sneak
c6ab946c86
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
70 lines
2.5 KiB
AMPL
Executable File
70 lines
2.5 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for sww, run again whenever sww
|
|
# exits; the wait spaces out the restarts. SWW_COMMAND names the
|
|
# command to run: rproxy when it is unset or empty, or waf. With any
|
|
# other value the script starts nothing and stops with a message naming it.
|
|
# exec, so that the signal `sv stop` sends reaches sww itself.
|
|
main() {
|
|
sleep 1
|
|
local command="${SWW_COMMAND:-rproxy}"
|
|
case "$command" in
|
|
rproxy) ;;
|
|
waf)
|
|
make_state_dir_for_sww
|
|
make_cache_dir_for_sww
|
|
;;
|
|
*)
|
|
printf 'SWW_COMMAND: "%s" is not rproxy or waf\n' \
|
|
"$command" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
exec chpst -u sww:sww /usr/local/bin/sww "$command"
|
|
}
|
|
|
|
# make_state_dir_for_sww makes the state directory, SWW_WAF_STATE_DIR in
|
|
# either form, when it is missing, gives it and every file in it to the
|
|
# sww user, and sets its mode to 0700. So a volume mounted there needs no
|
|
# change of owner; chown -R changes a symbolic link itself, never what it
|
|
# points to. When the setting cannot be read or is not an absolute path,
|
|
# nothing is changed, and waf starts and stops with a message naming the
|
|
# setting. A step that fails, as on a volume mounted read-only, does not
|
|
# end the script either: waf reports a directory it cannot write.
|
|
make_state_dir_for_sww() {
|
|
local dir
|
|
if dir="$(setting SWW_WAF_STATE_DIR /var/lib/sww)" && [[ "$dir" == /* ]]; then
|
|
{ mkdir -p -- "$dir" && chown -R sww:sww "$dir" &&
|
|
chmod 0700 "$dir"; } || true
|
|
fi
|
|
}
|
|
|
|
# make_cache_dir_for_sww makes the cache directory, SWW_WAF_CACHE_DIR in
|
|
# either form, when it is missing, and gives it and every file in it to
|
|
# the sww user. As for the state directory, a setting that cannot be read
|
|
# or is not an absolute path changes nothing, and a failure does not end
|
|
# the script.
|
|
make_cache_dir_for_sww() {
|
|
local dir
|
|
if dir="$(setting SWW_WAF_CACHE_DIR /var/cache/sww)" && [[ "$dir" == /* ]]; then
|
|
{ mkdir -p -- "$dir" && chown -R sww:sww "$dir"; } || true
|
|
fi
|
|
}
|
|
|
|
# setting prints the setting named $1, $2 when it is unset, or what is in
|
|
# the file the setting $1_FILE names, less every newline at its end. It
|
|
# fails when both are set or the file cannot be read.
|
|
setting() {
|
|
local name="$1" file_name="$1_FILE"
|
|
if [[ ! -v "$file_name" ]]; then
|
|
printf '%s\n' "${!name-$2}"
|
|
elif [[ ! -v "$name" ]]; then
|
|
cat -- "${!file_name}" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|