64 lines
3.2 KiB
Python
64 lines
3.2 KiB
Python
"""Prepare only our new directories and credentials on the external disk."""
|
|
from pathlib import Path
|
|
import os, secrets, shutil, socket, subprocess, tarfile, json
|
|
|
|
root = Path('/mnt/data/ikar_server')
|
|
if not os.path.ismount('/mnt/data'):
|
|
raise SystemExit('External disk is not mounted')
|
|
if (root / 'shared/server.env').exists():
|
|
raise SystemExit('Credentials already exist; inspect before updating')
|
|
root.mkdir(exist_ok=True)
|
|
for name in ('shared/data/secrets', 'releases/20261005', 'backups', 'rollback'):
|
|
(root / name).mkdir(parents=True, exist_ok=True)
|
|
baseline = subprocess.check_output(['docker', 'ps', '--format', '{{json .}}'], text=True)
|
|
(root / 'rollback/services-before.jsonl').write_text(baseline)
|
|
archive = root / 'rollback/old-ikar-20261005.tar.gz'
|
|
with tarfile.open(archive, 'w:gz') as bundle:
|
|
for name in ('ikar-deploy', 'ikar-data'):
|
|
source = Path('/mnt/data') / name
|
|
if source.exists():
|
|
bundle.add(source, arcname=name)
|
|
os.chmod(archive, 0o600)
|
|
old = {}
|
|
for line in Path('/mnt/data/ikar-deploy/.env.server').read_text().splitlines():
|
|
if '=' in line and not line.lstrip().startswith('#'):
|
|
key, value = line.split('=', 1)
|
|
old[key] = value
|
|
turn = {}
|
|
for line in Path('/mnt/data/ikar-deploy/.env').read_text().splitlines():
|
|
if '=' in line:
|
|
key, value = line.split('=', 1)
|
|
turn[key] = value
|
|
shutil.copy2('/mnt/data/ikar-data/secrets/firebase-admin.json', root / 'shared/data/secrets/firebase-admin.json')
|
|
username = 'ikar'
|
|
password = secrets.token_urlsafe(32)
|
|
private_ip = socket.gethostbyname(socket.gethostname())
|
|
if private_ip.startswith('127.'):
|
|
private_ip = subprocess.check_output(['hostname', '-I'], text=True).split()[0]
|
|
try:
|
|
public_ip = socket.gethostbyname('ikar.kusoft.xyz')
|
|
except socket.gaierror:
|
|
public_ip = socket.gethostbyname('argus.kusoft.xyz')
|
|
values = {
|
|
'ASPNETCORE_ENVIRONMENT': 'Production', 'SeedDemoData': 'false',
|
|
'ConnectionStrings__IkarDb': 'Data Source=/app/Data/ikar.db',
|
|
'Jwt__SigningKey': secrets.token_urlsafe(64),
|
|
'Push__FirebaseProjectId': old.get('Push__FirebaseProjectId', 'ikar-3bdfb'),
|
|
'Push__ServiceAccountJsonPath': '/app/Data/secrets/firebase-admin.json',
|
|
'Admin__Username': 'admin', 'Admin__Password': secrets.token_urlsafe(32),
|
|
'QlyraPublicEndpoint__BaseUrl': 'https://ikar.kusoft.xyz',
|
|
'WebRtc__IceServers__0__Urls__0': 'stun:ikar.kusoft.xyz:3478',
|
|
'WebRtc__IceServers__1__Urls__0': 'turn:ikar.kusoft.xyz:3478?transport=udp',
|
|
'WebRtc__IceServers__1__Urls__1': 'turn:ikar.kusoft.xyz:3478?transport=tcp',
|
|
'WebRtc__IceServers__1__Username': username, 'WebRtc__IceServers__1__Credential': password,
|
|
}
|
|
values.update({k: v for k, v in old.items() if k.startswith('EmailAuth__')})
|
|
env = root / 'shared/server.env'
|
|
env.write_text(''.join(f'{k}={v}\n' for k, v in values.items()))
|
|
os.chmod(env, 0o600)
|
|
env = root / 'shared/turn.env'
|
|
env.write_text(f'TURN_USERNAME={username}\nTURN_PASSWORD={password}\nTURN_PRIVATE_IP={private_ip}\nTURN_EXTERNAL_IP={public_ip}\n')
|
|
os.chmod(env, 0o600)
|
|
subprocess.run(['chown', '-R', '1000:1000', str(root)], check=True)
|
|
print(json.dumps({'path': str(root), 'oldArchiveBytes': archive.stat().st_size, 'privateIp': private_ip, 'publicIp': public_ip}))
|