250 lines
7.0 KiB
Bash
Executable File
250 lines
7.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# CISD init on-host precheck.
|
|
# Usage:
|
|
# chmod +x scripts/cisd_init_precheck.sh
|
|
# ./scripts/cisd_init_precheck.sh
|
|
# Optional:
|
|
# PRODUCT_TYPE=ENTERPRISE ./scripts/cisd_init_precheck.sh
|
|
|
|
PRODUCT_TYPE="${PRODUCT_TYPE:-${TMS_CISD_PRESET_PRODUCT_TYPE:-UNKNOWN}}"
|
|
MODE="${TMS_INIT_EXECUTOR_MODE:-SIMULATE}"
|
|
LOG_DIR="${TMS_INIT_EXECUTOR_LOG_DIR:-/tmp/tms-init-logs}"
|
|
STANDARD_CPCONFIG_PATH="${TMS_INIT_EXECUTOR_STANDARD_CPCONFIG_PATH:-/home/cmep4i/cpconfig.cfg}"
|
|
STANDARD_HOME_DIR="${TMS_INIT_EXECUTOR_STANDARD_HOME_DIR:-/home/cmep4i}"
|
|
STANDARD_RUN_USER="${TMS_INIT_EXECUTOR_STANDARD_RUN_USER:-cmep4i}"
|
|
TMS_RUN_USER="${TMS_RUN_USER:-tms}"
|
|
DIRECT_DB_SCRIPT_DIR="${TMS_INIT_EXECUTOR_DIRECT_DB_SCRIPT_DIR:-/opt/CAE_Install_Base_Resource/DB}"
|
|
DIRECT_TLQ_INIT_CFG_DIR="${TMS_INIT_EXECUTOR_DIRECT_TLQ_INIT_CFG_DIR:-/opt/CAE_Install_App_Resource/CAE}"
|
|
APP_PATTERN_1="${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_1:-/home/cmep4i/cmsp/application-prd*.properties}"
|
|
APP_PATTERN_2="${TMS_INIT_EXECUTOR_STANDARD_RABBIT_APP_CONFIG_PATTERN_2:-/home/cmep4i/cmtp/application-prd*.properties}"
|
|
RABBIT_CRED_ENCRYPT_ENABLED="${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_ENCRYPT_ENABLED:-true}"
|
|
RABBIT_CRED_SECRET_KEY="${TMS_INIT_EXECUTOR_STANDARD_RABBIT_CREDENTIAL_SECRET_KEY:-ABCDEFGHIJKLMN1234567890}"
|
|
|
|
pass_count=0
|
|
warn_count=0
|
|
fail_count=0
|
|
|
|
pass() {
|
|
echo "[PASS] $1"
|
|
pass_count=$((pass_count + 1))
|
|
}
|
|
|
|
warn() {
|
|
echo "[WARN] $1"
|
|
warn_count=$((warn_count + 1))
|
|
}
|
|
|
|
fail() {
|
|
echo "[FAIL] $1"
|
|
fail_count=$((fail_count + 1))
|
|
}
|
|
|
|
check_cmd() {
|
|
local cmd="$1"
|
|
if command -v "$cmd" >/dev/null 2>&1; then
|
|
pass "command exists: ${cmd}"
|
|
else
|
|
fail "command missing: ${cmd}"
|
|
fi
|
|
}
|
|
|
|
check_file() {
|
|
local file="$1"
|
|
if [[ -f "$file" ]]; then
|
|
pass "file exists: ${file}"
|
|
else
|
|
fail "file missing: ${file}"
|
|
fi
|
|
}
|
|
|
|
check_dir() {
|
|
local dir="$1"
|
|
if [[ -d "$dir" ]]; then
|
|
pass "directory exists: ${dir}"
|
|
else
|
|
fail "directory missing: ${dir}"
|
|
fi
|
|
}
|
|
|
|
check_writable_dir() {
|
|
local dir="$1"
|
|
mkdir -p "$dir" 2>/dev/null || true
|
|
if [[ -d "$dir" && -w "$dir" ]]; then
|
|
pass "directory writable: ${dir}"
|
|
else
|
|
fail "directory not writable: ${dir}"
|
|
fi
|
|
}
|
|
|
|
check_pattern_match() {
|
|
local pattern="$1"
|
|
shopt -s nullglob
|
|
local matches=($pattern)
|
|
shopt -u nullglob
|
|
if (( ${#matches[@]} > 0 )); then
|
|
pass "pattern matched (${#matches[@]}): ${pattern}"
|
|
else
|
|
fail "pattern has no match: ${pattern}"
|
|
fi
|
|
}
|
|
|
|
run_test_as_user() {
|
|
local user="$1"
|
|
shift
|
|
|
|
if [[ "$(id -un 2>/dev/null || true)" == "$user" ]]; then
|
|
test "$@"
|
|
return $?
|
|
fi
|
|
|
|
if [[ "$(id -u)" == "0" ]] && command -v runuser >/dev/null 2>&1; then
|
|
runuser -u "$user" -- test "$@" 2>/dev/null
|
|
return $?
|
|
fi
|
|
|
|
if command -v sudo >/dev/null 2>&1; then
|
|
sudo -n -u "$user" test "$@" 2>/dev/null
|
|
return $?
|
|
fi
|
|
|
|
return 125
|
|
}
|
|
|
|
check_user_path_access() {
|
|
local user="$1"
|
|
local mode="$2"
|
|
local path="$3"
|
|
local flag=""
|
|
|
|
case "$mode" in
|
|
r) flag="-r" ;;
|
|
w) flag="-w" ;;
|
|
x) flag="-x" ;;
|
|
rw) flag="-r" ;;
|
|
rx) flag="-r" ;;
|
|
*) fail "unknown access mode ${mode} for ${path}"; return ;;
|
|
esac
|
|
|
|
if ! id "$user" >/dev/null 2>&1; then
|
|
fail "user missing: ${user}"
|
|
return
|
|
fi
|
|
|
|
if run_test_as_user "$user" "$flag" "$path"; then
|
|
if [[ "$mode" == *w* ]] && ! run_test_as_user "$user" -w "$path"; then
|
|
fail "path not writable by ${user}: ${path}"
|
|
return
|
|
fi
|
|
if [[ "$mode" == *x* ]] && ! run_test_as_user "$user" -x "$path"; then
|
|
fail "path not executable/searchable by ${user}: ${path}"
|
|
return
|
|
fi
|
|
pass "path ${mode} by ${user}: ${path}"
|
|
else
|
|
local rc=$?
|
|
if [[ "$rc" == "125" ]]; then
|
|
warn "cannot verify access as ${user}: ${path} (run as root or configure sudo -n)"
|
|
else
|
|
fail "path not ${mode} by ${user}: ${path}"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
check_product_type() {
|
|
case "$PRODUCT_TYPE" in
|
|
ENTERPRISE|INDIRECT|DIRECT)
|
|
pass "product type recognized: ${PRODUCT_TYPE}"
|
|
;;
|
|
*)
|
|
fail "product type invalid: ${PRODUCT_TYPE} (expected ENTERPRISE/INDIRECT/DIRECT)"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
check_mode() {
|
|
if [[ "$MODE" == "LOCAL" ]]; then
|
|
pass "executor mode is LOCAL"
|
|
else
|
|
warn "executor mode is ${MODE}; on-host initialization should use LOCAL"
|
|
fi
|
|
}
|
|
|
|
check_encryption_config() {
|
|
local enabled_lower
|
|
enabled_lower="$(echo "$RABBIT_CRED_ENCRYPT_ENABLED" | tr '[:upper:]' '[:lower:]')"
|
|
if [[ "$enabled_lower" == "true" ]]; then
|
|
pass "rabbit app credential encryption is enabled"
|
|
if [[ -n "$RABBIT_CRED_SECRET_KEY" ]]; then
|
|
if [[ ${#RABBIT_CRED_SECRET_KEY} -eq 24 ]]; then
|
|
pass "rabbit credential secret key length is 24 (DESede)"
|
|
else
|
|
warn "rabbit credential secret key length is ${#RABBIT_CRED_SECRET_KEY}, expected 24"
|
|
fi
|
|
else
|
|
fail "rabbit credential secret key is empty"
|
|
fi
|
|
else
|
|
warn "rabbit app credential encryption disabled"
|
|
fi
|
|
}
|
|
|
|
check_standard_assets() {
|
|
local standard_media="${STANDARD_HOME_DIR}/cpackage"
|
|
check_file "$STANDARD_CPCONFIG_PATH"
|
|
check_dir "$standard_media"
|
|
check_file "${standard_media}/toolsh/setfraq.sh"
|
|
check_file "${standard_media}/toolsh/setftq.sh"
|
|
check_file "${standard_media}/toolsh/setsql.sh"
|
|
check_file "${standard_media}/toolsh/setsptp.sh"
|
|
check_user_path_access "$STANDARD_RUN_USER" rx "${standard_media}/toolsh/setfraq.sh"
|
|
check_user_path_access "$STANDARD_RUN_USER" rx "${standard_media}/toolsh/setftq.sh"
|
|
check_user_path_access "$STANDARD_RUN_USER" rx "${standard_media}/toolsh/setsptp.sh"
|
|
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmsp/01/application-prd-ci01.properties"
|
|
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmsp/02/application-prd-ci02.properties"
|
|
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmtp/01/application-prd-ci01.properties"
|
|
check_user_path_access "$STANDARD_RUN_USER" rw "${standard_media}/cmtp/02/application-prd-ci02.properties"
|
|
check_user_path_access "$TMS_RUN_USER" r "${standard_media}/software/nginx.conf"
|
|
check_user_path_access "$TMS_RUN_USER" r "${standard_media}/front/front.zip"
|
|
check_pattern_match "$APP_PATTERN_1"
|
|
check_pattern_match "$APP_PATTERN_2"
|
|
check_cmd "rabbitmqctl"
|
|
check_cmd "rabbitmqadmin"
|
|
}
|
|
|
|
check_direct_assets() {
|
|
check_file "$STANDARD_CPCONFIG_PATH"
|
|
check_dir "$DIRECT_DB_SCRIPT_DIR"
|
|
check_file "$DIRECT_DB_SCRIPT_DIR/setsql.sh"
|
|
check_dir "$DIRECT_TLQ_INIT_CFG_DIR"
|
|
check_file "$DIRECT_TLQ_INIT_CFG_DIR/init_cfg.sh"
|
|
check_cmd "java"
|
|
check_cmd "rabbitmqctl"
|
|
}
|
|
|
|
main() {
|
|
echo "[INFO] CISD init precheck started"
|
|
echo "[INFO] PRODUCT_TYPE=${PRODUCT_TYPE}"
|
|
echo "[INFO] MODE=${MODE}"
|
|
echo "[INFO] LOG_DIR=${LOG_DIR}"
|
|
|
|
check_product_type
|
|
check_mode
|
|
check_writable_dir "$LOG_DIR"
|
|
check_encryption_config
|
|
|
|
if [[ "$PRODUCT_TYPE" == "DIRECT" ]]; then
|
|
check_direct_assets
|
|
else
|
|
check_standard_assets
|
|
fi
|
|
|
|
echo "[INFO] precheck summary: pass=${pass_count}, warn=${warn_count}, fail=${fail_count}"
|
|
if (( fail_count > 0 )); then
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
main "$@"
|