hololake-system-architecture/product-source/hololake-platform/guanghu-os/scripts/hololake-release-bridge.sh

73 lines
2.5 KiB
Shell

#!/bin/bash
set -Eeuo pipefail
# Resident HoloLake update bridge for JD-FD-PRIMARY under the Guanghu
# supervisor. The release origin remains loopback-only. A dedicated,
# port-forwarding-only SSH identity exposes exactly one loopback port on the
# registered BS-GZ-006 HTTPS front door.
readonly RELEASE_SERVER=/opt/guanghu/hololake-release-broadcast-candidate/current/server.mjs
readonly RELEASE_STATE_ROOT=/var/lib/guanghu/hololake-release-broadcast
readonly RELEASE_PORT=3940
readonly TUNNEL_KEY=/etc/guanghu/secrets/hololake-release-tunnel-ed25519
readonly TUNNEL_KNOWN_HOSTS=/etc/guanghu/secrets/hololake-release-tunnel-known-hosts
readonly FRONT_DOOR_HOST=43.139.217.141
readonly FRONT_DOOR_USER=hololake-tunnel
readonly FRONT_DOOR_PORT=19440
declare -a CHILDREN=()
cleanup() {
trap - EXIT INT TERM
for pid in "${CHILDREN[@]:-}"; do
kill "$pid" 2>/dev/null || true
done
wait 2>/dev/null || true
}
trap cleanup EXIT INT TERM
require_exact_runtime() {
[[ -f $RELEASE_SERVER && ! -L $RELEASE_SERVER ]] || {
# current is an audited immutable-release symlink; resolve it and reject a
# non-regular final target rather than following arbitrary path material.
local resolved
resolved=$(readlink -f "$RELEASE_SERVER")
[[ $resolved == /opt/guanghu/hololake-release-broadcast-candidate/*/server.mjs ]]
[[ -f $resolved && ! -L $resolved ]]
}
[[ -f $TUNNEL_KEY && ! -L $TUNNEL_KEY ]]
[[ -f $TUNNEL_KNOWN_HOSTS && ! -L $TUNNEL_KNOWN_HOSTS ]]
[[ $(stat -c '%a' "$TUNNEL_KEY") == 600 ]]
}
start_pair() {
CHILDREN=()
/usr/bin/setpriv --reuid=989 --regid=989 --init-groups --inh-caps=-all --reset-env \
/usr/bin/env HOME=/nonexistent USER=hololake-release LOGNAME=hololake-release \
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
HOLOLAKE_RELEASE_HOST=127.0.0.1 HOLOLAKE_RELEASE_PORT="$RELEASE_PORT" \
HOLOLAKE_RELEASE_STATE_ROOT="$RELEASE_STATE_ROOT" \
/usr/bin/node "$RELEASE_SERVER" &
CHILDREN+=("$!")
/usr/bin/ssh -N \
-i "$TUNNEL_KEY" -o IdentitiesOnly=yes -o BatchMode=yes \
-o UserKnownHostsFile="$TUNNEL_KNOWN_HOSTS" -o StrictHostKeyChecking=yes \
-o ExitOnForwardFailure=yes -o ServerAliveInterval=20 -o ServerAliveCountMax=3 \
-R "127.0.0.1:${FRONT_DOOR_PORT}:127.0.0.1:${RELEASE_PORT}" \
"${FRONT_DOOR_USER}@${FRONT_DOOR_HOST}" &
CHILDREN+=("$!")
}
main() {
require_exact_runtime
while :; do
start_pair
wait -n "${CHILDREN[@]}" || true
for pid in "${CHILDREN[@]}"; do kill "$pid" 2>/dev/null || true; done
wait 2>/dev/null || true
sleep 2
done
}
main "$@"