52 lines
1.5 KiB
Python
52 lines
1.5 KiB
Python
|
# -*- coding: utf-8 -*-
|
||
|
|
"""REQ-通用-006 预生产测试通道 — nginx /api/dev/ 内网闸门注入脚本（幂等）"""
|
||
|
|
import shutil
|
||
|
|
import sys
|
||
|
|
|
||
|
|
NGINX_CONF = "/opt/wecom-it-desk/nginx/nginx.conf"
|
||
|
|
BAK = "/opt/wecom-it-desk/nginx/nginx.conf.bak-testch-20260811"
|
||
|
|
|
||
|
|
GATE_BLOCK = """ # ============================================================
|
||
|
|
# 预生产测试通道 (REQ-通用-006) - nginx 内网闸门
|
||
|
|
# 仅内网可访问 /api/dev/*，公网 403。部署后须双向 curl 验证
|
||
|
|
# ============================================================
|
||
|
|
location /api/dev/ {
|
||
|
|
allow 10.0.0.0/8;
|
||
|
|
allow 172.16.0.0/12;
|
||
|
|
allow 192.168.0.0/16;
|
||
|
|
deny all;
|
||
|
|
proxy_pass http://backend_api/;
|
||
|
|
proxy_set_header Host $host;
|
||
|
|
proxy_set_header X-Real-IP $remote_addr;
|
||
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
|
}
|
||
|
|
|
||
|
|
"""
|
||
|
|
|
||
|
|
|
||
|
|
def main() -> int:
|
||
|
|
with open(NGINX_CONF, encoding="utf-8") as f:
|
||
|
|
src = f.read()
|
||
|
|
|
||
|
|
if "location /api/dev/" in src:
|
||
|
|
print("ALREADY_EXISTS")
|
||
|
|
return 0
|
||
|
|
|
||
|
|
anchor = "location /api/ {\n"
|
||
|
|
idx = src.find(anchor)
|
||
|
|
if idx < 0:
|
||
|
|
print("ANCHOR_NOT_FOUND")
|
||
|
|
return 1
|
||
|
|
|
||
|
|
shutil.copy2(NGINX_CONF, BAK)
|
||
|
|
new_src = src[:idx] + GATE_BLOCK + src[idx:]
|
||
|
|
with open(NGINX_CONF, "w", encoding="utf-8") as f:
|
||
|
|
f.write(new_src)
|
||
|
|
print("INSERTED_OK")
|
||
|
|
return 0
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
sys.exit(main())
|