404 lines
16 KiB
Bash
Executable File
404 lines
16 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# 在受控 Nacos 临时配置窗口内预置狗粮账号，并在任何退出路径恢复原配置。
|
||
# 本脚本不创建额度池资源；调用既有 provision-dogfood-users.sh 完成账号与额度绑定。
|
||
set -Eeuo pipefail
|
||
|
||
readonly EXPECTED_ACK='PROVISION_DOGFOOD_WITH_NACOS_TRANSACTION'
|
||
readonly DATA_ID='huijing-server-staging.yaml'
|
||
readonly NACOS_GROUP='DEFAULT_GROUP'
|
||
readonly CODE_USERNAME_OR_PASSWORD_ERROR='1002090005'
|
||
readonly CODE_PASSWORD_REGISTER_DISABLED='1002090007'
|
||
readonly CODE_DOGFOOD_SMS_DISABLED='1002090008'
|
||
readonly CODE_AD_DOGFOOD_DISABLED='1111002006'
|
||
|
||
MODE='transaction'
|
||
WATCHDOG_RECOVERY_DIR=''
|
||
if [ "${1:-}" = '--watchdog' ]; then
|
||
MODE='watchdog'
|
||
WATCHDOG_RECOVERY_DIR="${2:-}"
|
||
elif [ -n "${1:-}" ]; then
|
||
printf 'DOGFOOD_NACOS_TX_FAIL 未知参数：%s\n' "$1" >&2
|
||
exit 2
|
||
fi
|
||
|
||
DOGFOOD_PROVISION_ACK="${DOGFOOD_PROVISION_ACK:-}"
|
||
ADMIN_TOKEN_FILE="${ADMIN_TOKEN_FILE:-}"
|
||
BASE="${BASE:-http://100.64.0.7:48080}"
|
||
TENANT="${TENANT:-1}"
|
||
NACOS_BASE_URL="${NACOS_BASE_URL:-http://100.64.0.8:8848/nacos}"
|
||
NACOS_USERNAME="${NACOS_USERNAME:-nacos}"
|
||
NACOS_PASSWORD="${NACOS_PASSWORD:-}"
|
||
NACOS_ENV_FILE="${NACOS_ENV_FILE:-/root/huijing-dev.env}"
|
||
BACKEND_UNIT="${BACKEND_UNIT:-gda-staging-backend}"
|
||
PROVISION_BIN="${PROVISION_BIN:-$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/provision-dogfood-users.sh}"
|
||
CURL_BIN="${CURL_BIN:-curl}"
|
||
SYSTEMCTL_BIN="${SYSTEMCTL_BIN:-systemctl}"
|
||
SYSTEMD_RUN_BIN="${SYSTEMD_RUN_BIN:-systemd-run}"
|
||
FLOCK_BIN="${FLOCK_BIN:-flock}"
|
||
SLEEP_BIN="${SLEEP_BIN:-sleep}"
|
||
RESTART_TIMEOUT_SEC="${RESTART_TIMEOUT_SEC:-180}"
|
||
PROVISION_TTL_SEC="${PROVISION_TTL_SEC:-900}"
|
||
RUN_ID="${RUN_ID:-$(date -u +%Y%m%dT%H%M%SZ)-$$}"
|
||
EVIDENCE_DIR="${EVIDENCE_DIR:-/root/game-staging/evidence/dogfood-provision-$RUN_ID}"
|
||
LOCK_FILE="${LOCK_FILE:-/root/game-staging/locks/dogfood-provision.lock}"
|
||
EVENT_LOG=''
|
||
|
||
log() {
|
||
local line
|
||
line="[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*"
|
||
printf '%s\n' "$line"
|
||
[ -z "$EVENT_LOG" ] || printf '%s\n' "$line" >>"$EVENT_LOG"
|
||
}
|
||
die() { printf 'DOGFOOD_NACOS_TX_FAIL %s\n' "$*" >&2; exit 1; }
|
||
|
||
[[ "$RESTART_TIMEOUT_SEC" =~ ^[0-9]+$ ]] && [ "$RESTART_TIMEOUT_SEC" -ge 30 ] || \
|
||
die 'RESTART_TIMEOUT_SEC 必须是至少 30 秒的整数'
|
||
[[ "$PROVISION_TTL_SEC" =~ ^[0-9]+$ ]] && [ "$PROVISION_TTL_SEC" -ge 60 ] || \
|
||
die 'PROVISION_TTL_SEC 必须是至少 60 秒的整数'
|
||
[ "$MODE" = watchdog ] || [ "$DOGFOOD_PROVISION_ACK" = "$EXPECTED_ACK" ] || \
|
||
die "DOGFOOD_PROVISION_ACK 不匹配；必须精确确认 $EXPECTED_ACK"
|
||
[ "$MODE" = watchdog ] || [ -x "$PROVISION_BIN" ] || die "预置脚本不可执行：$PROVISION_BIN"
|
||
[ "$MODE" = watchdog ] || [ -n "$ADMIN_TOKEN_FILE" ] || die 'ADMIN_TOKEN_FILE 必填'
|
||
[ "$MODE" = watchdog ] || { [ -f "$ADMIN_TOKEN_FILE" ] && [ ! -L "$ADMIN_TOKEN_FILE" ]; } || \
|
||
die 'ADMIN_TOKEN_FILE 必须是非 symlink 普通文件'
|
||
if [ "$MODE" != watchdog ]; then
|
||
token_mode="$(stat -f '%Lp' "$ADMIN_TOKEN_FILE" 2>/dev/null || stat -c '%a' "$ADMIN_TOKEN_FILE")"
|
||
[ "$token_mode" = 600 ] || die "ADMIN_TOKEN_FILE 权限必须为 0600 actual=$token_mode"
|
||
fi
|
||
command -v python3 >/dev/null || die '缺少 python3'
|
||
python3 -c 'import yaml' >/dev/null 2>&1 || die '缺少 PyYAML，无法安全合并既有 Nacos YAML'
|
||
|
||
mkdir -p "$(dirname "$LOCK_FILE")"
|
||
exec 9>"$LOCK_FILE"
|
||
if [ "$MODE" = watchdog ]; then
|
||
"$FLOCK_BIN" -w 30 9 || die 'watchdog 无法取得预置恢复锁'
|
||
else
|
||
"$FLOCK_BIN" -n 9 || die '已有 dogfood 账号预置事务运行，拒绝并发'
|
||
fi
|
||
|
||
if [ -z "$NACOS_PASSWORD" ]; then
|
||
[ -f "$NACOS_ENV_FILE" ] || die "缺少 Nacos 凭据来源：$NACOS_ENV_FILE"
|
||
set -a
|
||
# shellcheck disable=SC1090
|
||
. "$NACOS_ENV_FILE"
|
||
set +a
|
||
NACOS_PASSWORD="${NACOS_PASSWORD:-}"
|
||
fi
|
||
[ -n "$NACOS_PASSWORD" ] || die 'Nacos 口令为空'
|
||
|
||
umask 077
|
||
if [ "$MODE" = watchdog ]; then
|
||
[ -d "$WATCHDOG_RECOVERY_DIR" ] && [ ! -L "$WATCHDOG_RECOVERY_DIR" ] || die 'watchdog recovery 目录非法'
|
||
EVIDENCE_DIR="$(dirname "$WATCHDOG_RECOVERY_DIR")"
|
||
else
|
||
[ ! -e "$EVIDENCE_DIR" ] || die "证据目录已存在，拒绝覆盖：$EVIDENCE_DIR"
|
||
mkdir -p "$EVIDENCE_DIR"
|
||
fi
|
||
chmod 700 "$EVIDENCE_DIR"
|
||
EVENT_LOG="$EVIDENCE_DIR/transaction.log"
|
||
[ "$MODE" = watchdog ] || : >"$EVENT_LOG"
|
||
chmod 600 "$EVENT_LOG"
|
||
BODY_FILE="$(mktemp)"
|
||
NACOS_PASSWORD_FILE="$(mktemp)"
|
||
NACOS_TOKEN_FILE="$(mktemp)"
|
||
printf '%s' "$NACOS_PASSWORD" >"$NACOS_PASSWORD_FILE"
|
||
chmod 600 "$NACOS_PASSWORD_FILE" "$NACOS_TOKEN_FILE"
|
||
ORIGINAL_CONFIG="$EVIDENCE_DIR/nacos-original.yaml"
|
||
TEMP_CONFIG="$EVIDENCE_DIR/nacos-temporary.yaml"
|
||
ORIGINAL_STATUS_FILE="$EVIDENCE_DIR/nacos-original.status"
|
||
SUMMARY_FILE="$EVIDENCE_DIR/transaction.status"
|
||
RECOVERY_DIR="$EVIDENCE_DIR/watchdog"
|
||
WATCHDOG_UNIT="dogfood-provision-watchdog-${RUN_ID//[^A-Za-z0-9_-]/-}"
|
||
restore_required=0
|
||
finalizing=0
|
||
watchdog_armed=0
|
||
NACOS_TOKEN=''
|
||
LAST_HTTP=''
|
||
LAST_BODY=''
|
||
|
||
cleanup_body() { rm -f "$BODY_FILE" "$NACOS_PASSWORD_FILE" "$NACOS_TOKEN_FILE"; }
|
||
|
||
request() {
|
||
local method="$1" url="$2" data="${3:-}" token="${4:-}" content_file="${5:-}"
|
||
local -a args=(-sS --connect-timeout 5 --max-time 30 -o "$BODY_FILE" -w '%{http_code}' -X "$method")
|
||
if [ -n "$token" ]; then
|
||
[ "$method" != GET ] || args+=(-G)
|
||
# token 通过 mode600 临时文件交给 curl，避免出现在进程参数或日志。
|
||
args+=(--data-urlencode "accessToken@$NACOS_TOKEN_FILE")
|
||
fi
|
||
[ -z "$data" ] || args+=(--data "$data")
|
||
[ -z "$content_file" ] || args+=(--data-urlencode "content@$content_file")
|
||
LAST_HTTP="$("$CURL_BIN" "${args[@]}" "$url" 2>/dev/null || printf '000')"
|
||
LAST_BODY="$(<"$BODY_FILE")"
|
||
}
|
||
|
||
json_value() {
|
||
local path="$1"
|
||
printf '%s' "$LAST_BODY" | python3 -c '
|
||
import json,sys
|
||
try:
|
||
value=json.load(sys.stdin)
|
||
for part in sys.argv[1].split("."):
|
||
value=value.get(part) if isinstance(value,dict) else None
|
||
if isinstance(value,bool): print("true" if value else "false")
|
||
else: print("" if value is None else value)
|
||
except Exception: print("")
|
||
' "$path"
|
||
}
|
||
|
||
nacos_login() {
|
||
# 用户名与口令分别 URL encode；响应 token 只驻内存和临时响应文件，不落 evidence。
|
||
LAST_HTTP="$("$CURL_BIN" -sS --connect-timeout 5 --max-time 30 -o "$BODY_FILE" -w '%{http_code}' \
|
||
-X POST --data-urlencode "username=$NACOS_USERNAME" --data-urlencode "password@$NACOS_PASSWORD_FILE" \
|
||
"$NACOS_BASE_URL/v1/auth/login" 2>/dev/null || printf '000')"
|
||
LAST_BODY="$(<"$BODY_FILE")"
|
||
[ "$LAST_HTTP" = 200 ] || return 1
|
||
NACOS_TOKEN="$(json_value accessToken)"
|
||
[ -n "$NACOS_TOKEN" ] || return 1
|
||
printf '%s' "$NACOS_TOKEN" >"$NACOS_TOKEN_FILE"
|
||
chmod 600 "$NACOS_TOKEN_FILE"
|
||
}
|
||
|
||
nacos_get() {
|
||
local output="$1"
|
||
request GET "$NACOS_BASE_URL/v1/cs/configs?dataId=$DATA_ID&group=$NACOS_GROUP&tenant=" '' "$NACOS_TOKEN"
|
||
# 从 curl 原始响应文件复制，保留 Nacos 配置末尾换行等字节；命令替换会吞尾换行，不能用于快照。
|
||
cp "$BODY_FILE" "$output"
|
||
chmod 600 "$output"
|
||
[ "$LAST_HTTP" = 200 ] || [ "$LAST_HTTP" = 404 ]
|
||
}
|
||
|
||
nacos_md5() {
|
||
python3 - "$1" <<'PY'
|
||
import hashlib,sys
|
||
with open(sys.argv[1],"rb") as handle:
|
||
print(hashlib.md5(handle.read()).hexdigest())
|
||
PY
|
||
}
|
||
|
||
nacos_publish() {
|
||
local content_file="$1" expected_md5="$2"
|
||
[[ "$expected_md5" =~ ^[0-9a-f]{32}$ ]] || return 1
|
||
request POST "$NACOS_BASE_URL/v1/cs/configs" \
|
||
"dataId=$DATA_ID&group=$NACOS_GROUP&tenant=&casMd5=$expected_md5" "$NACOS_TOKEN" "$content_file"
|
||
[ "$LAST_HTTP" = 200 ] && [ "$LAST_BODY" = true ]
|
||
}
|
||
|
||
verify_nacos_exact() {
|
||
local expected_file="$1" actual="$EVIDENCE_DIR/nacos-verify.tmp"
|
||
nacos_get "$actual" || return 1
|
||
[ "$LAST_HTTP" = 200 ] || return 1
|
||
cmp -s "$expected_file" "$actual"
|
||
}
|
||
|
||
restart_backend() {
|
||
"$SYSTEMCTL_BIN" restart "$BACKEND_UNIT"
|
||
local deadline=$((SECONDS + RESTART_TIMEOUT_SEC))
|
||
while [ "$SECONDS" -lt "$deadline" ]; do
|
||
request GET "$BASE/actuator/health"
|
||
if [ "$LAST_HTTP" = 200 ] && [ "$(json_value status)" = UP ]; then
|
||
return 0
|
||
fi
|
||
"$SLEEP_BIN" 2
|
||
done
|
||
return 1
|
||
}
|
||
|
||
expect_code() {
|
||
local name="$1" expected="$2" method="$3" path="$4" data="${5:-}" auth="${6:-}"
|
||
local -a args=(-sS --connect-timeout 5 --max-time 30 -o "$BODY_FILE" -w '%{http_code}' -X "$method"
|
||
-H "tenant-id: $TENANT")
|
||
[ -z "$auth" ] || args+=(-H "Authorization: Bearer $auth")
|
||
[ -z "$data" ] || args+=(-H 'Content-Type: application/json' --data "$data")
|
||
LAST_HTTP="$("$CURL_BIN" "${args[@]}" "$BASE$path" 2>/dev/null || printf '000')"
|
||
LAST_BODY="$(<"$BODY_FILE")"
|
||
local actual
|
||
actual="$(json_value code)"
|
||
if [ "$LAST_HTTP" != 200 ] || [ "$actual" != "$expected" ]; then
|
||
log "$name FAIL expected=$expected actual=${actual:-none} http=$LAST_HTTP"
|
||
return 1
|
||
fi
|
||
log "$name PASS code=$expected"
|
||
}
|
||
|
||
verify_temporary_runtime() {
|
||
# 此时还没有真实玩家 token，只校验免登录边界；资金守卫由预置脚本在首次真实登录后验证。
|
||
expect_code 'provisioning SMS still disabled' "$CODE_DOGFOOD_SMS_DISABLED" POST \
|
||
/app-api/passport/send-sms-code '{"mobile":"13800000000"}'
|
||
expect_code 'provisioning ad still disabled' "$CODE_AD_DOGFOOD_DISABLED" GET /app-api/ad/slot/list-enabled
|
||
}
|
||
|
||
verify_restored_runtime() {
|
||
local suffix="${RUN_ID//[^0-9]/}"
|
||
local username="dogfoodverify${suffix:0:15}"
|
||
local login_body="{\"username\":\"$username\",\"password\":\"DogfoodVerify1\"}"
|
||
expect_code 'password register disabled' "$CODE_PASSWORD_REGISTER_DISABLED" POST \
|
||
/app-api/passport/password-register "$login_body"
|
||
# 查无用户统一返回用户名/密码错误；若登录开关关闭会返回另一业务码。
|
||
expect_code 'password login enabled' "$CODE_USERNAME_OR_PASSWORD_ERROR" POST \
|
||
/app-api/passport/password-login "$login_body"
|
||
expect_code 'SMS disabled' "$CODE_DOGFOOD_SMS_DISABLED" POST \
|
||
/app-api/passport/send-sms-code '{"mobile":"13800000000"}'
|
||
expect_code 'ad disabled' "$CODE_AD_DOGFOOD_DISABLED" GET /app-api/ad/slot/list-enabled
|
||
}
|
||
|
||
restore_original() {
|
||
local current="$EVIDENCE_DIR/nacos-before-restore.tmp" temporary_md5
|
||
log '开始恢复原 Nacos 配置'
|
||
nacos_login || return 1
|
||
nacos_get "$current" || return 1
|
||
[ "$LAST_HTTP" = 200 ] || return 1
|
||
cmp -s "$TEMP_CONFIG" "$current" || return 1
|
||
temporary_md5="$(nacos_md5 "$TEMP_CONFIG")"
|
||
nacos_publish "$ORIGINAL_CONFIG" "$temporary_md5" || return 1
|
||
verify_nacos_exact "$ORIGINAL_CONFIG" || return 1
|
||
restart_backend || return 1
|
||
verify_restored_runtime || return 1
|
||
log '原 Nacos 配置与狗粮安全边界恢复完成'
|
||
}
|
||
|
||
arm_watchdog() {
|
||
mkdir -p "$RECOVERY_DIR"
|
||
chmod 700 "$RECOVERY_DIR"
|
||
{
|
||
printf 'schema=dogfood-provision-watchdog/1\n'
|
||
printf 'run_id=%s\n' "$RUN_ID"
|
||
printf 'ttl_sec=%s\n' "$PROVISION_TTL_SEC"
|
||
printf 'temporary_md5=%s\n' "$(nacos_md5 "$TEMP_CONFIG")"
|
||
printf 'original_md5=%s\n' "$(nacos_md5 "$ORIGINAL_CONFIG")"
|
||
} >"$RECOVERY_DIR/metadata"
|
||
: >"$RECOVERY_DIR/armed"
|
||
chmod 600 "$RECOVERY_DIR/metadata" "$RECOVERY_DIR/armed"
|
||
if ! "$SYSTEMD_RUN_BIN" --quiet --collect --unit="$WATCHDOG_UNIT" \
|
||
--on-active="${PROVISION_TTL_SEC}s" --property=Type=oneshot \
|
||
--property=Restart=on-failure --property=RestartSec=15s \
|
||
/bin/bash "$(realpath "${BASH_SOURCE[0]}")" --watchdog "$RECOVERY_DIR"; then
|
||
rm -f "$RECOVERY_DIR/armed"
|
||
return 1
|
||
fi
|
||
watchdog_armed=1
|
||
log "独立恢复 watchdog 已注册 unit=$WATCHDOG_UNIT ttl=${PROVISION_TTL_SEC}s"
|
||
}
|
||
|
||
disarm_watchdog() {
|
||
[ "$watchdog_armed" -eq 1 ] || return 0
|
||
rm -f "$RECOVERY_DIR/armed"
|
||
"$SYSTEMCTL_BIN" stop "$WATCHDOG_UNIT.timer" "$WATCHDOG_UNIT.service" >/dev/null 2>&1 || true
|
||
printf 'disarmed_at=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$RECOVERY_DIR/disarmed"
|
||
chmod 600 "$RECOVERY_DIR/disarmed"
|
||
watchdog_armed=0
|
||
}
|
||
|
||
if [ "$MODE" = watchdog ]; then
|
||
EVENT_LOG="$EVIDENCE_DIR/watchdog.log"
|
||
touch "$EVENT_LOG"
|
||
chmod 600 "$EVENT_LOG"
|
||
[ -f "$RECOVERY_DIR/armed" ] || {
|
||
log 'watchdog 已解除，无需恢复'
|
||
cleanup_body
|
||
exit 0
|
||
}
|
||
log 'watchdog TTL 到期，开始独立恢复 Nacos 安全配置'
|
||
if restore_original; then
|
||
rm -f "$RECOVERY_DIR/armed"
|
||
printf 'WATCHDOG_RESTORE=PASS at=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$RECOVERY_DIR/watchdog.status"
|
||
chmod 600 "$RECOVERY_DIR/watchdog.status"
|
||
cleanup_body
|
||
exit 0
|
||
fi
|
||
printf 'WATCHDOG_RESTORE=FAILED at=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >"$RECOVERY_DIR/watchdog.status"
|
||
chmod 600 "$RECOVERY_DIR/watchdog.status"
|
||
cleanup_body
|
||
die "watchdog 恢复失败，保留 armed 标记等待人工处置：$RECOVERY_DIR"
|
||
fi
|
||
|
||
finalize() {
|
||
local main_rc=$? restore_rc=0
|
||
[ "$finalizing" -eq 0 ] || return
|
||
finalizing=1
|
||
trap - EXIT INT TERM
|
||
set +e
|
||
if [ "$restore_required" -eq 1 ]; then
|
||
restore_original
|
||
restore_rc=$?
|
||
fi
|
||
cleanup_body
|
||
if [ "$restore_rc" -ne 0 ]; then
|
||
printf 'restore_failed main_rc=%s restore_rc=%s evidence=%s\n' "$main_rc" "$restore_rc" "$EVIDENCE_DIR" >"$SUMMARY_FILE"
|
||
chmod 600 "$SUMMARY_FILE"
|
||
printf 'DOGFOOD_NACOS_TX_RESTORE_FAIL evidence=%s\n' "$EVIDENCE_DIR" >&2
|
||
exit 70
|
||
fi
|
||
disarm_watchdog
|
||
if [ "$main_rc" -ne 0 ]; then
|
||
printf 'provision_failed rc=%s restored=true evidence=%s\n' "$main_rc" "$EVIDENCE_DIR" >"$SUMMARY_FILE"
|
||
chmod 600 "$SUMMARY_FILE"
|
||
printf 'DOGFOOD_NACOS_TX_FAIL rc=%s restored=true evidence=%s\n' "$main_rc" "$EVIDENCE_DIR" >&2
|
||
exit "$main_rc"
|
||
fi
|
||
printf 'pass restored=true evidence=%s\n' "$EVIDENCE_DIR" >"$SUMMARY_FILE"
|
||
chmod 600 "$SUMMARY_FILE"
|
||
printf 'DOGFOOD_NACOS_TX_PASS restored=true evidence=%s\n' "$EVIDENCE_DIR"
|
||
}
|
||
trap finalize EXIT
|
||
trap 'exit 130' INT
|
||
trap 'exit 143' TERM
|
||
|
||
log "开始狗粮账号预置配置事务 runId=$RUN_ID"
|
||
nacos_login || die 'Nacos 登录失败'
|
||
nacos_get "$ORIGINAL_CONFIG" || die "读取 $DATA_ID 失败 http=$LAST_HTTP"
|
||
printf '%s\n' "$LAST_HTTP" >"$ORIGINAL_STATUS_FILE"
|
||
chmod 600 "$ORIGINAL_STATUS_FILE"
|
||
[ "$LAST_HTTP" = 200 ] || die 'Nacos dataId 不存在，无法执行内容 CAS；拒绝创建临时配置'
|
||
|
||
# 在原 YAML 上只覆盖预置窗口所需键；原文始终单独留证并在 EXIT trap 逐字恢复。
|
||
PROVISION_TTL_SEC="$PROVISION_TTL_SEC" python3 - "$ORIGINAL_CONFIG" "$TEMP_CONFIG" <<'PY'
|
||
import datetime,os,sys,yaml
|
||
source,target=sys.argv[1:]
|
||
with open(source,encoding="utf-8") as f:
|
||
doc=yaml.safe_load(f) or {}
|
||
if not isinstance(doc,dict):
|
||
raise SystemExit("Nacos staging 配置顶层必须是 YAML object")
|
||
# 若历史配置使用过 dotted key，先移除同义键，避免 Spring 扁平化后与嵌套键冲突；原文仍会逐字恢复。
|
||
for key in (
|
||
"huijing.dogfood.enabled",
|
||
"huijing.dogfood.provisioning-enabled",
|
||
"huijing.dogfood.provisioning-expires-at",
|
||
"huijing.dogfood.provisioning-run-id",
|
||
"wanxiang.passport.password-register-enabled",
|
||
):
|
||
doc.pop(key,None)
|
||
huijing=doc.setdefault("huijing",{})
|
||
if not isinstance(huijing,dict): raise SystemExit("huijing 必须是 object")
|
||
dogfood=huijing.setdefault("dogfood",{})
|
||
if not isinstance(dogfood,dict): raise SystemExit("huijing.dogfood 必须是 object")
|
||
dogfood["enabled"]=True
|
||
dogfood["provisioning-enabled"]=True
|
||
dogfood["provisioning-run-id"]=os.environ["RUN_ID"]
|
||
expires_at=datetime.datetime.now(datetime.timezone.utc)+datetime.timedelta(seconds=int(os.environ["PROVISION_TTL_SEC"]))
|
||
dogfood["provisioning-expires-at"]=expires_at.isoformat().replace("+00:00","Z")
|
||
wanxiang=doc.setdefault("wanxiang",{})
|
||
if not isinstance(wanxiang,dict): raise SystemExit("wanxiang 必须是 object")
|
||
passport=wanxiang.setdefault("passport",{})
|
||
if not isinstance(passport,dict): raise SystemExit("wanxiang.passport 必须是 object")
|
||
passport["password-register-enabled"]=True
|
||
with open(target,"w",encoding="utf-8") as f:
|
||
yaml.safe_dump(doc,f,allow_unicode=True,sort_keys=False)
|
||
PY
|
||
chmod 600 "$TEMP_CONFIG"
|
||
|
||
arm_watchdog || die '无法注册独立恢复 watchdog，未修改 Nacos'
|
||
original_md5="$(nacos_md5 "$ORIGINAL_CONFIG")"
|
||
nacos_publish "$TEMP_CONFIG" "$original_md5" || die "发布临时 Nacos 配置 CAS 失败 http=$LAST_HTTP"
|
||
restore_required=1
|
||
verify_nacos_exact "$TEMP_CONFIG" || die '临时 Nacos 配置回读不一致'
|
||
restart_backend || die '临时配置发布后 backend 未恢复健康'
|
||
verify_temporary_runtime || die '窄 provisioning 开关未生效或安全守卫被关闭'
|
||
|
||
log '临时配置已生效，执行既有账号预置脚本'
|
||
env -u ADMIN_USERNAME -u ADMIN_PASSWORD \
|
||
PROVISION_ACK='PROVISION_DOGFOOD_40_USERS_WITH_TEMP_CONFIG' DOGFOOD_PROVISIONING_MODE=narrow \
|
||
ADMIN_TOKEN_FILE="$ADMIN_TOKEN_FILE" "$PROVISION_BIN" >"$EVIDENCE_DIR/provision.log" 2>&1
|
||
chmod 600 "$EVIDENCE_DIR/provision.log"
|
||
log '账号预置脚本完成，退出时恢复原配置'
|