Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,3 @@
+# LisgloSIPS S04 data bind mounts
+/data/mysql /var/lib/mysql none bind 0 0
+/data/redis /var/lib/redis none bind 0 0
@@ -0,0 +1,19 @@
+[mysqld]
+bind-address = 127.0.0.1
+mysqlx-bind-address = 127.0.0.1
+skip_name_resolve = ON
+local_infile = OFF
+server_id = 1
+log_bin = /var/log/mysql/mysql-bin
+binlog_format = ROW
+binlog_expire_logs_seconds = 604800
+sync_binlog = 1
+innodb_flush_log_at_trx_commit = 1
+innodb_buffer_pool_size = 1G
+max_connections = 200
+default_time_zone = +00:00
+character_set_server = utf8mb4
+collation_server = utf8mb4_0900_ai_ci
+slow_query_log = ON
+long_query_time = 1
+slow_query_log_file = /var/log/mysql/mysql-slow.log
@@ -0,0 +1,20 @@
+bind 127.0.0.1 100.90.90.91
+protected-mode yes
+port 6379
+unixsocket /run/redis/redis-server.sock
+unixsocketperm 770
+dir /var/lib/redis
+dbfilename dump.rdb
+appendonly yes
+appendfilename "appendonly.aof"
+appenddirname "appendonlydir"
+appendfsync everysec
+save ""
+save 900 1
+save 300 10
+save 60 10000
+stop-writes-on-bgsave-error yes
+maxmemory 1536mb
+maxmemory-policy noeviction
+tcp-keepalive 60
+aclfile /etc/redis/users.acl
@@ -0,0 +1,5 @@
+# Do not deploy this file as-is. Replace both placeholders with independent
+# generated secrets and install the result as /etc/redis/users.acl, mode 0640.
+user default off
+user lisglosips on >GENERATE_APP_SECRET ~* &* +@all -@dangerous
+user lisglo-backup on >GENERATE_BACKUP_SECRET ~* &* +ping +info +bgsave +lastsave
@@ -0,0 +1,22 @@
+#!/bin/bash
+set -euo pipefail
+umask 077
+dest=/data/backups/mysql
+install -d -o root -g root -m 0700 "$dest"
+[ "$(realpath "$dest")" = "/data/backups/mysql" ] || exit 2
+exec 9>/run/lock/lisglosips-mysql-backup.lock
+flock -n 9 || { echo "MySQL backup already running" >&2; exit 3; }
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+tmp=$(mktemp -d "$dest/.tmp-$stamp.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+mysqladmin --protocol=socket ping --silent
+mysqldump --protocol=socket --all-databases --single-transaction --routines --events --triggers --hex-blob --set-gtid-purged=OFF --no-tablespaces | gzip -9 > "$tmp/all-databases.sql.gz"
+mysqldump --protocol=socket --single-transaction --routines --events --triggers --hex-blob --set-gtid-purged=OFF --no-tablespaces lisglosips | gzip -9 > "$tmp/lisglosips.sql.gz"
+mysql --protocol=socket -N -e "SELECT @@version, @@global.gtid_executed, @@global.binlog_format, UTC_TIMESTAMP();" > "$tmp/metadata.tsv"
+(cd "$tmp" && sha256sum *.gz metadata.tsv > SHA256SUMS)
+chmod 0600 "$tmp"/*
+final="$dest/$stamp"
+mv "$tmp" "$final"
+trap - EXIT
+find "$dest" -mindepth 1 -maxdepth 1 -type d -name '20*T*Z' -mtime +14 -exec rm -rf -- {} +
+echo "$final"
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+umask 077
+dest=/data/backups/redis
+install -d -o root -g root -m 0700 "$dest"
+[ "$(realpath "$dest")" = "/data/backups/redis" ] || exit 2
+exec 9>/run/lock/lisglosips-redis-backup.lock
+flock -n 9 || { echo "Redis backup already running" >&2; exit 3; }
+set -a
+. /etc/lisglosips/secrets/redis-backup.env
+set +a
+export REDISCLI_AUTH="$REDIS_PASSWORD"
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+tmp=$(mktemp -d "$dest/.tmp-$stamp.XXXXXX")
+trap 'rm -rf "$tmp"' EXIT
+redis_cmd=(redis-cli -h "$REDIS_HOST" -p "$REDIS_PORT" --user "$REDIS_USER" --no-auth-warning)
+"${redis_cmd[@]}" PING | grep -qx PONG
+"${redis_cmd[@]}" BGSAVE >/dev/null
+for _ in $(seq 1 60); do
+  info=$("${redis_cmd[@]}" INFO persistence | tr -d '\r')
+  in_progress=$(printf '%s\n' "$info" | awk -F: '/^rdb_bgsave_in_progress:/{print $2}')
+  status=$(printf '%s\n' "$info" | awk -F: '/^rdb_last_bgsave_status:/{print $2}')
+  [ "$in_progress" = "0" ] && [ "$status" = "ok" ] && break
+  sleep 1
+done
+[ "$in_progress" = "0" ] && [ "$status" = "ok" ]
+install -o root -g root -m 0600 /var/lib/redis/dump.rdb "$tmp/dump.rdb"
+redis-check-rdb "$tmp/dump.rdb" > "$tmp/redis-check-rdb.txt"
+"${redis_cmd[@]}" INFO server | tr -d '\r' | grep -E '^(redis_version|os|arch_bits|process_id|tcp_port)' > "$tmp/metadata.txt"
+(cd "$tmp" && sha256sum dump.rdb metadata.txt > SHA256SUMS)
+chmod 0600 "$tmp"/*
+final="$dest/$stamp"
+mv "$tmp" "$final"
+trap - EXIT
+find "$dest" -mindepth 1 -maxdepth 1 -type d -name '20*T*Z' -mtime +14 -exec rm -rf -- {} +
+echo "$final"
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+for _ in $(seq 1 60); do
+  if /usr/sbin/ip -4 -o addr show dev tailscale0 2>/dev/null | /usr/bin/grep -q '100.90.90.91/32'; then
+    exit 0
+  fi
+  /usr/bin/sleep 1
+done
+echo 'Tailscale address 100.90.90.91 not ready' >&2
+exit 1
@@ -0,0 +1,16 @@
+[Unit]
+Description=LisgloSIPS MySQL and Redis backup
+Requires=mysql.service redis-server.service
+After=mysql.service redis-server.service
+ConditionPathIsMountPoint=/var/lib/mysql
+ConditionPathIsMountPoint=/var/lib/redis
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+UMask=0077
+Nice=10
+IOSchedulingClass=idle
+ExecStart=/usr/local/sbin/lisglosips-mysql-backup
+ExecStart=/usr/local/sbin/lisglosips-redis-backup
@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily LisgloSIPS database backup
+
+[Timer]
+OnCalendar=*-*-* 03:15:00
+RandomizedDelaySec=15m
+Persistent=true
+Unit=lisglosips-backup.service
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,9 @@
+[Unit]
+Description=Wait for Server B Tailscale address
+Requires=tailscaled.service
+After=tailscaled.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/lisglosips-wait-tailscale-b
+RemainAfterExit=yes
@@ -0,0 +1,3 @@
+[Unit]
+Requires=var-lib-mysql.mount
+After=var-lib-mysql.mount
@@ -0,0 +1,3 @@
+[Unit]
+Requires=var-lib-redis.mount lisglosips-tailscale-ready.service
+After=var-lib-redis.mount lisglosips-tailscale-ready.service
@@ -0,0 +1,2 @@
+MYSQL_VERSION=8.0.46-0ubuntu0.24.04.2
+REDIS_VERSION=7.0.15-1ubuntu0.24.04.4