up

2026-10-10 14:32:07 +07:00
parent 6a198f2e2c
commit 3efdb52c3c
12 changed files with 524 additions and 105 deletions
@@ -2,12 +2,43 @@
 set -euo pipefail

 cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+if [[ $# -ne 0 ]]; then
+    echo 'Используйте make venue' >&2
+    exit 1
+fi
+compose=(docker compose -f docker-compose.yml -f docker-compose.https.yml)
+
+command -v openssl >/dev/null
+certificate=certificates/fullchain.pem
+key=certificates/privkey.pem
+if [[ ! -s "$certificate" || ! -s "$key" ]]; then
+    echo 'HTTPS: нужны venue/certificates/fullchain.pem и privkey.pem.' >&2
+    exit 1
+fi
+if ! openssl x509 -in "$certificate" -checkend 0 -noout >/dev/null 2>&1; then
+    echo 'HTTPS: сертификат повреждён или истёк.' >&2
+    exit 1
+fi
+if ! certificate_public=$(openssl x509 -in "$certificate" -pubkey -noout 2>/dev/null) ||
+   ! key_public=$(openssl pkey -in "$key" -pubout -passin pass: 2>/dev/null) ||
+   [[ "$certificate_public" != "$key_public" ]]; then
+    echo 'HTTPS: ключ повреждён, зашифрован или не соответствует сертификату.' >&2
+    exit 1
+fi
+for domain in evening-detective.crabs-games.art evening-detective-api.crabs-games.art; do
+    if ! openssl verify -purpose sslserver -verify_hostname "$domain" \
+        -untrusted "$certificate" "$certificate" >/dev/null 2>&1; then
+        echo "HTTPS: сертификат не доверен, недействителен или не покрывает $domain." >&2
+        exit 1
+    fi
+done
+
 if [[ ! -f .env ]]; then
    command -v openssl >/dev/null
    (
        umask 077
        cat > .env <<EOF
-APP_BASE_URL=http://localhost:8088
+APP_BASE_URL=https://evening-detective.crabs-games.art
 VENUE_BIND_IP=127.0.0.1
 VENUE_PORT=8088
 POSTGRES_USER=evening_detective
@@ -26,36 +57,32 @@ EOF
    )
 fi

-prepare=false
-case "${1:-}" in
-    --build) prepare=true ;;
-    '') ;;
-    *) echo 'Используйте make venue или make venue-update' >&2; exit 1 ;;
-esac
-for image in evening-detective-venue-app:1 postgres:15 rustfs/rustfs:latest byjg/static-httpserver:latest nginx:alpine; do
-    if ! docker image inspect "$image" >/dev/null 2>&1; then prepare=true; fi
-done
 for artifact in backend/evening_detective_server backend/goose backend/dev-user.sql frontend/dist/index.html; do
-    if [[ ! -f "$artifact" ]]; then prepare=true; fi
+    if [[ ! -f "$artifact" ]]; then
+        echo "Нет venue/$artifact. Сначала выполните make prod-build." >&2
+        exit 1
+    fi
 done
-if [[ ! -d migrations ]]; then prepare=true; fi
-if [[ "$prepare" == true ]]; then
-    echo 'Подготовка площадки: потребуется интернет.'
-    if ! docker image inspect my-go-builder >/dev/null 2>&1; then
-        make -C ../evening_detective_server build-builder
-    fi
-    if [[ ! -d ../evening_detective_frontend/node_modules ]]; then
-        npm --prefix ../evening_detective_frontend ci
-    fi
-    make -C .. build
-    docker compose pull postgres_evening_detective_server rustfs_evening_detective_server evening_detective_frontend proxy
-    docker pull alpine:3.22
-    docker compose build --pull=false
+if [[ ! -d migrations ]] || ! compgen -G 'migrations/*.sql' >/dev/null; then
+    echo 'Нет миграций venue. Сначала выполните make prod-build.' >&2
+    exit 1
 fi
+
+for service_image in postgres_evening_detective_server=postgres:15 rustfs_evening_detective_server=rustfs/rustfs:latest evening_detective_frontend=byjg/static-httpserver:latest proxy=nginx:alpine; do
+    if ! docker image inspect "${service_image#*=}" >/dev/null 2>&1; then
+        "${compose[@]}" pull "${service_image%%=*}"
+    fi
+done
+if ! docker image inspect alpine:3.22 >/dev/null 2>&1; then
+    docker pull alpine:3.22
+fi
+"${compose[@]}" build --pull=false
 for volume in evening-detective-local_postgres_data evening-detective-local_rustfs_data; do
    docker volume create "$volume" >/dev/null
 done
-docker compose up -d --no-build --pull never
-docker compose --profile setup run --rm bootstrap
-docker compose ps
-echo 'Площадка запущена. Адрес и данные входа находятся в venue/.env.'
+"${compose[@]}" up -d --force-recreate --no-build --pull never
+"${compose[@]}" --profile setup run --rm bootstrap
+"${compose[@]}" exec -T proxy nginx -t
+"${compose[@]}" exec -T proxy nginx -s reload
+echo 'Площадка: https://evening-detective.crabs-games.art; данные входа — venue/.env.'
+"${compose[@]}" ps
@@ -0,0 +1,13 @@
+services:
+  evening_detective_server:
+    environment:
+      APP_BASE_URL: https://evening-detective.crabs-games.art
+      FILE_PREFIX_DOMAIN: https://evening-detective.crabs-games.art/api/files/
+
+  proxy:
+    volumes:
+      - ./nginx.https.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./certificates:/etc/nginx/certificates:ro
+    ports:
+      - '${VENUE_BIND_IP:-127.0.0.1}:80:80'
+      - '${VENUE_BIND_IP:-127.0.0.1}:443:443'
@@ -0,0 +1,43 @@
+ssl_certificate /etc/nginx/certificates/fullchain.pem;
+ssl_certificate_key /etc/nginx/certificates/privkey.pem;
+ssl_protocols TLSv1.2 TLSv1.3;
+
+client_max_body_size 257m;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_read_timeout 120s;
+
+server {
+    listen 80;
+    server_name evening-detective.crabs-games.art;
+    return 308 https://evening-detective.crabs-games.art$request_uri;
+}
+
+server {
+    listen 80;
+    server_name evening-detective-api.crabs-games.art;
+    return 308 https://evening-detective-api.crabs-games.art$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name evening-detective.crabs-games.art;
+
+    location /api/ {
+        proxy_pass http://evening_detective_server:8090;
+    }
+
+    location / {
+        proxy_pass http://evening_detective_frontend:8080;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name evening-detective-api.crabs-games.art;
+
+    location / {
+        proxy_pass http://evening_detective_server:8090;
+    }
+}