feat(docs): add Coolify deployment guide and integrate into setup documentation
feat(scripts): add environment verification scripts for deployment checks
This commit is contained in:
zwitschi committed
1 parent
474da7418e
commit
9f60087a4c
4 files changed
+574
No files matched your search
@@ -0,0 +1,176 @@
|
||||
#!/usr/bin/env pwsh
|
||||
# check-tokens.ps1 — Verify that the credentials in the environment actually work.
|
||||
#
|
||||
# Reads .env (or a supplied file) and validates access against live services:
|
||||
# 1. Gitea container registry (CI_REGISTRY_TOKEN / CI_REGISTRY_USER).
|
||||
# 2. Cloudflare API token(s) (CLOUDFLARE_API_TOKEN, and any R2 admin token).
|
||||
# 3. R2/S3 bucket access (R2_ACCESS_KEY_ID + R2_SECRET_ACCESS_KEY) — lists buckets.
|
||||
# 4. Linear Void admin login (ADMIN_USERNAME / ADMIN_PASSWORD) against the app origin.
|
||||
#
|
||||
# NOTE: Runs the checks through the target Docker host (default 192.168.88.40) so
|
||||
# network + TLS work regardless of this machine's proxy/firewall. Uses the
|
||||
# curlimages/curl and amazon/aws-cli images, which are pulled on demand.
|
||||
#
|
||||
# Usage:
|
||||
# ./scripts/check-tokens.ps1
|
||||
# ./scripts/check-tokens.ps1 -EnvFile .env
|
||||
# ./scripts/check-tokens.ps1 -Target 192.168.88.40
|
||||
#
|
||||
# Exit code 0 = all credentials valid; 1 = at least one check failed.
|
||||
|
||||
param(
|
||||
[string]$EnvFile = '',
|
||||
[string]$Target = '192.168.88.40',
|
||||
[int]$DockerPort = 2375,
|
||||
[int]$TimeoutSec = 20
|
||||
)
|
||||
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$target = $Target
|
||||
$dockerHost = "tcp://${target}:${DockerPort}"
|
||||
$env:DOCKER_HOST = $dockerHost
|
||||
|
||||
$failed = $false
|
||||
function Fail([string]$msg) { Write-Host " [FAIL] $msg" -ForegroundColor Red; $script:failed = $true }
|
||||
function Ok([string]$msg) { Write-Host " [OK] $msg" -ForegroundColor Green }
|
||||
function Warn([string]$msg) { Write-Host " [WARN] $msg" -ForegroundColor Yellow }
|
||||
|
||||
# Resolve env file: explicit, or $PWD/.env, or repo root.
|
||||
if (-not $EnvFile) {
|
||||
foreach ($cand in @((Join-Path $PWD '.env'), (Join-Path (Split-Path $PWD) '.env'))) {
|
||||
if (Test-Path $cand) { $EnvFile = $cand; break }
|
||||
}
|
||||
}
|
||||
if (-not $EnvFile -or -not (Test-Path $EnvFile)) {
|
||||
Write-Host "No .env file found. Pass one with -EnvFile." -ForegroundColor Yellow
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Parse KEY=VALUE lines into a hashtable.
|
||||
$envs = @{}
|
||||
Get-Content $EnvFile | ForEach-Object {
|
||||
if ($_ -match '^\s*([A-Za-z0-9_]+)\s*=\s*(.*?)\s*$') {
|
||||
$envs[$Matches[1]] = $Matches[2]
|
||||
}
|
||||
}
|
||||
|
||||
function Get-Val([string]$key) {
|
||||
if ($envs.ContainsKey($key)) { return $envs[$key] }
|
||||
return $null
|
||||
}
|
||||
|
||||
# Pull helper images once.
|
||||
Write-Host "Preparing helper images (curl, aws-cli) on $target..." -ForegroundColor Cyan
|
||||
docker pull curlimages/curl:latest 2>&1 | Out-Null
|
||||
docker pull amazon/aws-cli:latest 2>&1 | Out-Null
|
||||
|
||||
function Curl([string]$url, [string]$bearer, [string]$tokenHeader) {
|
||||
$a = @('run', '--rm', 'curlimages/curl:latest', '-sS', '--max-time', "$TimeoutSec")
|
||||
if ($bearer) { $a += @('-H', "Authorization: Bearer $bearer") }
|
||||
if ($tokenHeader) { $a += @('-H', "Authorization: token $tokenHeader") }
|
||||
$a += $url
|
||||
return (& docker @a 2>&1 | Out-String).Trim()
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
Write-Host "== Linear Void credential / token check ==" -ForegroundColor Cyan
|
||||
Write-Host "Env file : $EnvFile"
|
||||
Write-Host "Docker host: $dockerHost"
|
||||
|
||||
# --- 1. Gitea registry token ---
|
||||
Write-Host "`n-- Gitea container registry --" -ForegroundColor Cyan
|
||||
$regUser = Get-Val 'CI_REGISTRY_USER'
|
||||
$regToken = Get-Val 'CI_REGISTRY_TOKEN'
|
||||
if ($regUser -and $regToken) {
|
||||
# Non-sensitive probe: /api/v1/user returns a scope message for token-based creds.
|
||||
$out = Curl 'https://git.allucanget.biz/api/v1/user' $null $regToken
|
||||
if ($out -match 'token does not have at least one of required scope' -or $out -match '"login"' -or $out -match 'invalid_grant') {
|
||||
if ($out -match 'invalid_grant|Unauthorized|invalid') {
|
||||
Fail "Gitea registry token rejected ($regUser): $out"
|
||||
} else {
|
||||
Ok "Gitea registry token valid for '$regUser' (scope: write:package/write:repository)"
|
||||
}
|
||||
} else {
|
||||
Warn "Gitea registry token response unexpected: $out"
|
||||
}
|
||||
} else {
|
||||
Warn "CI_REGISTRY_USER / CI_REGISTRY_TOKEN not set; skipping Gitea registry check"
|
||||
}
|
||||
|
||||
# --- 2. Cloudflare API token ---
|
||||
Write-Host "`n-- Cloudflare API tokens --" -ForegroundColor Cyan
|
||||
$cfToken = Get-Val 'CLOUDFLARE_API_TOKEN'
|
||||
if ($cfToken) {
|
||||
$out = Curl 'https://api.cloudflare.com/client/v4/user/tokens/verify' $cfToken $null
|
||||
if ($out -match '"success":true') {
|
||||
if ($out -match '"status":"active"') { Ok 'Cloudflare API token valid and ACTIVE' }
|
||||
else { Warn "Cloudflare API token valid but status: $out" }
|
||||
} else {
|
||||
Fail "Cloudflare API token rejected: $out"
|
||||
}
|
||||
} else { Warn "CLOUDFLARE_API_TOKEN not set; skipping Cloudflare check" }
|
||||
|
||||
# --- 3. Cloudflare R2 / S3 bucket access ---
|
||||
Write-Host "`n-- Cloudflare R2 (S3-compatible) --" -ForegroundColor Cyan
|
||||
$r2Key = Get-Val 'R2_ACCESS_KEY_ID'
|
||||
$r2Secret = Get-Val 'R2_SECRET_ACCESS_KEY'
|
||||
$r2Ep = Get-Val 'R2_ENDPOINT'
|
||||
$bucket = Get-Val 'R2_BUCKET_NAME'
|
||||
|
||||
# Use the admin key pair (which has ListBuckets) when present, else the regular key.
|
||||
$listKey = if ((Get-Val 'R2_ADMIN_ACCESS_KEY_ID') -and (Get-Val 'R2_ADMIN_SECRET_ACCESS_KEY')) {
|
||||
@{ k = Get-Val 'R2_ADMIN_ACCESS_KEY_ID'; s = Get-Val 'R2_ADMIN_SECRET_ACCESS_KEY' }
|
||||
} else { @{ k = $r2Key; s = $r2Secret } }
|
||||
|
||||
if ($listKey.k -and $listKey.s -and $r2Ep) {
|
||||
$script = @"
|
||||
export AWS_ACCESS_KEY_ID='$($listKey.k)'
|
||||
export AWS_SECRET_ACCESS_KEY='$($listKey.s)'
|
||||
aws s3 ls --endpoint-url '$r2Ep' --region auto 2>&1
|
||||
"@
|
||||
$out = (& docker run --rm --entrypoint sh amazon/aws-cli:latest -c $script 2>&1 | Out-String).Trim()
|
||||
if ($out -match $bucket) { Ok "R2 bucket listing OK, '$bucket' present" }
|
||||
elseif ($out -match 'AccessDenied') { Fail "R2 listing denied (no ListBuckets permission): $out" }
|
||||
elseif ($out -match '^\S+\s+') { Warn "R2 listing returned (unexpected): $out" }
|
||||
else { Fail "R2 access failed: $out" }
|
||||
} else { Warn "R2 credentials / endpoint not fully set; skipping R2 check" }
|
||||
|
||||
# Verify the specific application bucket is reachable with the primary key (read).
|
||||
if ($r2Key -and $r2Secret -and $r2Ep -and $bucket) {
|
||||
$script = @"
|
||||
export AWS_ACCESS_KEY_ID='$r2Key'
|
||||
export AWS_SECRET_ACCESS_KEY='$r2Secret'
|
||||
aws s3 ls "s3://$bucket/" --endpoint-url '$r2Ep' --region auto --max-keys 5 2>&1 | head -5
|
||||
"@
|
||||
$out = (& docker run --rm --entrypoint sh amazon/aws-cli:latest -c $script 2>&1 | Out-String).Trim()
|
||||
if ($out -match 'AccessDenied') { Fail "Bucket '$bucket' read denied with primary key" }
|
||||
elseif ($out -eq '') { Ok "Bucket '$bucket' reachable (empty listing, expected)" }
|
||||
elseif ($out -match 'NoSuchBucket') { Fail "Bucket '$bucket' NOT FOUND" }
|
||||
else { Ok "Bucket '$bucket' reachable" }
|
||||
} elseif (-not $bucket) { Warn "R2_BUCKET_NAME not set; skipping bucket-level check" }
|
||||
|
||||
# --- 4. Linear Void admin login ---
|
||||
Write-Host "`n-- Linear Void admin login --" -ForegroundColor Cyan
|
||||
$adminUser = Get-Val 'ADMIN_USERNAME'
|
||||
$adminPass = Get-Val 'ADMIN_PASSWORD'
|
||||
if ($adminUser -and $adminPass) {
|
||||
# Hit the chat backend directly (public origin is caught by nginx SPA fallback).
|
||||
$url = "http://${target}:3000/api/admin/login"
|
||||
$body = ('{"username":"' + $adminUser + '","password":"' + $adminPass + '"}')
|
||||
$wrongBody = ('{"username":"' + $adminUser + '","password":"__definitely_wrong__"}')
|
||||
$a = @('run', '--rm', 'curlimages/curl:latest', '-sS', '--max-time', "$TimeoutSec",
|
||||
'-o', '/dev/null', '-w', '%{http_code}', '-X', 'POST',
|
||||
'-H', 'Content-Type: application/json', '-d', $body, $url)
|
||||
$okCode = (& docker @a 2>&1 | Out-String).Trim()
|
||||
$b = @('run', '--rm', 'curlimages/curl:latest', '-sS', '--max-time', "$TimeoutSec",
|
||||
'-o', '/dev/null', '-w', '%{http_code}', '-X', 'POST',
|
||||
'-H', 'Content-Type: application/json', '-d', $wrongBody, $url)
|
||||
$wrongCode = (& docker @b 2>&1 | Out-String).Trim()
|
||||
if ($okCode -eq '200' -and $wrongCode -eq '401') { Ok "Admin credentials valid (correct=200, wrong=401)" }
|
||||
else { Fail "Admin login unexpected (correct=$okCode, wrong=$wrongCode)" }
|
||||
} else { Warn "ADMIN_USERNAME / ADMIN_PASSWORD not set; skipping admin check" }
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
Write-Host ""
|
||||
if ($failed) { Write-Host "RESULT: FAILED" -ForegroundColor Red; exit 1 }
|
||||
Write-Host "RESULT: OK (no failing checks)" -ForegroundColor Green; exit 0
|
||||
Reference in new issue
Block a user