mirror of
https://github.com/R0m1k3/Loki.git
synced 2026-10-18 12:46:56 +02:00
Façade Rust loki-rs : proxy devant le Go et mise à jour au démarrage
Premier lot de la migration vers Rust. Le binaire loki-rs : - serve : prend le port public (8090), lance `loki web 8091` en écoute locale et lui relaie tout — HTTP, flux SSE trame par trame, WebSocket. Les en-têtes de bout en bout passent intacts (Host, Authorization, Origin, Sec-Fetch-*, X-Forwarded-Proto : le Go en tire ses contrôles d'accès) ; X-Loki-Via entrant est effacé, un client ne doit jamais pouvoir se faire passer pour le tunnel. Go mort : relancé avec attente croissante, 502 lisible entre-temps. - self-update : lit la release « rolling », installe loki et loki-rs dans $LOKI_HOME/bin/<build>/ après vérification SHA-256, bascule par réécriture atomique de release.json. Les versions s'ordonnent par numéro de run CI ; une ABI d'image différente n'est jamais installée. Toute erreur laisse l'état précédent, le démarrage n'est jamais bloqué. Le HTTPS passe par curl (présent dans l'image) : pas de pile TLS ici. - which-bin : dossier d'où l'entrypoint prend les deux binaires, toujours ensemble. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
MichaelandClaude Opus 5.5 committed
1 parent
342f787eff
commit
0a6914c936
14 files changed
+2138
No files matched your search
@@ -0,0 +1,258 @@
|
||||
//! Mise à jour des binaires Loki au démarrage du conteneur.
|
||||
//!
|
||||
//! La CI publie à chaque push sur `main` une release GitHub `rolling` :
|
||||
//! `loki-linux`, `loki-rs-linux`, `SHA256SUMS` puis `manifest.json` (en
|
||||
//! dernier). Au boot, [`run`] compare le manifeste au build en service et, si
|
||||
//! besoin, installe les deux binaires dans `<LOKI_HOME>/bin/<build>/` (voir
|
||||
//! [`state`]). Rien ici ne doit bloquer le démarrage : toute erreur se solde
|
||||
//! par [`Outcome::Failed`] et l'ancien état reste en place.
|
||||
//!
|
||||
//! Le transfert HTTPS passe par `curl` (présent dans l'image) : le binaire
|
||||
//! n'embarque ainsi aucune pile TLS.
|
||||
|
||||
pub mod state;
|
||||
pub mod sums;
|
||||
|
||||
use sha2::{Digest, Sha256};
|
||||
use std::fs;
|
||||
use std::io::Read;
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::process::Command;
|
||||
use std::time::Duration;
|
||||
|
||||
use state::{Decision, Manifest};
|
||||
|
||||
pub const DEFAULT_URL: &str = "https://github.com/R0m1k3/Loki/releases/download/rolling";
|
||||
pub const IMAGE_ABI_FILE: &str = "/etc/loki/IMAGE_ABI";
|
||||
|
||||
/// Nom de l'asset publié → nom du binaire installé.
|
||||
pub const ASSETS: [(&str, &str); 2] = [
|
||||
("loki-linux", state::GO_BIN),
|
||||
("loki-rs-linux", state::RS_BIN),
|
||||
];
|
||||
|
||||
const TMP_DIR: &str = ".tmp-download";
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct UpdateConfig {
|
||||
pub enabled: bool,
|
||||
pub base_url: String,
|
||||
pub data_bin: PathBuf,
|
||||
pub image_build: u64,
|
||||
pub image_abi: u32,
|
||||
/// Durée maximale du téléchargement du manifeste et des sommes.
|
||||
pub small_timeout: Duration,
|
||||
/// Durée maximale de chaque binaire (un transfert figé est coupé bien
|
||||
/// avant, cf. `--speed-limit`).
|
||||
pub big_timeout: Duration,
|
||||
}
|
||||
|
||||
impl UpdateConfig {
|
||||
pub fn from_env() -> Self {
|
||||
let env = |k: &str| std::env::var(k).ok().filter(|v| !v.trim().is_empty());
|
||||
let home = env("LOKI_HOME").unwrap_or_else(|| "/data".into());
|
||||
let image_abi = fs::read_to_string(IMAGE_ABI_FILE)
|
||||
.ok()
|
||||
.or_else(|| env("LOKI_IMAGE_ABI"))
|
||||
.and_then(|s| s.trim().parse().ok())
|
||||
.unwrap_or(0);
|
||||
UpdateConfig {
|
||||
enabled: !matches!(
|
||||
env("LOKI_AUTO_UPDATE").as_deref().map(str::trim),
|
||||
Some("0" | "false" | "off" | "no")
|
||||
),
|
||||
base_url: env("LOKI_UPDATE_URL").unwrap_or_else(|| DEFAULT_URL.into()),
|
||||
data_bin: Path::new(&home).join("bin"),
|
||||
image_build: env("LOKI_BUILD")
|
||||
.and_then(|s| s.trim().parse().ok())
|
||||
.unwrap_or(0),
|
||||
image_abi,
|
||||
small_timeout: Duration::from_secs(20),
|
||||
big_timeout: Duration::from_secs(600),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
pub enum Outcome {
|
||||
Disabled,
|
||||
UpToDate(u64),
|
||||
/// Version publiée incompatible avec l'image : il faut tirer l'image.
|
||||
AbiMismatch {
|
||||
remote_abi: u32,
|
||||
image_abi: u32,
|
||||
},
|
||||
Installed(u64),
|
||||
Failed(String),
|
||||
}
|
||||
|
||||
impl Outcome {
|
||||
/// Ligne de journal pour l'entrypoint.
|
||||
pub fn message(&self) -> String {
|
||||
match self {
|
||||
Outcome::Disabled => "mise à jour au démarrage désactivée (LOKI_AUTO_UPDATE=0)".into(),
|
||||
Outcome::UpToDate(b) => format!("binaires à jour (build {b})"),
|
||||
Outcome::AbiMismatch {
|
||||
remote_abi,
|
||||
image_abi,
|
||||
} => format!(
|
||||
"nouvelle version disponible mais elle exige une nouvelle image \
|
||||
(ABI {remote_abi}, image {image_abi}) : docker compose pull"
|
||||
),
|
||||
Outcome::Installed(b) => format!("build {b} installé — actif dès ce démarrage"),
|
||||
Outcome::Failed(e) => {
|
||||
format!("mise à jour impossible ({e}) — binaires actuels conservés")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn run(cfg: &UpdateConfig) -> Outcome {
|
||||
if !cfg.enabled {
|
||||
return Outcome::Disabled;
|
||||
}
|
||||
if let Err(e) = fs::create_dir_all(&cfg.data_bin) {
|
||||
return Outcome::Failed(format!("{}: {e}", cfg.data_bin.display()));
|
||||
}
|
||||
let tmp = cfg.data_bin.join(TMP_DIR);
|
||||
let _ = fs::remove_dir_all(&tmp);
|
||||
let res = fs::create_dir_all(&tmp)
|
||||
.map_err(|e| format!("{}: {e}", tmp.display()))
|
||||
.and_then(|_| run_in(cfg, &tmp));
|
||||
let _ = fs::remove_dir_all(&tmp);
|
||||
res.unwrap_or_else(Outcome::Failed)
|
||||
}
|
||||
|
||||
fn run_in(cfg: &UpdateConfig, tmp: &Path) -> Result<Outcome, String> {
|
||||
let current = state::current(&cfg.data_bin, cfg.image_build, cfg.image_abi)
|
||||
.map(|(m, _)| m.build)
|
||||
.unwrap_or(cfg.image_build);
|
||||
|
||||
let man_path = tmp.join("manifest.json");
|
||||
fetch(&cfg.base_url, "manifest.json", &man_path, cfg.small_timeout)?;
|
||||
let remote = state::read_manifest(&man_path).ok_or("manifest.json illisible")?;
|
||||
|
||||
match state::decide(&remote, current, cfg.image_abi) {
|
||||
Decision::AbiMismatch => {
|
||||
return Ok(Outcome::AbiMismatch {
|
||||
remote_abi: remote.abi,
|
||||
image_abi: cfg.image_abi,
|
||||
});
|
||||
}
|
||||
Decision::UpToDate => {
|
||||
prune(&cfg.data_bin, current);
|
||||
return Ok(Outcome::UpToDate(current));
|
||||
}
|
||||
Decision::Install => {}
|
||||
}
|
||||
|
||||
let sums_path = tmp.join("SHA256SUMS");
|
||||
fetch(&cfg.base_url, "SHA256SUMS", &sums_path, cfg.small_timeout)?;
|
||||
let sums_text = fs::read_to_string(&sums_path).map_err(|e| format!("SHA256SUMS: {e}"))?;
|
||||
let sums = sums::parse(&sums_text);
|
||||
|
||||
let stage = tmp.join("stage");
|
||||
fs::create_dir_all(&stage).map_err(|e| e.to_string())?;
|
||||
for (asset, local) in ASSETS {
|
||||
let want = sums
|
||||
.get(asset)
|
||||
.ok_or(format!("SHA256SUMS sans entrée pour {asset}"))?;
|
||||
let dst = stage.join(local);
|
||||
fetch(&cfg.base_url, asset, &dst, cfg.big_timeout)?;
|
||||
let got = sha256_file(&dst).map_err(|e| format!("{asset}: {e}"))?;
|
||||
if &got != want {
|
||||
return Err(format!("empreinte de {asset} invalide"));
|
||||
}
|
||||
make_executable(&dst).map_err(|e| format!("{asset}: {e}"))?;
|
||||
}
|
||||
write_manifest(&stage.join(state::RELEASE_FILE), &remote)?;
|
||||
|
||||
let dest = cfg.data_bin.join(remote.build.to_string());
|
||||
let _ = fs::remove_dir_all(&dest);
|
||||
fs::rename(&stage, &dest).map_err(|e| format!("{}: {e}", dest.display()))?;
|
||||
|
||||
// Bascule : release.json réécrit en dernier, par renommage atomique.
|
||||
let pointer = cfg.data_bin.join(state::RELEASE_FILE);
|
||||
let pointer_tmp = cfg.data_bin.join("release.json.tmp");
|
||||
write_manifest(&pointer_tmp, &remote)?;
|
||||
fs::rename(&pointer_tmp, &pointer).map_err(|e| format!("{}: {e}", pointer.display()))?;
|
||||
|
||||
prune(&cfg.data_bin, remote.build);
|
||||
Ok(Outcome::Installed(remote.build))
|
||||
}
|
||||
|
||||
/// Télécharge `<base>/<name>` dans `dst` via curl. `--speed-limit` coupe un
|
||||
/// transfert figé (moins de 10 Ko/s pendant 20 s) bien avant `timeout`.
|
||||
fn fetch(base: &str, name: &str, dst: &Path, timeout: Duration) -> Result<(), String> {
|
||||
let url = format!("{}/{}", base.trim_end_matches('/'), name);
|
||||
let out = Command::new("curl")
|
||||
.args([
|
||||
"-fsSL",
|
||||
"--connect-timeout",
|
||||
"10",
|
||||
"--speed-limit",
|
||||
"10240",
|
||||
"--speed-time",
|
||||
"20",
|
||||
])
|
||||
.arg("--max-time")
|
||||
.arg(timeout.as_secs().max(1).to_string())
|
||||
.arg("-o")
|
||||
.arg(dst)
|
||||
.arg(&url)
|
||||
.output()
|
||||
.map_err(|e| format!("curl introuvable : {e}"))?;
|
||||
if !out.status.success() {
|
||||
let err = String::from_utf8_lossy(&out.stderr);
|
||||
return Err(format!("{name} : {}", err.trim()));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn sha256_file(path: &Path) -> std::io::Result<String> {
|
||||
let mut f = fs::File::open(path)?;
|
||||
let mut h = Sha256::new();
|
||||
let mut buf = [0u8; 64 * 1024];
|
||||
loop {
|
||||
let n = f.read(&mut buf)?;
|
||||
if n == 0 {
|
||||
break;
|
||||
}
|
||||
h.update(&buf[..n]);
|
||||
}
|
||||
Ok(hex::encode(h.finalize()))
|
||||
}
|
||||
|
||||
fn write_manifest(path: &Path, m: &Manifest) -> Result<(), String> {
|
||||
let text = serde_json::to_string(m).map_err(|e| e.to_string())?;
|
||||
fs::write(path, text).map_err(|e| format!("{}: {e}", path.display()))
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
fn make_executable(path: &Path) -> std::io::Result<()> {
|
||||
use std::os::unix::fs::PermissionsExt;
|
||||
fs::set_permissions(path, fs::Permissions::from_mode(0o755))
|
||||
}
|
||||
|
||||
#[cfg(not(unix))]
|
||||
fn make_executable(_: &Path) -> std::io::Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Supprime les builds autres que `keep` (un seul build est gardé : celui en
|
||||
/// service). Ne touche qu'aux dossiers au nom purement numérique.
|
||||
fn prune(data_bin: &Path, keep: u64) {
|
||||
let Ok(rd) = fs::read_dir(data_bin) else {
|
||||
return;
|
||||
};
|
||||
for e in rd.flatten() {
|
||||
let name = e.file_name();
|
||||
let Some(name) = name.to_str() else { continue };
|
||||
if let Ok(n) = name.parse::<u64>()
|
||||
&& n != keep
|
||||
&& e.path().is_dir()
|
||||
{
|
||||
let _ = fs::remove_dir_all(e.path());
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,151 @@
|
||||
//! État d'installation des binaires mis à jour, sous `<LOKI_HOME>/bin` :
|
||||
//!
|
||||
//! ```text
|
||||
//! bin/release.json manifeste du build actif (écrit en DERNIER)
|
||||
//! bin/<build>/loki binaire Go
|
||||
//! bin/<build>/loki-rs binaire Rust
|
||||
//! ```
|
||||
//!
|
||||
//! La bascule d'une version à l'autre se résume à réécrire `release.json` :
|
||||
//! un arrêt brutal pendant une mise à jour laisse l'ancien build intact.
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
pub const RELEASE_FILE: &str = "release.json";
|
||||
pub const GO_BIN: &str = "loki";
|
||||
pub const RS_BIN: &str = "loki-rs";
|
||||
|
||||
/// Contenu de `manifest.json` (release) et de `release.json` (installé).
|
||||
///
|
||||
/// `build` est le numéro de run de la CI : il ne fait que croître, c'est lui
|
||||
/// qui ordonne les versions (un commit ne s'ordonne pas). `abi` est l'ABI
|
||||
/// d'image exigée par ces binaires.
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
|
||||
pub struct Manifest {
|
||||
pub build: u64,
|
||||
pub abi: u32,
|
||||
#[serde(default)]
|
||||
pub commit: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum Decision {
|
||||
Install,
|
||||
UpToDate,
|
||||
AbiMismatch,
|
||||
}
|
||||
|
||||
pub fn read_manifest(path: &Path) -> Option<Manifest> {
|
||||
let text = std::fs::read_to_string(path).ok()?;
|
||||
serde_json::from_str(&text).ok()
|
||||
}
|
||||
|
||||
/// Build installé dans `data_bin` et utilisable avec cette image : même ABI,
|
||||
/// plus récent que les binaires de l'image, et les deux binaires présents.
|
||||
pub fn current(data_bin: &Path, image_build: u64, image_abi: u32) -> Option<(Manifest, PathBuf)> {
|
||||
let m = read_manifest(&data_bin.join(RELEASE_FILE))?;
|
||||
if m.abi != image_abi || m.build <= image_build {
|
||||
return None;
|
||||
}
|
||||
let dir = data_bin.join(m.build.to_string());
|
||||
if !dir.join(GO_BIN).is_file() || !dir.join(RS_BIN).is_file() {
|
||||
return None;
|
||||
}
|
||||
Some((m, dir))
|
||||
}
|
||||
|
||||
/// Dossier dont l'entrypoint doit prendre `loki` et `loki-rs` : toujours les
|
||||
/// deux du même endroit, jamais un Go d'une version avec un Rust d'une autre.
|
||||
pub fn select_dir(data_bin: &Path, image_dir: &Path, image_build: u64, image_abi: u32) -> PathBuf {
|
||||
match current(data_bin, image_build, image_abi) {
|
||||
Some((_, dir)) => dir,
|
||||
None => image_dir.to_path_buf(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Faut-il installer `remote`, sachant que le build en service est `current_build` ?
|
||||
pub fn decide(remote: &Manifest, current_build: u64, image_abi: u32) -> Decision {
|
||||
if remote.abi != image_abi {
|
||||
Decision::AbiMismatch
|
||||
} else if remote.build <= current_build {
|
||||
Decision::UpToDate
|
||||
} else {
|
||||
Decision::Install
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn m(build: u64, abi: u32) -> Manifest {
|
||||
Manifest {
|
||||
build,
|
||||
abi,
|
||||
commit: "abc".into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn install(data_bin: &Path, man: &Manifest, bins: &[&str]) {
|
||||
let dir = data_bin.join(man.build.to_string());
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
for b in bins {
|
||||
std::fs::write(dir.join(b), b"x").unwrap();
|
||||
}
|
||||
std::fs::write(
|
||||
data_bin.join(RELEASE_FILE),
|
||||
serde_json::to_string(man).unwrap(),
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn decision() {
|
||||
assert_eq!(decide(&m(10, 2), 5, 1), Decision::AbiMismatch);
|
||||
assert_eq!(decide(&m(5, 1), 5, 1), Decision::UpToDate);
|
||||
assert_eq!(decide(&m(4, 1), 5, 1), Decision::UpToDate);
|
||||
assert_eq!(decide(&m(6, 1), 5, 1), Decision::Install);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn selection_sans_installation() {
|
||||
let t = tempfile::tempdir().unwrap();
|
||||
let img = Path::new("/usr/local/bin");
|
||||
assert_eq!(select_dir(t.path(), img, 3, 1), img);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn selection_installation_valide() {
|
||||
let t = tempfile::tempdir().unwrap();
|
||||
install(t.path(), &m(7, 1), &[GO_BIN, RS_BIN]);
|
||||
let img = Path::new("/usr/local/bin");
|
||||
assert_eq!(select_dir(t.path(), img, 3, 1), t.path().join("7"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn selection_refuse_abi_differente() {
|
||||
let t = tempfile::tempdir().unwrap();
|
||||
install(t.path(), &m(7, 2), &[GO_BIN, RS_BIN]);
|
||||
let img = Path::new("/img");
|
||||
assert_eq!(select_dir(t.path(), img, 3, 1), img);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn selection_refuse_plus_ancien_que_l_image() {
|
||||
// Image tirée à la main plus récente que /data/bin : l'image gagne.
|
||||
let t = tempfile::tempdir().unwrap();
|
||||
install(t.path(), &m(7, 1), &[GO_BIN, RS_BIN]);
|
||||
let img = Path::new("/img");
|
||||
assert_eq!(select_dir(t.path(), img, 7, 1), img);
|
||||
assert_eq!(select_dir(t.path(), img, 9, 1), img);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn selection_refuse_binaire_manquant() {
|
||||
let t = tempfile::tempdir().unwrap();
|
||||
install(t.path(), &m(7, 1), &[GO_BIN]);
|
||||
let img = Path::new("/img");
|
||||
assert_eq!(select_dir(t.path(), img, 3, 1), img);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
//! Lecture du fichier SHA256SUMS publié avec chaque release (format
|
||||
//! `sha256sum` : "<hex> <nom>", ou "<hex> *<nom>" en mode binaire).
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
/// Associe chaque nom de fichier à son empreinte SHA-256 en hexadécimal
|
||||
/// minuscule. Les lignes vides ou mal formées sont ignorées : une entrée
|
||||
/// manquante fera échouer la vérification du fichier concerné, pas la lecture.
|
||||
pub fn parse(text: &str) -> HashMap<String, String> {
|
||||
let mut out = HashMap::new();
|
||||
for line in text.lines() {
|
||||
let mut it = line.split_whitespace();
|
||||
let (Some(hash), Some(name), None) = (it.next(), it.next(), it.next()) else {
|
||||
continue;
|
||||
};
|
||||
if hash.len() != 64 || !hash.bytes().all(|b| b.is_ascii_hexdigit()) {
|
||||
continue;
|
||||
}
|
||||
out.insert(
|
||||
name.trim_start_matches('*').to_string(),
|
||||
hash.to_ascii_lowercase(),
|
||||
);
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const A: &str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
|
||||
|
||||
#[test]
|
||||
fn lit_les_deux_formats() {
|
||||
let up = A.to_ascii_uppercase();
|
||||
let text = format!("{A} loki-linux\n{up} *loki-rs-linux\n");
|
||||
let m = parse(&text);
|
||||
assert_eq!(m.get("loki-linux").map(String::as_str), Some(A));
|
||||
assert_eq!(m.get("loki-rs-linux").map(String::as_str), Some(A));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ignore_les_lignes_cassees() {
|
||||
let text = format!("\nzz loki-linux\n{A}\n{A} a b\n{A} ok\n");
|
||||
let m = parse(&text);
|
||||
assert_eq!(m.len(), 1);
|
||||
assert!(m.contains_key("ok"));
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user