sneak
c516e34145
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
71 lines
2.5 KiB
AMPL
Executable File
71 lines
2.5 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for sww, run again whenever sww
|
|
# exits; the wait spaces out the restarts. SWW_COMMAND names the
|
|
# command to run: rproxy when it is unset or empty, or waf. With any
|
|
# other value the script starts nothing and stops with a message naming it.
|
|
# exec, so that the signal `sv stop` sends reaches sww itself.
|
|
main() {
|
|
sleep 1
|
|
local command="${SWW_COMMAND:-rproxy}"
|
|
case "$command" in
|
|
rproxy) ;;
|
|
waf)
|
|
give_state_dir_to_sww
|
|
make_cache_dir_for_sww
|
|
;;
|
|
*)
|
|
printf 'SWW_COMMAND: "%s" is not rproxy or waf\n' \
|
|
"$command" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
exec chpst -u sww:sww /usr/local/bin/sww "$command"
|
|
}
|
|
|
|
# give_state_dir_to_sww gives the state directory and every file in
|
|
# it to the sww user, so that a volume mounted there needs no change
|
|
# of owner; chown -R changes a symbolic link itself, never what it points
|
|
# to. When SWW_WAF_STATE_DIR, in either form, cannot be read or is not the
|
|
# absolute path of a directory, no owner is changed, and waf starts and
|
|
# stops with a message naming the setting. A change of owner that fails, as
|
|
# on a volume mounted read-only, does not end the script either: waf
|
|
# reports a directory it cannot write.
|
|
give_state_dir_to_sww() {
|
|
local dir
|
|
if dir="$(setting SWW_WAF_STATE_DIR /var/lib/sww)" &&
|
|
[[ "$dir" == /* && -d "$dir" ]]; then
|
|
chown -R sww:sww "$dir" || true
|
|
fi
|
|
}
|
|
|
|
# make_cache_dir_for_sww makes the cache directory, SWW_WAF_CACHE_DIR in
|
|
# either form, and gives it and every file in it to the sww user, as
|
|
# give_state_dir_to_sww does the state directory. Unlike that one, it is
|
|
# made when it is missing, since the cache files need no volume. As there,
|
|
# a setting that cannot be read or is not an absolute path changes
|
|
# nothing, and a failure does not end the script.
|
|
make_cache_dir_for_sww() {
|
|
local dir
|
|
if dir="$(setting SWW_WAF_CACHE_DIR /var/cache/sww)" && [[ "$dir" == /* ]]; then
|
|
{ mkdir -p -- "$dir" && chown -R sww:sww "$dir"; } || true
|
|
fi
|
|
}
|
|
|
|
# setting prints the setting named $1, $2 when it is unset, or what is in
|
|
# the file the setting $1_FILE names, less every newline at its end. It
|
|
# fails when both are set or the file cannot be read.
|
|
setting() {
|
|
local name="$1" file_name="$1_FILE"
|
|
if [[ ! -v "$file_name" ]]; then
|
|
printf '%s\n' "${!name-$2}"
|
|
elif [[ ! -v "$name" ]]; then
|
|
cat -- "${!file_name}" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|