feat: add control panel

2026-07-08 19:07:35 +09:00
parent a07b15e489
commit 3be9970c15
104 changed files with 3639 additions and 461 deletions
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Validate the managed-production Control Panel handoff without printing secrets.
+# This does not contact the enterprise IdP; it proves the host has the required
+# TLS/OIDC files and that values are not still local/mock placeholders.
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+COMPOSE="${CASAN_CP_COMPOSE:-$ROOT/docker-compose.control-panel.yml}"
+TLS_DIR="${CASAN_CP_TLS_DIR:-/opt/casan-control-panel/tls}"
+OAUTH_ENV="${CASAN_CP_OAUTH_ENV:-/opt/casan-control-panel/oauth2-proxy.env}"
+
+fail() {
+  echo "CP_PROD_READINESS_FAIL $1"
+  exit 1
+}
+
+pass() {
+  echo "PASS: $1"
+}
+
+value_of() {
+  local key="$1"
+  sed -n -E "s/^${key}=//p" "$OAUTH_ENV" | tail -1
+}
+
+require_file() {
+  local path="$1"
+  [[ -f "$path" ]] || fail "missing_file path=$path"
+  [[ -s "$path" ]] || fail "empty_file path=$path"
+}
+
+require_env() {
+  local key="$1"
+  local value
+  value="$(value_of "$key")"
+  [[ -n "$value" ]] || fail "missing_env key=$key file=$OAUTH_ENV"
+  case "$value" in
+    *replace-with*|*example.com*|*localhost*|*127.0.0.1*|*idp:8080*)
+      fail "placeholder_env key=$key"
+      ;;
+  esac
+}
+
+docker compose -f "$COMPOSE" config >/tmp/casan-cp-prod-compose-config.txt
+pass "docker compose config"
+
+require_file "$TLS_DIR/tls.crt"
+require_file "$TLS_DIR/tls.key"
+openssl x509 -in "$TLS_DIR/tls.crt" -noout >/dev/null
+pass "tls certificate/key present"
+
+require_file "$OAUTH_ENV"
+for key in \
+  OAUTH2_PROXY_PROVIDER \
+  OAUTH2_PROXY_OIDC_ISSUER_URL \
+  OAUTH2_PROXY_CLIENT_ID \
+  OAUTH2_PROXY_CLIENT_SECRET \
+  OAUTH2_PROXY_COOKIE_SECRET \
+  OAUTH2_PROXY_REDIRECT_URL \
+  OAUTH2_PROXY_OIDC_GROUPS_CLAIM
+do
+  require_env "$key"
+done
+
+[[ "$(value_of OAUTH2_PROXY_PROVIDER)" == "oidc" ]] || fail "provider_must_be_oidc"
+[[ "$(value_of OAUTH2_PROXY_COOKIE_SECURE)" == "true" ]] || fail "cookie_secure_must_be_true"
+[[ "$(value_of OAUTH2_PROXY_SET_XAUTHREQUEST)" == "true" ]] || fail "xauthrequest_must_be_true"
+[[ "$(value_of OAUTH2_PROXY_PASS_ACCESS_TOKEN)" == "false" ]] || fail "pass_access_token_must_be_false"
+[[ "$(value_of OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER)" == "false" ]] || fail "pass_authorization_header_must_be_false"
+[[ "$(value_of OAUTH2_PROXY_OIDC_ISSUER_URL)" == https://* ]] || fail "issuer_must_be_https"
+[[ "$(value_of OAUTH2_PROXY_REDIRECT_URL)" == https://*"/oauth2/callback" ]] || fail "redirect_url_must_be_https_callback"
+[[ "$(value_of OAUTH2_PROXY_OIDC_GROUPS_CLAIM)" == "groups" ]] || fail "groups_claim_must_be_groups"
+pass "oauth2-proxy env"
+
+tmp="$(mktemp -d)"
+cp "$TLS_DIR/tls.crt" "$tmp/tls.crt"
+cp "$TLS_DIR/tls.key" "$tmp/tls.key"
+docker run --rm \
+  --add-host oauth2-proxy:127.0.0.1 \
+  --add-host control-panel-api:127.0.0.1 \
+  -v "$ROOT/nginx/control-panel.conf:/etc/nginx/conf.d/default.conf:ro" \
+  -v "$tmp:/etc/nginx/tls:ro" \
+  nginx:1.27-alpine nginx -t >/tmp/casan-cp-prod-nginx-test.log 2>&1 || {
+    cat /tmp/casan-cp-prod-nginx-test.log
+    rm -rf "$tmp"
+    fail "nginx_config"
+  }
+rm -rf "$tmp"
+pass "nginx config"
+
+echo "CP_PROD_READINESS_PASS compose=true tls=true oidc=true nginx=true"