93 lines
3.0 KiB
Bash
Executable File
93 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Validate the managed-production Control Panel handoff without printing secrets.
|
|
# This does not contact the enterprise IdP; it proves the host has the required
|
|
# TLS/OIDC files and that values are not still local/mock placeholders.
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
|
|
COMPOSE="${CASAN_CP_COMPOSE:-$ROOT/docker-compose.control-panel.yml}"
|
|
TLS_DIR="${CASAN_CP_TLS_DIR:-/opt/casan-control-panel/tls}"
|
|
OAUTH_ENV="${CASAN_CP_OAUTH_ENV:-/opt/casan-control-panel/oauth2-proxy.env}"
|
|
|
|
fail() {
|
|
echo "CP_PROD_READINESS_FAIL $1"
|
|
exit 1
|
|
}
|
|
|
|
pass() {
|
|
echo "PASS: $1"
|
|
}
|
|
|
|
value_of() {
|
|
local key="$1"
|
|
sed -n -E "s/^${key}=//p" "$OAUTH_ENV" | tail -1
|
|
}
|
|
|
|
require_file() {
|
|
local path="$1"
|
|
[[ -f "$path" ]] || fail "missing_file path=$path"
|
|
[[ -s "$path" ]] || fail "empty_file path=$path"
|
|
}
|
|
|
|
require_env() {
|
|
local key="$1"
|
|
local value
|
|
value="$(value_of "$key")"
|
|
[[ -n "$value" ]] || fail "missing_env key=$key file=$OAUTH_ENV"
|
|
case "$value" in
|
|
*replace-with*|*example.com*|*localhost*|*127.0.0.1*|*idp:8080*)
|
|
fail "placeholder_env key=$key"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
docker compose -f "$COMPOSE" config >/tmp/casan-cp-prod-compose-config.txt
|
|
pass "docker compose config"
|
|
|
|
require_file "$TLS_DIR/tls.crt"
|
|
require_file "$TLS_DIR/tls.key"
|
|
openssl x509 -in "$TLS_DIR/tls.crt" -noout >/dev/null
|
|
pass "tls certificate/key present"
|
|
|
|
require_file "$OAUTH_ENV"
|
|
for key in \
|
|
OAUTH2_PROXY_PROVIDER \
|
|
OAUTH2_PROXY_OIDC_ISSUER_URL \
|
|
OAUTH2_PROXY_CLIENT_ID \
|
|
OAUTH2_PROXY_CLIENT_SECRET \
|
|
OAUTH2_PROXY_COOKIE_SECRET \
|
|
OAUTH2_PROXY_REDIRECT_URL \
|
|
OAUTH2_PROXY_OIDC_GROUPS_CLAIM
|
|
do
|
|
require_env "$key"
|
|
done
|
|
|
|
[[ "$(value_of OAUTH2_PROXY_PROVIDER)" == "oidc" ]] || fail "provider_must_be_oidc"
|
|
[[ "$(value_of OAUTH2_PROXY_COOKIE_SECURE)" == "true" ]] || fail "cookie_secure_must_be_true"
|
|
[[ "$(value_of OAUTH2_PROXY_SET_XAUTHREQUEST)" == "true" ]] || fail "xauthrequest_must_be_true"
|
|
[[ "$(value_of OAUTH2_PROXY_PASS_ACCESS_TOKEN)" == "false" ]] || fail "pass_access_token_must_be_false"
|
|
[[ "$(value_of OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER)" == "false" ]] || fail "pass_authorization_header_must_be_false"
|
|
[[ "$(value_of OAUTH2_PROXY_OIDC_ISSUER_URL)" == https://* ]] || fail "issuer_must_be_https"
|
|
[[ "$(value_of OAUTH2_PROXY_REDIRECT_URL)" == https://*"/oauth2/callback" ]] || fail "redirect_url_must_be_https_callback"
|
|
[[ "$(value_of OAUTH2_PROXY_OIDC_GROUPS_CLAIM)" == "groups" ]] || fail "groups_claim_must_be_groups"
|
|
pass "oauth2-proxy env"
|
|
|
|
tmp="$(mktemp -d)"
|
|
cp "$TLS_DIR/tls.crt" "$tmp/tls.crt"
|
|
cp "$TLS_DIR/tls.key" "$tmp/tls.key"
|
|
docker run --rm \
|
|
--add-host oauth2-proxy:127.0.0.1 \
|
|
--add-host control-panel-api:127.0.0.1 \
|
|
-v "$ROOT/nginx/control-panel.conf:/etc/nginx/conf.d/default.conf:ro" \
|
|
-v "$tmp:/etc/nginx/tls:ro" \
|
|
nginx:1.27-alpine nginx -t >/tmp/casan-cp-prod-nginx-test.log 2>&1 || {
|
|
cat /tmp/casan-cp-prod-nginx-test.log
|
|
rm -rf "$tmp"
|
|
fail "nginx_config"
|
|
}
|
|
rm -rf "$tmp"
|
|
pass "nginx config"
|
|
|
|
echo "CP_PROD_READINESS_PASS compose=true tls=true oidc=true nginx=true"
|