SyslogSolution/prose-contracts
7
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

no-mistakes(review): reprobe dsh tokens; persist pending nginx reload on failure

Browse Source
This commit is contained in:
abiba-bot
2026-09-11 17:12:11 +00:00
parent c66671dbee
commit 288f74cf84
2 changed files with 20 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/capture-dsh-token.sh
+12 -7
View File
@@ -34,6 +34,7 @@ JOURNAL_UNIT="dsh-web.service"
TOKEN_FILE="/etc/dsh-web/launch-token"
INCLUDE_FILE="/etc/dsh-web/nginx-login.conf"
STAMP_FILE="/etc/dsh-web/nginx-login.conf.applied"
PENDING_FILE="/etc/dsh-web/nginx-reload.pending"
SITE_ENABLED="/etc/nginx/sites-enabled/dsh"
LEGACY_8081="/etc/nginx/sites-enabled/dsh.token"
STASH_DIR="/etc/nginx/sites-available"
@@ -50,6 +51,7 @@ die() { printf 'capture-dsh-token: ERROR: %s\n' "$*" >&2; exit 1; }
# ── 0. Serialize runs so timer/ExecStartPost/manual runs cannot interleave ──
exec 9>"$LOCK_FILE"
flock -n 9 || { log "another capture-dsh-token run holds $LOCK_FILE; exiting"; exit 0; }
mkdir -p "$(dirname "$PENDING_FILE")"
# ── 1. Remove the legacy unauthenticated :8081 endpoint, if present ─────────
# It bypassed Authentik entirely (listened on 0.0.0.0:8081 with no auth_request)
@@ -58,12 +60,14 @@ if [ -e "$LEGACY_8081" ] || [ -L "$LEGACY_8081" ]; then
TS="$(date -u +%Y%m%dT%H%M%SZ)"
STASHED="$STASH_DIR/dsh.token.disabled-$TS"
mv "$LEGACY_8081" "$STASHED"
touch "$PENDING_FILE"
if ! nginx -t >/dev/null 2>&1; then
die "nginx config test failed after disabling $LEGACY_8081 (kept disabled at $STASHED). Fix the nginx config and rerun; the legacy :8081 endpoint will NOT be restored."
die "nginx config test failed after disabling $LEGACY_8081 (kept disabled at $STASHED); a pending reload is recorded so running nginx is reloaded once the config is fixed. The legacy :8081 endpoint will NOT be restored."
fi
if ! nginx -s reload; then
die "nginx reload failed after disabling $LEGACY_8081 (kept disabled at $STASHED). Fix nginx and rerun; the legacy :8081 endpoint will NOT be restored."
die "nginx reload failed after disabling $LEGACY_8081 (kept disabled at $STASHED); a pending reload is recorded so running nginx is reloaded on the next run. The legacy :8081 endpoint will NOT be restored."
fi
rm -f "$PENDING_FILE"
log "removed legacy :8081 endpoint -> $STASHED"
fi
@@ -83,12 +87,9 @@ collect_tokens() {
}
TOKEN=""
TRIED=" "
DEADLINE=$((SECONDS + TOKEN_WAIT))
while [ -z "$TOKEN" ] && [ "$SECONDS" -lt "$DEADLINE" ]; do
for cand in $(collect_tokens); do
case "$TRIED" in *" $cand "*) continue ;; esac
TRIED="$TRIED$cand "
code="$(curl -s -o /dev/null --max-time 5 -w '%{http_code}' \
-H "Host: $LOGIN_HOST" "$LOGIN_UPSTREAM/?token=$cand" || true)"
if [ "$code" = "303" ]; then
@@ -126,7 +127,8 @@ chmod 600 "$NEW_INCLUDE"
APPLIED=""
[ -f "$STAMP_FILE" ] && APPLIED="$(cat "$STAMP_FILE" 2>/dev/null || true)"
if [ "$APPLIED" = "$TOKEN" ] && [ -f "$INCLUDE_FILE" ] && cmp -s "$NEW_INCLUDE" "$INCLUDE_FILE"; then
if [ "$APPLIED" = "$TOKEN" ] && [ -f "$INCLUDE_FILE" ] && cmp -s "$NEW_INCLUDE" "$INCLUDE_FILE" \
&& [ ! -e "$PENDING_FILE" ]; then
rm -f "$NEW_INCLUDE"
log "token unchanged; nginx not reloaded"
exit 0
@@ -158,13 +160,16 @@ if ! nginx -s reload; then
else
rm -f "$INCLUDE_FILE"
fi
die "nginx reload failed; previous include restored; will retry next run"
touch "$PENDING_FILE"
die "nginx reload failed; previous include restored; a pending reload is recorded so the next run retries"
fi
if [ -n "$RESTORE" ]; then
rm -f "$RESTORE"
fi
rm -f "$PENDING_FILE"
printf '%s\n' "$TOKEN" > "$STAMP_FILE.tmp"
chmod 600 "$STAMP_FILE.tmp"
mv "$STAMP_FILE.tmp" "$STAMP_FILE"