88 lines
3.0 KiB
Bash
88 lines
3.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
usage() {
|
|
echo '用法：generate-env.sh --public-host admin.example.com --files-host files.example.com [--output /etc/lehuo/lehuo.env]'
|
|
}
|
|
|
|
public_host=''
|
|
files_host=''
|
|
output='/etc/lehuo/lehuo.env'
|
|
while (($#)); do
|
|
case "$1" in
|
|
--public-host) public_host="${2:-}"; shift 2 ;;
|
|
--files-host) files_host="${2:-}"; shift 2 ;;
|
|
--output) output="${2:-}"; shift 2 ;;
|
|
-h|--help) usage; exit 0 ;;
|
|
*) usage >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
[[ "$public_host" =~ ^[A-Za-z0-9.-]+$ ]] || { echo 'PUBLIC_HOST 格式无效。' >&2; exit 1; }
|
|
[[ "$files_host" =~ ^[A-Za-z0-9.-]+$ ]] || { echo 'FILES_HOST 格式无效。' >&2; exit 1; }
|
|
[[ "$public_host" != "$files_host" ]] || { echo '管理后台/API 域名与文件域名必须不同。' >&2; exit 1; }
|
|
command -v openssl >/dev/null 2>&1 || { echo '缺少 openssl。' >&2; exit 1; }
|
|
command -v git >/dev/null 2>&1 || { echo '缺少 git。' >&2; exit 1; }
|
|
|
|
if [[ -e "$output" ]]; then
|
|
printf '拒绝覆盖已有环境文件：%s\n' "$output" >&2
|
|
exit 1
|
|
fi
|
|
|
|
install -d -m 0700 "$(dirname -- "$output")"
|
|
umask 077
|
|
|
|
mysql_password="$(openssl rand -hex 24)"
|
|
mysql_root_password="$(openssl rand -hex 32)"
|
|
redis_password="$(openssl rand -hex 32)"
|
|
minio_password="$(openssl rand -hex 32)"
|
|
session_secret="$(openssl rand -hex 32)"
|
|
session_pepper="$(openssl rand -hex 32)"
|
|
audit_key="$(openssl rand -hex 32)"
|
|
field_key="$(openssl rand -base64 32 | tr -d '\n')"
|
|
image_tag="$(git -C "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)" rev-parse --short=12 HEAD)"
|
|
|
|
cat > "$output" <<EOF
|
|
IMAGE_TAG=${image_tag}
|
|
PUBLIC_HOST=${public_host}
|
|
FILES_HOST=${files_host}
|
|
TLS_CERT_PATH=/opt/lehuo/shared/tls/fullchain.pem
|
|
TLS_KEY_PATH=/opt/lehuo/shared/tls/privkey.pem
|
|
BACKUP_DIR=/opt/lehuo/backups
|
|
MYSQL_DATABASE=lehuo
|
|
MYSQL_USER=lehuo
|
|
MYSQL_PASSWORD=${mysql_password}
|
|
MYSQL_ROOT_PASSWORD=${mysql_root_password}
|
|
DATABASE_URL=mysql://lehuo:${mysql_password}@mysql:3306/lehuo
|
|
REDIS_PASSWORD=${redis_password}
|
|
REDIS_URL=redis://:${redis_password}@redis:6379
|
|
MINIO_ROOT_USER=lehuo_storage
|
|
MINIO_ROOT_PASSWORD=${minio_password}
|
|
OBJECT_STORAGE_ENDPOINT=https://${files_host}
|
|
OBJECT_STORAGE_REGION=auto
|
|
OBJECT_STORAGE_BUCKET=lehuo-private
|
|
OBJECT_STORAGE_ACCESS_KEY=lehuo_storage
|
|
OBJECT_STORAGE_SECRET_KEY=${minio_password}
|
|
SESSION_SECRET=${session_secret}
|
|
SESSION_TOKEN_PEPPER=${session_pepper}
|
|
AUDIT_IP_HASH_KEY=${audit_key}
|
|
FIELD_ENCRYPTION_KEY=${field_key}
|
|
ADMIN_WEB_ORIGIN=https://${public_host}
|
|
AUTH_SESSION_TTL_SECONDS=28800
|
|
WECHAT_SESSION_TTL_SECONDS=7200
|
|
WECHAT_APP_ID=
|
|
WECHAT_APP_SECRET=
|
|
WECHAT_TEMPLATE_APPLICATION_SUBMITTED=
|
|
WECHAT_TEMPLATE_APPLICATION_ACCEPTED=
|
|
WECHAT_TEMPLATE_SERVICE_ARRANGED=
|
|
WECHAT_TEMPLATE_SERVICE_COMPLETED=
|
|
WECHAT_TEMPLATE_FOLLOW_UP_PENDING=
|
|
WECHAT_TEMPLATE_ACTIVITY_REGISTRATION_RESULT=
|
|
NOTIFICATION_WORKER_ENABLED=false
|
|
EOF
|
|
chmod 600 "$output"
|
|
|
|
install -d -m 0700 /opt/lehuo/shared/tls /opt/lehuo/backups /opt/lehuo/releases
|
|
printf '环境文件已生成：%s\n' "$output"
|
|
echo '下一步：放置覆盖两个域名的 TLS 证书，然后运行 preflight.sh。'
|