forked from lei.chen/myxce
Rongsong Shen
ee8473bd99
deploy-ha.sh no longer takes a <data-dir> argument or --build-config
flag. Every deploy now generates a fresh self-signed TLS cert/key
(openssl, RSA 2048, 10y validity) directly into the deploy dir's
certs/, and builds cluster.bin directly into controller/ctrl-1/conf/
via xceadmin -- no intermediate staging directory, nothing preserved
across runs. run-ha-soak.sh (/xce-test-ha) updated to match: dropped
its own XCE_HA_DATADIR-based precondition entirely. Updated 4 callers
(run-ha-soak.sh, test-heartbeat-tolerance.sh, test-commit-durability.sh,
both xce-deploy-ha/xce-test-ha SKILL.md docs).
Separately: xcecommon.wire.connect() was loading a client-side TLS
cert, diverging from the real reference client -- netio.c's
create_ssl_context() presents no certificate at all when acting as a
client (cert_file/key_file both NULL, bare TLS_client_method()).
Fixed connect() to match, and since nothing else consumed cert_dir
(verify_mode=CERT_NONE throughout, no CA check either), removed it
end-to-end: discovery.follow_redirects(), push.push_config()/
probe_config(), and the --cert-dir CLI flag.
Server-side cert loading (mock TLS test servers) is unaffected --
moved into a shared session-scoped tls_certs fixture (new
tests/conftest.py, openssl-generated) replacing 3 duplicated
REPO_HA_DATA_DIR/skipif blocks. Net result: those tests no longer skip
under a hermetic nix build sandbox (which never had ha/data/) --
verified 165/165 passed, 0 skipped, via both meson compile and a full
nix build --option sandbox false .#xcecore_debug rebuild (previously
128 passed / 37 skipped there).
ha/data/{xce.crt,xce.key} removed from git tracking. Requirements
2.3/2.4 and 8.3/8.4/8.5 marked superseded in requirements.md with
dated correction notes.
119 lines
3.9 KiB
Bash
Executable file
119 lines
3.9 KiB
Bash
Executable file
#!/bin/bash
|
|
set -e
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
|
|
BINARY=$1
|
|
TOP=$2
|
|
PEERS=$3
|
|
|
|
if [ -z "$BINARY" ] || [ -z "$TOP" ] || [ -z "$PEERS" ]; then
|
|
echo "Usage: $0 <binary> <top-dir> <peers>"
|
|
echo " peers: comma-separated host:port list (e.g. host1:port1,host2:port2)"
|
|
echo " TLS cert/key and cluster.bin are generated fresh into <top-dir> every"
|
|
echo " run (openssl self-signed cert; cluster.bin via xceadmin from"
|
|
echo " src/configs/*.yaml) -- no pre-existing data directory needed."
|
|
exit 1
|
|
fi
|
|
|
|
BINARY=$(realpath "$BINARY")
|
|
|
|
# xceadmin is meson-built now (src/xceadmin/meson.build), not a plain
|
|
# `pip install -e .` venv checked out under src/xceadmin/ -- its build
|
|
# output lives under whichever meson build dir xce-build.sh's profile
|
|
# picked, or under a nix-installed prefix's bin/. Try each in turn.
|
|
XCEADMIN=""
|
|
for candidate in \
|
|
"$SCRIPT_DIR/../xce.build/xceadmin/.venv/bin/xceadmin" \
|
|
"$SCRIPT_DIR/../build.release/xceadmin/.venv/bin/xceadmin" \
|
|
"$SCRIPT_DIR/../build.dbg/xceadmin/.venv/bin/xceadmin" \
|
|
"$SCRIPT_DIR/../result/bin/xceadmin" \
|
|
"$(command -v xceadmin 2>/dev/null || true)"
|
|
do
|
|
if [ -n "$candidate" ] && [ -x "$candidate" ]; then
|
|
XCEADMIN="$candidate"
|
|
break
|
|
fi
|
|
done
|
|
if [ -z "$XCEADMIN" ]; then
|
|
echo "Error: xceadmin binary not found -- run 'xce-build.sh xceadmin' or 'nix build .#xcecore' first"
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v openssl >/dev/null 2>&1; then
|
|
echo "Error: openssl not found -- run under 'nix develop' (provides openssl on PATH)"
|
|
exit 1
|
|
fi
|
|
|
|
IFS=',' read -ra PEER_ARRAY <<< "$PEERS"
|
|
N=${#PEER_ARRAY[@]}
|
|
|
|
# Create directory structure
|
|
mkdir -p "$TOP/certs"
|
|
mkdir -p "$TOP/logs"
|
|
mkdir -p "$TOP/scripts"
|
|
for i in $(seq 1 $N); do
|
|
mkdir -p "$TOP/controller/ctrl-$i/conf"
|
|
mkdir -p "$TOP/controller/ctrl-$i/data"
|
|
done
|
|
|
|
# Self-signed dev/test TLS cert+key, generated fresh directly into the
|
|
# deployment dir every run -- nothing checked into git, nothing shared
|
|
# across deploys. Long-lived (10y) since it's regenerated per deploy
|
|
# anyway; TLS verification is SSL_VERIFY_NONE everywhere in this codebase
|
|
# (no hostname/identity check), so a fresh self-signed pair per run loses
|
|
# no real security property versus a long-lived shared one.
|
|
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
|
-keyout "$TOP/certs/xce.key" -out "$TOP/certs/xce.crt" \
|
|
-subj "/CN=xce-dev-test" 2>/dev/null
|
|
|
|
# Build cluster.bin from src/configs/*.yaml via xceadmin, straight into
|
|
# this deploy's own ctrl-1/conf/ (no intermediate data-dir copy).
|
|
CLUSTER_BIN_TMP="$TOP/.cluster.bin.tmp"
|
|
"$XCEADMIN" config build "$SCRIPT_DIR/../configs" -o "$CLUSTER_BIN_TMP"
|
|
TAG=$(sha256sum "$CLUSTER_BIN_TMP" | cut -c1-12)
|
|
mv "$CLUSTER_BIN_TMP" "$TOP/controller/ctrl-1/conf/cluster.bin.$TAG"
|
|
echo "cluster.bin.$TAG" > "$TOP/controller/ctrl-1/conf/current"
|
|
|
|
# Build peers string: ctrl-1=host1:port1,ctrl-2=host2:port2,...
|
|
PEERS_STR=""
|
|
for i in "${!PEER_ARRAY[@]}"; do
|
|
n=$((i+1))
|
|
[ -n "$PEERS_STR" ] && PEERS_STR+=","
|
|
PEERS_STR+="ctrl-$n=${PEER_ARRAY[$i]}"
|
|
done
|
|
|
|
# Generate start script
|
|
cat > "$TOP/scripts/start.sh" << EOF
|
|
#!/bin/bash
|
|
set -e
|
|
NAME=\$1
|
|
if [ -z "\$NAME" ]; then
|
|
echo "Usage: \$0 <ctrl-name>"
|
|
exit 1
|
|
fi
|
|
shift
|
|
CTRL_DIR=$TOP/controller/\$NAME
|
|
if [ ! -d "\$CTRL_DIR/conf" ] || [ ! -d "\$CTRL_DIR/data" ]; then
|
|
echo "Error: \$CTRL_DIR/conf or \$CTRL_DIR/data does not exist"
|
|
exit 1
|
|
fi
|
|
$BINARY --myname \$NAME --peers "$PEERS_STR" --workdir $TOP/controller --certdir $TOP/certs --logfile $TOP/logs/\$NAME.log --vcpus 4 \$*
|
|
EOF
|
|
chmod +x "$TOP/scripts/start.sh"
|
|
|
|
# Generate cleanup script
|
|
cat > "$TOP/scripts/cleanup.sh" << EOF
|
|
#!/bin/bash
|
|
set -e
|
|
rm -f $TOP/logs/*.log
|
|
for i in \$(seq 1 $N); do
|
|
rm -rf $TOP/controller/ctrl-\$i/data/*
|
|
done
|
|
for i in \$(seq 2 $N); do
|
|
rm -rf $TOP/controller/ctrl-\$i/conf/*
|
|
done
|
|
EOF
|
|
chmod +x "$TOP/scripts/cleanup.sh"
|
|
|
|
echo "Deployed $N-node cluster to $TOP (tag: $TAG)"
|