docker/entrypoint.sh
entrypoint.shhistorycomment on this file
| 1 | #!/bin/bash |
| 2 | # Bootstraps the single-node hosted root (`roots.single-node-hosted`) on |
| 3 | # first boot, then serves it two ways behind one nginx: stock git's |
| 4 | # smart-HTTP transport on the *.git paths, and the hosted web UI |
| 5 | # (`git ents serve --hosted`) on everything else. |
| 6 | # |
| 7 | # bash, not sh: `wait -n` below is the whole process supervisor — first |
| 8 | # long-running process to exit takes the machine down nonzero, and Fly |
| 9 | # restarts it. Crude but honest for a single-node root; runit is the |
| 10 | # upgrade path if either process starts crash-looping. |
| 11 | set -eu |
| 12 | |
| 13 | repo=/data/git-ents/git-ents.git |
| 14 | key=/data/hosted_signing_key |
| 15 | public_host="PUBLIC_HOST" |
| 16 | |
| 17 | if [ ! -d "$repo" ]; then |
| 18 | git init --quiet --bare "$repo" |
| 19 | fi |
| 20 | git -C "$repo" config http.receivepack true |
| 21 | git -C "$repo" config http.uploadpack true |
| 22 | |
| 23 | # Idempotent: reuses $key if it already exists (persisted on the /data |
| 24 | # volume across deploys), and always reinstalls hooks pointing at this |
| 25 | # binary's own current path. |
| 26 | git-ents setup --hosted --key "$key" "$repo" |
| 27 | |
| 28 | mkdir -p /run |
| 29 | spawn-fcgi -s /run/fcgiwrap.sock -M 766 -- /usr/sbin/fcgiwrap |
| 30 | |
| 31 | # The web UI refuses to boot until $key's public half is enrolled as a |
| 32 | # member (`roots.web-signing`). Retry rather than die: an unenrolled key |
| 33 | # on a fresh volume must not take nginx — and with it the git transport |
| 34 | # and the ssh path an operator needs to *do* the enrolling — down in a |
| 35 | # crash loop. The web surface stays fail-closed (nothing listens on 4880 |
| 36 | # until enrollment succeeds); the enroll command prints every attempt. |
| 37 | # |
| 38 | # Fresh-volume runbook: enrollment is deliberately NOT automated here. |
| 39 | # Auto-enrolling would spend the self-admitting first push |
| 40 | # (`gate.bootstrap`) on the server's own key, making the machine the |
| 41 | # trust root instead of the operator. From a local clone, one command — |
| 42 | # it enrolls the operator (signed by `user.signingkey`), then vouches |
| 43 | # for the server key, discovered from nginx's /.ents/server-key (its |
| 44 | # private half never leaves this volume): |
| 45 | # git ents bootstrap <you> |
| 46 | # The retry below then admits the web UI within one 15s cycle. |
| 47 | ( |
| 48 | until git-ents serve --hosted --key "$key" --public-host "$public_host" \ |
| 49 | --port 4880 "$repo"; do |
| 50 | echo "web UI not started; retrying in 15s" >&2 |
| 51 | sleep 15 |
| 52 | done |
| 53 | ) & |
| 54 | nginx -c /etc/git-ents/nginx.conf -g "daemon off;" & |
| 55 | |
| 56 | wait -n |
| 57 | code=$? |
| 58 | kill 0 2>/dev/null || true |
| 59 | exit "$code" |