scripts/new-docker-env.ps1
Rama main · réplica de lectura del repositorio original.
[CmdletBinding(SupportsShouldProcess)]
param(
[Parameter(Mandatory = $true)]
[ValidateNotNullOrEmpty()]
[string]$AdvertiseIP,
[Parameter()]
[string]$PublicBaseURL = "",
[Parameter()]
[string]$PublicWebBaseURL = "",
[Parameter()]
[string]$AdminBindIP = "127.0.0.1",
[Parameter()]
[switch]$HostNetwork,
[Parameter()]
[switch]$BridgeNetwork,
[Parameter()]
[switch]$AllowInsecureDevelopmentAuth
)
$ErrorActionPreference = "Stop"
if ($HostNetwork -and $BridgeNetwork) {
throw "HostNetwork and BridgeNetwork are mutually exclusive."
}
$parsedIP = $null
if (-not [System.Net.IPAddress]::TryParse($AdvertiseIP, [ref]$parsedIP)) {
throw "AdvertiseIP must be an IPv4 or IPv6 address, not a DNS name."
}
$isLoopback = [System.Net.IPAddress]::IsLoopback($parsedIP)
$isIPv6 = $parsedIP.AddressFamily -eq [System.Net.Sockets.AddressFamily]::InterNetworkV6
$parsedAdminBindIP = $null
if (-not [System.Net.IPAddress]::TryParse($AdminBindIP, [ref]$parsedAdminBindIP)) {
throw "AdminBindIP must be an IPv4 or IPv6 address."
}
if ([string]::IsNullOrWhiteSpace($PublicBaseURL)) {
if (-not $isLoopback) {
throw "PublicBaseURL is required when AdvertiseIP is not loopback."
}
$loopbackHost = if ($isIPv6) { "[::1]" } else { "127.0.0.1" }
$PublicBaseURL = "http://${loopbackHost}:2401"
}
if ([string]::IsNullOrWhiteSpace($PublicWebBaseURL)) {
$PublicWebBaseURL = $PublicBaseURL
}
function Assert-HTTPURL {
param([string]$Name, [string]$Value)
$uri = $null
if (-not [Uri]::TryCreate($Value, [UriKind]::Absolute, [ref]$uri) -or
($uri.Scheme -ne "http" -and $uri.Scheme -ne "https") -or
-not [string]::IsNullOrEmpty($uri.UserInfo)) {
throw "$Name must be an absolute HTTP(S) URL without embedded credentials."
}
}
Assert-HTTPURL -Name "PublicBaseURL" -Value $PublicBaseURL
Assert-HTTPURL -Name "PublicWebBaseURL" -Value $PublicWebBaseURL
if (-not $isLoopback -and -not $AllowInsecureDevelopmentAuth) {
throw "Internet/LAN development-code auth requires AllowInsecureDevelopmentAuth; for production generate on loopback, then configure the webhook provider before startup."
}
$repoRoot = Split-Path -Parent $PSScriptRoot
$dockerDir = Join-Path $repoRoot "deploy\docker"
$templatePath = Join-Path $dockerDir ".env.example"
$outputPath = Join-Path $dockerDir ".env"
if (-not (Test-Path -LiteralPath $templatePath -PathType Leaf)) {
throw "Docker environment template not found: $templatePath"
}
if (Test-Path -LiteralPath $outputPath) {
throw "$outputPath already exists. Initialization never overwrites live credentials."
}
function New-HexSecret {
param([int]$Bytes = 32)
$buffer = New-Object byte[] $Bytes
$generator = [System.Security.Cryptography.RandomNumberGenerator]::Create()
try {
$generator.GetBytes($buffer)
}
finally {
$generator.Dispose()
}
return [BitConverter]::ToString($buffer).Replace("-", "").ToLowerInvariant()
}
function Get-GitValue {
param([string[]]$GitArguments)
try {
$value = & git -C $repoRoot @GitArguments 2>$null
if ($LASTEXITCODE -eq 0) { return ($value | Select-Object -First 1).Trim() }
}
catch {}
return "unknown"
}
$publicBindIP = if ($isIPv6) { "::" } else { "0.0.0.0" }
$localBindIP = if ($isIPv6) { "::1" } else { "127.0.0.1" }
if ($isLoopback) {
$publicBindIP = $parsedIP.ToString()
$localBindIP = $parsedIP.ToString()
}
elseif (([Uri]$PublicBaseURL).Scheme -eq "http") {
$publicLinkIP = $null
$publicLinkHost = ([Uri]$PublicBaseURL).Host.Trim([char[]]"[]")
if ([System.Net.IPAddress]::TryParse($publicLinkHost, [ref]$publicLinkIP) -and $publicLinkIP.Equals($parsedIP)) {
$localBindIP = $parsedIP.ToString()
}
}
$adminHealthIP = $parsedAdminBindIP.ToString()
if ($adminHealthIP -eq "0.0.0.0") { $adminHealthIP = "127.0.0.1" }
if ($adminHealthIP -eq "::") { $adminHealthIP = "::1" }
$publicListenHost = if ($publicBindIP.Contains(":")) { "[${publicBindIP}]" } else { $publicBindIP }
$localListenHost = if ($localBindIP.Contains(":")) { "[${localBindIP}]" } else { $localBindIP }
$serverHealthURLHost = $localListenHost
$adminListenIP = $parsedAdminBindIP.ToString()
$adminListenHost = if ($adminListenIP.Contains(":")) { "[${adminListenIP}]" } else { $adminListenIP }
$turnEnabled = (-not $isIPv6).ToString().ToLowerInvariant()
$turnAdvertiseIP = if ($isIPv6) { "127.0.0.1" } else { $parsedIP.ToString() }
$rtmpHost = if ($isIPv6) { "[$($parsedIP.ToString())]" } else { $parsedIP.ToString() }
$postgresPassword = New-HexSecret 24
$treeState = "unknown"
try {
$treeOutput = & git -C $repoRoot status --porcelain 2>$null
if ($LASTEXITCODE -eq 0) { $treeState = if (@($treeOutput).Count -gt 0) { "dirty" } else { "clean" } }
}
catch {}
$values = [ordered]@{
TELESRV_BUILD_COMMIT = Get-GitValue @("rev-parse", "HEAD")
TELESRV_BUILD_BRANCH = Get-GitValue @("rev-parse", "--abbrev-ref", "HEAD")
TELESRV_BUILD_TREE_STATE = $treeState
TELESRV_BUILD_DATE = [DateTime]::UtcNow.ToString("o")
POSTGRES_PASSWORD = $postgresPassword
TELESRV_POSTGRES_DSN = "postgres://telesrv:${postgresPassword}@127.0.0.1:15432/telesrv_main?sslmode=disable"
TELESRV_REDIS_PASSWORD = New-HexSecret 32
TELESRV_ADMIN_API_TOKEN = New-HexSecret 32
TELESRV_ADMIN_UI_PASSWORD = New-HexSecret 24
TELESRV_ADMIN_SESSION_KEY = New-HexSecret 32
TELESRV_TURN_SECRET = New-HexSecret 32
TELESRV_OTP_WEBHOOK_SECRET = New-HexSecret 32
TELESRV_ALLOW_INSECURE_DEVELOPMENT_AUTH = ($isLoopback -or $AllowInsecureDevelopmentAuth).ToString().ToLowerInvariant()
TELESRV_ADVERTISE_IP = $parsedIP.ToString()
TELESRV_PUBLIC_BASE_URL = $PublicBaseURL
TELESRV_PUBLIC_WEB_BASE_URL = $PublicWebBaseURL
TELESRV_SERVER_HOST_NETWORK = (-not $BridgeNetwork).ToString().ToLowerInvariant()
TELESRV_SFU_ADVERTISE_IP = $parsedIP.ToString()
TELESRV_TURN_ENABLE = $turnEnabled
TELESRV_TURN_ADVERTISE_IP = $turnAdvertiseIP
TELESRV_LIVESTREAM_RTMP_URL = "rtmp://${rtmpHost}:2400/live"
TELESRV_PUBLIC_BIND_IP = $publicBindIP
TELESRV_PUBLIC_LISTEN_HOST = $publicListenHost
TELESRV_LOCAL_BIND_IP = $localBindIP
TELESRV_LOCAL_LISTEN_HOST = $localListenHost
TELESRV_SERVER_HEALTH_IP = $localBindIP
TELESRV_SERVER_HEALTH_URL_HOST = $serverHealthURLHost
TELESRV_ADMIN_BIND_IP = $adminListenIP
TELESRV_ADMIN_LISTEN_HOST = $adminListenHost
TELESRV_ADMIN_HEALTH_IP = $adminHealthIP
}
$content = [IO.File]::ReadAllText($templatePath)
foreach ($entry in $values.GetEnumerator()) {
$pattern = "(?m)^$([Regex]::Escape($entry.Key))=.*$"
if (-not [Regex]::IsMatch($content, $pattern)) { throw "Template is missing $($entry.Key)." }
$replacement = ("{0}={1}" -f $entry.Key, $entry.Value).Replace('$', '$$')
$content = [Regex]::Replace($content, $pattern, $replacement)
}
function Protect-SecretFile {
param([string]$Path)
if ($env:OS -eq "Windows_NT") {
$owner = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
$acl = New-Object System.Security.AccessControl.FileSecurity
$acl.SetAccessRuleProtection($true, $false)
$acl.SetOwner($owner)
$identities = @(
$owner,
(New-Object System.Security.Principal.SecurityIdentifier("S-1-5-18")),
(New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544"))
)
foreach ($identity in $identities) {
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
$identity,
[System.Security.AccessControl.FileSystemRights]::FullControl,
[System.Security.AccessControl.AccessControlType]::Allow
)
[void]$acl.AddAccessRule($rule)
}
Set-Acl -LiteralPath $Path -AclObject $acl
return
}
& chmod 600 -- $Path
if ($LASTEXITCODE -ne 0) { throw "chmod 600 failed for $Path" }
}
if ($PSCmdlet.ShouldProcess($outputPath, "write owner-only Docker deployment environment")) {
$temporaryPath = "$outputPath.tmp.$PID"
try {
[IO.File]::WriteAllText($temporaryPath, $content, (New-Object Text.UTF8Encoding($false)))
Protect-SecretFile -Path $temporaryPath
Move-Item -LiteralPath $temporaryPath -Destination $outputPath
}
finally {
if (Test-Path -LiteralPath $temporaryPath) { Remove-Item -LiteralPath $temporaryPath -Force }
}
Write-Host "Created $outputPath with generated deployment credentials."
}