
                ALLOWLIST=$2
                shift 2
                ;;
            --static)
                STATIC=$2
                shift 2
                ;;
            --haproxy-cfg)
                HAPROXY_CFG=$2
                shift 2
                ;;
            --zone-url)
                zone_url=$2
                shift 2
                ;;
            --min-entries)
                min_entries=$2
                shift 2
                ;;
            --env-file)
                ENV_FILE=$2
                load_env_file "$ENV_FILE"
                shift 2
                ;;
            -o | --output)
                output_path=$2
                shift 2
                ;;
            --generate-only)
                generate_only=1
                shift
                ;;
            -h | --help)
                usage
                exit 0
                ;;
            *)
                die "unknown option: $1"
                ;;
        esac
    done

    command -v curl >/dev/null 2>&1 || die "curl not found (apt install curl)"

    exec 9>"$LOCK_FILE"
    if ! flock -n 9; then
        log "already running, exit"
        exit 0
    fi

    if [[ -z $output_path ]]; then
        if [[ $generate_only -eq 1 ]]; then
            die "use -o/--output with --generate-only"
        fi
        temp_list=$(mktemp)
        output_path=$temp_list
        remove_temp_list=1
        trap "rm -f '${temp_list}'" EXIT
    fi

    echo "downloading zone: ${zone_url}"
    generate_allowlist_bundle "$zone_url" "$output_path" "$STATIC" "$min_entries"
    echo "generated entries=${GENERATED_ENTRIES} zone_entries=${GENERATED_ZONE_ENTRIES} bytes=${GENERATED_BYTES}"

    if [[ $generate_only -eq 1 ]]; then
        echo "wrote ${output_path}"
        if [[ $remove_temp_list -eq 1 ]]; then
            rm -f "$temp_list"
            trap - EXIT
        fi
        exit 0
    fi

    command -v haproxy >/dev/null 2>&1 || die "haproxy not found"
    install_allowlist "$output_path" "$GENERATED_ENTRIES"

    if [[ $remove_temp_list -eq 1 ]]; then
        rm -f "$temp_list"
        trap - EXIT
    fi
}

main "$@"