figmar/deepdata
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(images): normalize shell scripts to LF line endings
CodeQL Advanced / Analyze (actions) (push) Canceled after 0s
Details
CodeQL Advanced / Analyze (java-kotlin) (push) Canceled after 0s
Details
CodeQL Advanced / Analyze (javascript-typescript) (push) Canceled after 0s
Details
CodeQL Advanced / Analyze (python) (push) Canceled after 0s
Details
Docker Image Build & Push / manifest (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-arm (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-amd (push) Canceled after 0s
Details
Docker Image Build & Push / manifest (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-arm (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-amd (push) Canceled after 0s
Details
Docker Image Build & Push / manifest (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-arm (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-amd (push) Canceled after 0s
Details
Docker Image Build & Push / manifest (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-arm (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-amd (push) Canceled after 0s
Details
Docker Image Build & Push / manifest (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-arm (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-amd (push) Canceled after 0s
Details
Docker Image Build & Push / manifest (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-arm (push) Canceled after 0s
Details
Docker Image Build & Push / build-and-push-amd (push) Canceled after 0s
Details
Python Backend Docker Image CI / Build and Push Backend Python Docker Image (push) Canceled after 0s
Details
Backend Docker Image CI / Build and Push Backend Docker Image (push) Canceled after 0s
Details
Database Docker Image CI / Build and Push Database Docker Image (push) Canceled after 0s
Details
Frontend Docker Image CI / Build and Push Frontend Docker Image (push) Canceled after 0s
Details
Gateway Docker Image CI / Build and Push Gateway Docker Image (push) Canceled after 0s
Details
Runtime Docker Image CI / Build and Push Runtime Docker Image (push) Canceled after 0s
Details

Browse Source 
database image crashed at start: CRLF shebang in start.sh made the kernel
look for interpreter '/bin/bash\r'. Other image Dockerfiles mask this with
dos2unix at build time, but scripts/images/database/Dockerfile does not.
Convert all tracked .sh files to LF and pin eol=lf via .gitattributes.
This commit is contained in:
apescale
2026-08-31 06:43:31 +08:00
parent 98b52fdb31
commit 54e067ed54
16 changed files with 1321 additions and 1319 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/images/frontend/rotate-nginx-logs.sh
+92 -92
View File
@@ -1,92 +1,92 @@
#!/bin/bash
set -euo pipefail
LOG_DIR="${NGINX_LOG_DIR:-/var/log/deepdata/frontend}"
LOG_ROTATION_MAX_SIZE="${LOG_ROTATION_MAX_SIZE:-100MB}"
LOG_ROTATION_BACKUP_COUNT="${LOG_ROTATION_BACKUP_COUNT:-30}"
LOG_ROTATION_INTERVAL_SECONDS="${LOG_ROTATION_INTERVAL_SECONDS:-300}"
parse_size_bytes() {
local value
value="$(printf '%s' "$1" | tr '[:lower:]' '[:upper:]')"
value="${value// /}"
case "$value" in
*GB) echo $((${value%GB} * 1024 * 1024 * 1024)) ;;
*G) echo $((${value%G} * 1024 * 1024 * 1024)) ;;
*MB) echo $((${value%MB} * 1024 * 1024)) ;;
*M) echo $((${value%M} * 1024 * 1024)) ;;
*KB) echo $((${value%KB} * 1024)) ;;
*K) echo $((${value%K} * 1024)) ;;
*B) echo "${value%B}" ;;
*) echo "$value" ;;
esac
}
file_size_bytes() {
wc -c < "$1" | tr -d ' '
}
backup_path() {
local file="$1"
local index="$2"
local ext="${file##*.}"
local stem="${file%.$ext}"
echo "${stem}.${index}.${ext}"
}
rotate_file() {
local file="$1"
local max_bytes="$2"
local backup_count="$3"
[ -f "$file" ] || return 1
local current_size
current_size="$(file_size_bytes "$file")"
[ "$current_size" -lt "$max_bytes" ] && return 1
rm -f "$(backup_path "$file" "$backup_count")"
local index
for ((index = backup_count - 1; index >= 1; index--)); do
local src dst
src="$(backup_path "$file" "$index")"
dst="$(backup_path "$file" "$((index + 1))")"
[ -f "$src" ] && mv "$src" "$dst"
done
mv "$file" "$(backup_path "$file" 1)"
install -o nginx -g nginx -m 0644 /dev/null "$file"
return 0
}
rotate_once() {
mkdir -p "$LOG_DIR"
touch "$LOG_DIR/access.log" "$LOG_DIR/error.log"
chown -R nginx:nginx "$LOG_DIR" 2>/dev/null || true
local max_bytes
max_bytes="$(parse_size_bytes "$LOG_ROTATION_MAX_SIZE")"
local rotated=false
for file in "$LOG_DIR/access.log" "$LOG_DIR/error.log"; do
if rotate_file "$file" "$max_bytes" "$LOG_ROTATION_BACKUP_COUNT"; then
rotated=true
fi
done
if [ "$rotated" = true ]; then
nginx -s reopen || true
fi
}
if [ "${1:-}" = "--once" ]; then
rotate_once
exit 0
fi
while true; do
rotate_once
sleep "$LOG_ROTATION_INTERVAL_SECONDS"
done
#!/bin/bash
set -euo pipefail
LOG_DIR="${NGINX_LOG_DIR:-/var/log/deepdata/frontend}"
LOG_ROTATION_MAX_SIZE="${LOG_ROTATION_MAX_SIZE:-100MB}"
LOG_ROTATION_BACKUP_COUNT="${LOG_ROTATION_BACKUP_COUNT:-30}"
LOG_ROTATION_INTERVAL_SECONDS="${LOG_ROTATION_INTERVAL_SECONDS:-300}"
parse_size_bytes() {
local value
value="$(printf '%s' "$1" | tr '[:lower:]' '[:upper:]')"
value="${value// /}"
case "$value" in
*GB) echo $((${value%GB} * 1024 * 1024 * 1024)) ;;
*G) echo $((${value%G} * 1024 * 1024 * 1024)) ;;
*MB) echo $((${value%MB} * 1024 * 1024)) ;;
*M) echo $((${value%M} * 1024 * 1024)) ;;
*KB) echo $((${value%KB} * 1024)) ;;
*K) echo $((${value%K} * 1024)) ;;
*B) echo "${value%B}" ;;
*) echo "$value" ;;
esac
}
file_size_bytes() {
wc -c < "$1" | tr -d ' '
}
backup_path() {
local file="$1"
local index="$2"
local ext="${file##*.}"
local stem="${file%.$ext}"
echo "${stem}.${index}.${ext}"
}
rotate_file() {
local file="$1"
local max_bytes="$2"
local backup_count="$3"
[ -f "$file" ] || return 1
local current_size
current_size="$(file_size_bytes "$file")"
[ "$current_size" -lt "$max_bytes" ] && return 1
rm -f "$(backup_path "$file" "$backup_count")"
local index
for ((index = backup_count - 1; index >= 1; index--)); do
local src dst
src="$(backup_path "$file" "$index")"
dst="$(backup_path "$file" "$((index + 1))")"
[ -f "$src" ] && mv "$src" "$dst"
done
mv "$file" "$(backup_path "$file" 1)"
install -o nginx -g nginx -m 0644 /dev/null "$file"
return 0
}
rotate_once() {
mkdir -p "$LOG_DIR"
touch "$LOG_DIR/access.log" "$LOG_DIR/error.log"
chown -R nginx:nginx "$LOG_DIR" 2>/dev/null || true
local max_bytes
max_bytes="$(parse_size_bytes "$LOG_ROTATION_MAX_SIZE")"
local rotated=false
for file in "$LOG_DIR/access.log" "$LOG_DIR/error.log"; do
if rotate_file "$file" "$max_bytes" "$LOG_ROTATION_BACKUP_COUNT"; then
rotated=true
fi
done
if [ "$rotated" = true ]; then
nginx -s reopen || true
fi
}
if [ "${1:-}" = "--once" ]; then
rotate_once
exit 0
fi
while true; do
rotate_once
sleep "$LOG_ROTATION_INTERVAL_SECONDS"
done
scripts/images/frontend/start.sh
+62 -62
View File
@@ -1,62 +1,62 @@
#!/bin/bash
function set_proxy_protocol() {
if [ "${REAL_IP_MODE}" != "proxy_protocol" ]; then
echo "REAL_IP_MODE is ${REAL_IP_MODE}, no need to update nginx configuration file."
return 0
fi
sed -i 's/listen 3000;/listen 3000 proxy_protocol;/' /opt/frontend/http_backend.conf
sed -i 's/listen 3000 ssl;/listen 3000 ssl proxy_protocol;/' /opt/frontend/https_backend.conf
sed -i '/access_log.*main/a\ set_real_ip_from 0.0.0.0/0;' /opt/frontend/nginx.conf
sed -i '/access_log.*main/a\ real_ip_header proxy_protocol;' /opt/frontend/nginx.conf
echo "Nginx configuration file updated."
}
mkdir -p /var/log/deepdata/frontend
touch /var/log/deepdata/frontend/access.log /var/log/deepdata/frontend/error.log
chown -R nginx:nginx /var/log/deepdata/frontend 2>/dev/null || true
/usr/local/bin/rotate-nginx-logs.sh &
if [ -f "/cert/server.pem" ]; then
cp /cert/server.pem /etc/nginx/cert/server.pem
chown nginx:nginx /etc/nginx/cert/server.pem
fi
if [ -f "/cert/server.key" ]; then
# Private key MUST be encrypted. Plaintext keys are not accepted.
if grep -q "ENCRYPTED" /cert/server.key 2>/dev/null; then
if [ -z "$CERT_PASS" ]; then
echo "ERROR: CERT_PASS is required to decrypt the private key"
exit 1
fi
echo "$CERT_PASS" | openssl pkey -in /cert/server.key -out /etc/nginx/cert/server.key -passin stdin
chmod 600 /etc/nginx/cert/server.key
else
echo "ERROR: /cert/server.key is not encrypted. Please encrypt it before deployment."
exit 1
fi
chown nginx:nginx /etc/nginx/cert/server.key
fi
set_proxy_protocol
cp /opt/frontend/nginx.conf /etc/nginx/nginx.conf
if [ -f "/etc/nginx/cert/server.pem" ]; then
cp /opt/frontend/https_backend.conf /etc/nginx/conf.d/default.conf
cp /opt/frontend/routes.inc /etc/nginx/conf.d/routes.inc
echo "Switching to HTTPS config"
else
cp /opt/frontend/http_backend.conf /etc/nginx/conf.d/default.conf
cp /opt/frontend/routes.inc /etc/nginx/conf.d/routes.inc
if [ -n "$DOMAIN" ]; then
cron
certbot --nginx "-d ${DOMAIN//,/ -d }"
echo "Switching to HTTPS config, Domain: $DOMAIN"
echo "0 0 1 * * root /usr/local/bin/certbot renew --quiet" | tee /etc/cron.d/certbot-renew
chmod 0644 /etc/cron.d/certbot-renew
else
echo "Switching to HTTP config"
fi
fi
exec nginx -g "daemon off;"
#!/bin/bash
function set_proxy_protocol() {
if [ "${REAL_IP_MODE}" != "proxy_protocol" ]; then
echo "REAL_IP_MODE is ${REAL_IP_MODE}, no need to update nginx configuration file."
return 0
fi
sed -i 's/listen 3000;/listen 3000 proxy_protocol;/' /opt/frontend/http_backend.conf
sed -i 's/listen 3000 ssl;/listen 3000 ssl proxy_protocol;/' /opt/frontend/https_backend.conf
sed -i '/access_log.*main/a\ set_real_ip_from 0.0.0.0/0;' /opt/frontend/nginx.conf
sed -i '/access_log.*main/a\ real_ip_header proxy_protocol;' /opt/frontend/nginx.conf
echo "Nginx configuration file updated."
}
mkdir -p /var/log/deepdata/frontend
touch /var/log/deepdata/frontend/access.log /var/log/deepdata/frontend/error.log
chown -R nginx:nginx /var/log/deepdata/frontend 2>/dev/null || true
/usr/local/bin/rotate-nginx-logs.sh &
if [ -f "/cert/server.pem" ]; then
cp /cert/server.pem /etc/nginx/cert/server.pem
chown nginx:nginx /etc/nginx/cert/server.pem
fi
if [ -f "/cert/server.key" ]; then
# Private key MUST be encrypted. Plaintext keys are not accepted.
if grep -q "ENCRYPTED" /cert/server.key 2>/dev/null; then
if [ -z "$CERT_PASS" ]; then
echo "ERROR: CERT_PASS is required to decrypt the private key"
exit 1
fi
echo "$CERT_PASS" | openssl pkey -in /cert/server.key -out /etc/nginx/cert/server.key -passin stdin
chmod 600 /etc/nginx/cert/server.key
else
echo "ERROR: /cert/server.key is not encrypted. Please encrypt it before deployment."
exit 1
fi
chown nginx:nginx /etc/nginx/cert/server.key
fi
set_proxy_protocol
cp /opt/frontend/nginx.conf /etc/nginx/nginx.conf
if [ -f "/etc/nginx/cert/server.pem" ]; then
cp /opt/frontend/https_backend.conf /etc/nginx/conf.d/default.conf
cp /opt/frontend/routes.inc /etc/nginx/conf.d/routes.inc
echo "Switching to HTTPS config"
else
cp /opt/frontend/http_backend.conf /etc/nginx/conf.d/default.conf
cp /opt/frontend/routes.inc /etc/nginx/conf.d/routes.inc
if [ -n "$DOMAIN" ]; then
cron
certbot --nginx "-d ${DOMAIN//,/ -d }"
echo "Switching to HTTPS config, Domain: $DOMAIN"
echo "0 0 1 * * root /usr/local/bin/certbot renew --quiet" | tee /etc/cron.d/certbot-renew
chmod 0644 /etc/cron.d/certbot-renew
else
echo "Switching to HTTP config"
fi
fi
exec nginx -g "daemon off;"