lendry/IdP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix and update

Browse Source
This commit is contained in:
lendry
2026-06-29 17:46:50 +03:00
parent 2701c0e90b
commit 71dfeda873
2 changed files with 90 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/api-gateway/src/app.module.ts
View File

@@ -55,7 +55,13 @@ import { FedcmCookieInterceptor } from './interceptors/fedcm-cookie.interceptor'
join(__dirname, '../../../shared/proto/chat.proto'),
join(__dirname, '../../../shared/proto/bot.proto')
],
url: config.get<string>('SSO_CORE_GRPC_URL', 'localhost:50051')
url: config.get<string>('SSO_CORE_GRPC_URL', 'localhost:50051'),
channelOptions: {
'grpc.keepalive_time_ms': 30000,
'grpc.keepalive_timeout_ms': 10000,
'grpc.keepalive_permit_without_calls': 1,
'grpc.http2.max_pings_without_data': 0
}
}
})
}

93
install.sh
View File

@@ -10,7 +10,7 @@
set -euo pipefail
SCRIPT_VERSION="2.3.0"
SCRIPT_VERSION="2.3.1"
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$ROOT_DIR"
@@ -1924,11 +1924,8 @@ build_nginx_api_location_block() {
proxy_api="$(render_proxy_root api)"
cat <<EOF
location / {
set \$cors_origin "";
if (\$http_origin) { set \$cors_origin \$http_origin; }
if (\$request_method = OPTIONS) {
add_header Access-Control-Allow-Origin \$cors_origin always;
add_header Access-Control-Allow-Origin \$http_origin always;
add_header Access-Control-Allow-Credentials true always;
add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, Accept, Origin, X-CSRF-Token" always;
@@ -1939,11 +1936,12 @@ build_nginx_api_location_block() {
proxy_hide_header Access-Control-Allow-Origin;
proxy_hide_header Access-Control-Allow-Credentials;
add_header Access-Control-Allow-Origin \$cors_origin always;
add_header Access-Control-Allow-Origin \$http_origin always;
add_header Access-Control-Allow-Credentials true always;
${proxy_api}
proxy_http_version 1.1;
proxy_set_header Connection "";
${nginx_proxy_headers}
}
EOF
@@ -2600,6 +2598,55 @@ check_local_upstream() {
fi
}
# Readiness api-gateway → sso-core по gRPC (/health не проверяет gRPC).
wait_for_api_grpc_ready() {
local attempt max="${1:-60}" code
for ((attempt = 1; attempt <= max; attempt++)); do
code="$(curl -fsS --max-time 3 -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/health/ready 2>/dev/null || echo 000)"
if [[ "$code" == "200" ]]; then
ok "gRPC api-gateway → sso-core: готов (/health/ready)"
return 0
fi
sleep 2
done
warn "gRPC api-gateway → sso-core не готов (HTTP ${code:-000} на /health/ready)"
return 1
}
check_https_api_with_origin() {
local api_domain frontend_domain origin code
api_domain="$(env_get DOMAIN_API "")"
frontend_domain="$(env_get DOMAIN_FRONTEND "")"
[[ -n "$api_domain" && -n "$frontend_domain" ]] || return 0
[[ "$(env_get USE_NGINX_SSL false)" == "true" ]] || return 0
origin="https://${frontend_domain}"
code="$(curl -sk --max-time 5 -o /dev/null -w '%{http_code}' -H "Origin: ${origin}" "https://${api_domain}/health" 2>/dev/null || echo 000)"
if [[ "$code" == "200" ]]; then
echo -e " ${GREEN}✔${NC} HTTPS API + Origin: https://${api_domain}/health → 200"
elif [[ "$code" == "502" ]]; then
echo -e " ${RED}✘${NC} HTTPS API + Origin → 502 (Nginx не проксирует cross-origin на api-домен)"
echo " Решение: ./install.sh --fix-all (перегенерирует конфиг api-домена)"
return 1
else
echo -e " ${YELLOW}!${NC} HTTPS API + Origin: https://${api_domain}/health → HTTP ${code}"
return 1
fi
code="$(curl -sk --max-time 5 -o /dev/null -w '%{http_code}' -H "Origin: ${origin}" "https://${api_domain}/notifications/unread-count" 2>/dev/null || echo 000)"
if [[ "$code" == "401" || "$code" == "403" ]]; then
echo -e " ${GREEN}✔${NC} HTTPS API + Origin (без токена): /notifications/unread-count → ${code}"
return 0
elif [[ "$code" == "502" ]]; then
echo -e " ${RED}✘${NC} HTTPS API + Origin: /notifications/unread-count → 502 (upstream api-gateway)"
echo " Проверьте: curl -s http://127.0.0.1:3000/health/ready && docker compose logs --tail=50 api-gateway sso-core"
return 1
else
echo -e " ${YELLOW}!${NC} HTTPS API + Origin: /notifications/unread-count → HTTP ${code} (ожидалось 401)"
return 1
fi
}
# Диагностика типичных проблем: 502 на /idp-api, конфликт nginx, порты upstream.
diagnose_common_issues() {
load_env
@@ -2663,6 +2710,20 @@ diagnose_common_issues() {
issues=$((issues + 1))
elif docker_cmd ps --format '{{.Names}} {{.Status}}' 2>/dev/null | grep -q 'lendry-id-api-gateway.*Up'; then
echo -e " ${GREEN}✔${NC} api-gateway: контейнер запущен"
local grpc_code
grpc_code="$(curl -fsS --max-time 3 -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/health/ready 2>/dev/null || echo 000)"
if [[ "$grpc_code" == "200" ]]; then
echo -e " ${GREEN}✔${NC} api-gateway gRPC → sso-core: /health/ready → 200"
else
echo -e " ${RED}✘${NC} api-gateway gRPC → sso-core: /health/ready → HTTP ${grpc_code} (без gRPC все API-запросы падают)"
echo " Решение: docker compose restart sso-core api-gateway && ./install.sh --fix-all"
issues=$((issues + 1))
fi
fi
if [[ "$(env_get USE_NGINX_SSL false)" == "true" ]] \
&& [[ -n "$(env_get DOMAIN_API "")" && -n "$(env_get DOMAIN_FRONTEND "")" ]]; then
check_https_api_with_origin || issues=$((issues + 1))
fi
local api_domain frontend_domain public_api
@@ -2700,10 +2761,16 @@ show_upstream_health() {
[[ -n "$(env_get DOMAIN_API "")" ]] || return 0
echo " Upstream (host Nginx → localhost):"
check_local_upstream "API" "http://127.0.0.1:3000/health"
check_local_upstream "API /health" "http://127.0.0.1:3000/health"
check_local_upstream "API gRPC ready" "http://127.0.0.1:3000/health/ready"
check_local_upstream "Swagger" "http://127.0.0.1:3000/docs"
check_local_upstream "Frontend" "http://127.0.0.1:3002"
check_local_upstream "Docs" "http://127.0.0.1:3003/docs"
if [[ "$(env_get USE_NGINX_SSL false)" == "true" ]]; then
echo ""
echo " HTTPS (как в браузере, с Origin SSO):"
check_https_api_with_origin || true
fi
echo ""
}
@@ -2902,8 +2969,12 @@ action_fix_host_proxy() {
apply_intranet_selfsigned_runtime
log "Шаг 5/5: пересоздание ldap-auth и sso-core..."
log "Шаг 5/5: пересоздание ldap-auth, sso-core и api-gateway..."
compose_build_and_up ldap-auth sso-core
wait_for_service "sso-core" 120
compose_build_and_up api-gateway
wait_for_service "api-gateway" 90
wait_for_api_grpc_ready 60 || true
ok "Прокси исправлен — проверьте: curl -I http://127.0.0.1:3002"
diagnose_common_issues || true
@@ -2931,10 +3002,12 @@ action_fix_all_errors() {
write_compose_override
ensure_split_domain_public_urls
log "Шаг 3/6: пересборка api-gateway и sso-core..."
compose_build_and_up api-gateway sso-core
log "Шаг 3/6: пересборка sso-core, затем api-gateway..."
compose_build_and_up sso-core
wait_for_service "sso-core" 120
compose_build_and_up api-gateway
wait_for_service "api-gateway" 90
wait_for_api_grpc_ready 90 || compose_build_and_up api-gateway
log "Шаг 4/6: пересоздание edge-сервисов (frontend, docs, media-ws)..."
compose_build_and_up "${HOST_EDGE_SERVICES[@]}"