44 lines
3.2 KiB
YAML
44 lines
3.2 KiB
YAML
# nh3-dev PHASE B of the v0.0.14 rollout: connector base 0.0.10 + app-terminal 0.0.5 (release 3726d73 already built beside
|
|
# the live one in /opt/svos/releases/3726d73). Adds [seat_host].scan_patterns (hermes's threat-pattern table) and restarts
|
|
# ONLY svos-terminal; postoffice, miranda and agent keep their running code until their next restart. Terminal's manifest
|
|
# adds the `scan` read verb: registration raises ONE card, and the app refuses wrong-revision until Prime approves it.
|
|
# Run as: scripts/elway infra-ops@10.100.10.50 (the apps are lkraven USER units, driven with runuser + XDG_RUNTIME_DIR).
|
|
steps:
|
|
- name: Release 3726d73 is built and pip-clean
|
|
shell: test -f /opt/svos/releases/3726d73/release.json && /home/lkraven/bin/uv pip check --python /opt/svos/releases/3726d73/apps-env/bin/python | tail -1
|
|
changed_when: "false"
|
|
- name: Back up terminal.toml, then add scan_patterns under [seat_host]
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
p=/var/lib/svos/config/apps/terminal.toml
|
|
runuser -u lkraven -- cp -p $p $p.pre-3726d73
|
|
runuser -u lkraven -- python3 - <<'PY'
|
|
import os
|
|
p = "/var/lib/svos/config/apps/terminal.toml"; s = open(p).read()
|
|
anchor = 'tasks_root = "/var/lib/svos/apps/terminal/tasks" # U15 (v0.0.11): = the kernel\'s [tasks].scratch_root\n'
|
|
assert s.count(anchor) == 1 and "scan_patterns" not in s
|
|
s = s.replace(anchor, anchor + 'scan_patterns = "/home/lkraven/.hermes/hermes-agent/tools/threat_patterns.py" # U15 v0.7 (v0.0.14): hermes\'s own threat table; /health then says scan: on\n')
|
|
t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
|
with os.fdopen(fd, "w") as f: f.write(s)
|
|
os.replace(t, p); print("edited")
|
|
PY
|
|
- name: Switch current to 3726d73 (as lkraven, who owns /opt/svos on nh3-dev)
|
|
sudo: true
|
|
shell: runuser -u lkraven -- sh -c 'ln -sfn /opt/svos/releases/3726d73 /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current'
|
|
- name: Restart ONLY svos-terminal
|
|
sudo: true
|
|
shell: |
|
|
runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemctl --user restart svos-terminal
|
|
sleep 6; runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemctl --user is-active svos-terminal
|
|
pid=$(runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemctl --user show svos-terminal -p MainPID --value); grep -oE '/opt/svos/releases/[0-9a-f]+' /proc/$pid/maps | sort -u
|
|
runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 journalctl --user -u svos-terminal --since "-60s" --no-pager -o cat | grep -i -E "scan|manifest|card|held|revision|error" | tail -8 | cut -c1-200
|
|
verify:
|
|
- name: Terminal runs 3726d73 and logged its scan table (its /health needs a signed request, so read the log)
|
|
sudo: true
|
|
shell: |
|
|
pid=$(runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemctl --user show svos-terminal -p MainPID --value)
|
|
grep -q /opt/svos/releases/3726d73 /proc/$pid/maps && echo "terminal pid $pid on 3726d73"
|
|
runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 journalctl --user -u svos-terminal --since "-5min" --no-pager -o cat | grep -i scan | tail -3
|
|
changed_when: "false"
|