42 lines
2.3 KiB
Bash
42 lines
2.3 KiB
Bash
#!/bin/sh
|
|
# Generated by the mesh. Do not edit: module supabase writes this file and replaces it at every push.
|
|
#
|
|
# Two things logflare 1.4.0 does not do for itself, done here before it starts; either failing
|
|
# stops the start, with the reason as the last line of this container's log.
|
|
#
|
|
# 1. The API key never travels in a URL. logflare prints the whole URL of every request that fails,
|
|
# query string included, in the error report Plug.Cowboy writes ("Request: POST
|
|
# /api/logs?source_name=...&api_key=..."). That is an error, so no log level hides it while errors
|
|
# are logged at all (novox/hq issue 268). logflare reads the key from the x-api-key header as well,
|
|
# and the mesh's caller, vector, sends it there; this refuses to start logflare while the vector
|
|
# config it is given still passes the key in a URL: an analytics that does not start says why
|
|
# here, and one that leaks says nothing.
|
|
#
|
|
# 2. Its database says what its environment says. logflare copies LOGFLARE_API_KEY into its default
|
|
# user and POSTGRES_BACKEND_URL into every source's backend once, when it creates them, and never
|
|
# again; reconcile.exs makes both copies match the environment through logflare's own code, after
|
|
# its migrations and before it starts. That is what lets the mesh rotate the key by starting
|
|
# logflare again, and what moves the sources' backend when the database's address or password
|
|
# changes.
|
|
set -e
|
|
conf=/run/logflare/vector.yml
|
|
if [ ! -r "$conf" ]; then
|
|
echo "analytics: $conf is not there to check, so whether the API key travels in a URL is unknown; not starting (novox/hq issue 268)" >&2
|
|
exit 1
|
|
fi
|
|
if grep -v '^[[:space:]]*#' "$conf" | grep -q 'api_key='; then
|
|
echo "analytics: $conf passes the API key in a URL, and logflare prints a failed request's URL; not starting (novox/hq issue 268)" >&2
|
|
exit 1
|
|
fi
|
|
reconcile=/run/logflare/reconcile.exs
|
|
if [ ! -r "$reconcile" ]; then
|
|
echo "analytics: $reconcile is not there, so whether logflare's stored key and backends match its environment is unknown; not starting" >&2
|
|
exit 1
|
|
fi
|
|
cd /opt/app/rel/logflare/bin
|
|
# The tables reconcile.exs reads exist only once the migrations have run; run.sh runs them again,
|
|
# which finds nothing left to do.
|
|
./logflare eval Logflare.Release.migrate
|
|
./logflare eval 'Code.eval_file("/run/logflare/reconcile.exs")'
|
|
exec sh run.sh
|