81 lines
2.5 KiB
Bash
Executable File
81 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
mode="${1:---check}"
|
|
case "$mode" in
|
|
--check | --apply) ;;
|
|
*) echo "usage: $0 [--check|--apply]" >&2; exit 2 ;;
|
|
esac
|
|
|
|
: "${TF_VAR_nexus_url:?set TF_VAR_nexus_url}"
|
|
: "${TF_VAR_nexus_username:?set TF_VAR_nexus_username}"
|
|
: "${TF_VAR_nexus_password:?set TF_VAR_nexus_password}"
|
|
|
|
script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
auth_file="$(mktemp /tmp/nexus-oci-auth.XXXXXX)"
|
|
trap 'rm -f -- "$auth_file"' EXIT
|
|
chmod 0600 "$auth_file"
|
|
printf 'machine %s\nlogin %s\npassword %s\n' \
|
|
"${TF_VAR_nexus_url#*://}" "$TF_VAR_nexus_username" \
|
|
"$TF_VAR_nexus_password" >"$auth_file"
|
|
|
|
drift=0
|
|
for entry in \
|
|
"hosted:$script_dir/oci/oci-hosted.json" \
|
|
"proxy:$script_dir/oci/oci-proxy.json" \
|
|
"group:$script_dir/oci/oci-public.json"; do
|
|
repository_type="${entry%%:*}"
|
|
desired_file="${entry#*:}"
|
|
repository_name="$(jq -er '.name' "$desired_file")"
|
|
endpoint="$TF_VAR_nexus_url/service/rest/v1/repositories/oci/$repository_type"
|
|
current_file="$(mktemp /tmp/nexus-oci-current.XXXXXX)"
|
|
|
|
status="$(curl --silent --show-error --netrc-file "$auth_file" \
|
|
--output "$current_file" --write-out '%{http_code}' \
|
|
"$endpoint/$repository_name")"
|
|
|
|
if [[ "$status" == 404 ]]; then
|
|
drift=1
|
|
if [[ "$mode" == --apply ]]; then
|
|
curl --fail --silent --show-error --netrc-file "$auth_file" \
|
|
--header 'Content-Type: application/json' \
|
|
--data-binary "@$desired_file" "$endpoint"
|
|
echo "created $repository_name"
|
|
else
|
|
echo "missing $repository_name" >&2
|
|
fi
|
|
elif [[ "$status" == 200 ]]; then
|
|
if jq -e --slurpfile desired "$desired_file" '
|
|
def subset($actual; $wanted):
|
|
if ($wanted | type) == "object" then
|
|
all($wanted | keys[];
|
|
($actual[.] != null) and subset($actual[.]; $wanted[.]))
|
|
else
|
|
$actual == $wanted
|
|
end;
|
|
subset(.; $desired[0])
|
|
' "$current_file" >/dev/null; then
|
|
echo "in sync $repository_name"
|
|
else
|
|
drift=1
|
|
if [[ "$mode" == --apply ]]; then
|
|
curl --fail --silent --show-error --netrc-file "$auth_file" \
|
|
--request PUT --header 'Content-Type: application/json' \
|
|
--data-binary "@$desired_file" "$endpoint/$repository_name"
|
|
echo "updated $repository_name"
|
|
else
|
|
echo "drifted $repository_name" >&2
|
|
fi
|
|
fi
|
|
else
|
|
cat "$current_file" >&2
|
|
echo "unexpected HTTP $status for $repository_name" >&2
|
|
exit 1
|
|
fi
|
|
rm -f -- "$current_file"
|
|
done
|
|
|
|
if [[ "$mode" == --check && "$drift" -ne 0 ]]; then
|
|
exit 1
|
|
fi
|