elixir/rel/env.sh.eex

Rama main · réplica de lectura del repositorio original.

#!/bin/sh

# Build ERL_OPTIONS based on environment
ERL_DIST_OPTIONS="-kernel inet_dist_listen_min ${ERLANG_DISTRIBUTION_PORT} inet_dist_listen_max ${ERLANG_DISTRIBUTION_PORT}"

# Optionally disable EPMD startup (for environments where EPMD runs on the host)
# Defaults to true (start EPMD) for backwards compatibility
if [ "${START_EPMD}" = "false" ]; then
  ERL_DIST_OPTIONS="${ERL_DIST_OPTIONS} -start_epmd false"
fi

# Run Erlang distribution over mutual TLS when a node certificate, its key and
# the CA that signs all node certificates are given. Without them, the release
# keeps plain TCP distribution, so the infrastructure decides when to switch.
# Every node in a cluster must use the same mode: TLS and TCP nodes cannot connect.
ERL_DIST_TLS_OPTIONS=""
if [ -n "${ERLANG_DISTRIBUTION_TLS_CERTFILE}${ERLANG_DISTRIBUTION_TLS_KEYFILE}${ERLANG_DISTRIBUTION_TLS_CACERTFILE}" ]; then
  if [ -z "${ERLANG_DISTRIBUTION_TLS_CERTFILE}" ] || [ -z "${ERLANG_DISTRIBUTION_TLS_KEYFILE}" ] || [ -z "${ERLANG_DISTRIBUTION_TLS_CACERTFILE}" ]; then
    echo "ERROR: Set all or none of ERLANG_DISTRIBUTION_TLS_CERTFILE, ERLANG_DISTRIBUTION_TLS_KEYFILE and ERLANG_DISTRIBUTION_TLS_CACERTFILE" >&2
    exit 1
  fi

  SSL_DIST_DIR="${RELEASE_TMP:-$RELEASE_ROOT/tmp}"
  SSL_DIST_OPTFILE="$SSL_DIST_DIR/ssl_dist.conf"
  mkdir -p "$SSL_DIST_DIR"
  SSL_DIST_TMP=$(mktemp "$SSL_DIST_OPTFILE.XXXXXX")

  # Peers are checked against the CA only. Node names use private IPs that
  # change on every deploy, so the client does not check the hostname.
  cat >"$SSL_DIST_TMP" <<EOF
[{server, [{certfile, "${ERLANG_DISTRIBUTION_TLS_CERTFILE}"},
           {keyfile, "${ERLANG_DISTRIBUTION_TLS_KEYFILE}"},
           {cacertfile, "${ERLANG_DISTRIBUTION_TLS_CACERTFILE}"},
           {verify, verify_peer},
           {fail_if_no_peer_cert, true},
           {versions, ['tlsv1.3']}]},
 {client, [{certfile, "${ERLANG_DISTRIBUTION_TLS_CERTFILE}"},
           {keyfile, "${ERLANG_DISTRIBUTION_TLS_KEYFILE}"},
           {cacertfile, "${ERLANG_DISTRIBUTION_TLS_CACERTFILE}"},
           {verify, verify_peer},
           {server_name_indication, disable},
           {versions, ['tlsv1.3']}]}].
EOF
  mv "$SSL_DIST_TMP" "$SSL_DIST_OPTFILE"

  ERL_DIST_TLS_OPTIONS="-proto_dist inet_tls -ssl_dist_optfile $SSL_DIST_OPTFILE"
fi

# Sets and enables heart (recommended only in daemon mode)
case $RELEASE_COMMAND in
  daemon*)
    HEART_COMMAND="$RELEASE_ROOT/bin/$RELEASE_NAME $RELEASE_COMMAND"
    export HEART_COMMAND
    export ELIXIR_ERL_OPTIONS="-heart ${ERL_DIST_OPTIONS} ${ERL_DIST_TLS_OPTIONS}"
    ;;

  start*)
    export ELIXIR_ERL_OPTIONS="${ERL_DIST_OPTIONS} ${ERL_DIST_TLS_OPTIONS}"
    ;;

  *)
    # rpc, remote, stop and friends must use the same distribution protocol
    if [ -n "${ERL_DIST_TLS_OPTIONS}" ]; then
      export ELIXIR_ERL_OPTIONS="${ERL_DIST_TLS_OPTIONS}"
    fi
    ;;
esac

# Set the release to work across nodes. If using the long name format like
# the one below (my_app@127.0.0.1), you need to also uncomment the
# RELEASE_DISTRIBUTION variable below. Must be "sname", "name" or "none".
export RELEASE_DISTRIBUTION=name

# Read current hostname from metadata server if available,
# this is to ensure that the hostname is correct in Google Cloud Compute.
#
# Having a valid DNS record is important to remotely connect to a running Erlang node.
if [ "${RELEASE_HOST_DISCOVERY_METHOD}" = "gce_metadata" ]; then
  RELEASE_HOSTNAME=$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google" -s)
elif [ "${RELEASE_HOST_DISCOVERY_METHOD}" = "aws_ecs_metadata" ]; then
  RELEASE_HOSTNAME=$(curl "${ECS_CONTAINER_METADATA_URI_V4}" | jq -r '.Networks[0].IPv4Addresses[0]')
else
  RELEASE_HOSTNAME=${RELEASE_HOSTNAME:-127.0.0.1}
fi

# RELEASE_NAME is guaranteed to be set by the start script and defaults to 'firezone'
# set RELEASE_NAME in the environment to a unique value when running multiple instances
# in the same network namespace (i.e. with host networking in Podman)
#
# Only set RELEASE_NODE if not already provided (allows Azure/external node naming)
if [ -z "${RELEASE_NODE}" ]; then
  export RELEASE_NODE=${RELEASE_NAME}@${RELEASE_HOSTNAME}
fi

# Choices here are 'interactive' and 'embedded'. 'interactive' boots faster which
# prevents some runit process management edge cases at the expense of the application
# not technically being ready to serve requests "right away". This is a useful tradeoff.
export RELEASE_MODE=interactive