58 lines
1.6 KiB
Bash
58 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# WinRM uses requests/pywinrm which may pick up local proxy settings (systemd env, shells, etc).
|
|
# If that happens, WinRM traffic can be sent to 127.0.0.1:<proxy> and time out.
|
|
# This wrapper hard-disables proxy env vars to make deploy deterministic.
|
|
#
|
|
# Also, NTLM auth requires MD4. On OpenSSL 3 builds where MD4 is disabled by default,
|
|
# pywinrm fails with "unsupported hash type md4". In that case we enable OpenSSL legacy
|
|
# provider only for this process.
|
|
|
|
if [[ -z "${AW_WINRM_PASSWORD:-}" ]]; then
|
|
echo "ERROR: AW_WINRM_PASSWORD is not set" >&2
|
|
echo "Usage: AW_WINRM_PASSWORD='...' ./run_deploy_aw_windows.sh [ansible-playbook args...]" >&2
|
|
exit 2
|
|
fi
|
|
|
|
unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY
|
|
|
|
if ! python3 - <<'PY' >/dev/null 2>&1
|
|
import hashlib
|
|
raise SystemExit(0 if 'md4' in hashlib.algorithms_available else 1)
|
|
PY
|
|
then
|
|
cat >/tmp/openssl-legacy.cnf <<'EOF'
|
|
openssl_conf = openssl_init
|
|
[openssl_init]
|
|
providers = provider_sect
|
|
[provider_sect]
|
|
default = default_sect
|
|
legacy = legacy_sect
|
|
[default_sect]
|
|
activate = 1
|
|
[legacy_sect]
|
|
activate = 1
|
|
EOF
|
|
export OPENSSL_CONF=/tmp/openssl-legacy.cnf
|
|
fi
|
|
|
|
retries="${AW_DEPLOY_RETRIES:-5}"
|
|
delay="${AW_DEPLOY_RETRY_DELAY_SEC:-30}"
|
|
|
|
attempt=1
|
|
while [[ "$attempt" -le "$retries" ]]; do
|
|
echo "Deploy attempt $attempt/$retries"
|
|
if ansible-playbook -i inventory.ini deploy_aw_windows.yml "$@"; then
|
|
exit 0
|
|
fi
|
|
if [[ "$attempt" -lt "$retries" ]]; then
|
|
echo "Deploy attempt $attempt failed; sleeping ${delay}s before retry..." >&2
|
|
sleep "$delay"
|
|
fi
|
|
attempt=$((attempt + 1))
|
|
done
|
|
|
|
echo "Deploy failed after ${retries} attempts." >&2
|
|
exit 1
|