57 lines
2.6 KiB
Bash
57 lines
2.6 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
umask 077
|
|
# shellcheck source=infra/local/sendico/network.sh
|
|
. /etc/sendico/network.sh
|
|
mkdir -p /private /run/sendico
|
|
chmod 755 /run/sendico
|
|
cd /private
|
|
bridge=''; monitor=''; delay=''
|
|
cleanup() {
|
|
for child in "$bridge" "$monitor" "$delay"; do
|
|
if [ -n "$child" ]; then kill "$child" 2>/dev/null || true; fi
|
|
done
|
|
}
|
|
trap cleanup EXIT
|
|
trap 'exit 0' INT TERM
|
|
socat TCP4-LISTEN:18081,bind=127.0.0.1,reuseaddr,fork TCP4:host.docker.internal:8080 &
|
|
bridge=$!
|
|
session_pid=$$
|
|
(trap - EXIT INT TERM; watch_network "$session_pid") &
|
|
monitor=$!
|
|
|
|
session() {
|
|
jq -n --rawfile role /etc/agent/role-id --rawfile secret /etc/agent/secret-id \
|
|
'{role_id:($role|rtrimstr("\n")),secret_id:($secret|rtrimstr("\n"))}' > login.json
|
|
curl -fsS --max-time 15 -H 'Content-Type: application/json' --data-binary @login.json \
|
|
http://vault:8200/v1/auth/approle/login > vault.json 2>/dev/null || return 1
|
|
jq -er '"X-Vault-Token: "+.auth.client_token' vault.json > vault.header || return 1
|
|
curl -fsS --max-time 15 -H @vault.header http://vault:8200/v1/kv/data/services/bff/sendico > credentials.json 2>/dev/null || return 1
|
|
jq -e --arg client "$SENDICO_CLIENT_ID" --arg device "$SENDICO_DEVICE_ID" \
|
|
'.data.data | {login:{login,password},clientSecret:.client_secret,clientId:$client,deviceId:$device}' credentials.json > request.json || return 1
|
|
curl -fsS --max-time 15 -H @vault.header -X POST http://vault:8200/v1/auth/token/revoke-self >/dev/null 2>&1 || return 1
|
|
rm -f vault.header vault.json credentials.json login.json
|
|
curl -fsS --max-time 20 -H 'Content-Type: application/json' --data-binary @request.json \
|
|
http://127.0.0.1:18081/api/v1/accounts/login/api > response.json 2>/dev/null || return 1
|
|
rm -f request.json
|
|
jq -er '.data.accessToken.token' response.json > token 2>/dev/null || return 1
|
|
jq -e --arg source "$SENDICO_SOURCE_ACCOUNT_REF" \
|
|
'.data.accessToken.token | split(".")[1] | gsub("-";"+") | gsub("_";"/") | @base64d | fromjson | .id==$source and .pending!=true and .exp>(now+1500)' response.json >/dev/null 2>&1 || return 1
|
|
cp token /run/sendico/access-token.new
|
|
chmod 444 /run/sendico/access-token.new
|
|
mv /run/sendico/access-token.new /run/sendico/access-token
|
|
rm -f token response.json
|
|
touch ready
|
|
}
|
|
|
|
while :; do
|
|
if session; then
|
|
echo 'Local Sendico session ready; next renewal in 20 minutes.'
|
|
sleep 1200 & delay=$!; wait "$delay"
|
|
else
|
|
echo 'Local Sendico session unavailable; check stand health and integration credentials. Retrying in 5 minutes.' >&2
|
|
rm -f request.json response.json token vault.header vault.json credentials.json login.json
|
|
sleep 300 & delay=$!; wait "$delay"
|
|
fi
|
|
done
|