mrlee/Havline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(updater): generate shared token without init container

Browse Source
This commit is contained in:
mrlee
2026-10-05 19:11:05 +08:00
parent 9aaefa3b77
commit a7d71752e3
12 changed files with 351 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/app/app.go
+9 -1
View File
@@ -68,6 +68,14 @@ func New(cfg config.Config, staticFS fs.FS, migrationsDir string) (*App, error)
}
logger.Info("会话密钥已就绪", "module", "SYSTEM", "source", secretSource)
updaterToken, updaterTokenSource, err := updater.EnsureToken(cfg.UpdaterToken, cfg.UpdaterTokenFile)
if err != nil {
return nil, err
}
if updaterToken != "" {
logger.Info("updater Token 已就绪", "module", "SYSTEM", "source", updaterTokenSource)
}
conn, err := db.Open(cfg.DBPath())
if err != nil {
return nil, err
@@ -122,7 +130,7 @@ func New(cfg config.Config, staticFS fs.FS, migrationsDir string) (*App, error)
proxySvc.SetExitSync(cloudflareSvc)
startedAt := time.Now().UTC().Format(time.RFC3339)
trafficCollector := traffic.NewCollector(conn, filepath.Join(cfg.LogsDir(), "access.log"), notifySvc)
updaterClient := updater.NewClient(cfg.UpdaterSocket)
updaterClient := updater.NewClient(cfg.UpdaterSocket, updaterToken)
handler := api.NewRouter(api.Deps{
Config: cfg,
internal/config/config.go
+17 -1
View File
@@ -22,6 +22,8 @@ type Config struct {
FrpcBin string
FrpPIDFile string
UpdaterSocket string
UpdaterToken string
UpdaterTokenFile string
}
func Load() Config {
@@ -40,7 +42,9 @@ func Load() Config {
NginxDefaultHTTPSPort: envIntOr("HAVLINE_NGINX_HTTPS_PORT", 443),
FrpcBin: envOr("HAVLINE_FRPC_BIN", "frpc"),
FrpPIDFile: envOr("HAVLINE_FRP_PID", dataDir+"/frp/frpc.pid"),
UpdaterSocket: envOr("HAVLINE_UPDATER_SOCKET", "/run/havline-updater/updater.sock"),
UpdaterSocket: updaterSocket(),
UpdaterToken: envOr("HAVLINE_UPDATER_TOKEN", ""),
UpdaterTokenFile: envOr("HAVLINE_UPDATER_TOKEN_FILE", defaultUpdaterTokenFile()),
}
}
@@ -232,3 +236,15 @@ func envIntOr(key string, fallback int) int {
}
return n
}
// 原生应用显式传空值以禁用 Docker 升级；未配置时保留容器默认值。
func updaterSocket() string {
if value, ok := os.LookupEnv("HAVLINE_UPDATER_SOCKET"); ok {
return value
}
return "/run/havline-updater/updater.sock"
}
func defaultUpdaterTokenFile() string {
return "/run/havline-updater/updater.token"
}
internal/config/config_test.go
+9
View File
@@ -33,3 +33,12 @@ func TestLoadNginxDefaultPortsFallback(t *testing.T) {
t.Fatalf("ports %d %d", cfg.NginxDefaultHTTPPort, cfg.NginxDefaultHTTPSPort)
}
}
func TestLoadUpdaterTokenFile(t *testing.T) {
t.Setenv("HAVLINE_UPDATER_TOKEN_FILE", "/tmp/havline-updater.token")
cfg := Load()
if cfg.UpdaterTokenFile != "/tmp/havline-updater.token" {
t.Fatalf("updater token file %q", cfg.UpdaterTokenFile)
}
}
internal/updater/client.go
+8 -1
View File
@@ -14,12 +14,15 @@ import (
)
// Client 通过共享 Unix Socket 调用 havline-updater sidecar。
const tokenHeader = "X-Havline-Updater-Token"
type Client struct {
socketPath string
token string
http *http.Client
}
func NewClient(socketPath string) *Client {
func NewClient(socketPath, token string) *Client {
socketPath = strings.TrimSpace(socketPath)
transport := &http.Transport{
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
@@ -29,6 +32,7 @@ func NewClient(socketPath string) *Client {
}
return &Client{
socketPath: socketPath,
token: strings.TrimSpace(token),
http: &http.Client{Transport: transport, Timeout: 15 * time.Second},
}
}
@@ -76,6 +80,9 @@ func (c *Client) request(ctx context.Context, method, path string, payload any,
if payload != nil {
req.Header.Set("Content-Type", "application/json")
}
if c.token != "" {
req.Header.Set(tokenHeader, c.token)
}
resp, err := c.http.Do(req)
if err != nil {
return err
internal/updater/server.go
+14 -1
View File
@@ -2,6 +2,7 @@ package updater
import (
"context"
"crypto/subtle"
"encoding/json"
"errors"
"fmt"
@@ -34,6 +35,7 @@ type Config struct {
ProjectName string
SelfImage string
DockerSocket string
Token string
BuildTimeout time.Duration
HealthTimeout time.Duration
}
@@ -87,6 +89,10 @@ func NewServer(cfg Config, logger *slog.Logger) (*Server, error) {
cfg.HostProjectDir = strings.TrimSpace(cfg.HostProjectDir)
cfg.ProjectName = strings.TrimSpace(cfg.ProjectName)
cfg.SelfImage = strings.TrimSpace(cfg.SelfImage)
cfg.Token = strings.TrimSpace(cfg.Token)
if cfg.Token == "" {
return nil, fmt.Errorf("HAVLINE_UPDATER_TOKEN 未设置，拒绝启动未鉴权的升级服务")
}
if cfg.BuildTimeout <= 0 {
cfg.BuildTimeout = 30 * time.Minute
}
@@ -126,7 +132,14 @@ func (s *Server) Handler() http.Handler {
mux := http.NewServeMux()
mux.HandleFunc("GET /status", s.handleStatus)
mux.HandleFunc("POST /apply", s.handleApply)
return mux
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
provided := strings.TrimSpace(r.Header.Get(tokenHeader))
if len(provided) != len(s.cfg.Token) || subtle.ConstantTimeCompare([]byte(provided), []byte(s.cfg.Token)) != 1 {
writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "updater 鉴权失败"})
return
}
mux.ServeHTTP(w, r)
})
}
// Serve 在共享 Unix Socket 上提供服务。
internal/updater/server_test.go
+40 -3
View File
@@ -2,6 +2,8 @@ package updater
import (
"context"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"testing"
@@ -29,6 +31,7 @@ func TestNewServerDefaultsAndValidation(t *testing.T) {
server, err := NewServer(Config{
ProjectDir: t.TempDir(),
ComposeFile: "docker-compose.yml",
Token: "test-token",
}, nil)
if err != nil {
t.Fatal(err)
@@ -36,17 +39,17 @@ func TestNewServerDefaultsAndValidation(t *testing.T) {
if !server.state.Enabled || server.cfg.Mode != "local" {
t.Fatalf("默认状态不正确: %#v", server.state)
}
if _, err := NewServer(Config{ProjectDir: t.TempDir(), Mode: "invalid"}, nil); err == nil {
if _, err := NewServer(Config{ProjectDir: t.TempDir(), Mode: "invalid", Token: "test-token"}, nil); err == nil {
t.Fatal("非法 mode 应被拒绝")
}
if _, err := NewServer(Config{ProjectDir: t.TempDir(), Mode: "git"}, nil); err == nil {
if _, err := NewServer(Config{ProjectDir: t.TempDir(), Mode: "git", Token: "test-token"}, nil); err == nil {
t.Fatal("git 模式缺少 RepoURL 应被拒绝")
}
}
func TestEnsureComposeFile(t *testing.T) {
dir := t.TempDir()
server, err := NewServer(Config{ProjectDir: dir, ComposeFile: "docker-compose.yml", ProjectName: "havline"}, nil)
server, err := NewServer(Config{ProjectDir: dir, ComposeFile: "docker-compose.yml", ProjectName: "havline", Token: "test-token"}, nil)
if err != nil {
t.Fatal(err)
}
@@ -70,6 +73,7 @@ func TestResolveComposePlanUsesHostProjectDir(t *testing.T) {
ComposeFile: "docker-compose.hub.yml",
HostProjectDir: hostDir,
ProjectName: "havline",
Token: "test-token",
}, nil)
if err != nil {
t.Fatal(err)
@@ -86,6 +90,39 @@ func TestResolveComposePlanUsesHostProjectDir(t *testing.T) {
}
}
func TestNewServerRequiresToken(t *testing.T) {
if _, err := NewServer(Config{ProjectDir: t.TempDir()}, nil); err == nil {
t.Fatal("缺少 Token 时应拒绝启动")
}
}
func TestHandlerRequiresToken(t *testing.T) {
server, err := NewServer(Config{ProjectDir: t.TempDir(), Token: "test-token"}, nil)
if err != nil {
t.Fatal(err)
}
for _, token := range []string{"", "wrong-token"} {
req := httptest.NewRequest(http.MethodGet, "http://unix/status", nil)
if token != "" {
req.Header.Set(tokenHeader, token)
}
res := httptest.NewRecorder()
server.Handler().ServeHTTP(res, req)
if res.Code != http.StatusUnauthorized {
t.Fatalf("Token %q 应返回 401，实际为 %d", token, res.Code)
}
}
req := httptest.NewRequest(http.MethodGet, "http://unix/status", nil)
req.Header.Set(tokenHeader, "test-token")
res := httptest.NewRecorder()
server.Handler().ServeHTTP(res, req)
if res.Code != http.StatusOK {
t.Fatalf("正确 Token 应返回 200，实际为 %d", res.Code)
}
}
func TestIsContainerPath(t *testing.T) {
cases := []struct {
path string
internal/updater/token.go
+112
View File
@@ -0,0 +1,112 @@
package updater
import (
"crypto/rand"
"encoding/hex"
"errors"
"fmt"
"os"
"path/filepath"
"strings"
"time"
)
// DefaultTokenPath 是主服务与 updater sidecar 共享 Token 的默认位置。
const DefaultTokenPath = "/run/havline-updater/updater.token"
const tokenWaitInterval = 200 * time.Millisecond
// ResolveToken 解析 updater Token：显式环境变量优先，其次读取共享文件。
// 文件不存在时返回空 Token，不视为错误，便于不含 updater 的部署直接启动。
func ResolveToken(token, tokenFile string) (string, string, error) {
if value := strings.TrimSpace(token); value != "" {
return value, "环境变量", nil
}
path := strings.TrimSpace(tokenFile)
if path == "" {
return "", "", nil
}
data, err := os.ReadFile(path)
if err != nil {
if errors.Is(err, os.ErrNotExist) {
return "", "", nil
}
return "", "", fmt.Errorf("读取 updater Token 文件失败: %w", err)
}
value := strings.TrimSpace(string(data))
if value == "" {
return "", "", fmt.Errorf("updater Token 文件为空: %s", path)
}
return value, path, nil
}
// EnsureToken 确保共享 Token 文件存在。环境变量优先；未配置时由主程序生成
// 并原子写入共享卷，updater 随后读取同一文件。
func EnsureToken(token, tokenFile string) (string, string, error) {
if value := strings.TrimSpace(token); value != "" {
return value, "环境变量", nil
}
path := strings.TrimSpace(tokenFile)
if path == "" {
return "", "", nil
}
if data, err := os.ReadFile(path); err == nil {
if value := strings.TrimSpace(string(data)); value != "" {
return value, path, nil
}
} else if !errors.Is(err, os.ErrNotExist) {
return "", "", fmt.Errorf("读取 updater Token 文件失败: %w", err)
}
value, err := randomToken()
if err != nil {
return "", "", err
}
if err := writeTokenFile(path, value); err != nil {
return "", "", err
}
return value, path, nil
}
// WaitForToken 等待主程序在共享卷中创建 Token 文件；环境变量已设置时立即返回。
func WaitForToken(token, tokenFile string, timeout time.Duration) (string, string, error) {
if timeout <= 0 {
timeout = 60 * time.Second
}
deadline := time.Now().Add(timeout)
for {
value, source, err := ResolveToken(token, tokenFile)
if err != nil {
return "", "", err
}
if value != "" {
return value, source, nil
}
if time.Now().After(deadline) {
return "", "", fmt.Errorf("等待 updater Token 文件超时: %s", tokenFile)
}
time.Sleep(tokenWaitInterval)
}
}
func randomToken() (string, error) {
buf := make([]byte, 32)
if _, err := rand.Read(buf); err != nil {
return "", fmt.Errorf("生成 updater Token 失败: %w", err)
}
return hex.EncodeToString(buf), nil
}
func writeTokenFile(path, token string) error {
if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
return fmt.Errorf("创建 updater Token 目录失败: %w", err)
}
tmp := path + ".tmp"
if err := os.WriteFile(tmp, []byte(token+"\n"), 0o600); err != nil {
return fmt.Errorf("写入 updater Token 文件失败: %w", err)
}
if err := os.Rename(tmp, path); err != nil {
_ = os.Remove(tmp)
return fmt.Errorf("保存 updater Token 文件失败: %w", err)
}
return os.Chmod(path, 0o600)
}
internal/updater/token_test.go
+107
View File
@@ -0,0 +1,107 @@
package updater
import (
"os"
"path/filepath"
"testing"
"time"
)
func TestResolveTokenPrefersEnvironment(t *testing.T) {
dir := t.TempDir()
path := filepath.Join(dir, "updater.token")
if err := os.WriteFile(path, []byte("file-token\n"), 0o600); err != nil {
t.Fatal(err)
}
token, source, err := ResolveToken("env-token", path)
if err != nil {
t.Fatal(err)
}
if token != "env-token" || source != "环境变量" {
t.Fatalf("环境变量应优先，实际 token=%q source=%q", token, source)
}
}
func TestResolveTokenFromFile(t *testing.T) {
dir := t.TempDir()
path := filepath.Join(dir, "updater.token")
if err := os.WriteFile(path, []byte(" file-token \n"), 0o600); err != nil {
t.Fatal(err)
}
token, source, err := ResolveToken("", path)
if err != nil {
t.Fatal(err)
}
if token != "file-token" || source != path {
t.Fatalf("文件 Token 解析不正确，实际 token=%q source=%q", token, source)
}
}
func TestResolveTokenMissingFile(t *testing.T) {
token, source, err := ResolveToken("", filepath.Join(t.TempDir(), "missing.token"))
if err != nil {
t.Fatal(err)
}
if token != "" || source != "" {
t.Fatalf("文件不存在时应返回空 Token，实际 token=%q source=%q", token, source)
}
}
func TestResolveTokenEmptyFile(t *testing.T) {
path := filepath.Join(t.TempDir(), "updater.token")
if err := os.WriteFile(path, []byte("\n"), 0o600); err != nil {
t.Fatal(err)
}
if _, _, err := ResolveToken("", path); err == nil {
t.Fatal("空 Token 文件应返回错误")
}
}
func TestEnsureTokenCreatesAndReusesFile(t *testing.T) {
path := filepath.Join(t.TempDir(), "updater.token")
token, source, err := EnsureToken("", path)
if err != nil {
t.Fatal(err)
}
if len(token) != 64 || source != path {
t.Fatalf("生成的 Token 不正确，实际 token=%q source=%q", token, source)
}
data, err := os.ReadFile(path)
if err != nil {
t.Fatal(err)
}
if string(data) != token+"\n" {
t.Fatalf("Token 文件内容不正确: %q", string(data))
}
again, _, err := EnsureToken("", path)
if err != nil {
t.Fatal(err)
}
if again != token {
t.Fatalf("重复调用应复用文件 Token，实际 %q", again)
}
}
func TestWaitForTokenReadsExistingFile(t *testing.T) {
path := filepath.Join(t.TempDir(), "updater.token")
if err := os.WriteFile(path, []byte("file-token\n"), 0o600); err != nil {
t.Fatal(err)
}
token, _, err := WaitForToken("", path, time.Second)
if err != nil {
t.Fatal(err)
}
if token != "file-token" {
t.Fatalf("等待 Token 结果不正确: %q", token)
}
}
func TestWaitForTokenTimesOut(t *testing.T) {
path := filepath.Join(t.TempDir(), "missing.token")
if _, _, err := WaitForToken("", path, 50*time.Millisecond); err == nil {
t.Fatal("文件不存在时应等待超时")
}
}