ssh git이 가능하도록 변경, cron 버그 수정, fpm timezone 수정

2019-09-15 13:30:12 +00:00
parent 0d49729c63
commit af6353105b
12 changed files with 121 additions and 64 deletions
@@ -0,0 +1,15 @@
+
+#MYSQL 비밀번호. (필수)
+MYSQL_ROOT_PASSWORD=
+MYSQL_USER=hidche
+MYSQL_PASSWORD=
+HIDCHE_DB_PREFIX=hidche
+
+
+#운영자 계정, 비밀번호.
+HIDCHE_ADMIN=
+HIDCHE_PASSWORD=
+
+#카카오 로그인을 위한 API
+HIDCHE_KAKAO_REST_KEY=
+HIDCHE_KAKAO_ADMIN_KEY=
@@ -37,14 +37,22 @@ RUN { \
    \
    echo 'memory_limit=512M' > /usr/local/etc/php/conf.d/memory-limit.ini; \
    \
-    mkdir /var/www/data; \
+    mkdir -p /var/www/data; \
    chown -R www-data:root /var/www; \
-    chmod -R g=u /var/www
+    chmod -R g=u /var/www; \
+    mkdir -p /var/www/.ssh; \
+    chown www-data:www-data /var/www/.ssh; \
+    chmod 700 /var/www/.ssh

 VOLUME /var/www/html

 ENV TZ=Asia/Seoul

 COPY entrypoint_hidche_app.sh /usr/local/bin/
+COPY id_ecdsa.key /var/www/.ssh/id_ecdsa
+COPY known_hosts /var/www/.ssh/known_hosts
+RUN \
+    chown www-data:www-data /var/www/.ssh/*; \
+    chmod 600 /var/www/.ssh/*;
 ENTRYPOINT ["entrypoint_hidche_app.sh"]
 CMD ["php-fpm"]
@@ -1,27 +1,25 @@
 #!/bin/bash
-set -euxo pipefail
+set -uxo pipefail
 shopt -s nullglob

 ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+printf "[PHP]\ndate.timezone = \"$TZ\"\n" > /usr/local/etc/php/conf.d/tzone.ini

 wwwRoot="/var/www/html"
 samRoot="$wwwRoot/sam"
 imageRoot="$wwwRoot/image"

-gameGitPath="https://storage.hided.net/gogs/devsam/core.git"
-imgGitPath="https://storage.hided.net/gogs/devsam/image.git"
-
-
-if [ ! -f "$wwwRoot/index.php" ]; then
-    echo "<?php header('location:sam',TRUE,301);" > $wwwRoot/index.php
-    chown www-data:www-data $wwwRoot/index.php
-fi
-
 if [ ! -f "$samRoot/index.php" ]; then
    gosu www-data git clone $gameGitPath /var/www/html/sam
 fi

 if [ $HIDCHE_IMAGE_USE_INTERNAL = "yes" ] && [ ! -d "$imageRoot" ]; then
+    if [[ "$imageRoot" =~ ^ssh ]]; then
+        query=`echo "<?php \\\$a=parse_url('$imageRoot');echo join(' ', [\\\$a['port']?'-p '.\\\$a['port']:'',\\\$a['host']]);" | php`
+        ssh-keyscan $query >> /var/www/.ssh/known_hosts 2>/dev/null;
+        chown www-data:www-data /var/www/.ssh/known_hosts
+        chmod 600 /var/www/.ssh/known_hosts
+    fi
    gosu www-data git clone $imgGitPath /var/www/html/image
 fi

@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFPwAmkXCRG4Q7RSUqL9uzi4SF09iXQGB785l3/Hbw0woAoGCCqGSM49
+AwEHoUQDQgAEpGiOeQnFmPb3fecADT0jikWWO03WvJIGux5j4+kh/g3FXP2Fjb1V
+4SI264WpBZFTdoSyLKXWvrLeQCXZsZwa2w==
+-----END EC PRIVATE KEY-----
@@ -0,0 +1,3 @@
+[storage.hided.net]:2525 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCb9BLlqXb8jsnho4Db6WTMQOnhjxC42lanowDicTjzaan7JgTrRxFbrLL8zUcqMhNpFBqD9oUxV2gKD00/BoVtXEbjKoa+GjKtDyU+RfejaAw4j+nVZjyjvXoIKMyzr6NqjA3mLdcd47KLZKtFQNKcOL00foMsqYJhmr75UM6scfCj8+KnjVLkNdlFtJ9fGlnA1FGmEoldHR+htN01E/Yx8teHQGo5W0hZ/tOvE+r7NWA2PXFqOrb+IXe3URVndDZb1idInQDuMRetrWgCEZSy4/sTIss030wkHkUdDuLCt2NnUvLEVlxvpQw72k9j/nRapkGthwN7x1L8yQYKY6iv|1|XTprP1yTMznxEkakYqFoyNVBs7A=|8wea12ZyJ0L/nHHQ3nEtWJHlikA= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCb9BLlqXb8jsnho4Db6WTMQOnhjxC42lanowDicTjzaan7JgTrRxFbrLL8zUcqMhNpFBqD9oUxV2gKD00/BoVtXEbjKoa+GjKtDyU+RfejaAw4j+nVZjyjvXoIKMyzr6NqjA3mLdcd47KLZKtFQNKcOL00foMsqYJhmr75UM6scfCj8+KnjVLkNdlFtJ9fGlnA1FGmEoldHR+htN01E/Yx8teHQGo5W0hZ/tOvE+r7NWA2PXFqOrb+IXe3URVndDZb1idInQDuMRetrWgCEZSy4/sTIss030wkHkUdDuLCt2NnUvLEVlxvpQw72k9j/nRapkGthwN7x1L8yQYKY6iv
+|1|3UOicj4TheEV6TEnSfmHNKhpuWU=|EL7zXO8enUCmq5tmi4WlxuEp2BM= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCb9BLlqXb8jsnho4Db6WTMQOnhjxC42lanowDicTjzaan7JgTrRxFbrLL8zUcqMhNpFBqD9oUxV2gKD00/BoVtXEbjKoa+GjKtDyU+RfejaAw4j+nVZjyjvXoIKMyzr6NqjA3mLdcd47KLZKtFQNKcOL00foMsqYJhmr75UM6scfCj8+KnjVLkNdlFtJ9fGlnA1FGmEoldHR+htN01E/Yx8teHQGo5W0hZ/tOvE+r7NWA2PXFqOrb+IXe3URVndDZb1idInQDuMRetrWgCEZSy4/sTIss030wkHkUdDuLCt2NnUvLEVlxvpQw72k9j/nRapkGthwN7x1L8yQYKY6iv
+|1|M8V56tJHA+xiw51scQfhSs5nZeE=|wIw/fQk0MR3l7Bo3Mqd0zR+S4rE= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCb9BLlqXb8jsnho4Db6WTMQOnhjxC42lanowDicTjzaan7JgTrRxFbrLL8zUcqMhNpFBqD9oUxV2gKD00/BoVtXEbjKoa+GjKtDyU+RfejaAw4j+nVZjyjvXoIKMyzr6NqjA3mLdcd47KLZKtFQNKcOL00foMsqYJhmr75UM6scfCj8+KnjVLkNdlFtJ9fGlnA1FGmEoldHR+htN01E/Yx8teHQGo5W0hZ/tOvE+r7NWA2PXFqOrb+IXe3URVndDZb1idInQDuMRetrWgCEZSy4/sTIss030wkHkUdDuLCt2NnUvLEVlxvpQw72k9j/nRapkGthwN7x1L8yQYKY6iv
@@ -2,6 +2,6 @@ FROM python:3-alpine
 #alpine + python3 + cron(from alpine)

 #only cron this
-RUN echo '*  *  *  *  *  python3 /var/www/html/sam/src/run_daemon.py' > /etc/crontabs/root
-
-CMD ["crond", "-l 2", "-f"]
+COPY        entrypoint.sh /
+RUN         chmod +x /entrypoint.sh
+ENTRYPOINT  ["/entrypoint.sh"]
@@ -0,0 +1,3 @@
+#!/bin/sh
+set -e
+echo '*  *  *  *  *  python3 /var/www/html/sam/src/run_daemon.py' | crontab - && crond -f -L /dev/stdout
@@ -58,7 +58,7 @@ _check_config() {

 #modifed
 file_env 'TZ'
-echo `ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone`
+ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

 #modifed
 hidcheDBList=("root" "che" "kwe" "pwe" "twe" "nya" "pya" "hwe")
@@ -171,7 +171,8 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
 		file_env 'HIDCHE_DB_PREFIX'
 		if [ "$HIDCHE_DB_PREFIX" ]; then
 			for dbName in "${hidcheDBList[@]}"; do
-				echo "CREATE DATABASE IF NOT EXISTS \`${HIDCHE_DB_PREFIX}_${dbName}\` ;" | "${mysql[@]}"
+				fullDBName="${HIDCHE_DB_PREFIX}_${dbName}"
+				echo "CREATE DATABASE IF NOT EXISTS \`$fullDBName\` ;" | "${mysql[@]}"
 			done
 			mysql+=( "${HIDCHE_DB_PREFIX}_${hidcheDBList[0]}" )
 			
@@ -185,8 +186,14 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
 			#modifed
 			if [ "$HIDCHE_DB_PREFIX" ]; then
 				for dbName in "${hidcheDBList[@]}"; do
-					echo "GRANT ALL ON \`${HIDCHE_DB_PREFIX}_${dbName}\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}"
+					fullDBName="${HIDCHE_DB_PREFIX}_${dbName}"
+					subPW=`echo -n ${dbName}${MYSQL_USER}${MYSQL_PASSWORD}${dbName} | shasum -a 512`
+					subPW=${subPW:0:32}
+					echo "CREATE USER '$fullDBName'@'%' IDENTIFIED BY '$subPW' ;" | "${mysql[@]}"
+					echo "GRANT ALL ON \`$fullDBName\`.* TO '$MYSQL_USER'@'%' ;" | "${mysql[@]}"
+					echo "GRANT ALL ON \`$fullDBName\`.* TO '$fullDBName'@'%' ;" | "${mysql[@]}"
 				done
+					
 			fi
 		fi

@@ -207,7 +214,7 @@ if [ "$1" = 'mysqld' -a -z "$wantHelp" ]; then
 		fi

 		echo
-		echo 'MySQL init process wid HIDCHE done. Ready for start up.'
+		echo 'MySQL init process with HIDCHE done. Ready for start up.'
 		echo
 	fi
 fi
@@ -6,10 +6,9 @@ services:
    restart: always
    volumes:
      - db:/var/lib/mysql
-    environment:
-      - MYSQL_ROOT_PASSWORD=
    env_file:
-      - setup.env
+      - account.env
+      - game.env

  web:
    build: ./web
@@ -25,7 +24,7 @@ services:
    volumes:
      - hidche:/var/www/html
    env_file:
-      - setup.env
+      - game.env
    depends_on:
      - db
      - web
@@ -38,7 +37,8 @@ services:
    environment:
      - MYSQL_HOST=db
    env_file:
-      - setup.env
+      - account.env
+      - game.env
    depends_on:
      - app
      - db
@@ -48,7 +48,7 @@ services:
    build: ./cron
    restart: always
    volumes:
-      - hidche:/var/www/html:ro
+      - hidche:/var/www/html
    depends_on:
      - app

@@ -0,0 +1,19 @@
+
+#서버 git 주소.
+#만약 https:// 대신 ssh://로 시작하는 주소를 사용하는 경우 app/id_ecdsa.key, app/known_host 에 ecdsa 개인키와 ssh값을 추가할 것.
+gameGitPath=ssh://git@storage.hided.net:2525/devsam/core.git
+imgGitPath=ssh://git@storage.hided.net:2525/devsam/image.git
+
+#게임 시간대.
+TZ=Asia/Seoul
+
+#서버 리스트. 구현 문제로 아래 서버들로 현재 고정. Dockercompose 값 수정 불가.
+HIDCHE_SERVER_LIST=che,kwe,pwe,twe,nya,pya,hwe
+
+#외부에서 접근 가능한(할) 경로로 지정.
+HIDCHE_GAME_PATH=http://127.0.0.1:8080/sam
+
+#게임 서버에서 이미지를 같이 처리할 것인지 여부.
+HIDCHE_IMAGE_USE_INTERNAL=yes
+#이미지 경로, HIDCHE_IMAGE_USE_INTERNAL이 yes인 경우 HIDCHE_GAME_PATH의 상대 경로. yes가 아닌 경우 전체 도메인 경로.
+HIDCHE_IMAGE_PATH=../image
@@ -16,11 +16,28 @@ def hash_password(globalSalt, password):
 env = os.environ
 wwwRoot = '/var/www/html'
 samRoot = '%s/sam'%wwwRoot
-imageRoot= '%s/image'%wwwRoot
-
+indexPHP = '%s/index.php'%wwwRoot
 if os.path.exists('%s/hwe/d_setting/DB.php'):
    exit(0)

+useWaitIndex = False
+if not os.path.exists(indexPHP):
+    useWaitIndex = True
+    fp = open(indexPHP, 'wt', encoding='utf-8')
+    fp.write("""
+<!doctype html>
+<html>
+<head>
+<title>HIDCHE - Auto Install Process</title>
+<meta http-equiv="refresh" content="5"/>
+</head>
+<body>
+<h1>Please wait for installation.</h1>
+</body>
+</html>
+""")
+    fp.close()
+
 while True:
    try: 
        r = requests.head('http://web/sam/f_install/j_install_status.php')
@@ -40,19 +57,21 @@ while True:

 session = requests.session()

+db_root_pw = hash_password('root', env['MYSQL_USER']+env['MYSQL_PASSWORD'])[:32]
+db_root_name = '%s_root'%env['HIDCHE_DB_PREFIX']
+
 setupDBResult = session.post('http://web/sam/f_install/j_setup_db.php', {
    'db_host':'db',
    'db_port':3306,
-    'db_id':env['MYSQL_USER'],
-    'db_pw':env['MYSQL_PASSWORD'],
-    'db_name':'%s_root'%env['HIDCHE_DB_PREFIX'],
+    'db_id':db_root_name,
+    'db_pw':db_root_pw,
+    'db_name':db_root_name,
    'serv_host':env['HIDCHE_GAME_PATH'],
    'shared_icon_path':'%s/icons'%env['HIDCHE_IMAGE_PATH'],
    'game_image_path':'%s/game'%env['HIDCHE_IMAGE_PATH'],
    'kakao_rest_key':env['HIDCHE_KAKAO_REST_KEY'],
    'kakao_admin_key':env['HIDCHE_KAKAO_ADMIN_KEY'],
 })
-
 setupDBJsonResult = json.loads(setupDBResult.text)
 print(setupDBJsonResult)

@@ -65,12 +84,11 @@ query = {
    'password':hashPassword,
    'nickname':'운영자'
 }
-print(query)
 setupAdminResult = session.post('http://web/sam/f_install/j_create_admin.php', query)
 setupAdminJsonResult = json.loads(setupAdminResult.text)
 print(setupAdminJsonResult)

-loginResult=session.post('http://web/sam/j_login.php', query)
+loginResult = session.post('http://web/sam/j_login.php', query)
 print(loginResult.text)

 serverList = str(env['HIDCHE_SERVER_LIST']).split(',')
@@ -82,13 +100,21 @@ for serverName in serverList:
    })
    print(serverName, updateResult.text)

+    db_pw = hash_password(serverName, env['MYSQL_USER']+env['MYSQL_PASSWORD'])[:32]
+    db_name = '%s_%s'%(env['HIDCHE_DB_PREFIX'], serverName)
    resetResult = session.post('http://web/sam/%s/j_install_db.php'%serverName, {
        'db_host':'db',
        'db_port':3306,
-        'db_id':env['MYSQL_USER'],
-        'db_pw':env['MYSQL_PASSWORD'],
-        'db_name':'%s_%s'%(env['HIDCHE_DB_PREFIX'], serverName),
+        'db_id':db_name,
+        'db_pw':db_pw,
+        'db_name':db_name,
    })
    print(serverName, resetResult.text)

-print('Welcome to HIDCHE')
+if useWaitIndex:
+    fp = open(indexPHP, 'wt', encoding='utf-8')
+    fp.write("<?php header('location:sam',TRUE,301);")
+    fp.close()
+    os.chown(indexPHP, 33, 33)
+
+print('Welcome to HIDCHE')
@@ -1,27 +0,0 @@
-#서버 리스트. 구현 문제로 아래 서버들로 현재 고정. Dockercompose 값 수정 불가.
-HIDCHE_SERVER_LIST=che,kwe,pwe,twe,nya,pya,hwe
-#게임 시간대. 구현 문제로 아래 시간대로 고정. Dockercompose 값 수정 불가.
-TZ=Asia/Seoul
-
-#MYSQL 비밀번호. (필수)
-MYSQL_USER=
-MYSQL_PASSWORD=
-HIDCHE_DB_PREFIX=hidche
-
-
-#외부에서 접근 가능한(할) 경로로 지정. (필수)
-HIDCHE_GAME_PATH=http://127.0.0.1:8080/sam
-
-#게임 서버에서 이미지를 같이 처리할 것인지 여부.
-HIDCHE_IMAGE_USE_INTERNAL=yes
-#이미지 경로.
-#HIDCHE_IMAGE_USE_INTERNAL이 yes인 경우 HIDCHE_GAME_PATH 기준 상대 경로
-HIDCHE_IMAGE_PATH=../image
-
-#운영자 계정, 비밀번호. (필수)
-HIDCHE_ADMIN=
-HIDCHE_PASSWORD=
-
-#카카오 로그인을 위한 API (필수)
-HIDCHE_KAKAO_REST_KEY=
-HIDCHE_KAKAO_ADMIN_KEY=