bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat(history): publish sanitized server watermarks

Browse source
This commit is contained in:
冰朔 2026-08-01 19:27:55 +08:00
commit d40a89d942
7 changed files with 371 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

39
engineering/persona-history-runtime/scripts/install-bs-sh-005.sh
View file

@ -18,6 +18,11 @@ state_root=/var/lib/guanghu/persona-history
private_source_root=/guanghu/gestation/private/history-sources
receipt_root=/guanghu/gestation/receipts/persona-history
unit_target=/etc/systemd/system/guanghu-persona-history-recovery.service
publisher_unit_target=/etc/systemd/system/guanghu-persona-history-publisher.service
publisher_timer_target=/etc/systemd/system/guanghu-persona-history-publisher.timer
publisher_config_target=/etc/guanghu/persona-history-publisher.json
publisher_state_root=/var/lib/guanghu/persona-history-publisher
publisher_token=/etc/guanghu/persona-history-publisher.token
previous_target=NONE
if [ -L "${current_link}" ]; then
@ -32,12 +37,27 @@ if ! id guanghu-history >/dev/null 2>&1; then
--user-group \
guanghu-history
fi
if ! id guanghu-history-publisher >/dev/null 2>&1; then
useradd \
--system \
--home-dir "${publisher_state_root}" \
--shell /usr/sbin/nologin \
--user-group \
guanghu-history-publisher
fi
test -s "${publisher_token}"
install -d -o root -g root -m 0755 "${target_root}"
install -d -o root -g root -m 0755 "${target_root}/runtime"
install -m 0755 \
"${source_root}/runtime/guanghu_history_runtime.py" \
"${target_root}/runtime/guanghu_history_runtime.py"
install -m 0755 \
"${source_root}/runtime/guanghu_history_publisher.py" \
"${target_root}/runtime/guanghu_history_publisher.py"
install -m 0755 \
"${source_root}/runtime/git-credential-guanghu-history" \
"${target_root}/runtime/git-credential-guanghu-history"
install -m 0644 \
"${source_root}/config/BS-SH-005.json" \
"${target_root}/BS-SH-005.json"
@ -49,24 +69,40 @@ install -d -o root -g guanghu-history -m 0750 /etc/guanghu
install -m 0640 -o root -g guanghu-history \
"${source_root}/config/BS-SH-005.json" \
"${config_target}"
install -m 0644 -o root -g root \
"${source_root}/config/BS-SH-005-publisher.json" \
"${publisher_config_target}"
chown root:guanghu-history-publisher "${publisher_token}"
chmod 0640 "${publisher_token}"
install -d -o guanghu-history -g guanghu-history -m 0750 "${state_root}"
install -d -o guanghu-history -g guanghu-history -m 0750 "${state_root}/public"
setfacl -m u:guanghu-history:--x /guanghu/gestation
install -d -o root -g guanghu-history -m 0750 "${private_source_root}"
install -d -o root -g root -m 0755 "${receipt_root}"
install -d -o guanghu-history-publisher -g guanghu-history-publisher -m 0750 \
"${publisher_state_root}"
ln -sfn "${target_root}/runtime" "${current_link}"
install -m 0644 \
"${source_root}/packaging/guanghu-persona-history-recovery.service" \
"${unit_target}"
install -m 0644 \
"${source_root}/packaging/guanghu-persona-history-publisher.service" \
"${publisher_unit_target}"
install -m 0644 \
"${source_root}/packaging/guanghu-persona-history-publisher.timer" \
"${publisher_timer_target}"
"${current_link}/guanghu_history_runtime.py" validate --config "${config_target}"
systemctl daemon-reload
systemctl enable guanghu-persona-history-recovery.service
systemctl enable guanghu-persona-history-publisher.timer
systemctl restart guanghu-persona-history-recovery.service
systemctl start guanghu-persona-history-publisher.timer
sleep 2
systemctl is-active --quiet guanghu-persona-history-recovery.service
systemctl is-active --quiet guanghu-persona-history-publisher.timer
health=$(curl -fsS http://127.0.0.1:8089/healthz)
echo "${health}" | grep -q '"status": "ok"'
@ -84,6 +120,9 @@ target_root: ${target_root}
previous_target: ${previous_target}
service: guanghu-persona-history-recovery.service
service_state: active
publisher_service: guanghu-persona-history-publisher.service
publisher_timer: active
publisher_scope: REPO-014_AND_REPO-012_SANITIZED_WATERMARK_ONLY
listen: 127.0.0.1:8089
private_source_root: ${private_source_root}
public_state_root: ${state_root}/public