90 lines
2.8 KiB
Bash
90 lines
2.8 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
# Idempotently provisions the S3 docs bucket with sane defaults.
|
|
#
|
|
# This script is intended for CI/CD (Gitea Actions) or operator usage.
|
|
# It is safe to run repeatedly:
|
|
# - If the bucket exists, it will NOT recreate it.
|
|
# - It will (re)apply public-access-block and optional versioning/lifecycle.
|
|
#
|
|
# Required env:
|
|
# - S3_ENDPOINT
|
|
# - S3_REGION
|
|
# - S3_BUCKET_DOCS
|
|
#
|
|
# Optional env:
|
|
# - S3_ENABLE_VERSIONING (true/false; default false)
|
|
# - S3_LIFECYCLE_JSON (path; default docs/usage/s3_lifecycle_docs_default.json)
|
|
#
|
|
# Credentials:
|
|
# - AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (or AWS_PROFILE)
|
|
#
|
|
# Notes:
|
|
# - Some S3-compatible providers ignore LocationConstraint; this script tries to be compatible.
|
|
|
|
need() {
|
|
name="$1"
|
|
val="$(printenv "$name" 2>/dev/null || true)"
|
|
if [ -z "$val" ]; then
|
|
echo "missing env: $name" >&2
|
|
exit 2
|
|
fi
|
|
}
|
|
|
|
need S3_ENDPOINT
|
|
need S3_REGION
|
|
need S3_BUCKET_DOCS
|
|
|
|
if ! command -v aws >/dev/null 2>&1; then
|
|
echo "missing dependency: aws (AWS CLI v2 recommended)" >&2
|
|
exit 2
|
|
fi
|
|
|
|
export AWS_EC2_METADATA_DISABLED=true
|
|
export AWS_DEFAULT_REGION="$S3_REGION"
|
|
export AWS_REGION="$S3_REGION"
|
|
|
|
endpoint_args="--endpoint-url=$S3_ENDPOINT"
|
|
|
|
bucket="$S3_BUCKET_DOCS"
|
|
|
|
echo "== ensure bucket exists =="
|
|
if aws s3api head-bucket $endpoint_args --bucket "$bucket" >/dev/null 2>&1; then
|
|
echo "bucket exists: $bucket"
|
|
else
|
|
# Try create-bucket without LocationConstraint first (works for many S3-compatible providers).
|
|
if aws s3api create-bucket $endpoint_args --bucket "$bucket" >/dev/null 2>&1; then
|
|
echo "created bucket: $bucket"
|
|
else
|
|
# Fallback for AWS-style regions.
|
|
aws s3api create-bucket $endpoint_args --bucket "$bucket" \
|
|
--create-bucket-configuration "LocationConstraint=$S3_REGION" >/dev/null
|
|
echo "created bucket (with location constraint): $bucket"
|
|
fi
|
|
fi
|
|
|
|
echo "== apply public access block =="
|
|
aws s3api put-public-access-block $endpoint_args --bucket "$bucket" --public-access-block-configuration \
|
|
"BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true" >/dev/null
|
|
|
|
S3_ENABLE_VERSIONING="${S3_ENABLE_VERSIONING:-false}"
|
|
if [ "$S3_ENABLE_VERSIONING" = "true" ] || [ "$S3_ENABLE_VERSIONING" = "1" ]; then
|
|
echo "== enable versioning =="
|
|
aws s3api put-bucket-versioning $endpoint_args --bucket "$bucket" --versioning-configuration Status=Enabled >/dev/null
|
|
fi
|
|
|
|
echo "== apply lifecycle (optional) =="
|
|
S3_LIFECYCLE_JSON="${S3_LIFECYCLE_JSON:-docs/usage/s3_lifecycle_docs_default.json}"
|
|
if [ -f "$S3_LIFECYCLE_JSON" ]; then
|
|
aws s3api put-bucket-lifecycle-configuration \
|
|
--endpoint-url "$S3_ENDPOINT" \
|
|
--bucket "$bucket" \
|
|
--lifecycle-configuration "file://$S3_LIFECYCLE_JSON" >/dev/null
|
|
else
|
|
echo "lifecycle file missing, skipping: $S3_LIFECYCLE_JSON" >&2
|
|
fi
|
|
|
|
echo "ok: provisioned bucket $bucket"
|
|
|