wangjia
bc77e85b7d
deploy-pangolin / deploy (push) Has been cancelled
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
41 lines
1.5 KiB
Bash
Executable File
41 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# root-setup.sh —— 一次性 root 前置(在 EC2 上以 root 执行一次)。
|
|
# sudo bash /opt/pangolin/setup/root-setup.sh
|
|
#
|
|
# 作用:
|
|
# 1. 创建部署目录 /opt/pangolin(归属部署用户,后续 CI/手动 rsync 写入)
|
|
# 2. 安装受限特权脚本到 /usr/local/sbin/pangolin-nginx-apply.sh(root:root 0755)
|
|
# 3. 安装 sudoers 片段,授权 ec2-user 仅 NOPASSWD 调用上述脚本
|
|
# 之后 CI(ec2-user)即可非交互地增量更新 nginx 路由,且无法获得通用 root。
|
|
set -euo pipefail
|
|
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "请以 root 运行:sudo bash $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SRC_DIR="$(cd "$(dirname "$0")/.." && pwd)" # -> 本脚本所在的 deploy/(可在 /tmp 暂存或 /opt/pangolin)
|
|
APPLY_SRC="${SRC_DIR}/nginx/pangolin-nginx-apply.sh"
|
|
APPLY_DST="/usr/local/sbin/pangolin-nginx-apply.sh"
|
|
SUDOERS="/etc/sudoers.d/pangolin"
|
|
DEPLOY_USER="${PANGOLIN_DEPLOY_USER:-ec2-user}"
|
|
DEPLOY_DIR="${PANGOLIN_DEPLOY_DIR:-/opt/pangolin}"
|
|
|
|
[[ -f "$APPLY_SRC" ]] || { echo "找不到 $APPLY_SRC" >&2; exit 1; }
|
|
|
|
# 1) 部署目录
|
|
mkdir -p "$DEPLOY_DIR"
|
|
chown "${DEPLOY_USER}:${DEPLOY_USER}" "$DEPLOY_DIR"
|
|
echo "[root-setup] 已准备部署目录 $DEPLOY_DIR(归属 ${DEPLOY_USER})"
|
|
|
|
install -o root -g root -m 0755 "$APPLY_SRC" "$APPLY_DST"
|
|
echo "[root-setup] 已安装 $APPLY_DST"
|
|
|
|
cat > "$SUDOERS" <<EOF
|
|
${DEPLOY_USER} ALL=(root) NOPASSWD: ${APPLY_DST}
|
|
EOF
|
|
chmod 0440 "$SUDOERS"
|
|
visudo -cf "$SUDOERS" >/dev/null && echo "[root-setup] 已安装并校验 $SUDOERS"
|
|
|
|
echo "[root-setup] 完成。现在 ${DEPLOY_USER} 可执行: sudo ${APPLY_DST}"
|