wrapper.sh

#!/usr/bin/env bash
# Copyright (C) 2025-2026 Gustavo Freitas
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# This file is part of bb-docker.
# bb-docker is free software: you can redistribute it and/or modify it under
# the terms of the GNU Affero General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option)
# any later version. See the LICENSE file for details.

set -Eeuo pipefail

WARSAW_DIR=/usr/local/bin/warsaw
WARSAW_BINARIES=(core wsatspi wsupdsl)
WARSAW_CA=/usr/local/etc/warsaw/rootca.crt
WARSAW_CA_NAME="Warsaw Personal CA"
APP_USER=app
APP_HOME=/home/app
APP_GROUP=$(id -g "${APP_USER}")
APP_UID=$(id -u "${APP_USER}")
APP_RUNTIME_DIR="/run/user/${APP_UID}"
CHROME_PROFILE=${CHROME_PROFILE:-${APP_HOME}/chrome-profile}
NSS_DB="${APP_HOME}/.local/share/pki/nssdb"
VNC_DISPLAY=:1
VNC_PORT=5901
VNC_PASSWORD=${VNC_PASSWORD:-bbwarsaw}
VNC_GEOMETRY=${VNC_GEOMETRY:-1440x900}
browser_pid=
mate_pid=
novnc_pid=
session_dbus_pid=
vnc_pid=

stop_services() {
    for pid in \
        "${browser_pid}" \
        "${mate_pid}" \
        "${session_dbus_pid}" \
        "${novnc_pid}" \
        "${vnc_pid}"; do
        [[ -n "${pid}" ]] && kill -TERM "${pid}" 2>/dev/null || true
    done

    if command -v warsaw >/dev/null 2>&1; then
        warsaw stop >/dev/null 2>&1 || true
    fi
    pkill -TERM -f 'warsaw|wsatspi|wsupdsl' 2>/dev/null || true
}
trap stop_services EXIT INT TERM

run_as_app() {
    setpriv --reuid="${APP_USER}" --regid="${APP_GROUP}" --init-groups \
        env HOME="${APP_HOME}" USER="${APP_USER}" LOGNAME="${APP_USER}" \
        XDG_RUNTIME_DIR="${APP_RUNTIME_DIR}" \
        DBUS_SESSION_BUS_ADDRESS="unix:path=${APP_RUNTIME_DIR}/bus" \
        DISPLAY="${VNC_DISPLAY}" "$@"
}

install -d -m 0700 -o "${APP_USER}" -g "${APP_GROUP}" \
    "${APP_HOME}/.local" \
    "${APP_HOME}/.local/share" \
    "${APP_HOME}/.local/share/pki" \
    "${NSS_DB}" \
    "${APP_RUNTIME_DIR}"

install -d -m 0755 /run/dbus
rm -f /run/dbus/pid /run/dbus/system_bus_socket
dbus-daemon --system --fork --nopidfile

for name in "${WARSAW_BINARIES[@]}"; do
    binary="${WARSAW_DIR}/${name}"
    [[ -e "${binary}" ]] || continue

    if [[ "${name}" == core ]]; then
        chattr -i "${binary}" 2>/dev/null || true
        patchelf --set-execstack "${binary}"
    fi

    if ! chattr +i "${binary}" 2>/dev/null; then
        echo "AVISO: não foi possível marcar ${binary} como imutável." >&2
        echo "Execute pelo docker-compose.yaml, que concede CAP_LINUX_IMMUTABLE." >&2
    fi
done

pkill -9 -f 'warsaw|wsatspi|wsupdsl' 2>/dev/null || true
rm -f \
    /dev/shm/wimtxWS* \
    /dev/shm/sem.WS* \
    /var/run/shm/wiservice* \
    /var/run/shm/wiuser* \
    /var/run/core.pid \
    "${APP_RUNTIME_DIR}/core.pid"

if command -v warsaw >/dev/null 2>&1; then
    warsaw start
else
    "${WARSAW_DIR}/core" >/var/log/warsaw-container.log 2>&1 &
fi

for _ in {1..30}; do
    if ss -ltn | grep -Eq '127\.0\.0\.1:(30800|30900)'; then
        echo "Warsaw ativo em $(ss -ltnH | awk '$4 ~ /127\.0\.0\.1:(30800|30900)$/ {print $4}' | paste -sd, -)"
        break
    fi
    sleep 1
done

if ! ss -ltn | grep -Eq '127\.0\.0\.1:(30800|30900)'; then
    echo "ERRO: o Warsaw não abriu as portas 30800/30900." >&2
    ps aux | grep -E '[w]arsaw|[w]satspi|[w]supdsl' >&2 || true
    [[ -f /var/log/warsaw-container.log ]] && tail -n 100 /var/log/warsaw-container.log >&2
    exit 1
fi

for _ in {1..30}; do
    [[ -s "${WARSAW_CA}" ]] && break
    sleep 1
done
if [[ ! -s "${WARSAW_CA}" ]]; then
    echo "ERRO: o Warsaw não gerou ${WARSAW_CA}." >&2
    exit 1
fi

# O Chrome 146+ usa este NSS DB no Linux. Sem a CA do Warsaw nele, o serviço
# escuta em 30900, mas o WebSocket TLS é rejeitado pelo navegador.
install -m 0644 "${WARSAW_CA}" /usr/local/share/ca-certificates/warsaw-personal-ca.crt
update-ca-certificates >/tmp/warsaw-ca-update.log

if [[ ! -f "${NSS_DB}/cert9.db" ]]; then
    run_as_app certutil -N -d "sql:${NSS_DB}" --empty-password
fi
run_as_app certutil -D -d "sql:${NSS_DB}" -n "${WARSAW_CA_NAME}" 2>/dev/null || true
run_as_app certutil -A \
    -d "sql:${NSS_DB}" \
    -n "${WARSAW_CA_NAME}" \
    -t 'C,,' \
    -i "${WARSAW_CA}"
run_as_app certutil -L -d "sql:${NSS_DB}" -n "${WARSAW_CA_NAME}" \
    >/tmp/warsaw-nss-ca.txt

warsaw_http_status=$(curl \
    --cacert "${WARSAW_CA}" \
    --silent \
    --show-error \
    --output /dev/null \
    --write-out '%{http_code}' \
    https://127.0.0.1:30900/)
if [[ "${warsaw_http_status}" != 426 ]]; then
    echo "ERRO: resposta TLS inesperada do Warsaw: HTTP ${warsaw_http_status}." >&2
    exit 1
fi
echo "CA do Warsaw confiável no NSS do Chrome; WebSocket respondeu HTTP 426."

if (( ${#VNC_PASSWORD} < 6 )); then
    echo "ERRO: VNC_PASSWORD precisa ter pelo menos 6 caracteres." >&2
    exit 1
fi
if (( ${#VNC_PASSWORD} > 8 )); then
    echo "AVISO: o protocolo VNC considera somente os primeiros 8 caracteres da senha." >&2
fi

install -d -m 1777 /tmp/.X11-unix
rm -f /tmp/.X1-lock /tmp/.X11-unix/X1
install -d -m 0700 -o "${APP_USER}" -g "${APP_GROUP}" \
    "${APP_HOME}/.vnc" \
    "${APP_HOME}/.config" \
    "${APP_HOME}/.config/dconf" \
    "${CHROME_PROFILE}" \
    "${APP_RUNTIME_DIR}"

# O Chrome 151 exibe os termos antes de abrir o DevTools em um perfil novo.
# O sentinela vazio é o mesmo que o Chrome grava depois da aceitação.
if [[ ! -e "${CHROME_PROFILE}/EULA Accepted" ]]; then
    install -o "${APP_USER}" -g "${APP_GROUP}" -m 0600 \
        /dev/null "${CHROME_PROFILE}/EULA Accepted"
fi

# O perfil fica em um volume persistente; remova apenas locks deixados pelo
# processo do Chrome que terminou junto com o contêiner anterior.
rm -f \
    "${CHROME_PROFILE}/SingletonCookie" \
    "${CHROME_PROFILE}/SingletonLock" \
    "${CHROME_PROFILE}/SingletonSocket"

printf '%s\n' "${VNC_PASSWORD}" | vncpasswd -f > "${APP_HOME}/.vnc/passwd"
chown "${APP_USER}:${APP_GROUP}" "${APP_HOME}/.vnc/passwd"
chmod 0600 "${APP_HOME}/.vnc/passwd"

run_as_app Xtigervnc "${VNC_DISPLAY}" \
    -geometry "${VNC_GEOMETRY}" \
    -depth 24 \
    -rfbauth "${APP_HOME}/.vnc/passwd" \
    -rfbport "${VNC_PORT}" \
    -localhost yes \
    -SecurityTypes VncAuth \
    -AlwaysShared \
    -desktop "Licitações-e" \
    >/tmp/tigervnc.log 2>&1 &
vnc_pid=$!

for _ in {1..30}; do
    [[ -S /tmp/.X11-unix/X1 ]] && break
    kill -0 "${vnc_pid}" 2>/dev/null || break
    sleep 0.5
done
if [[ ! -S /tmp/.X11-unix/X1 ]]; then
    echo "ERRO: o TigerVNC não criou a tela ${VNC_DISPLAY}." >&2
    tail -n 100 /tmp/tigervnc.log >&2 || true
    exit 1
fi

run_as_app websockify --web=/usr/share/novnc 0.0.0.0:6080 "127.0.0.1:${VNC_PORT}" \
    >/tmp/novnc.log 2>&1 &
novnc_pid=$!

rm -f "${APP_RUNTIME_DIR}/bus"
session_dbus_pid=$(run_as_app dbus-daemon \
    --session \
    --fork \
    --address="unix:path=${APP_RUNTIME_DIR}/bus" \
    --nopidfile \
    --print-pid=1)

run_as_app mate-session >/tmp/mate-session.log 2>&1 &
mate_pid=$!
sleep 3

# O Warsaw usa uma instância de serviço root e outra por usuário gráfico.
# A instância do usuário permite que o módulo inspecione o Chrome sem conceder
# SYS_PTRACE ao contêiner.
run_as_app "${WARSAW_DIR}/core" >/tmp/warsaw-user.log 2>&1
for _ in {1..30}; do
    if pgrep -U "${APP_UID}" -fx "${WARSAW_DIR}/core" >/dev/null; then
        break
    fi
    sleep 1
done
if ! pgrep -U "${APP_UID}" -fx "${WARSAW_DIR}/core" >/dev/null; then
    echo "ERRO: a instância gráfica do Warsaw não iniciou." >&2
    tail -n 100 /tmp/warsaw-user.log >&2 || true
    exit 1
fi
echo "Warsaw ativo para root e para o usuário ${APP_USER}."

rm -f /tmp/licitacoes-login-ready
run_as_app "$@" >/tmp/browser-automation.log 2>&1 &
browser_pid=$!

echo "noVNC disponível na porta 6080 (tela ${VNC_GEOMETRY})."

status=0
wait -n "${vnc_pid}" "${novnc_pid}" "${mate_pid}" "${browser_pid}" || status=$?
echo "ERRO: um processo da sessão gráfica terminou (status ${status})." >&2
tail -n 80 \
    /tmp/tigervnc.log \
    /tmp/novnc.log \
    /tmp/mate-session.log \
    /tmp/warsaw-user.log \
    /tmp/browser-automation.log >&2 || true
exit "${status}"