mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-06 13:10:37 -04:00
033f0c84da
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com> Co-authored-by: Aditya Tripathi <aditya@climactic.co>
973 lines
43 KiB
PHP
973 lines
43 KiB
PHP
<?php
|
|
|
|
use App\Actions\Shared\CloneVolumeDataWithSourceStopped;
|
|
use App\Enums\ApplicationDeploymentStatus;
|
|
use App\Enums\CancelPreviousDeployments;
|
|
use App\Jobs\ApplicationDeploymentJob;
|
|
use App\Jobs\CancelSupersededDeploymentJob;
|
|
use App\Jobs\SyncGithubDeploymentJob;
|
|
use App\Jobs\VolumeCloneJob;
|
|
use App\Models\Application;
|
|
use App\Models\ApplicationDeploymentQueue;
|
|
use App\Models\ApplicationPreview;
|
|
use App\Models\Environment;
|
|
use App\Models\EnvironmentVariable;
|
|
use App\Models\Server;
|
|
use App\Models\StandaloneDocker;
|
|
use App\Notifications\Application\DeploymentFailed;
|
|
use App\Services\Dns\ResourceDnsRecords;
|
|
use Illuminate\Support\Collection;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Http;
|
|
use Illuminate\Support\Facades\Log;
|
|
use Spatie\Url\Url;
|
|
|
|
function queue_application_deployment(Application $application, string $deployment_uuid, ?int $pull_request_id = 0, ?string $commit = null, bool $force_rebuild = false, bool $is_webhook = false, bool $is_api = false, bool $restart_only = false, ?string $git_type = null, bool $no_questions_asked = false, ?Server $server = null, ?StandaloneDocker $destination = null, bool $only_this_server = false, bool $rollback = false, ?string $docker_registry_image_tag = null, ?string $parent_deployment_uuid = null, ?int $scan_gate_bypassed_by = null, ?string $scan_gate_pinned_image = null, bool $is_mcp = false, ?CancelPreviousDeployments $cancel_previous = null)
|
|
{
|
|
$commit = $commit ?: ($application->git_commit_sha ?: 'HEAD');
|
|
$commit = validateGitRef($commit, 'deployment commit');
|
|
$application_id = $application->id;
|
|
$deployment_link = Url::fromString($application->link()."/deployment/{$deployment_uuid}");
|
|
$deployment_url = $deployment_link->getPath();
|
|
$server_id = $application->destination->server->id;
|
|
$server_name = $application->destination->server->name;
|
|
$destination_id = $application->destination->id;
|
|
|
|
if ($server) {
|
|
$server_id = $server->id;
|
|
$server_name = $server->name;
|
|
}
|
|
if ($destination) {
|
|
$destination_id = $destination->id;
|
|
}
|
|
|
|
// MCP tools also call the REST API controllers through an internal request.
|
|
$is_mcp = $is_mcp || request()->attributes->get('mcp_rest_bridge') === true;
|
|
$is_api = $is_api && ! $is_mcp;
|
|
|
|
$admission = DB::transaction(function () use ($application, $application_id, $cancel_previous, $commit, $deployment_uuid, $deployment_url, $destination_id, $docker_registry_image_tag, $force_rebuild, $git_type, $is_api, $is_mcp, $is_webhook, $no_questions_asked, $only_this_server, $parent_deployment_uuid, $pull_request_id, $restart_only, $rollback, $scan_gate_bypassed_by, $scan_gate_pinned_image, $server_id, $server_name) {
|
|
// Lock stable rows because an empty deployment queue has no row to lock.
|
|
Application::query()->whereKey($application_id)->lockForUpdate()->firstOrFail();
|
|
$serverForQueueCheck = Server::query()->whereKey($server_id)->lockForUpdate()->firstOrFail();
|
|
$queue_limit = $serverForQueueCheck->settings->deployment_queue_limit ?? 25;
|
|
$queued_count = ApplicationDeploymentQueue::where('server_id', $server_id)
|
|
->where('status', ApplicationDeploymentStatus::QUEUED->value)
|
|
->count();
|
|
|
|
if ($queued_count >= $queue_limit) {
|
|
return [
|
|
'status' => 'queue_full',
|
|
'message' => 'Deployment queue is full. Please wait for existing deployments to complete.',
|
|
];
|
|
}
|
|
|
|
$existing_deployment = ApplicationDeploymentQueue::where('application_id', $application_id)
|
|
->where('commit', $commit)
|
|
->where('pull_request_id', $pull_request_id)
|
|
->where('docker_registry_image_tag', $docker_registry_image_tag)
|
|
->whereIn('status', [ApplicationDeploymentStatus::IN_PROGRESS->value, ApplicationDeploymentStatus::QUEUED->value])
|
|
->first();
|
|
|
|
if ($existing_deployment && ! $force_rebuild && ! $rollback && ! $no_questions_asked) {
|
|
return [
|
|
'status' => 'skipped',
|
|
'message' => 'Deployment already queued for this commit.',
|
|
'deployment_uuid' => $existing_deployment->deployment_uuid,
|
|
'existing_deployment' => $existing_deployment,
|
|
];
|
|
}
|
|
|
|
$deployment = ApplicationDeploymentQueue::create([
|
|
'application_id' => $application_id,
|
|
'application_name' => $application->name,
|
|
'server_id' => $server_id,
|
|
'server_name' => $server_name,
|
|
'destination_id' => $destination_id,
|
|
'deployment_uuid' => $deployment_uuid,
|
|
'deployment_url' => $deployment_url,
|
|
'pull_request_id' => $pull_request_id,
|
|
'docker_registry_image_tag' => $docker_registry_image_tag,
|
|
'force_rebuild' => $force_rebuild,
|
|
'is_webhook' => $is_webhook,
|
|
'is_api' => $is_api,
|
|
'is_mcp' => $is_mcp,
|
|
'restart_only' => $restart_only,
|
|
'commit' => $commit,
|
|
'rollback' => $rollback,
|
|
'git_type' => $git_type,
|
|
'only_this_server' => $only_this_server,
|
|
'parent_deployment_uuid' => $parent_deployment_uuid,
|
|
'scan_gate_bypassed_by' => $scan_gate_bypassed_by,
|
|
// "Deploy anyway" of a Docker image starts the blocked image by its digest.
|
|
'scan_gate_result' => $scan_gate_pinned_image !== null ? ['repo_digest' => $scan_gate_pinned_image] : null,
|
|
]);
|
|
|
|
$superseded = cancel_superseded_deployments($deployment, $application, $cancel_previous);
|
|
|
|
// Decide whether to start while the application and server rows are still locked,
|
|
// so concurrent requests cannot both see an idle queue and start two deployments.
|
|
// After a cancelled build, CancelSupersededDeploymentJob starts it once the build is stopped.
|
|
$started = $superseded['building']->isEmpty() && ($no_questions_asked || next_queuable($deployment));
|
|
if ($started) {
|
|
$deployment->update([
|
|
'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
|
|
]);
|
|
}
|
|
|
|
return ['deployment' => $deployment, 'started' => $started, 'superseded' => $superseded];
|
|
});
|
|
|
|
if (! isset($admission['deployment'])) {
|
|
return $admission;
|
|
}
|
|
|
|
$deployment = $admission['deployment'];
|
|
|
|
foreach ($admission['superseded'] as $kind => $cancelled) {
|
|
foreach ($cancelled as $old) {
|
|
$old->addLogEntry("Deployment cancelled: the newer deployment {$deployment_uuid} (commit {$commit}) replaces it.", 'stderr');
|
|
// The cancel is a query update, which fires no model event.
|
|
try {
|
|
SyncGithubDeploymentJob::dispatchFor($old);
|
|
} catch (Throwable $e) {
|
|
Log::warning("Failed to queue the GitHub deployment sync of superseded deployment {$old->deployment_uuid}: {$e->getMessage()}");
|
|
}
|
|
if ($kind !== 'building') {
|
|
continue;
|
|
}
|
|
try {
|
|
CancelSupersededDeploymentJob::dispatch($old, (int) $application->team()->id);
|
|
} catch (Throwable $e) {
|
|
Log::warning("Failed to dispatch the cleanup of superseded deployment {$old->deployment_uuid}: {$e->getMessage()}");
|
|
queue_next_deployment($application, $old->server_id);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (auth()->check() && ! $is_webhook && ! $is_api && ! $is_mcp && ! $rollback) {
|
|
auditLog($restart_only ? 'ui.application.restarted' : 'ui.application.deployed', [
|
|
'application_uuid' => $application->uuid,
|
|
'application_name' => $application->name,
|
|
'deployment_uuid' => $deployment_uuid,
|
|
'force_rebuild' => $force_rebuild,
|
|
]);
|
|
}
|
|
|
|
if ($admission['started']) {
|
|
try {
|
|
ApplicationDeploymentJob::dispatch(
|
|
application_deployment_queue_id: $deployment->id,
|
|
);
|
|
} catch (Throwable $exception) {
|
|
fail_undispatchable_deployment($deployment, $exception);
|
|
|
|
throw $exception;
|
|
}
|
|
}
|
|
|
|
return [
|
|
'status' => 'queued',
|
|
'message' => 'Deployment queued.',
|
|
'deployment_uuid' => $deployment_uuid,
|
|
];
|
|
}
|
|
/**
|
|
* A new deployment can replace older deployments of the same application, pull request, and server:
|
|
* - A webhook deployment replaces older webhook deployments, as the application settings allow.
|
|
* - An API or MCP deployment replaces older webhook, API, and MCP deployments, as its caller asks
|
|
* with $cancelPrevious. Without it, nothing is cancelled, so callers that wait for their
|
|
* deployment keep working.
|
|
*
|
|
* A running deployment is cancelled only before it starts to deploy containers, so a cancel never
|
|
* leaves an application half deployed. Manual, restart, and rollback deployments are never cancelled,
|
|
* and restarts and rollbacks never cancel others.
|
|
*
|
|
* Call it in the admission transaction, after the new deployment is created.
|
|
*
|
|
* @return array{queued: Collection<int, ApplicationDeploymentQueue>, building: Collection<int, ApplicationDeploymentQueue>}
|
|
*/
|
|
function cancel_superseded_deployments(ApplicationDeploymentQueue $deployment, Application $application, ?CancelPreviousDeployments $cancelPrevious = null): array
|
|
{
|
|
$none = ['queued' => collect(), 'building' => collect()];
|
|
if ($deployment->rollback || $deployment->restart_only) {
|
|
return $none;
|
|
}
|
|
$settings = $application->settings;
|
|
$fromWebhook = (bool) $deployment->is_webhook;
|
|
$mode = match (true) {
|
|
$fromWebhook && (bool) $settings?->is_auto_cancel_building_deployments_enabled => CancelPreviousDeployments::BUILDING,
|
|
$fromWebhook && (bool) $settings?->is_auto_cancel_queued_deployments_enabled => CancelPreviousDeployments::QUEUED,
|
|
(bool) $deployment->is_api || (bool) $deployment->is_mcp => $cancelPrevious ?? CancelPreviousDeployments::NONE,
|
|
default => CancelPreviousDeployments::NONE,
|
|
};
|
|
if ($mode === CancelPreviousDeployments::NONE) {
|
|
return $none;
|
|
}
|
|
$cancelBuilding = $mode === CancelPreviousDeployments::BUILDING;
|
|
|
|
$candidates = ApplicationDeploymentQueue::query()
|
|
->where('application_id', $deployment->application_id)
|
|
->where('pull_request_id', $deployment->pull_request_id)
|
|
->where('server_id', $deployment->server_id)
|
|
->where(fn ($query) => $fromWebhook
|
|
? $query->where('is_webhook', true)
|
|
: $query->where('is_webhook', true)->orWhere('is_api', true)->orWhere('is_mcp', true))
|
|
->where('rollback', false)
|
|
->where('restart_only', false)
|
|
->whereKeyNot($deployment->getKey())
|
|
->where(function ($query) use ($cancelBuilding) {
|
|
$query->where('status', ApplicationDeploymentStatus::QUEUED->value);
|
|
if ($cancelBuilding) {
|
|
$query->orWhere(fn ($query) => $query
|
|
->where('status', ApplicationDeploymentStatus::IN_PROGRESS->value)
|
|
->whereNull('deploy_started_at'));
|
|
}
|
|
})
|
|
->get();
|
|
|
|
// A conditional update, so a build that starts to deploy at the same moment is never cancelled.
|
|
$cancelled = $candidates->filter(fn (ApplicationDeploymentQueue $old) => ApplicationDeploymentQueue::query()
|
|
->whereKey($old->getKey())
|
|
->where('status', $old->status)
|
|
->whereNull('deploy_started_at')
|
|
->update(['status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value]) === 1);
|
|
[$building, $queued] = $cancelled->partition(fn (ApplicationDeploymentQueue $old) => $old->status === ApplicationDeploymentStatus::IN_PROGRESS->value);
|
|
$cancelled->each(fn (ApplicationDeploymentQueue $old) => $old->status = ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
|
|
|
|
return ['queued' => $queued->values(), 'building' => $building->values()];
|
|
}
|
|
/**
|
|
* Start a queued deployment right away, ignoring the per-application and per-server
|
|
* concurrency limits. It returns false without dispatching when the deployment is no
|
|
* longer queued, so a repeated force start never runs the same deployment twice.
|
|
*/
|
|
function force_start_deployment(ApplicationDeploymentQueue $deployment): bool
|
|
{
|
|
return start_queued_deployment($deployment, force: true);
|
|
}
|
|
/**
|
|
* Start the queued deployments that can run now on the application's primary server, on the
|
|
* server of the deployment that just ended (an additional server), and on every other server
|
|
* with a queued deployment of this application, because those waited for this one to end.
|
|
*
|
|
* A deployment that fails to dispatch advances the queue again. A call made while the queue
|
|
* is already advancing is run after the current pass instead of recursing. Each such call
|
|
* needs a deployment that moved from queued to failed, so the loop ends.
|
|
*/
|
|
function queue_next_deployment(Application $application, ?int $finished_deployment_server_id = null)
|
|
{
|
|
static $advancing = false;
|
|
static $pending = [];
|
|
|
|
$pending[] = [$application, $finished_deployment_server_id];
|
|
if ($advancing) {
|
|
return;
|
|
}
|
|
|
|
$advancing = true;
|
|
try {
|
|
while ($next = array_shift($pending)) {
|
|
start_next_queued_deployments(...$next);
|
|
}
|
|
} finally {
|
|
$advancing = false;
|
|
$pending = [];
|
|
}
|
|
}
|
|
|
|
function start_next_queued_deployments(Application $application, ?int $finished_deployment_server_id = null): void
|
|
{
|
|
$application_queued_server_ids = ApplicationDeploymentQueue::where('application_id', $application->id)
|
|
->where('status', ApplicationDeploymentStatus::QUEUED)
|
|
->distinct()
|
|
->pluck('server_id');
|
|
// A build on a build server frees a slot that deployments on other servers of the team can wait for.
|
|
$primary_server = $application->destination?->server;
|
|
$build_server_team_server_ids = $primary_server && $application->buildServerCandidates($primary_server)->isNotEmpty()
|
|
? Server::where('team_id', $primary_server->team_id)->pluck('id')
|
|
: collect();
|
|
$server_ids = collect([$application->destination?->server_id, $finished_deployment_server_id])
|
|
->merge($application_queued_server_ids)
|
|
->merge($build_server_team_server_ids)
|
|
->filter(fn ($server_id) => $server_id !== null)
|
|
->unique()
|
|
->values();
|
|
$queued_deployments = ApplicationDeploymentQueue::whereIn('server_id', $server_ids)
|
|
->where('status', ApplicationDeploymentStatus::QUEUED)
|
|
->get()
|
|
->sortBy('created_at');
|
|
|
|
foreach ($queued_deployments as $next_deployment) {
|
|
try {
|
|
start_queued_deployment($next_deployment);
|
|
} catch (Throwable $e) {
|
|
Log::warning("Failed to start queued deployment {$next_deployment->deployment_uuid}: {$e->getMessage()}");
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Start a queued deployment if it can run now. The check and the status change run under
|
|
* the same application and server row locks as queue admission, so two workers cannot both
|
|
* start the same deployment or exceed the per-application and per-server limits.
|
|
* With $force, the limits are skipped but the deployment still has to be queued.
|
|
*/
|
|
function start_queued_deployment(ApplicationDeploymentQueue $deployment, bool $force = false): bool
|
|
{
|
|
$started = DB::transaction(function () use ($deployment, $force): bool {
|
|
Application::query()->whereKey($deployment->application_id)->lockForUpdate()->first();
|
|
Server::query()->whereKey($deployment->server_id)->lockForUpdate()->first();
|
|
$current = ApplicationDeploymentQueue::query()->whereKey($deployment->id)->lockForUpdate()->first();
|
|
|
|
if (! $current || $current->status !== ApplicationDeploymentStatus::QUEUED->value) {
|
|
return false;
|
|
}
|
|
|
|
if (! $force && ! next_queuable($current)) {
|
|
return false;
|
|
}
|
|
|
|
$current->update([
|
|
'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
|
|
]);
|
|
|
|
return true;
|
|
});
|
|
|
|
if (! $started) {
|
|
return false;
|
|
}
|
|
|
|
try {
|
|
ApplicationDeploymentJob::dispatch(
|
|
application_deployment_queue_id: $deployment->id,
|
|
);
|
|
} catch (Throwable $exception) {
|
|
fail_undispatchable_deployment($deployment, $exception);
|
|
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Fail a deployment whose job could not be created or queued, for example a deployment queued
|
|
* before an upgrade with a commit that no longer validates. Leaving it in progress would block
|
|
* every later deployment of the application and stop the queue advancement loop.
|
|
*/
|
|
function fail_undispatchable_deployment(ApplicationDeploymentQueue $deployment, Throwable $exception): void
|
|
{
|
|
$failed = ApplicationDeploymentQueue::query()
|
|
->whereKey($deployment->id)
|
|
->where('status', ApplicationDeploymentStatus::IN_PROGRESS->value)
|
|
->update(['status' => ApplicationDeploymentStatus::FAILED->value]);
|
|
|
|
if ($failed === 0) {
|
|
return;
|
|
}
|
|
|
|
Log::warning("Deployment {$deployment->deployment_uuid} could not be started: {$exception->getMessage()}");
|
|
|
|
$deployment->refresh();
|
|
// The query update above fires no model event.
|
|
try {
|
|
SyncGithubDeploymentJob::dispatchFor($deployment);
|
|
} catch (Throwable $e) {
|
|
Log::warning("Failed to queue the GitHub deployment sync of deployment {$deployment->deployment_uuid}: {$e->getMessage()}");
|
|
}
|
|
$deployment->addLogEntry('========================================', 'stderr');
|
|
$deployment->addLogEntry("Deployment could not be started: {$exception->getMessage()}", 'stderr');
|
|
$deployment->addLogEntry('========================================', 'stderr');
|
|
|
|
$application = Application::query()->find($deployment->application_id);
|
|
if (! $application) {
|
|
return;
|
|
}
|
|
|
|
try {
|
|
if (blank($deployment->parent_deployment_uuid)) {
|
|
$preview = $deployment->pull_request_id !== 0
|
|
? ApplicationPreview::findPreviewByApplicationAndPullId($application->id, $deployment->pull_request_id)
|
|
: null;
|
|
$application->environment?->project?->team?->notify(new DeploymentFailed($application, $deployment->deployment_uuid, $preview));
|
|
}
|
|
} catch (Throwable $notificationException) {
|
|
Log::warning("Failed to send the failure notification for deployment {$deployment->deployment_uuid}: {$notificationException->getMessage()}");
|
|
}
|
|
|
|
// The failed deployment no longer holds its build slot, so the deployments it blocked can start.
|
|
try {
|
|
queue_next_deployment($application, $deployment->server_id);
|
|
} catch (Throwable $queueException) {
|
|
Log::warning("Starting the next queued deployment after {$deployment->deployment_uuid} failed: {$queueException->getMessage()}");
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Decide whether a queued deployment can start now. Each deployment holds one build slot of the
|
|
* server that builds it: its deployment server, or a build server of the team. When it builds on a
|
|
* build server, it reserves the least busy one with a free slot in build_server_id, which the caller
|
|
* saves with the status change. Call it while the application and deployment server rows are locked.
|
|
*/
|
|
function next_queuable(ApplicationDeploymentQueue $deployment): bool
|
|
{
|
|
// Check if there's already a deployment in progress for this application with the same pull_request_id
|
|
// This allows normal deployments and PR deployments to run concurrently
|
|
$in_progress = ApplicationDeploymentQueue::where('application_id', $deployment->application_id)
|
|
->where('pull_request_id', $deployment->pull_request_id)
|
|
->where('status', ApplicationDeploymentStatus::IN_PROGRESS->value)
|
|
->exists();
|
|
|
|
if ($in_progress) {
|
|
return false;
|
|
}
|
|
|
|
// A deleted server keeps its queued deployments; they cannot run anymore.
|
|
$server = Server::find($deployment->server_id);
|
|
$application = Application::find($deployment->application_id);
|
|
if (! $server || ! $application) {
|
|
return false;
|
|
}
|
|
|
|
$buildServers = $application->buildServerCandidates($server);
|
|
if ($buildServers->isEmpty()) {
|
|
return active_builds_on_server($server->id) < $server->settings->concurrent_builds;
|
|
}
|
|
|
|
// Deployments of other servers can take the same build slots, so lock the build servers too.
|
|
Server::query()->whereKey($buildServers->modelKeys())->orderBy('id')->lockForUpdate()->get();
|
|
$buildServer = least_busy_build_server($buildServers);
|
|
if (! $buildServer) {
|
|
return false;
|
|
}
|
|
$deployment->build_server_id = $buildServer->id;
|
|
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* The running deployments that build on a server: its own deployments without a build server,
|
|
* and the deployments that it builds as a build server.
|
|
*/
|
|
function active_builds_on_server(int $server_id): int
|
|
{
|
|
return ApplicationDeploymentQueue::where('status', ApplicationDeploymentStatus::IN_PROGRESS->value)
|
|
->where(fn ($query) => $query->where('build_server_id', $server_id)
|
|
->orWhere(fn ($query) => $query->where('server_id', $server_id)->whereNull('build_server_id')))
|
|
->count();
|
|
}
|
|
|
|
/**
|
|
* The build server with the fewest running builds, at random among equals. With $onlyWithFreeSlot,
|
|
* a server that already runs as many builds as its "Concurrent builds" setting allows is skipped,
|
|
* and null means that all servers are full.
|
|
*
|
|
* @param Collection<int, Server> $buildServers
|
|
*/
|
|
function least_busy_build_server(Collection $buildServers, bool $onlyWithFreeSlot = true): ?Server
|
|
{
|
|
return $buildServers
|
|
->map(fn (Server $buildServer) => ['server' => $buildServer, 'builds' => active_builds_on_server($buildServer->id)])
|
|
->filter(fn (array $candidate) => ! $onlyWithFreeSlot || $candidate['builds'] < $candidate['server']->settings->concurrent_builds)
|
|
->shuffle()
|
|
->sortBy('builds')
|
|
->first()['server'] ?? null;
|
|
}
|
|
/**
|
|
* Start the queued deployments that can run after a cancellation. With the application of the
|
|
* cancelled deployment, its queued deployments on all servers start too, as when a deployment ends.
|
|
*/
|
|
function next_after_cancel(?Server $server = null, ?Application $application = null)
|
|
{
|
|
if ($application) {
|
|
queue_next_deployment($application, $server?->id);
|
|
|
|
return;
|
|
}
|
|
if ($server) {
|
|
$next_found = ApplicationDeploymentQueue::where('server_id', data_get($server, 'id'))
|
|
->where('status', ApplicationDeploymentStatus::QUEUED)
|
|
->get()
|
|
->sortBy('created_at');
|
|
|
|
foreach ($next_found as $next) {
|
|
start_queued_deployment($next);
|
|
}
|
|
}
|
|
}
|
|
|
|
function clone_application(Application $source, $destination, array $overrides = [], bool $cloneVolumeData = false): Application
|
|
{
|
|
$uuid = $overrides['uuid'] ?? new_public_id();
|
|
$server = $destination->server;
|
|
|
|
$teamId = $server->team_id;
|
|
$sourceTeamId = $source->team()?->id;
|
|
$environmentTeamId = Environment::query()->find($overrides['environment_id'] ?? $source->environment_id)?->project?->team_id;
|
|
if ($sourceTeamId === null || $environmentTeamId === null || (int) $sourceTeamId !== (int) $teamId || (int) $environmentTeamId !== (int) $teamId) {
|
|
throw new RuntimeException('The application, the target environment, and the destination must belong to the same team.');
|
|
}
|
|
|
|
// Prepare name and URL
|
|
$name = $overrides['name'] ?? 'clone-of-'.str($source->name)->limit(20).'-'.$uuid;
|
|
$applicationSettings = $source->settings;
|
|
$url = $overrides['fqdn'] ?? $source->fqdn;
|
|
|
|
if ($server->proxyType() !== 'NONE' && $applicationSettings->is_container_label_readonly_enabled === true) {
|
|
$url = generateUrl(server: $server, random: $uuid);
|
|
}
|
|
|
|
// Clone the application
|
|
$newApplication = $source->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
'additional_servers_count',
|
|
'additional_networks_count',
|
|
])->fill(array_merge([
|
|
'uuid' => $uuid,
|
|
'name' => $name,
|
|
'fqdn' => $url,
|
|
'status' => 'exited',
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination->getMorphClass(),
|
|
], $overrides));
|
|
$newApplication->save();
|
|
|
|
// Update custom labels if needed
|
|
if ($newApplication->destination->server->proxyType() !== 'NONE' && $applicationSettings->is_container_label_readonly_enabled === true) {
|
|
$customLabels = str(implode('|coolify|', generateLabelsApplication($newApplication)))->replace('|coolify|', "\n");
|
|
$newApplication->custom_labels = base64_encode($customLabels);
|
|
$newApplication->save();
|
|
}
|
|
|
|
// Clone settings
|
|
$newApplication->settings()->delete();
|
|
if ($applicationSettings) {
|
|
$newApplicationSettings = $applicationSettings->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
])->fill([
|
|
'application_id' => $newApplication->id,
|
|
]);
|
|
$newApplicationSettings->save();
|
|
$newApplication->setRelation('settings', $newApplicationSettings->fresh());
|
|
}
|
|
|
|
// Clone tags
|
|
$tags = $source->tags;
|
|
foreach ($tags as $tag) {
|
|
$newApplication->tags()->attach($tag->id);
|
|
}
|
|
|
|
// Clone scheduled tasks
|
|
$scheduledTasks = $source->scheduled_tasks()->get();
|
|
foreach ($scheduledTasks as $task) {
|
|
$newTask = $task->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
])->fill([
|
|
'uuid' => new_public_id(),
|
|
'application_id' => $newApplication->id,
|
|
'team_id' => $teamId,
|
|
]);
|
|
$newTask->save();
|
|
}
|
|
|
|
// Preview records belong to the pull request deployments of the source. The clone gets its own on the next pull request.
|
|
|
|
// Clone persistent volumes
|
|
$pendingVolumeClones = [];
|
|
$persistentVolumes = $source->persistentStorages()->get();
|
|
foreach ($persistentVolumes as $volume) {
|
|
$newName = '';
|
|
if ($volume->standalone_sqlite_id !== null) {
|
|
// A mounted SQLite database volume stays connected to the source only; the clone gets its own volume.
|
|
$newName = $newApplication->uuid.'-'.$volume->name;
|
|
} elseif (str_starts_with($volume->name, $source->uuid)) {
|
|
$newName = str($volume->name)->replace($source->uuid, $newApplication->uuid);
|
|
} else {
|
|
$newName = $newApplication->uuid.'-'.str($volume->name)->afterLast('-');
|
|
}
|
|
|
|
$newPersistentVolume = $volume->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
'uuid',
|
|
])->fill([
|
|
'name' => $newName,
|
|
'resource_id' => $newApplication->id,
|
|
'standalone_sqlite_id' => null,
|
|
]);
|
|
$newPersistentVolume->save();
|
|
|
|
if ($cloneVolumeData) {
|
|
$pendingVolumeClones[] = new VolumeCloneJob(
|
|
$volume->name,
|
|
$newPersistentVolume->name,
|
|
$source->destination->server,
|
|
$newApplication->destination->server,
|
|
$newPersistentVolume,
|
|
);
|
|
}
|
|
}
|
|
|
|
CloneVolumeDataWithSourceStopped::run($source, $pendingVolumeClones);
|
|
|
|
// Clone file storages
|
|
$fileStorages = $source->fileStorages()->get();
|
|
foreach ($fileStorages as $storage) {
|
|
$newStorage = $storage->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
])->fill([
|
|
'resource_id' => $newApplication->id,
|
|
]);
|
|
$newStorage->save();
|
|
}
|
|
|
|
// Clone production environment variables without triggering the created hook
|
|
$environmentVariables = $source->environment_variables()->get();
|
|
$previewEnvironmentVariables = $source->environment_variables_preview()->get();
|
|
|
|
// Drop defaults auto-created for the new application (e.g. NIXPACKS_NODE_VERSION) so the source values win
|
|
EnvironmentVariable::query()
|
|
->where('resourceable_type', $newApplication->getMorphClass())
|
|
->where('resourceable_id', $newApplication->id)
|
|
->whereIn('key', $environmentVariables->pluck('key')->merge($previewEnvironmentVariables->pluck('key'))->unique())
|
|
->delete();
|
|
|
|
foreach ($environmentVariables as $environmentVariable) {
|
|
EnvironmentVariable::withoutEvents(function () use ($environmentVariable, $newApplication) {
|
|
$newEnvironmentVariable = $environmentVariable->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
])->fill([
|
|
'resourceable_id' => $newApplication->id,
|
|
'resourceable_type' => $newApplication->getMorphClass(),
|
|
'is_preview' => false,
|
|
]);
|
|
$newEnvironmentVariable->save();
|
|
});
|
|
}
|
|
|
|
$source->cloneSecretManagerLinkTo($newApplication);
|
|
|
|
// Clone preview environment variables
|
|
foreach ($previewEnvironmentVariables as $previewEnvironmentVariable) {
|
|
EnvironmentVariable::withoutEvents(function () use ($previewEnvironmentVariable, $newApplication) {
|
|
$newPreviewEnvironmentVariable = $previewEnvironmentVariable->replicate([
|
|
'id',
|
|
'created_at',
|
|
'updated_at',
|
|
])->fill([
|
|
'resourceable_id' => $newApplication->id,
|
|
'resourceable_type' => $newApplication->getMorphClass(),
|
|
'is_preview' => true,
|
|
]);
|
|
$newPreviewEnvironmentVariable->save();
|
|
});
|
|
}
|
|
|
|
$dnsRecords = app(ResourceDnsRecords::class);
|
|
$dnsRecords->queueAutomaticRecords($newApplication, array_keys($dnsRecords->hostnameUsers($source)));
|
|
|
|
return $newApplication;
|
|
}
|
|
|
|
/**
|
|
* The published SSH host keys of the large git hosts, also for their SSH endpoints on port 443.
|
|
* ssh.github.com also serves the GitHub keys on port 22, where a `Port 443` in the SSH config ends because
|
|
* gitSshCommand() passes the port of the repository URL.
|
|
* Git over SSH to these hosts accepts only these keys. Update this list when a provider changes its host keys.
|
|
* GitLab.com does not publish its keys over HTTPS, so for gitlab.com an application also accepts the keys that are saved on its Source page.
|
|
*
|
|
* @see https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
|
|
* @see https://api.github.com/meta (ssh_keys)
|
|
* @see https://docs.gitlab.com/user/gitlab_com/#ssh-known_hosts-entries
|
|
* @see https://bitbucket.org/site/ssh
|
|
* @see https://docs.github.com/en/authentication/troubleshooting-ssh/using-ssh-over-the-https-port
|
|
*/
|
|
const GIT_PINNED_HOST_KEYS = [
|
|
'github.com,ssh.github.com,[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl',
|
|
'github.com,ssh.github.com,[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=',
|
|
'github.com,ssh.github.com,[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=',
|
|
'gitlab.com,[altssh.gitlab.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf',
|
|
'gitlab.com,[altssh.gitlab.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=',
|
|
'gitlab.com,[altssh.gitlab.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9',
|
|
'bitbucket.org,[altssh.bitbucket.org]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO',
|
|
'bitbucket.org,[altssh.bitbucket.org]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=',
|
|
'bitbucket.org,[altssh.bitbucket.org]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=',
|
|
];
|
|
|
|
/**
|
|
* The providers that publish their SSH host keys over HTTPS. "Fetch current host key" on the Source page reads
|
|
* them (fetchGitProviderHostKeys()), so deployments follow a key change without a Coolify release.
|
|
* GitLab publishes its keys only in its docs. The key is the host list of the provider's lines in GIT_PINNED_HOST_KEYS.
|
|
*/
|
|
const GIT_PROVIDER_HOST_KEY_SOURCES = [
|
|
'github.com,ssh.github.com,[ssh.github.com]:443' => 'https://api.github.com/meta',
|
|
'bitbucket.org,[altssh.bitbucket.org]:443' => 'https://bitbucket.org/site/ssh',
|
|
];
|
|
|
|
function gitProviderHostKeysCacheKey(string $hosts): string
|
|
{
|
|
return 'git-provider-host-keys:'.$hosts;
|
|
}
|
|
|
|
/**
|
|
* The key of GIT_PROVIDER_HOST_KEY_SOURCES whose host list contains $host, or null.
|
|
*/
|
|
function gitProviderHostKeySource(string $host): ?string
|
|
{
|
|
foreach (array_keys(GIT_PROVIDER_HOST_KEY_SOURCES) as $hosts) {
|
|
if (in_array(strtolower($host), gitKnownHostsLineHosts($hosts), true)) {
|
|
return $hosts;
|
|
}
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Reads the host keys that a provider publishes over HTTPS and saves them for gitProviderHostKeys().
|
|
*
|
|
* @return list<string>
|
|
*
|
|
* @throws RuntimeException When the provider does not answer with valid keys. The saved keys do not change.
|
|
*/
|
|
function fetchGitProviderHostKeys(string $hosts): array
|
|
{
|
|
$url = GIT_PROVIDER_HOST_KEY_SOURCES[$hosts];
|
|
$response = Http::timeout(10)->get($url);
|
|
if (! $response->successful()) {
|
|
throw new RuntimeException("Could not read the published host keys from {$url} (HTTP {$response->status()}).");
|
|
}
|
|
$keys = $hosts === array_key_first(GIT_PROVIDER_HOST_KEY_SOURCES)
|
|
? (array) $response->json('ssh_keys')
|
|
: collect(preg_split('/\R/', $response->body()))
|
|
->map(fn (string $line) => preg_split('/\s+/', trim($line)))
|
|
->filter(fn (array $parts) => count($parts) >= 3 && $parts[0] === explode(',', $hosts)[0])
|
|
->map(fn (array $parts) => "{$parts[1]} {$parts[2]}")
|
|
->all();
|
|
$lines = collect($keys)
|
|
->filter(fn ($key) => is_string($key))
|
|
->map(fn (string $key) => $hosts.' '.trim($key))
|
|
->unique()
|
|
->values();
|
|
if ($lines->isEmpty() || $lines->contains(fn (string $line) => ! isValidGitKnownHostsLine($line))) {
|
|
throw new RuntimeException("The answer from {$url} has no valid host keys.");
|
|
}
|
|
Cache::forever(gitProviderHostKeysCacheKey($hosts), $lines->all());
|
|
|
|
return $lines->all();
|
|
}
|
|
|
|
/**
|
|
* GIT_PINNED_HOST_KEYS, with the lines of a provider replaced by the keys that it published last.
|
|
* A replaced list also drops a key that the provider withdrew.
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
function gitProviderHostKeys(): array
|
|
{
|
|
$lines = GIT_PINNED_HOST_KEYS;
|
|
foreach (array_keys(GIT_PROVIDER_HOST_KEY_SOURCES) as $hosts) {
|
|
$published = Cache::get(gitProviderHostKeysCacheKey($hosts));
|
|
if (is_array($published) && $published !== []) {
|
|
$lines = [...array_filter($lines, fn (string $line) => explode(' ', $line, 2)[0] !== $hosts), ...$published];
|
|
}
|
|
}
|
|
|
|
return array_values($lines);
|
|
}
|
|
|
|
function gitSshConfigFile(string $uuid): string
|
|
{
|
|
return "/root/.ssh/coolify_git_{$uuid}.config";
|
|
}
|
|
|
|
function gitKnownHostsFile(string $uuid): string
|
|
{
|
|
return "/root/.ssh/coolify_git_{$uuid}.known_hosts";
|
|
}
|
|
|
|
/**
|
|
* A known_hosts line without markers, hashed host names, or comments: `host[,host] key-type key`.
|
|
* A host with a custom SSH port is written as `[host]:port`.
|
|
*/
|
|
function isValidGitKnownHostsLine(string $line): bool
|
|
{
|
|
$host = '(?:[A-Za-z0-9._:-]+|\[[A-Za-z0-9._:-]+\]:[0-9]{1,5})';
|
|
$keyType = '(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp(?:256|384|521)|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)';
|
|
|
|
return preg_match("/\\A{$host}(?:,{$host})* {$keyType} [A-Za-z0-9+\/]+={0,2}\\z/", $line) === 1;
|
|
}
|
|
|
|
/**
|
|
* The host names of a known_hosts line, without brackets and ports.
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
function gitKnownHostsLineHosts(string $line): array
|
|
{
|
|
return array_map(
|
|
fn (string $host) => strtolower(preg_replace('/\A\[(.+)\]:[0-9]+\z/', '$1', $host)),
|
|
explode(',', strtok($line, ' ')),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* The host names in GIT_PINNED_HOST_KEYS.
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
function gitPinnedHosts(): array
|
|
{
|
|
return array_values(array_unique(array_merge(...array_map(gitKnownHostsLineHosts(...), GIT_PINNED_HOST_KEYS))));
|
|
}
|
|
|
|
/**
|
|
* The host names of the providers in GIT_PROVIDER_HOST_KEY_SOURCES. Coolify reads their keys over HTTPS, so the
|
|
* keys that are saved for an application are not used for these hosts.
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
function gitHostsWithPublishedKeys(): array
|
|
{
|
|
return array_values(array_unique(array_merge(...array_map(gitKnownHostsLineHosts(...), array_keys(GIT_PROVIDER_HOST_KEY_SOURCES)))));
|
|
}
|
|
|
|
/**
|
|
* Whether a known_hosts line names a host of gitHostsWithPublishedKeys(). Deployments ignore such lines.
|
|
*/
|
|
function gitKnownHostsLineHasHostWithPublishedKeys(string $line): bool
|
|
{
|
|
return array_intersect(gitKnownHostsLineHosts($line), gitHostsWithPublishedKeys()) !== [];
|
|
}
|
|
|
|
/**
|
|
* The valid known_hosts lines of a text, without blank lines, duplicates, and lines of gitHostsWithPublishedKeys().
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
function gitKnownHostsLines(?string $text): array
|
|
{
|
|
return collect(preg_split('/\R/', (string) $text))
|
|
->map(fn (string $line) => preg_replace('/\s+/', ' ', trim($line)))
|
|
->filter(fn (string $line) => isValidGitKnownHostsLine($line) && ! gitKnownHostsLineHasHostWithPublishedKeys($line))
|
|
->unique()
|
|
->values()
|
|
->all();
|
|
}
|
|
|
|
/**
|
|
* The saved known_hosts lines, with the lines of the hosts in $fetchedLines replaced by $fetchedLines.
|
|
* A saved line belongs to a fetched host when one of its host entries has the same host and port.
|
|
*
|
|
* @param list<string> $fetchedLines
|
|
* @return list<string>
|
|
*/
|
|
function gitKnownHostsReplaceHostKeys(?string $saved, array $fetchedLines): array
|
|
{
|
|
$entries = fn (string $line) => array_map(
|
|
fn (string $host) => strtolower(preg_match('/\A\[(.+)\]:([0-9]+)\z/', $host, $match) ? "{$match[1]}:{$match[2]}" : "{$host}:22"),
|
|
explode(',', strtok($line, ' ')),
|
|
);
|
|
$fetchedEntries = array_merge(...array_map($entries, $fetchedLines));
|
|
$otherLines = array_filter(gitKnownHostsLines($saved), fn (string $line) => array_intersect($entries($line), $fetchedEntries) === []);
|
|
|
|
return [...array_values($otherLines), ...$fetchedLines];
|
|
}
|
|
|
|
/**
|
|
* The host, key type, and SHA256 fingerprint of a known_hosts line, in the format that `ssh-keygen -lf` shows.
|
|
*
|
|
* @return array{host: string, type: string, fingerprint: string}
|
|
*/
|
|
function gitKnownHostFingerprint(string $line): array
|
|
{
|
|
[$host, $type, $key] = explode(' ', $line);
|
|
|
|
return [
|
|
'host' => $host,
|
|
'type' => $type,
|
|
'fingerprint' => 'SHA256:'.rtrim(base64_encode(hash('sha256', (string) base64_decode($key), true)), '='),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* A shell command that writes the SSH config and known_hosts file that gitSshCommand() uses.
|
|
* Run it in the place where git runs (the helper container or the server) before git uses SSH.
|
|
*
|
|
* The hosts in GIT_PINNED_HOST_KEYS must show one of their published keys (gitProviderHostKeys()), or for gitlab.com also
|
|
* a key in $knownHosts. Other hosts are trusted on
|
|
* first use: SSH adds the key of a new host to the known_hosts file and rejects a changed key of a known
|
|
* host. $knownHosts are the keys that earlier deployments saved (Application::$git_ssh_known_hosts).
|
|
* The config of the SSH user is read after these rules, so it cannot change StrictHostKeyChecking or
|
|
* UserKnownHostsFile. Root on the server can still add trusted keys (for example with KnownHostsCommand
|
|
* or GlobalKnownHostsFile), which is trusted by design. `~` in the Include is resolved from $HOME.
|
|
*
|
|
* With $onServer, the command first tests whether the ssh of the server supports accept-new (OpenSSH 7.6+,
|
|
* which also has Include). An older ssh rejects the whole config, so there every host is checked strictly
|
|
* against the pinned and saved keys, with no trust on first use, and the config of root and the system
|
|
* config are appended to the file instead of included.
|
|
*/
|
|
function gitSshSetupCommand(string $uuid, ?string $knownHosts = null, bool $onServer = false): string
|
|
{
|
|
$knownHostsFile = gitKnownHostsFile($uuid);
|
|
$pinnedHosts = implode(' ', gitPinnedHosts());
|
|
$config = implode("\n", [
|
|
"Host {$pinnedHosts}",
|
|
' StrictHostKeyChecking yes',
|
|
'Host *',
|
|
' StrictHostKeyChecking accept-new',
|
|
" UserKnownHostsFile {$knownHostsFile}",
|
|
' HashKnownHosts no',
|
|
' Include ~/.ssh/config /etc/ssh/ssh_config',
|
|
])."\n";
|
|
$knownHostsContent = implode("\n", [...gitProviderHostKeys(), ...gitKnownHostsLines($knownHosts)])."\n";
|
|
$write = fn (string $content, string $file) => "echo '".base64_encode($content)."' | base64 -d | tee {$file} > /dev/null";
|
|
$setup = 'mkdir -p /root/.ssh && '.$write($knownHostsContent, $knownHostsFile).' && ';
|
|
if (! $onServer) {
|
|
return $setup.$write($config, gitSshConfigFile($uuid));
|
|
}
|
|
|
|
$strictConfig = implode("\n", [
|
|
'Host *',
|
|
' StrictHostKeyChecking yes',
|
|
" UserKnownHostsFile {$knownHostsFile}",
|
|
' HashKnownHosts no',
|
|
])."\n";
|
|
|
|
return $setup.'if ssh -F /dev/null -G -o StrictHostKeyChecking=accept-new localhost > /dev/null 2>&1; then '.$write($config, gitSshConfigFile($uuid))
|
|
."; else { echo '".base64_encode($strictConfig)."' | base64 -d; cat /root/.ssh/config /etc/ssh/ssh_config 2> /dev/null; } | tee ".gitSshConfigFile($uuid).' > /dev/null; fi';
|
|
}
|
|
|
|
/**
|
|
* The SSH command that git uses to reach a repository. Run gitSshSetupCommand() with the same $uuid first.
|
|
* Without a port, SSH uses the port of the repository URL.
|
|
* The keepalive options stop a stalled connection after about one minute; without them git waits until the deployment timeout.
|
|
*/
|
|
function gitSshCommand(string $uuid, int|string|null $port = null, ?string $identityFile = null, bool $identitiesOnly = true): string
|
|
{
|
|
$command = 'ssh -F '.gitSshConfigFile($uuid).' -o ConnectTimeout=30 -o ServerAliveInterval=15 -o ServerAliveCountMax=4';
|
|
if ($port !== null) {
|
|
$command .= " -p {$port} -o Port={$port}";
|
|
}
|
|
$command .= ' -o LogLevel=ERROR';
|
|
|
|
if ($identityFile !== null) {
|
|
$command .= " -i {$identityFile}".($identitiesOnly ? ' -o IdentitiesOnly=yes' : '');
|
|
}
|
|
|
|
return $command;
|
|
}
|