303 lines
9.9 KiB
Bash
Executable File
303 lines
9.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo_root="$(cd "${script_dir}/.." && pwd)"
|
|
|
|
env_file=""
|
|
mode=""
|
|
|
|
usage() {
|
|
cat <<USAGE
|
|
Usage: ./scripts/sync-public-env-urls.sh --env-file <file> --mode ssl|nossl
|
|
|
|
Recomputes env-backed public URLs from the current domain and HTTPS port settings:
|
|
- NEXTCLOUD_PUBLIC_URL
|
|
- OIDC_ISSUER
|
|
- OIDC_REDIRECT_URI_ALLOWLIST
|
|
- COLLABORA_PUBLIC_URL
|
|
- TALK_SIGNALING_PUBLIC_URL
|
|
- TALK_TURN_SERVER
|
|
- TALK_STUN_SERVER
|
|
|
|
When BROKER_CORS_ALLOWED_ORIGINS is empty or still matches the previous single
|
|
Nextcloud public URL, it is updated as well.
|
|
USAGE
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--env-file)
|
|
env_file="${2:-}"
|
|
shift 2
|
|
;;
|
|
--env-file=*)
|
|
env_file="${1#*=}"
|
|
shift
|
|
;;
|
|
--mode)
|
|
mode="${2:-}"
|
|
shift 2
|
|
;;
|
|
--mode=*)
|
|
mode="${1#*=}"
|
|
shift
|
|
;;
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Unknown option: $1"
|
|
usage
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "${env_file}" || -z "${mode}" ]]; then
|
|
usage
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "${env_file}" != /* ]]; then
|
|
env_file="${repo_root}/${env_file}"
|
|
fi
|
|
|
|
if [[ ! -f "${env_file}" ]]; then
|
|
echo "Missing env file: ${env_file}"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "${mode}" != "ssl" && "${mode}" != "nossl" ]]; then
|
|
echo "Invalid mode: ${mode}"
|
|
exit 1
|
|
fi
|
|
|
|
read_kv() {
|
|
local key="$1"
|
|
local line
|
|
line="$(grep -m1 -E "^${key}=" "${env_file}" || true)"
|
|
if [[ -z "${line}" ]]; then
|
|
return 1
|
|
fi
|
|
echo "${line#*=}"
|
|
}
|
|
|
|
set_kv() {
|
|
local key="$1"
|
|
local value="$2"
|
|
local tmp
|
|
tmp="$(mktemp)"
|
|
if grep -q -E "^${key}=" "${env_file}"; then
|
|
sed -E "s|^${key}=.*$|${key}=${value}|" "${env_file}" > "${tmp}"
|
|
else
|
|
cat "${env_file}" > "${tmp}"
|
|
printf '\n%s=%s\n' "${key}" "${value}" >> "${tmp}"
|
|
fi
|
|
mv "${tmp}" "${env_file}"
|
|
}
|
|
|
|
compute_public_url() {
|
|
local domain="$1"
|
|
local https_port="$2"
|
|
if [[ -z "${domain}" ]]; then
|
|
echo ""
|
|
return 0
|
|
fi
|
|
if [[ "${https_port}" == "443" ]]; then
|
|
echo "https://${domain}"
|
|
else
|
|
echo "https://${domain}:${https_port}"
|
|
fi
|
|
}
|
|
|
|
trim() {
|
|
local value="$1"
|
|
value="$(echo "${value}" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
|
|
echo "${value}"
|
|
}
|
|
|
|
derive_host_candidates() {
|
|
local host_fqdn host_short
|
|
host_fqdn="$(hostname -f 2>/dev/null || true)"
|
|
host_short="$(hostname -s 2>/dev/null || true)"
|
|
printf '%s\n' \
|
|
"${host_fqdn}" \
|
|
"${host_short}" \
|
|
"${host_fqdn}.local" \
|
|
"${host_short}.local" \
|
|
"localhost" \
|
|
"127.0.0.1" | sed '/^$/d'
|
|
}
|
|
|
|
sync_talk_stun_server() {
|
|
local talk_domain="$1"
|
|
local turn_port="$2"
|
|
local current_stun_server="$3"
|
|
local legacy_domain="${4:-}"
|
|
local desired_stun_server current_host current_host_no_port candidate
|
|
|
|
if [[ -z "${talk_domain}" || -z "${turn_port}" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
desired_stun_server="${talk_domain}:${turn_port}"
|
|
current_stun_server="$(trim "${current_stun_server}")"
|
|
current_stun_server="${current_stun_server%/}"
|
|
|
|
if [[ -z "${current_stun_server}" || "${current_stun_server}" == "stun.nextcloud.com:443" ]]; then
|
|
set_kv "TALK_STUN_SERVER" "${desired_stun_server}"
|
|
return 0
|
|
fi
|
|
|
|
current_host="${current_stun_server%%:*}"
|
|
current_host_no_port="${current_stun_server%:*}"
|
|
if [[ "${current_host}" == "${talk_domain}" || "${current_host_no_port}" == "${talk_domain}" || -n "${legacy_domain}" && ( "${current_host}" == "${legacy_domain}" || "${current_host_no_port}" == "${legacy_domain}" ) ]]; then
|
|
set_kv "TALK_STUN_SERVER" "${desired_stun_server}"
|
|
return 0
|
|
fi
|
|
|
|
while IFS= read -r candidate; do
|
|
if [[ -z "${candidate}" ]]; then
|
|
continue
|
|
fi
|
|
if [[ "${current_host}" == "${candidate}" || "${current_host_no_port}" == "${candidate}" ]]; then
|
|
set_kv "TALK_STUN_SERVER" "${desired_stun_server}"
|
|
return 0
|
|
fi
|
|
done < <(derive_host_candidates)
|
|
}
|
|
|
|
sync_talk_turn_server() {
|
|
local talk_domain="$1"
|
|
local turn_port="$2"
|
|
local current_turn_server="$3"
|
|
local legacy_domain="${4:-}"
|
|
local desired_turn_server current_host current_host_no_port candidate
|
|
|
|
if [[ -z "${talk_domain}" || -z "${turn_port}" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
desired_turn_server="${talk_domain}:${turn_port}"
|
|
current_turn_server="$(trim "${current_turn_server}")"
|
|
current_turn_server="${current_turn_server%/}"
|
|
|
|
if [[ -z "${current_turn_server}" ]]; then
|
|
set_kv "TALK_TURN_SERVER" "${desired_turn_server}"
|
|
return 0
|
|
fi
|
|
|
|
current_host="${current_turn_server%%:*}"
|
|
current_host_no_port="${current_turn_server%:*}"
|
|
if [[ "${current_host}" == "${talk_domain}" || "${current_host_no_port}" == "${talk_domain}" || -n "${legacy_domain}" && ( "${current_host}" == "${legacy_domain}" || "${current_host_no_port}" == "${legacy_domain}" ) ]]; then
|
|
set_kv "TALK_TURN_SERVER" "${desired_turn_server}"
|
|
return 0
|
|
fi
|
|
|
|
while IFS= read -r candidate; do
|
|
if [[ -z "${candidate}" ]]; then
|
|
continue
|
|
fi
|
|
if [[ "${current_host}" == "${candidate}" || "${current_host_no_port}" == "${candidate}" ]]; then
|
|
set_kv "TALK_TURN_SERVER" "${desired_turn_server}"
|
|
return 0
|
|
fi
|
|
done < <(derive_host_candidates)
|
|
}
|
|
|
|
nextcloud_domain="$(read_kv "NEXTCLOUD_DOMAIN" || true)"
|
|
broker_domain="$(read_kv "BROKER_DOMAIN" || true)"
|
|
collabora_domain="$(read_kv "COLLABORA_DOMAIN" || true)"
|
|
signaling_domain="$(read_kv "SIGNALING_DOMAIN" || true)"
|
|
if [[ -z "${signaling_domain}" ]]; then
|
|
signaling_domain="$(read_kv "TALK_DOMAIN" || true)"
|
|
fi
|
|
talk_turn_host="$(read_kv "TALK_TURN_HOST" || true)"
|
|
if [[ -z "${talk_turn_host}" || "${talk_turn_host}" == "${signaling_domain}" ]]; then
|
|
talk_turn_host="${nextcloud_domain}"
|
|
if [[ -n "${talk_turn_host}" ]]; then
|
|
set_kv "TALK_TURN_HOST" "${talk_turn_host}"
|
|
fi
|
|
fi
|
|
talk_janus_stun_server="$(read_kv "TALK_JANUS_STUN_SERVER" || true)"
|
|
if [[ -z "${talk_janus_stun_server}" || "${talk_janus_stun_server}" == "stun.nextcloud.com" || "${talk_janus_stun_server}" == "${signaling_domain}" || "${talk_janus_stun_server}" == "${talk_turn_host}" || "${talk_janus_stun_server}" == "${nextcloud_domain}" ]]; then
|
|
set_kv "TALK_JANUS_STUN_SERVER" "${talk_turn_host}"
|
|
fi
|
|
|
|
current_nextcloud_public_url="$(read_kv "NEXTCLOUD_PUBLIC_URL" || true)"
|
|
current_broker_cors_allowed_origins="$(read_kv "BROKER_CORS_ALLOWED_ORIGINS" || true)"
|
|
current_talk_signaling_port="$(read_kv "TALK_SIGNALING_PORT" || true)"
|
|
current_talk_signaling_container_port="$(read_kv "TALK_SIGNALING_CONTAINER_PORT" || true)"
|
|
current_talk_signaling_upstream_host="$(read_kv "TALK_SIGNALING_UPSTREAM_HOST" || true)"
|
|
current_talk_signaling_upstream_port="$(read_kv "TALK_SIGNALING_UPSTREAM_PORT" || true)"
|
|
current_talk_signaling_port="${current_talk_signaling_port:-8081}"
|
|
talk_turn_port="$(read_kv "TALK_TURN_PORT" || true)"
|
|
current_talk_stun_server="$(read_kv "TALK_STUN_SERVER" || true)"
|
|
current_talk_turn_server="$(read_kv "TALK_TURN_SERVER" || true)"
|
|
current_janus_stun_port="$(read_kv "TALK_JANUS_STUN_PORT" || true)"
|
|
if [[ -z "${current_janus_stun_port}" || "${current_janus_stun_port}" == "3478" || "${current_janus_stun_port}" == "${talk_turn_port}" ]]; then
|
|
set_kv "TALK_JANUS_STUN_PORT" "${talk_turn_port:-3478}"
|
|
fi
|
|
|
|
https_port="$(read_kv "PUBLIC_HTTPS_PORT" || true)"
|
|
if [[ "${mode}" == "ssl" ]]; then
|
|
https_port="$(read_kv "CADDY_HTTPS_PORT" || true)"
|
|
fi
|
|
https_port="${https_port:-443}"
|
|
|
|
nextcloud_public_url="$(compute_public_url "${nextcloud_domain}" "${https_port}")"
|
|
broker_public_url="$(compute_public_url "${broker_domain}" "${https_port}")"
|
|
collabora_public_url="$(compute_public_url "${collabora_domain}" "${https_port}")"
|
|
signaling_public_url="$(compute_public_url "${signaling_domain}" "${https_port}")"
|
|
|
|
if [[ -n "${nextcloud_public_url}" ]]; then
|
|
set_kv "NEXTCLOUD_PUBLIC_URL" "${nextcloud_public_url}"
|
|
set_kv "OIDC_REDIRECT_URI_ALLOWLIST" "${nextcloud_public_url}/apps/user_oidc/code"
|
|
fi
|
|
if [[ -n "${broker_public_url}" ]]; then
|
|
set_kv "OIDC_ISSUER" "${broker_public_url}"
|
|
fi
|
|
if [[ -n "${collabora_public_url}" ]]; then
|
|
set_kv "COLLABORA_PUBLIC_URL" "${collabora_public_url}"
|
|
fi
|
|
if [[ -n "${signaling_public_url}" ]]; then
|
|
set_kv "TALK_SIGNALING_PUBLIC_URL" "${signaling_public_url}"
|
|
fi
|
|
if [[ -z "${current_talk_signaling_upstream_host}" || "${current_talk_signaling_upstream_host}" == "talk_hpb" ]]; then
|
|
set_kv "TALK_SIGNALING_UPSTREAM_HOST" "host.docker.internal"
|
|
fi
|
|
if [[ "${current_talk_signaling_container_port}" != "8081" ]]; then
|
|
set_kv "TALK_SIGNALING_CONTAINER_PORT" "8081"
|
|
fi
|
|
set_kv "TALK_SIGNALING_PORT" "${current_talk_signaling_port}"
|
|
set_kv "TALK_SIGNALING_UPSTREAM_PORT" "${current_talk_signaling_port}"
|
|
|
|
if [[ -n "${nextcloud_public_url}" ]]; then
|
|
if [[ -z "${current_broker_cors_allowed_origins}" || "${current_broker_cors_allowed_origins}" == "${current_nextcloud_public_url}" ]]; then
|
|
set_kv "BROKER_CORS_ALLOWED_ORIGINS" "${nextcloud_public_url}"
|
|
fi
|
|
fi
|
|
|
|
sync_talk_turn_server "${talk_turn_host}" "${talk_turn_port:-3478}" "${current_talk_turn_server}" "${signaling_domain}"
|
|
sync_talk_stun_server "${talk_turn_host}" "${talk_turn_port:-3478}" "${current_talk_stun_server}" "${signaling_domain}"
|
|
|
|
echo "Synchronized public URLs in ${env_file} for mode=${mode}"
|
|
echo " NEXTCLOUD_PUBLIC_URL=${nextcloud_public_url:-<unchanged>}"
|
|
echo " OIDC_ISSUER=${broker_public_url:-<unchanged>}"
|
|
if [[ -n "${collabora_public_url}" ]]; then
|
|
echo " COLLABORA_PUBLIC_URL=${collabora_public_url}"
|
|
fi
|
|
if [[ -n "${signaling_public_url}" ]]; then
|
|
echo " TALK_SIGNALING_PUBLIC_URL=${signaling_public_url}"
|
|
fi
|
|
echo " TALK_TURN_HOST=$(read_kv "TALK_TURN_HOST" || true)"
|
|
echo " TALK_JANUS_STUN_SERVER=$(read_kv "TALK_JANUS_STUN_SERVER" || true)"
|
|
echo " TALK_JANUS_STUN_PORT=$(read_kv "TALK_JANUS_STUN_PORT" || true)"
|
|
echo " TALK_SIGNALING_PORT=$(read_kv "TALK_SIGNALING_PORT" || true)"
|
|
echo " TALK_SIGNALING_CONTAINER_PORT=$(read_kv "TALK_SIGNALING_CONTAINER_PORT" || true)"
|
|
echo " TALK_SIGNALING_UPSTREAM_PORT=$(read_kv "TALK_SIGNALING_UPSTREAM_PORT" || true)"
|
|
echo " TALK_TURN_SERVER=$(read_kv "TALK_TURN_SERVER" || true)"
|
|
echo " TALK_STUN_SERVER=$(read_kv "TALK_STUN_SERVER" || true)"
|