35 lines
1.2 KiB
Bash
Executable File
35 lines
1.2 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
|
|
mkdir -p "$tmp/deploy/secrets" "$tmp/deploy/workspaces"
|
|
cp compose.yaml "$tmp/compose.yaml"
|
|
cp .env.example "$tmp/.env"
|
|
printf '%s\n' 'THT_MODEL_API_KEY=example-secret' >"$tmp/deploy/secrets/thothii.secrets"
|
|
chmod 0600 "$tmp/deploy/secrets/thothii.secrets"
|
|
|
|
services=$(docker compose --project-directory "$tmp" config --services)
|
|
[ "$services" = "core
|
|
frontend" ] || {
|
|
echo "default Compose services must be core and frontend (got: $services)" >&2
|
|
exit 1
|
|
}
|
|
|
|
rendered=$(docker compose --project-directory "$tmp" config)
|
|
printf '%s\n' "$rendered" | grep -q 'target: thothii.secrets'
|
|
if printf '%s\n' "$rendered" | grep -Eq 'dwh_api_key|vector_reader_api_key|vector_writer_api_key|model_api_key|thoth_ca'; then
|
|
echo "default Compose must not declare legacy per-secret mounts" >&2
|
|
exit 1
|
|
fi
|
|
if printf '%s\n' "$rendered" | grep -Eq 'THT_[A-Z0-9_]+_SECRET_FILE:'; then
|
|
echo "default Compose must not require legacy secret-file variables" >&2
|
|
exit 1
|
|
fi
|
|
printf '%s\n' "$rendered" | grep -q 'THT_SECRETS_FILE: /run/secrets/thothii.secrets'
|
|
|
|
echo "default Compose contract passed."
|