115 lines
5 KiB
Shell
115 lines
5 KiB
Shell
#!/bin/sh
|
|
set -eu
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "idunn-yggdrasil must run through its narrow sudo boundary" >&2
|
|
exit 1
|
|
fi
|
|
|
|
action="${1:-}"
|
|
target="${2:-}"
|
|
source_commit="${3:-}"
|
|
repository_full_name="${4:-}"
|
|
upstream_ref="${5:-}"
|
|
release_authority_id="${6:-}"
|
|
release_authority_sha256="${7:-}"
|
|
deployment_request_id="${8:-}"
|
|
requires_bifrost_authority="${9:-false}"
|
|
compose=/srv/compose/yggdrasil-apps.yaml
|
|
|
|
require_release_lineage() {
|
|
case "$target" in
|
|
bifrost-persona-feedback) target_requires_bifrost_authority=true ;;
|
|
epiphany|epiphany-capstone-17|voidbot|heimdall|repixelizer|streampixels|odin|codex-connector|ghostlight|gjallar) target_requires_bifrost_authority=false ;;
|
|
*) echo "deployment target has no release-authority policy: $target" >&2; exit 1 ;;
|
|
esac
|
|
if [ "$requires_bifrost_authority" != "$target_requires_bifrost_authority" ]; then
|
|
echo "caller release-authority mode does not match root policy for $target" >&2
|
|
exit 1
|
|
fi
|
|
requires_bifrost_authority="$target_requires_bifrost_authority"
|
|
case "$source_commit" in
|
|
*[!0-9a-f]*|'') echo "invalid or missing IDUNN_SOURCE_COMMIT" >&2; exit 1 ;;
|
|
esac
|
|
[ "${#source_commit}" -eq 40 ] || { echo "IDUNN_SOURCE_COMMIT must be 40 hex characters" >&2; exit 1; }
|
|
[ -n "$repository_full_name" ] || { echo "missing repository identity" >&2; exit 1; }
|
|
[ -n "$upstream_ref" ] || { echo "missing upstream ref" >&2; exit 1; }
|
|
[ -n "$deployment_request_id" ] || { echo "missing Idunn deployment request id" >&2; exit 1; }
|
|
case "$requires_bifrost_authority" in
|
|
true)
|
|
[ -n "$release_authority_id" ] || { echo "missing Bifrost release authority id" >&2; exit 1; }
|
|
case "$release_authority_sha256" in
|
|
*[!0-9a-f]*|'') echo "invalid or missing Bifrost release authority digest" >&2; exit 1 ;;
|
|
esac
|
|
[ "${#release_authority_sha256}" -eq 64 ] || { echo "Bifrost release authority digest must be 64 hex characters" >&2; exit 1; }
|
|
/usr/local/bin/idunn validate-release-authority \
|
|
--store /var/lib/gamecult/idunn/yggdrasil.keepalive.cc \
|
|
--release-authority-store /srv/bifrost/state/repository-release-authority.cc \
|
|
--repository-full-name "$repository_full_name" \
|
|
--upstream-ref "$upstream_ref" \
|
|
--source-revision "$source_commit" \
|
|
--release-authority-id "$release_authority_id" \
|
|
--release-authority-sha256 "$release_authority_sha256"
|
|
;;
|
|
false)
|
|
[ -z "$release_authority_id" ] || { echo "source-observed release cannot claim Bifrost authority id" >&2; exit 1; }
|
|
[ -z "$release_authority_sha256" ] || { echo "source-observed release cannot claim Bifrost authority digest" >&2; exit 1; }
|
|
;;
|
|
*) echo "invalid Bifrost authority requirement mode" >&2; exit 1 ;;
|
|
esac
|
|
}
|
|
|
|
case "$action:$target" in
|
|
restart:heimdall)
|
|
exec docker compose -f "$compose" restart heimdall
|
|
;;
|
|
restart:repixelizer)
|
|
exec docker compose -f "$compose" restart repixelizer
|
|
;;
|
|
restart:streampixels)
|
|
docker compose -f "$compose" restart streampixels-service streampixels-web
|
|
;;
|
|
restart:gjallar)
|
|
exec systemctl restart gjallar-yggdrasil.service
|
|
;;
|
|
deploy:voidbot|restart:voidbot|deploy:epiphany|restart:epiphany|deploy:epiphany-capstone-17|deploy:odin|restart:odin|deploy:codex-connector|restart:codex-connector|deploy:ghostlight|restart:ghostlight)
|
|
manifest="/srv/odin/deploy-manifests/$target"
|
|
if [ ! -x "$manifest" ] || [ ! -O "$manifest" ]; then
|
|
echo "root-owned executable deploy manifest is not installed: $manifest" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$action" = deploy ]; then
|
|
require_release_lineage
|
|
fi
|
|
IDUNN_ACTUATOR=1 IDUNN_COMMAND_AUTHORITY=idunn-daemon \
|
|
IDUNN_SOURCE_COMMIT="$source_commit" \
|
|
IDUNN_REPOSITORY_FULL_NAME="$repository_full_name" \
|
|
IDUNN_UPSTREAM_REF="$upstream_ref" \
|
|
BIFROST_RELEASE_AUTHORITY_ID="$release_authority_id" \
|
|
BIFROST_RELEASE_AUTHORITY_SHA256="$release_authority_sha256" \
|
|
IDUNN_DEPLOYMENT_REQUEST_ID="$deployment_request_id" \
|
|
IDUNN_REQUIRES_BIFROST_AUTHORITY="$requires_bifrost_authority" \
|
|
exec "$manifest" "$action"
|
|
;;
|
|
deploy:heimdall|deploy:repixelizer|deploy:streampixels|deploy:bifrost-persona-feedback|deploy:gjallar)
|
|
manifest="/srv/odin/deploy-manifests/$target"
|
|
if [ ! -x "$manifest" ] || [ ! -O "$manifest" ]; then
|
|
echo "root-owned executable deploy manifest is not installed: $manifest" >&2
|
|
exit 1
|
|
fi
|
|
require_release_lineage
|
|
IDUNN_ACTUATOR=1 IDUNN_COMMAND_AUTHORITY=idunn-daemon \
|
|
IDUNN_SOURCE_COMMIT="$source_commit" \
|
|
IDUNN_REPOSITORY_FULL_NAME="$repository_full_name" \
|
|
IDUNN_UPSTREAM_REF="$upstream_ref" \
|
|
BIFROST_RELEASE_AUTHORITY_ID="$release_authority_id" \
|
|
BIFROST_RELEASE_AUTHORITY_SHA256="$release_authority_sha256" \
|
|
IDUNN_DEPLOYMENT_REQUEST_ID="$deployment_request_id" \
|
|
IDUNN_REQUIRES_BIFROST_AUTHORITY="$requires_bifrost_authority" \
|
|
exec "$manifest"
|
|
;;
|
|
*)
|
|
echo "unsupported Idunn Yggdrasil actuator request: $action $target" >&2
|
|
exit 2
|
|
;;
|
|
esac
|