platform/sicabe-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

345d921 fix(verify-phase2)

Browse Source
This commit is contained in:
subroto
2026-10-13 21:26:50 +07:00
parent 678885f681
commit 8f323b579b
2 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/scripts/test-generate.sh
+20
View File
@@ -423,6 +423,26 @@ else
bad "Nessie host-facing: port bisa salah untuk Nessie eksternal (beh='${_nr_beh}')" bad "Nessie host-facing: port bisa salah untuk Nessie eksternal (beh='${_nr_beh}')"
fi fi
# ─── 0r2. S3 host-facing: port dari S3_ENDPOINT (mis. :8443) lewat sicabe_host_url ─
# Regresi: verify-phase2 membentuk host_ep via sicabe_local_url(MINIO_HOST,MINIO_PORT)
# → S3 eksternal ber-URL penuh (https://minio-api.sicabe.com:8443) diprobe di :12900.
_sr2=1
grep -q 'sicabe_host_url S3_ENDPOINT MINIO_HOST' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" || _sr2=0
grep -q 'sicabe_local_url "${S3_SCHEME:-http}" MINIO_HOST' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" && _sr2=0
_sr2_beh="$(bash -c '
# shellcheck disable=SC1091
source "'"${DEPLOY_DIR}"'/lib/common.sh" >/dev/null 2>&1 || exit 9
MINIO_HOST=localhost MINIO_PORT=12900 S3_SCHEME=https
S3_ENDPOINT=https://minio-api.sicabe.com:8443; a="$(sicabe_host_url S3_ENDPOINT MINIO_HOST "$MINIO_PORT" "$S3_SCHEME")"
S3_ENDPOINT=http://minio:9000; b="$(sicabe_host_url S3_ENDPOINT MINIO_HOST "$MINIO_PORT" http)"
printf "%s|%s" "$a" "$b"' 2>/dev/null)"
[[ "${_sr2_beh}" == "https://minio-api.sicabe.com:8443|http://localhost:12900" ]] || _sr2=0
if [[ "${_sr2}" == "1" ]]; then
ok "S3 host-facing: pakai sicabe_host_url (URL penuh → apa adanya; nama service → host:port terbit)"
else
bad "S3 host-facing: port bisa salah untuk S3 eksternal ber-URL penuh (beh='${_sr2_beh}')"
fi
# ─── 0s. Realm Keycloak Trino terparameter (SICABE_REALM, bukan literal `sicabe`) ─ # ─── 0s. Realm Keycloak Trino terparameter (SICABE_REALM, bukan literal `sicabe`) ─
# Regresi: issuer/auth/token/jwks Trino dipatok `/realms/sicabe` → client ber-realm lain # Regresi: issuer/auth/token/jwks Trino dipatok `/realms/sicabe` → client ber-realm lain
# (SICABE_REALM != sicabe) tetap diarahkan ke realm `sicabe` → OIDC gagal. # (SICABE_REALM != sicabe) tetap diarahkan ke realm `sicabe` → OIDC gagal.
deploy/scripts/verify-phase2-storage.sh
+4 -1
View File
@@ -125,7 +125,10 @@ check_object_storage() {
# S3_ENDPOINT umumnya hanya terjangkau dari jaringan Docker (mis. # S3_ENDPOINT umumnya hanya terjangkau dari jaringan Docker (mis.
# http://minio:9000) → uji keterjangkauan dilakukan dari container (uji mc). # http://minio:9000) → uji keterjangkauan dilakukan dari container (uji mc).
# Di host kita cek port publik MinIO saja (informatif, bukan gate). # Di host kita cek port publik MinIO saja (informatif, bukan gate).
local host_ep="$(sicabe_local_url "${S3_SCHEME:-http}" MINIO_HOST "${MINIO_PORT:-12900}")" # Bila S3_ENDPOINT berupa ALAMAT (IP/FQDN, mis. https://minio-api.sicabe.com:8443),
# pakai APA ADANYA — termasuk port-nya — lewat sicabe_host_url. Tanpa ini, URL
# penuh diprobe di port terbit lokal (12900) → WARN palsu.
local host_ep="$(sicabe_host_url S3_ENDPOINT MINIO_HOST "${MINIO_PORT:-12900}" "${S3_SCHEME:-http}")"
local host_code local host_code
host_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 8 \ host_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 8 \
"${host_ep}/minio/health/live" 2>/dev/null || true) "${host_ep}/minio/health/live" 2>/dev/null || true)