fix idp on started
This commit is contained in:
lendry
136
install.sh
136
install.sh
@@ -614,6 +614,10 @@ derive_public_urls() {
|
||||
MINIO_USE_SSL=$([[ "$scheme" == "https" ]] && echo true || echo false)
|
||||
fi
|
||||
|
||||
if [[ "$ssl_type" == "selfsigned" && -n "${DOMAIN_FRONTEND:-}" ]]; then
|
||||
apply_same_origin_api_proxy_urls "$scheme"
|
||||
fi
|
||||
|
||||
SSL_TYPE="$ssl_type"
|
||||
USE_NGINX_SSL=$([[ "$ssl_type" == "none" ]] && echo false || echo true)
|
||||
|
||||
@@ -628,6 +632,18 @@ derive_public_urls() {
|
||||
fi
|
||||
}
|
||||
|
||||
apply_same_origin_api_proxy_urls() {
|
||||
local scheme="${1:-https}"
|
||||
PUBLIC_API_URL="${PUBLIC_FRONTEND_URL%/}/idp-api"
|
||||
if [[ -z "${DOMAIN_WS:-}" || "${DOMAIN_WS}" == "${DOMAIN_API}" ]]; then
|
||||
if [[ "$scheme" == "https" ]]; then
|
||||
PUBLIC_WS_URL="wss://${DOMAIN_FRONTEND}/idp-api/ws"
|
||||
else
|
||||
PUBLIC_WS_URL="ws://${DOMAIN_FRONTEND}/idp-api/ws"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
choose_ssl_type_interactive() {
|
||||
local default="${1:-none}"
|
||||
|
||||
@@ -1063,6 +1079,12 @@ nginx_cert_base_path() {
|
||||
local ssl_type="$2"
|
||||
if [[ "$ssl_type" == "letsencrypt" ]]; then
|
||||
echo "/etc/letsencrypt/live/${domain}"
|
||||
elif [[ "$ssl_type" == "selfsigned" ]]; then
|
||||
if [[ "$NGINX_MODE" == "docker" ]]; then
|
||||
echo "/etc/nginx/certs/shared-intranet"
|
||||
else
|
||||
echo "${LOCAL_CERTS_DIR}/shared-intranet"
|
||||
fi
|
||||
elif [[ "$NGINX_MODE" == "docker" ]]; then
|
||||
echo "/etc/nginx/certs/${domain}"
|
||||
else
|
||||
@@ -1070,26 +1092,60 @@ nginx_cert_base_path() {
|
||||
fi
|
||||
}
|
||||
|
||||
generate_self_signed_cert() {
|
||||
local domain="$1"
|
||||
local cert_dir="${LOCAL_CERTS_DIR}/${domain}"
|
||||
intranet_wildcard_base_domain() {
|
||||
local domain="${1:-}"
|
||||
[[ -z "$domain" ]] && return 0
|
||||
if [[ "$domain" == *.*.* ]]; then
|
||||
echo "${domain#*.}"
|
||||
else
|
||||
echo "$domain"
|
||||
fi
|
||||
}
|
||||
|
||||
collect_self_signed_sans() {
|
||||
local -a sans=()
|
||||
local base domain
|
||||
|
||||
load_env
|
||||
for domain in "$DOMAIN_API" "$DOMAIN_FRONTEND" "$DOMAIN_DOCS" "${DOMAIN_WS:-}" "${DOMAIN_MINIO:-}" "${DOMAIN_MINIO_CONSOLE:-}"; do
|
||||
[[ -z "$domain" ]] && continue
|
||||
sans+=("DNS:${domain}")
|
||||
done
|
||||
|
||||
base="$(intranet_wildcard_base_domain "${DOMAIN_FRONTEND:-$DOMAIN_API}")"
|
||||
if [[ -n "$base" ]]; then
|
||||
sans+=("DNS:*.${base}")
|
||||
sans+=("DNS:${base}")
|
||||
fi
|
||||
|
||||
(IFS=,; echo "${sans[*]}")
|
||||
}
|
||||
|
||||
generate_shared_self_signed_cert() {
|
||||
local cert_dir="${LOCAL_CERTS_DIR}/shared-intranet"
|
||||
local base sans cn
|
||||
|
||||
mkdir -p "$cert_dir"
|
||||
base="$(intranet_wildcard_base_domain "${DOMAIN_FRONTEND:-$DOMAIN_API}")"
|
||||
[[ -z "$base" ]] && base="${DOMAIN_FRONTEND:-$DOMAIN_API}"
|
||||
cn="*.${base}"
|
||||
sans="$(collect_self_signed_sans)"
|
||||
|
||||
if [[ -f "${cert_dir}/fullchain.pem" && -f "${cert_dir}/privkey.pem" ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
log "Самоподписанный сертификат: ${domain}"
|
||||
log "Общий самоподписанный сертификат: ${cn} (${sans})"
|
||||
if has_cmd openssl; then
|
||||
openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
|
||||
-keyout "${cert_dir}/privkey.pem" \
|
||||
-out "${cert_dir}/fullchain.pem" \
|
||||
-subj "/CN=${domain}/O=Lendry ID Intranet/C=RU" \
|
||||
-addext "subjectAltName=DNS:${domain}" 2>/dev/null || \
|
||||
-subj "/CN=${cn}/O=Lendry ID Intranet/C=RU" \
|
||||
-addext "subjectAltName=${sans}" 2>/dev/null || \
|
||||
openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
|
||||
-keyout "${cert_dir}/privkey.pem" \
|
||||
-out "${cert_dir}/fullchain.pem" \
|
||||
-subj "/CN=${domain}/O=Lendry ID Intranet/C=RU"
|
||||
-subj "/CN=${cn}/O=Lendry ID Intranet/C=RU"
|
||||
chmod 600 "${cert_dir}/privkey.pem" 2>/dev/null || true
|
||||
else
|
||||
fail "openssl не найден — нужен для самоподписанных сертификатов"
|
||||
@@ -1097,16 +1153,13 @@ generate_self_signed_cert() {
|
||||
}
|
||||
|
||||
generate_all_self_signed_certs() {
|
||||
local force="${1:-}"
|
||||
load_env
|
||||
generate_self_signed_cert "$DOMAIN_API"
|
||||
generate_self_signed_cert "$DOMAIN_FRONTEND"
|
||||
generate_self_signed_cert "$DOMAIN_DOCS"
|
||||
if [[ -n "${DOMAIN_WS:-}" && "${DOMAIN_WS}" != "${DOMAIN_API}" ]]; then
|
||||
generate_self_signed_cert "$DOMAIN_WS"
|
||||
if [[ "$force" == "--force" ]]; then
|
||||
rm -f "${LOCAL_CERTS_DIR}/shared-intranet/fullchain.pem" "${LOCAL_CERTS_DIR}/shared-intranet/privkey.pem"
|
||||
fi
|
||||
[[ -n "${DOMAIN_MINIO:-}" ]] && generate_self_signed_cert "$DOMAIN_MINIO"
|
||||
[[ -n "${DOMAIN_MINIO_CONSOLE:-}" ]] && generate_self_signed_cert "$DOMAIN_MINIO_CONSOLE"
|
||||
ok "Самоподписанные сертификаты созданы в ${LOCAL_CERTS_DIR}"
|
||||
generate_shared_self_signed_cert
|
||||
ok "Самоподписанный сертификат создан: ${LOCAL_CERTS_DIR}/shared-intranet"
|
||||
}
|
||||
|
||||
nginx_conf_target() {
|
||||
@@ -1269,13 +1322,39 @@ EOF
|
||||
nginx_publish_config "api"
|
||||
}
|
||||
|
||||
build_nginx_idp_api_proxy_block() {
|
||||
local api_upstream
|
||||
api_upstream="$(nginx_upstream api)"
|
||||
cat <<EOF
|
||||
location /idp-api/ws {
|
||||
proxy_pass ${api_upstream}/ws;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade \$http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
proxy_read_timeout 86400s;
|
||||
}
|
||||
|
||||
location /idp-api/ {
|
||||
proxy_pass ${api_upstream}/;
|
||||
proxy_http_version 1.1;
|
||||
${nginx_proxy_headers}
|
||||
}
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
write_nginx_site_frontend() {
|
||||
local domain="$1"
|
||||
local ssl_type="${2:-none}"
|
||||
local conf upstream http_preamble ssl_block
|
||||
local conf upstream http_preamble ssl_block idp_api_block
|
||||
conf="$(nginx_conf_target frontend)"
|
||||
upstream="$(nginx_upstream frontend)"
|
||||
http_preamble="$(nginx_http_server_preamble "$domain" "$ssl_type")"
|
||||
idp_api_block="$(build_nginx_idp_api_proxy_block)"
|
||||
|
||||
if [[ "$ssl_type" == "none" ]]; then
|
||||
nginx_write_conf "$conf" <<EOF
|
||||
@@ -1283,6 +1362,7 @@ server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name ${domain};
|
||||
${idp_api_block}
|
||||
location / {
|
||||
proxy_pass ${upstream};
|
||||
proxy_http_version 1.1;
|
||||
@@ -1299,6 +1379,7 @@ ${http_preamble}server {
|
||||
server_name ${domain};
|
||||
${ssl_block}
|
||||
client_max_body_size 50m;
|
||||
${idp_api_block}
|
||||
location / {
|
||||
proxy_pass ${upstream};
|
||||
proxy_http_version 1.1;
|
||||
@@ -1667,8 +1748,9 @@ print_intranet_hint() {
|
||||
echo " ${server_ip} ${DOMAIN_API} ${DOMAIN_FRONTEND} ${DOMAIN_DOCS}"
|
||||
echo ""
|
||||
if [[ "$(env_get SSL_TYPE none)" == "selfsigned" ]]; then
|
||||
echo " Сертификаты: ${LOCAL_CERTS_DIR}/"
|
||||
echo " Браузер покажет предупреждение — это нормально для локальных доменов."
|
||||
echo " Сертификат: ${LOCAL_CERTS_DIR}/shared-intranet (общий для всех доменов)"
|
||||
echo " Браузер покажет предупреждение — примите сертификат для ${DOMAIN_FRONTEND}."
|
||||
echo " API вызывается через ${DOMAIN_FRONTEND}/idp-api — отдельно открывать ${DOMAIN_API} не нужно."
|
||||
echo ""
|
||||
fi
|
||||
}
|
||||
@@ -1682,7 +1764,7 @@ print_summary() {
|
||||
echo -e "${GREEN}══════════════════════════════════════════════════════════════${NC}"
|
||||
echo ""
|
||||
echo -e " ${BOLD}Режим:${NC} ${INSTALL_MODE:-local} | SSL: ${SSL_TYPE:-none} | Nginx: ${NGINX_MODE:-auto}"
|
||||
echo -e " ${BOLD}API / Swagger:${NC} ${PUBLIC_API_URL}/api"
|
||||
echo -e " ${BOLD}API / Swagger:${NC} ${PUBLIC_API_URL}/docs"
|
||||
echo -e " ${BOLD}Frontend:${NC} ${PUBLIC_FRONTEND_URL}"
|
||||
echo -e " ${BOLD}Документация:${NC} ${PUBLIC_DOCS_URL}/docs"
|
||||
echo -e " ${BOLD}WebSocket:${NC} ${PUBLIC_WS_URL}"
|
||||
@@ -1726,7 +1808,7 @@ check_local_upstream() {
|
||||
if curl -fsS --max-time 3 "$url" >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✔${NC} ${label}: ${url}"
|
||||
else
|
||||
echo -e " ${RED}✘${NC} ${label}: ${url} — недоступен (502 Bad Gateway)"
|
||||
echo -e " ${RED}✘${NC} ${label}: ${url} — недоступен"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -1737,7 +1819,8 @@ show_upstream_health() {
|
||||
[[ -n "$(env_get DOMAIN_API "")" ]] || return 0
|
||||
|
||||
echo " Upstream (host Nginx → localhost):"
|
||||
check_local_upstream "API" "http://127.0.0.1:3000/api"
|
||||
check_local_upstream "API" "http://127.0.0.1:3000/health"
|
||||
check_local_upstream "Swagger" "http://127.0.0.1:3000/docs"
|
||||
check_local_upstream "Frontend" "http://127.0.0.1:3002"
|
||||
check_local_upstream "Docs" "http://127.0.0.1:3003/docs"
|
||||
echo ""
|
||||
@@ -1823,7 +1906,7 @@ action_renew_ssl() {
|
||||
ok "Let's Encrypt сертификаты обновлены"
|
||||
;;
|
||||
selfsigned)
|
||||
generate_all_self_signed_certs
|
||||
generate_all_self_signed_certs --force
|
||||
write_all_nginx_configs "selfsigned"
|
||||
ok "Самоподписанные сертификаты пересозданы"
|
||||
;;
|
||||
@@ -1856,6 +1939,15 @@ action_fix_host_proxy() {
|
||||
log "Шаг 4/4: конфиги системного Nginx..."
|
||||
refresh_host_nginx_configs
|
||||
|
||||
if [[ "$(env_get SSL_TYPE none)" == "selfsigned" && -n "$(env_get DOMAIN_FRONTEND "")" ]]; then
|
||||
derive_public_urls "selfsigned"
|
||||
env_set PUBLIC_API_URL "${PUBLIC_API_URL}"
|
||||
env_set PUBLIC_WS_URL "${PUBLIC_WS_URL}"
|
||||
log "Шаг 5/5: пересборка frontend (same-origin API для HTTPS)..."
|
||||
build_compose_stack_cmd
|
||||
docker_cmd "${COMPOSE_STACK_CMD[@]}" up -d --build frontend
|
||||
fi
|
||||
|
||||
ok "Прокси исправлен — проверьте: curl -I http://127.0.0.1:3002"
|
||||
show_status
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user