Реализация на отдельных двух машинах с протестированным взаимодействием по проверке сообщений

2026-08-19 18:24:00 +03:00
parent bbef7a30c9
commit c7a80e7256
103 changed files with 3457 additions and 3725 deletions
@@ -0,0 +1,49 @@
+#!/bin/sh
+set -eu
+
+COMPOSE=/usr/local/sbin/han-vm1-compose
+TLS_DIR=/var/lib/han-chat/public-tls
+TLS_GROUP=han-nginx-tls
+
+lineage=${RENEWED_LINEAGE:?Certbot did not provide RENEWED_LINEAGE}
+test -s "$lineage/fullchain.pem"
+test -s "$lineage/privkey.pem"
+test -d "$TLS_DIR"
+getent group "$TLS_GROUP" >/dev/null
+
+staging=$(mktemp -d "${TLS_DIR}/.renew.XXXXXX")
+trap 'rm -rf -- "$staging"' EXIT HUP INT TERM
+install -m 0640 -o root -g "$TLS_GROUP" \
+  "$lineage/fullchain.pem" "$staging/fullchain.pem"
+install -m 0640 -o root -g "$TLS_GROUP" \
+  "$lineage/privkey.pem" "$staging/privkey.pem"
+
+cert_public=$(
+  openssl x509 -in "$staging/fullchain.pem" -pubkey -noout |
+    openssl pkey -pubin -outform DER 2>/dev/null |
+    sha256sum | awk '{print $1}'
+)
+key_public=$(
+  openssl pkey -in "$staging/privkey.pem" -passin pass: -pubout -outform DER 2>/dev/null |
+    sha256sum | awk '{print $1}'
+)
+[ "$cert_public" = "$key_public" ] || {
+  echo "renewed certificate and private key do not match" >&2
+  exit 1
+}
+
+mv -f "$staging/fullchain.pem" "$TLS_DIR/fullchain.pem"
+mv -f "$staging/privkey.pem" "$TLS_DIR/privkey.pem"
+rmdir "$staging"
+trap - EXIT HUP INT TERM
+
+container=$("$COMPOSE" ps --status running --quiet nginx)
+[ -n "$container" ] || {
+  echo "HAN VM1 nginx is not running" >&2
+  exit 1
+}
+if ! output=$("$COMPOSE" exec -T nginx nginx -t -c /tmp/nginx.conf 2>&1); then
+  printf '%s\n' "$output" >&2
+  exit 1
+fi
+/usr/bin/docker kill --signal HUP "$container" >/dev/null