blob: 236581103604d9ea82e8b385f447e4b9a89cd19a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
#!/usr/bin/env bash
# One-time apply of COOP/COEP/CORP headers for the wasm PoA crypto preconditions.
# Run ON 192.168.3.110 as root: ops/apply-wasm-headers.sh (lighttpd primary, nginx mirror optional).
# Enables SharedArrayBuffer (cross-origin isolation) for WasmPoaSigner; see BUILD-OPS.md section 9.
set -euo pipefail
HERE=$(cd "$(dirname "$0")" && pwd)
REPO=$(cd "$HERE/.." && pwd)
MARKER="kukuri wasm-headers"
LIGHTTPD_CONF=/etc/lighttpd/lighttpd.conf
if [ "$(id -u)" != "0" ]; then
echo "run as root" >&2
exit 1
fi
if [ -d /etc/lighttpd ]; then
if grep -rqs "$MARKER" "$LIGHTTPD_CONF" /etc/lighttpd/conf-enabled/ 2>/dev/null; then
echo "lighttpd: already applied; refreshing snippet"
rm -f /etc/lighttpd/conf-enabled/95-wasm-headers.conf
sed -i "/# $MARKER (added by/,+8d" "$LIGHTTPD_CONF" 2>/dev/null || true
fi
if ! grep -rqs "mod_setenv" "$LIGHTTPD_CONF" /etc/lighttpd/conf-enabled/ 2>/dev/null; then
printf '\nserver.modules += ( "mod_setenv" ) # %s\n' "$MARKER" >> "$LIGHTTPD_CONF"
fi
if grep -qs "conf-enabled" "$LIGHTTPD_CONF"; then
install -m 644 "$REPO/deploy/lighttpd/wasm-headers.conf" /etc/lighttpd/conf-available/95-wasm-headers.conf
ln -sfn /etc/lighttpd/conf-available/95-wasm-headers.conf /etc/lighttpd/conf-enabled/95-wasm-headers.conf
else
printf '\n# %s (added by ops/apply-wasm-headers.sh)\n' "$MARKER" >> "$LIGHTTPD_CONF"
cat "$REPO/deploy/lighttpd/wasm-headers.conf" >> "$LIGHTTPD_CONF"
fi
lighttpd -tt -f "$LIGHTTPD_CONF"
if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet lighttpd 2>/dev/null; then
systemctl restart lighttpd
else
/etc/init.d/lighttpd restart
fi
echo "lighttpd: COOP/COEP/CORP headers applied to /artifact/kukuri/latest/web/"
else
echo "lighttpd: /etc/lighttpd not found; skipped"
fi
if [ -d /etc/nginx ]; then
install -m 644 "$REPO/deploy/nginx/wasm-headers.conf" /etc/nginx/wasm-headers.conf
echo "nginx: snippet at /etc/nginx/wasm-headers.conf - add 'include /etc/nginx/wasm-headers.conf;'"
echo " to the server block serving the app, then: nginx -t && systemctl reload nginx"
else
echo "nginx: /etc/nginx not found; skipped"
fi
echo "--- verify (expect Cross-Origin-Opener-Policy / -Embedder-Policy / -Resource-Policy) ---"
if command -v curl >/dev/null 2>&1; then
curl -sI http://127.0.0.1/artifact/kukuri/latest/web/ | grep -i "^cross-origin" || {
echo "header check failed - inspect lighttpd config" >&2
exit 1
}
fi
|
