blob: b6ec9b5e8c35604a6250c61b2134215041b37106 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
#!/bin/sh
# Started by ttyd for every browser terminal, with the terminal handle from
# the URL (?arg=) as $1. Trades the handle for the bokfd session at the
# gate (bokfweb /redeem, internal only), then runs bokftui already logged
# in, in a private throwaway HOME, in web mode (no local files), with
# resource limits. No shell is ever offered: when bokftui exits, the
# terminal ends.
set -u
gate="${BOKFWEB_INTERNAL:-http://127.0.0.1:7682}"
msg() {
printf '\r\n %s\r\n\r\n' "$1"
sleep 4
exit 1
}
handle="${1:-}"
case "$handle" in
"" | *[!A-Za-z0-9_-]*) msg "Ogiltig länk. Öppna /web/ och logga in igen." ;;
esac
session=$(wget -q -O - --post-data "handle=$handle" "$gate/redeem" 2>/dev/null) ||
msg "Sessionen har gått ut. Öppna /web/ och logga in igen."
case "$session" in
"" | *[!A-Za-z0-9_-]*) msg "Sessionen har gått ut. Öppna /web/ och logga in igen." ;;
esac
home=$(mktemp -d /tmp/bokf-web.XXXXXXXX) || msg "Kunde inte starta sessionen."
trap 'rm -rf "$home"' EXIT HUP INT TERM
chmod 0700 "$home"
# per-session limits: memory, CPU time, open files (the process count is
# capped per container in compose.yaml: every session runs as one uid)
ulimit -v 524288 2>/dev/null || true
ulimit -t 7200 2>/dev/null || true
ulimit -n 256 2>/dev/null || true
HOME="$home" XDG_CONFIG_HOME="$home/.config" XDG_CACHE_HOME="$home/.cache" \
BOKF_WEB=1 BOKFD_SESSION="$session" \
bokftui --socket "${BOKFD_SOCKET:-/run/bokfd/bokfd.sock}"
|
