bugabinga.net

#!/usr/bin/env bash
set -euo pipefail
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
deploy="${repo_root}/services/pufferpanel/deploy"
rendered="$(QUADLET_UNIT_DIRS="${deploy}" /usr/lib/systemd/system-generators/podman-system-generator --user --dryrun)"
require() { grep -F -- "$1" <<<"${rendered}" >/dev/null; }
require 'registry.bugabinga.net/pufferpanel:latest'
require 'io.containers.autoupdate=registry'
require '127.0.0.1:8082:8080'
require 'Network=pufferpanel.network'
require 'Image=docker.io/library/caddy:2'
require 'Volume=/data/pufferpanel/gateway.Caddyfile:/etc/caddy/Caddyfile:ro'
require 'Volume=/data/pufferpanel-ingress:/run/pufferpanel-ingress'
require 'NoNewPrivileges=true'
require 'ReadOnly=true'
require '--cap-drop all'
require '--cap-add net_bind_service'
require '--image-volume=ignore'
grep -Fx 'Network=pufferpanel.network' "${deploy}/pufferpanel.container" >/dev/null
grep -Fx 'Network=pufferpanel.network' "${deploy}/pufferpanel-ingress.container" >/dev/null
grep -F '{{if .State.Health}}' "${deploy}/start.sh" >/dev/null
require 'DOCKER_HOST=unix:///var/run/docker.sock'
require 'PUFFER_DOCKER_ROOT=/data/pufferpanel/data'
require 'PUFFER_DOCKER_DISALLOWHOST=true'
require 'PUFFER_PANEL_REGISTRATIONENABLED=true'
require '/home/pufferpanel/.config/pufferpanel-email.env'
require 'PUFFER_PANEL_WEB_COOKIES_SECURE=true'
require '/data/pufferpanel/data:/data/pufferpanel/data:z'
require 'podman/podman.sock:/var/run/docker.sock'
require '--sdnotify=healthy'
require '--health-on-failure kill'
require 'PUFFER_PANEL_SETTINGS_DEFAULTTHEME=Nugu'
require '/data/pufferpanel/theme:/var/www/pufferpanel/theme:ro,Z'
require 'Requires=podman.socket'
if grep -E -- '--privileged|--network(=| )host|/run/podman/podman.sock:|pufferpanel-ingress.*(podman.sock|/data/pufferpanel/data)' <<<"${rendered}"; then
  echo "unsafe PufferPanel runtime configuration" >&2
  exit 1
fi
caddy adapt --config "${deploy}/gateway.Caddyfile" --adapter caddyfile | jq -e '
  all(.apps.http.servers[].listen[]; startswith("unix/"))
  and (.apps | has("tls") | not)
  and .admin.disabled
  and any(.. | objects | select(has("host")); .host == ["games.bugabinga.net"])
  and any(.. | objects; .dial? == "pufferpanel:8080")
  and any(.. | objects; .headers?.request?.set?["X-Forwarded-Proto"] == ["https"])
' >/dev/null
jq -e '.panel.database.dialect == "sqlite3" and .daemon.data.root == "/data/pufferpanel/data" and .docker.disallowHost == true' "${deploy}/config.json" >/dev/null
printf '%s\n' 'PufferPanel Quadlet isolation, updates, health, and data-path contracts passed'