bump version to 0.0.7

treewide: improve template expansion
2024-11-18 11:30:16 +03:00 · 2024-11-18 11:30:16 +03:00
22 changed files with 101 additions and 38 deletions
--- a/build-scripts/image-base.sh
+++ b/build-scripts/image-base.sh
@ -2,7 +2,7 @@
 set -ef
 cd "$(dirname "$0")/.."

-IMAGE_VERSION="${IMAGE_VERSION:-v0.0.6}"
+IMAGE_VERSION="${IMAGE_VERSION:-v0.0.7}"

 set -a
 BUILDAH_FORMAT="${BUILDAH_FORMAT:-docker}"
--- a/build-scripts/image-deps.sh
+++ b/build-scripts/image-deps.sh
@ -2,7 +2,7 @@
 set -ef
 cd "$(dirname "$0")/.."

-IMAGE_VERSION="${IMAGE_VERSION:-v0.0.6}"
+IMAGE_VERSION="${IMAGE_VERSION:-v0.0.7}"

 set -a
 BUILDAH_FORMAT="${BUILDAH_FORMAT:-docker}"
--- a/build-scripts/image.sh
+++ b/build-scripts/image.sh
@ -2,7 +2,7 @@
 set -ef
 cd "$(dirname "$0")/.."

-IMAGE_VERSION="${IMAGE_VERSION:-v0.0.6}"
+IMAGE_VERSION="${IMAGE_VERSION:-v0.0.7}"

 set -a
 BUILDAH_FORMAT="${BUILDAH_FORMAT:-docker}"
--- a/doc/examples/basic/Dockerfile
+++ b/doc/examples/basic/Dockerfile
@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7
 SHELL [ "/bin/sh", "-ec" ]

 COPY /site/   /etc/angie/site/
--- a/doc/examples/basic/docker-compose.yml
+++ b/doc/examples/basic/docker-compose.yml
@ -4,7 +4,7 @@ services:

  angie-conv-example-basic:
    container_name: angie-conv-example-basic
-    image: docker.io/rockdrilla/angie-conv:v0.0.6
+    image: docker.io/rockdrilla/angie-conv:v0.0.7
    environment:
      NGX_HTTP_NO_PROXY: 1
    ports:
--- a/doc/examples/config-template/README.md
+++ b/doc/examples/config-template/README.md
@ -58,7 +58,7 @@ services:

  my-cache:
    container_name: my-cache
-    image: docker.io/rockdrilla/angie-conv:v0.0.6
+    image: docker.io/rockdrilla/angie-conv:v0.0.7
    restart: always
    privileged: true
    stop_grace_period: 15s
--- a/doc/examples/config-template/docker-compose.yml
+++ b/doc/examples/config-template/docker-compose.yml
@ -4,7 +4,7 @@ services:

  my-cache:
    container_name: my-cache
-    image: docker.io/rockdrilla/angie-conv:v0.0.6
+    image: docker.io/rockdrilla/angie-conv:v0.0.7
    restart: always
    privileged: true
    stop_grace_period: 15s
--- a/doc/examples/j2cfg-override/Dockerfile
+++ b/doc/examples/j2cfg-override/Dockerfile
@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7
 SHELL [ "/bin/sh", "-ec" ]

 COPY /j2cfg/  /etc/angie/j2cfg/
--- a/doc/examples/j2cfg-override/docker-compose.yml
+++ b/doc/examples/j2cfg-override/docker-compose.yml
@ -4,7 +4,7 @@ services:

  angie-conv-example-cfg-override:
    container_name: angie-conv-example-cfg-override
-    image: docker.io/rockdrilla/angie-conv:v0.0.6
+    image: docker.io/rockdrilla/angie-conv:v0.0.7
    environment:
      NGX_HTTP_MODULES: 'gzip brotli zstd'
    ports:
--- a/doc/examples/njs/Dockerfile
+++ b/doc/examples/njs/Dockerfile
@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7
 SHELL [ "/bin/sh", "-ec" ]

 COPY /site/ /etc/angie/site/
--- a/doc/examples/njs/README.md
+++ b/doc/examples/njs/README.md
@ -3,7 +3,7 @@
 Dockerfile:

 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7

 COPY /site/ /etc/angie/site/

--- a/doc/examples/perl/Dockerfile
+++ b/doc/examples/perl/Dockerfile
@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7
 SHELL [ "/bin/sh", "-ec" ]

 COPY /site/ /etc/angie/site/
--- a/doc/examples/perl/README.md
+++ b/doc/examples/perl/README.md
@ -3,7 +3,7 @@
 Dockerfile:

 ```dockerfile
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7

 COPY /site/ /etc/angie/site/

--- a/doc/examples/ssl/Dockerfile
+++ b/doc/examples/ssl/Dockerfile
@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7
 SHELL [ "/bin/sh", "-ec" ]

 COPY /site/   /etc/angie/site/
--- a/doc/examples/ssl/docker-compose.yml
+++ b/doc/examples/ssl/docker-compose.yml
@ -4,7 +4,7 @@ services:

  angie-conv-example-ssl:
    container_name: angie-conv-example-ssl
-    image: docker.io/rockdrilla/angie-conv:v0.0.6
+    image: docker.io/rockdrilla/angie-conv:v0.0.7
    environment:
      NGX_HTTP_NO_PROXY: 1
      NGX_HTTP_CONFLOAD: 'ssl v2'
--- a/doc/examples/static-template/Dockerfile
+++ b/doc/examples/static-template/Dockerfile
@ -1,4 +1,4 @@
-FROM docker.io/rockdrilla/angie-conv:v0.0.6
+FROM docker.io/rockdrilla/angie-conv:v0.0.7
 SHELL [ "/bin/sh", "-ec" ]

 COPY /site/   /etc/angie/site/
--- a/doc/examples/static-template/docker-compose.yml
+++ b/doc/examples/static-template/docker-compose.yml
@ -4,7 +4,7 @@ services:

  angie-conv-example-static-template:
    container_name: angie-conv-example-static-template
-    image: docker.io/rockdrilla/angie-conv:v0.0.6
+    image: docker.io/rockdrilla/angie-conv:v0.0.7
    environment:
      NGX_HTTP_NO_PROXY: 1
      NGX_PROCESS_STATIC: 1
--- a/image-entry.d/00-common.envsh
+++ b/image-entry.d/00-common.envsh
@ -128,9 +128,20 @@ expand_dir_envsubst() {

 	__template_list=$(mktemp) || return

-	find "$@" -follow -type f -name '*.in' \
+	find "$@" -follow -name '*.in' -type f \
+	| {
+		if [ -n "${NGX_TEMPLATE_EXCLUDE_REGEX:-}" ] ; then
+			grep -Ev -e "${NGX_TEMPLATE_EXCLUDE_REGEX}"
+		elif [ -n "${NGX_TEMPLATE_INCLUDE_REGEX:-}" ] ; then
+			grep -E -e "${NGX_TEMPLATE_INCLUDE_REGEX}"
+		else
+			cat
+		fi
+	} \
 	| sort -uV > "${__template_list}"

+	__ret=0
+	if [ -s "${__template_list}" ] ; then
 		__have_args="${ENVSUBST_ARGS:+1}"
 		if [ -z "${__have_args}" ] ; then
 			## optimize envsubst.sh invocation by caching argument list
@ -140,7 +151,6 @@ expand_dir_envsubst() {
 			export ENVSUBST_ARGS
 		fi

-	__ret=0
 		while read -r __orig_file ; do
 			[ -n "${__orig_file}" ] || continue
 			expand_file_envsubst "${__orig_file}" || __ret=1
@ -150,6 +160,7 @@ expand_dir_envsubst() {
 			rm -f "${ENVSUBST_ARGS}" ; unset ENVSUBST_ARGS
 		fi
 		unset __have_args
+	fi

 	rm -f "${__template_list}" ; unset __template_list
 	
@ -161,7 +172,16 @@ expand_dir_j2cfg() {

 	__template_list=$(mktemp) || return

-	find "$@" -follow -type f -name '*.j2' -printf '%p\0' \
+	find "$@" -follow -name '*.j2' -type f -printf '%p\0' \
+	| {
+		if [ -n "${NGX_TEMPLATE_EXCLUDE_REGEX:-}" ] ; then
+			grep -zEv -e "${NGX_TEMPLATE_EXCLUDE_REGEX}"
+		elif [ -n "${NGX_TEMPLATE_INCLUDE_REGEX:-}" ] ; then
+			grep -zE -e "${NGX_TEMPLATE_INCLUDE_REGEX}"
+		else
+			cat
+		fi
+	} \
 	| sort -zuV > "${__template_list}"

 	__ret=0
--- a/image-entry.d/01-defaults.envsh
+++ b/image-entry.d/01-defaults.envsh
@ -44,6 +44,10 @@ for i in ${NGX_DIRS_MERGE:-} ; do
 		log_always "NGX_DIRS_MERGE: dir '$i' is not legal, skipping"
 		continue
 	;;
+	j2cfg | j2cfg/* )
+		log_always "NGX_DIRS_MERGE: '$i' is reserved for internal use, skipping"
+		continue
+	;;
 	esac

 	dirs=$(append_list "${dirs}" "$i")
@ -59,6 +63,10 @@ for i in ${NGX_DIRS_LINK:-} ; do
 		log_always "NGX_DIRS_LINK: dir '$i' is not legal, skipping"
 		continue
 	;;
+	j2cfg | j2cfg/* )
+		log_always "NGX_DIRS_MERGE: '$i' is reserved for internal use, skipping"
+		continue
+	;;
 	esac

 	if list_have_item "${NGX_DIRS_MERGE}" "$i" ; then
--- a/image-entry.d/73-expand-templates.sh
+++ b/image-entry.d/73-expand-templates.sh
@ -38,10 +38,13 @@ for n in ${NGX_DIRS_MERGE} ; do
 done

 set -a
+ENVSUBST_ARGS="${volume_root}/diag.envsubst.txt"
 J2CFG_PATH="${merged_root}/j2cfg"
 J2CFG_SEARCH_PATH="${merged_root}"
 set +a

+envsubst-args.sh > "${ENVSUBST_ARGS}"
+
 ## expand j2cfg templates first

 expand_dir_envsubst j2cfg/ || expand_error
@ -60,4 +63,29 @@ export J2CFG_CONFIG="${j2cfg_dump}"

 expand_dir_j2cfg ${merge_dirs} || expand_error

+## remove template sources in order to avoid leaking sensitive data
+if [ "${NGX_PROCESS_STATIC}" = 1 ] ; then
+	__template_list=$(mktemp)
+
+	find static/ -follow -type f -printf '%p\0' \
+	| grep -zE '\.(in|j2)$' \
+	| {
+		if [ -n "${NGX_TEMPLATE_EXCLUDE_REGEX:-}" ] ; then
+			grep -zEv -e "${NGX_TEMPLATE_EXCLUDE_REGEX}"
+		elif [ -n "${NGX_TEMPLATE_INCLUDE_REGEX:-}" ] ; then
+			grep -zE -e "${NGX_TEMPLATE_INCLUDE_REGEX}"
+		else
+			cat
+		fi
+	} \
+	| sort -zuV > "${__template_list}"
+
+	if [ -s "${__template_list}" ] ; then
+		xargs -0r -n 1000 -a "${__template_list}" \
+		rm -fv < /dev/null
+	fi
+
+	rm -f "${__template_list}" ; unset __template_list
+fi
+
 exit 0
--- a/j2cfg/j2cfg/settings.py
+++ b/j2cfg/j2cfg/settings.py
@ -29,8 +29,11 @@ J2CFG_JINJA_EXTENSIONS = [
 ]

 J2CFG_BANNED_ENVS = [
-    r'ANGIE(=|$)',
-    r'ANGIE_BPF_MAPS(=|$)'
+    r'__IEP_', r'IEP_',
+    r'NGX_TEMPLATE_(EX|IN)CLUDE',
+    r'ENVSUBST_',
+    r'J2CFG_',
+    r'ANGIE(|_BPF_MAPS)(=|$)',
 ]

 J2CFG_PRESERVE_ENVS = [
--- a/scripts/envsubst-args.sh
+++ b/scripts/envsubst-args.sh
@ -3,8 +3,12 @@ set -f

 sed -znE '/^([^=]+)=.*$/s,,\1,p' /proc/$$/environ \
 | sed -zE \
-    -e '/^_$/d;/^ENVSUBST_/d;' \
+    -e '/^_$/d' \
    -e '/^__IEP_/d;/^IEP_$/d' \
+    -e '/^NGX_TEMPLATE_(EX|IN)CLUDE/d' \
+    -e '/^ENVSUBST_/d' \
+    -e '/^J2CFG_/d' \
+    -e '/^ANGIE(|_BPF_MAPS)$/d' \
 | {
 	if [ -n "${ENVSUBST_EXCLUDE_REGEX:-}" ] ; then
 		grep -zEv -e "${ENVSUBST_EXCLUDE_REGEX}"
Author	SHA1	Message	Date
Konstantin Demin	3d2defc086	bump version to 0.0.7	2024-11-18 11:30:16 +03:00
Konstantin Demin	00648c9940	treewide: improve template expansion	2024-11-18 11:30:16 +03:00