grendervill/glchat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deploy): убраны остатки TURN_SECRET, исправлена очистка hex при генерации age-ключа

Browse Source
This commit is contained in:
grendervill
2026-09-19 20:38:46 +03:00
parent 653229b6f0
commit 028a10b8d2
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/install.sh
+4 -5
View File
@@ -335,7 +335,7 @@ resolve_derived_values() {
PROFILE_LIVEKIT_DISABLE_SIMULCAST PROFILE_LIVEKIT_USE_EXTERNAL_IP \ PROFILE_LIVEKIT_DISABLE_SIMULCAST PROFILE_LIVEKIT_USE_EXTERNAL_IP \
GLCHAT_DATA_DIR GLCHAT_CADDY_PROFILE GLCHAT_TURN_CERT_DIR \ GLCHAT_DATA_DIR GLCHAT_CADDY_PROFILE GLCHAT_TURN_CERT_DIR \
GLCHAT_APP_BIND GLCHAT_LIVEKIT_BIND TLS_ENABLED \ GLCHAT_APP_BIND GLCHAT_LIVEKIT_BIND TLS_ENABLED \
TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED TURN_SECRET_RESOLVED \ TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED \
TURN_RELAY_USER TURN_RELAY_PASSWORD TURN_RELAY_USER TURN_RELAY_PASSWORD
} }
@@ -499,7 +499,7 @@ install_docker() {
generate_age_key() { generate_age_key() {
local dst="$1" local dst="$1"
local raw pub local raw pub
raw="$(openssl rand 32 | od -An -tx1 | tr -d ' \n')" raw="$(openssl rand 32 | od -An -tx1 | tr -d '[:space:]')"
if ! have age-keygen; then if ! have age-keygen; then
warn "age-keygen не найден: бэкапы будут без шифрования" warn "age-keygen не найден: бэкапы будут без шифрования"
return 0 return 0
@@ -753,7 +753,7 @@ TOTP_ENCRYPTION_KEY=${TOTP_ENCRYPTION_KEY}
WEBHOOK_SECRET=${WEBHOOK_SECRET} WEBHOOK_SECRET=${WEBHOOK_SECRET}
LIVEKIT_API_KEY=${LIVEKIT_API_KEY} LIVEKIT_API_KEY=${LIVEKIT_API_KEY}
LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET} LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET}
TURN_SECRET=${TURN_SECRET_RESOLVED}
AGE_RECIPIENT=${AGE_RECIPIENT:-} AGE_RECIPIENT=${AGE_RECIPIENT:-}
SQLITE_READ_POOL=${PROFILE_SQLITE_READ_POOL} SQLITE_READ_POOL=${PROFILE_SQLITE_READ_POOL}
SQLITE_CACHE_SIZE=-${PROFILE_SQLITE_CACHE_MB}000 SQLITE_CACHE_SIZE=-${PROFILE_SQLITE_CACHE_MB}000
@@ -892,7 +892,7 @@ ensure_swap() {
# render_turn_relay_servers формирует YAML-список turn_servers для LiveKit: # render_turn_relay_servers формирует YAML-список turn_servers для LiveKit:
# UDP и TLS-эндпоинты внешнего релея (VPS), у которого есть публичный IP. # UDP и TLS-эндпоинты внешнего релея (VPS), у которого есть публичный IP.
# Секрет уже вычислен в resolve_derived_values (TURN_SECRET_RESOLVED). # Используются статические креденшелы coturn (username/credential).
render_turn_relay_servers() { render_turn_relay_servers() {
[ -n "$TURN_RELAY_HOST" ] || return 0 [ -n "$TURN_RELAY_HOST" ] || return 0
printf ' turn_servers:\n' printf ' turn_servers:\n'
@@ -913,7 +913,6 @@ turn_shared_secret() {
TURN_SECRET_RESOLVED="$(env_get TURN_SECRET || true)" TURN_SECRET_RESOLVED="$(env_get TURN_SECRET || true)"
fi fi
[ -n "${TURN_SECRET_RESOLVED:-}" ] || TURN_SECRET_RESOLVED="$(rand_hex 32)" [ -n "${TURN_SECRET_RESOLVED:-}" ] || TURN_SECRET_RESOLVED="$(rand_hex 32)"
export TURN_SECRET_RESOLVED
printf '%s' "$TURN_SECRET_RESOLVED" printf '%s' "$TURN_SECRET_RESOLVED"
} }