65 lines
3.5 KiB
Bash
Executable File
65 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
[[ ${EUID} -eq 0 ]] || { echo "root required" >&2; exit 1; }
|
|
ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)
|
|
CONFIG=${1:-/etc/aios-codex-watcher/config.json}
|
|
[[ "$CONFIG" = /* ]] || { echo "config path must be absolute" >&2; exit 1; }
|
|
[[ -f "$CONFIG" && ! -L "$CONFIG" ]] || { echo "pre-provisioned regular config required" >&2; exit 1; }
|
|
|
|
for path in \
|
|
services/aios_codex_watcher/__init__.py \
|
|
services/aios_codex_watcher/__main__.py \
|
|
services/aios_codex_watcher/watcher.py \
|
|
systemd/aios-codex-watcher.service \
|
|
systemd/aios-codex-watcher.timer \
|
|
systemd/aios-codex-watcher.sysusers \
|
|
systemd/aios-codex-watcher.tmpfiles; do
|
|
[[ -f "$ROOT/$path" && ! -L "$ROOT/$path" ]] || { echo "missing or unsafe: $path" >&2; exit 1; }
|
|
done
|
|
|
|
digest=$(sha256sum \
|
|
"$ROOT/services/aios_codex_watcher/__init__.py" \
|
|
"$ROOT/services/aios_codex_watcher/__main__.py" \
|
|
"$ROOT/services/aios_codex_watcher/watcher.py" | sha256sum | awk '{print $1}')
|
|
release="/opt/aios-codex-watcher/releases/$digest"
|
|
install -d -o root -g root -m 0755 "$release/services/aios_codex_watcher" "$release/bin"
|
|
install -o root -g root -m 0644 "$ROOT/services/aios_codex_watcher/"*.py "$release/services/aios_codex_watcher/"
|
|
|
|
launcher="$release/bin/aios-codex-watcher"
|
|
printf '%s\n' '#!/usr/bin/env bash' 'set -euo pipefail' \
|
|
"export PYTHONPATH='$release'" \
|
|
"exec /usr/bin/python3 -m services.aios_codex_watcher \"\$@\"" >"$launcher"
|
|
chown root:root "$launcher"
|
|
chmod 0755 "$launcher"
|
|
|
|
install -d -o root -g root -m 0755 /opt/aios-codex-watcher /etc/aios-codex-watcher
|
|
ln -sfn "releases/$digest" /opt/aios-codex-watcher/current.new
|
|
mv -Tf /opt/aios-codex-watcher/current.new /opt/aios-codex-watcher/current
|
|
install -o root -g root -m 0644 "$ROOT/systemd/aios-codex-watcher.service" /etc/systemd/system/
|
|
install -o root -g root -m 0644 "$ROOT/systemd/aios-codex-watcher.timer" /etc/systemd/system/
|
|
install -o root -g root -m 0644 "$ROOT/systemd/aios-codex-watcher.sysusers" /usr/lib/sysusers.d/
|
|
install -o root -g root -m 0644 "$ROOT/systemd/aios-codex-watcher.tmpfiles" /usr/lib/tmpfiles.d/
|
|
systemd-sysusers /usr/lib/sysusers.d/aios-codex-watcher.sysusers
|
|
systemd-tmpfiles --create /usr/lib/tmpfiles.d/aios-codex-watcher.tmpfiles
|
|
commands=/data/aios-gitops/workspace/agents/commands
|
|
for directory in "$commands/active" "$commands/completed"; do
|
|
[[ -d "$directory" && ! -L "$directory" ]] || { echo "missing or unsafe command directory: $directory" >&2; exit 1; }
|
|
[[ $(stat -c '%U:%G' "$directory") == aios-orchestrator:aios-orchestrator ]] || { echo "unexpected command directory owner: $directory" >&2; exit 1; }
|
|
mode=$(stat -c '%a' "$directory")
|
|
(( (8#$mode & 2) == 0 )) || { echo "world-writable command directory: $directory" >&2; exit 1; }
|
|
done
|
|
if [[ -e "$commands/dead-letter" || -L "$commands/dead-letter" ]]; then
|
|
[[ -d "$commands/dead-letter" && ! -L "$commands/dead-letter" ]] || { echo "unsafe dead-letter directory" >&2; exit 1; }
|
|
else
|
|
install -d -o aios-orchestrator -g aios-orchestrator -m 0750 "$commands/dead-letter"
|
|
fi
|
|
[[ $(stat -c '%U:%G' "$commands/dead-letter") == aios-orchestrator:aios-orchestrator ]] || { echo "unexpected dead-letter owner" >&2; exit 1; }
|
|
mode=$(stat -c '%a' "$commands/dead-letter")
|
|
(( (8#$mode & 2) == 0 )) || { echo "world-writable dead-letter directory" >&2; exit 1; }
|
|
printf '{"release_sha256":"%s","installed_at":"%s"}\n' "$digest" "$(date -u +%FT%TZ)" >"$release/receipt.json"
|
|
chmod 0644 "$release/receipt.json"
|
|
systemctl daemon-reload
|
|
systemctl enable --now aios-codex-watcher.timer
|
|
printf 'installed_sha256=%s\n' "$digest"
|