78 lines
2.7 KiB
Shell
78 lines
2.7 KiB
Shell
#!/bin/bash
|
|
set -Eeuo pipefail
|
|
|
|
# Resident HoloLake update bridge for JD-FD-PRIMARY under the Guanghu
|
|
# supervisor. The release origin remains loopback-only. A dedicated,
|
|
# port-forwarding-only SSH identity exposes exactly one loopback port on the
|
|
# registered BS-GZ-006 HTTPS front door.
|
|
|
|
readonly RELEASE_SERVER=/opt/guanghu/hololake-release-broadcast-candidate/current/server.mjs
|
|
readonly RELEASE_STATE_ROOT=/var/lib/guanghu/hololake-release-broadcast
|
|
readonly RELEASE_PORT=3940
|
|
readonly TUNNEL_KEY=/etc/guanghu/secrets/hololake-release-tunnel-ed25519
|
|
readonly TUNNEL_KNOWN_HOSTS=/etc/guanghu/secrets/hololake-release-tunnel-known-hosts
|
|
readonly FRONT_DOOR_HOST=43.139.217.141
|
|
readonly FRONT_DOOR_USER=hololake-tunnel
|
|
readonly FRONT_DOOR_PORT=19440
|
|
|
|
SERVER_PID=
|
|
TUNNEL_PID=
|
|
|
|
cleanup() {
|
|
trap - EXIT INT TERM
|
|
[[ -z ${TUNNEL_PID:-} ]] || kill "$TUNNEL_PID" 2>/dev/null || true
|
|
[[ -z ${SERVER_PID:-} ]] || kill "$SERVER_PID" 2>/dev/null || true
|
|
wait 2>/dev/null || true
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
require_exact_runtime() {
|
|
[[ -f $RELEASE_SERVER && ! -L $RELEASE_SERVER ]] || {
|
|
# current is an audited immutable-release symlink; resolve it and reject a
|
|
# non-regular final target rather than following arbitrary path material.
|
|
local resolved
|
|
resolved=$(readlink -f "$RELEASE_SERVER")
|
|
[[ $resolved == /opt/guanghu/hololake-release-broadcast-candidate/*/server.mjs ]]
|
|
[[ -f $resolved && ! -L $resolved ]]
|
|
}
|
|
[[ -f $TUNNEL_KEY && ! -L $TUNNEL_KEY ]]
|
|
[[ -f $TUNNEL_KNOWN_HOSTS && ! -L $TUNNEL_KNOWN_HOSTS ]]
|
|
[[ $(stat -c '%a' "$TUNNEL_KEY") == 600 ]]
|
|
}
|
|
|
|
start_server() {
|
|
/usr/bin/setpriv --reuid=989 --regid=989 --init-groups --inh-caps=-all --reset-env \
|
|
/usr/bin/env HOME=/nonexistent USER=hololake-release LOGNAME=hololake-release \
|
|
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
|
|
HOLOLAKE_RELEASE_HOST=127.0.0.1 HOLOLAKE_RELEASE_PORT="$RELEASE_PORT" \
|
|
HOLOLAKE_RELEASE_STATE_ROOT="$RELEASE_STATE_ROOT" \
|
|
/usr/bin/node "$RELEASE_SERVER" &
|
|
SERVER_PID=$!
|
|
}
|
|
|
|
start_tunnel() {
|
|
/usr/bin/ssh -N \
|
|
-i "$TUNNEL_KEY" -o IdentitiesOnly=yes -o BatchMode=yes \
|
|
-o UserKnownHostsFile="$TUNNEL_KNOWN_HOSTS" -o StrictHostKeyChecking=yes \
|
|
-o ExitOnForwardFailure=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=3 \
|
|
-R "127.0.0.1:${FRONT_DOOR_PORT}:127.0.0.1:${RELEASE_PORT}" \
|
|
"${FRONT_DOOR_USER}@${FRONT_DOOR_HOST}" &
|
|
TUNNEL_PID=$!
|
|
}
|
|
|
|
main() {
|
|
require_exact_runtime
|
|
start_server
|
|
while :; do
|
|
kill -0 "$SERVER_PID" 2>/dev/null || return 1
|
|
start_tunnel
|
|
wait -n "$SERVER_PID" "$TUNNEL_PID" || true
|
|
kill -0 "$SERVER_PID" 2>/dev/null || return 1
|
|
kill "$TUNNEL_PID" 2>/dev/null || true
|
|
wait "$TUNNEL_PID" 2>/dev/null || true
|
|
TUNNEL_PID=
|
|
sleep 2
|
|
done
|
|
}
|
|
|
|
main "$@"
|