chore(home): mirror from kalinamall (9883e6a) with papatramp URLs
This commit is contained in:
@@ -0,0 +1,38 @@
|
||||
#Requires -Version 5.1
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Удалённый sudo на SAC-сервере без интерактивного ввода.
|
||||
Пароль: Password из ssh-setup/local/kalinamall-sac.conf
|
||||
#>
|
||||
[CmdletBinding()]
|
||||
param(
|
||||
[string]$HostAlias = 'sac.kalinamall.ru',
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$RemoteCommand,
|
||||
[string]$PasswordFile = (Join-Path $HOME 'Projects\Answer.and.other.shit\scripts\ssh-setup\local\kalinamall-sac.conf')
|
||||
)
|
||||
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
function Read-ConfigFile {
|
||||
param([string]$Path)
|
||||
$data = @{}
|
||||
if (-not (Test-Path -LiteralPath $Path)) { throw "Config not found: $Path" }
|
||||
Get-Content -LiteralPath $Path | ForEach-Object {
|
||||
if ($_ -match '^([^#=]+)=(.*)$') {
|
||||
$data[$Matches[1].Trim()] = $Matches[2].Trim()
|
||||
}
|
||||
}
|
||||
return $data
|
||||
}
|
||||
|
||||
$cfg = Read-ConfigFile -Path $PasswordFile
|
||||
$password = $cfg['Password']
|
||||
if (-not $password) {
|
||||
throw "Password not found in $PasswordFile"
|
||||
}
|
||||
|
||||
$inner = $RemoteCommand.Replace("'", "'\\''")
|
||||
$remote = "sudo -S -p '' bash -lc '$inner'"
|
||||
$password | & ssh -o BatchMode=yes -o ConnectTimeout=15 $HostAlias $remote
|
||||
@@ -0,0 +1,53 @@
|
||||
#!/usr/bin/env bash
|
||||
# Одноразовый hotfix: увеличить proxy_read_timeout для долгих SSH/WinRM API.
|
||||
# Запуск на SAC-сервере: sudo bash patch-nginx-sac-long-timeout.sh
|
||||
set -euo pipefail
|
||||
|
||||
CFG="${SAC_NGINX_SITE:-/etc/nginx/sites-available/sac}"
|
||||
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
echo "Run as root: sudo bash $0" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ ! -f "$CFG" ]]; then
|
||||
echo "Config not found: $CFG" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if grep -q 'agent-update-fallback' "$CFG"; then
|
||||
echo "Already patched: $CFG"
|
||||
else
|
||||
cp "$CFG" "${CFG}.bak-$(date +%Y%m%d%H%M%S)"
|
||||
python3 - "$CFG" <<'PY'
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
path = Path(sys.argv[1])
|
||||
text = path.read_text(encoding="utf-8")
|
||||
block = """
|
||||
# SSH/WinRM и git-probe: backend ждёт до 900s
|
||||
location ~ ^/api/v1/(hosts/[0-9]+/actions/(agent-update|agent-update-fallback|ssh-test|winrm-test)|settings/agent-updates/test-git) {
|
||||
proxy_pass http://sac_api;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 30s;
|
||||
proxy_send_timeout 960s;
|
||||
proxy_read_timeout 960s;
|
||||
}
|
||||
|
||||
"""
|
||||
needle = " location / {"
|
||||
if needle not in text:
|
||||
raise SystemExit(f"needle not found in {path}")
|
||||
path.write_text(text.replace(needle, block + needle, 1), encoding="utf-8")
|
||||
print(f"Patched {path}")
|
||||
PY
|
||||
fi
|
||||
|
||||
nginx -t
|
||||
systemctl reload nginx
|
||||
echo "nginx reloaded OK"
|
||||
@@ -0,0 +1,21 @@
|
||||
#!/usr/bin/env python3
|
||||
import sys
|
||||
sys.path.insert(0, "/opt/security-alert-center/backend")
|
||||
|
||||
from app.database import SessionLocal
|
||||
from app.services.agent_update_settings import get_effective_agent_update_config
|
||||
from app.services.agent_git_release import get_git_release_versions
|
||||
|
||||
db = SessionLocal()
|
||||
try:
|
||||
cfg = get_effective_agent_update_config(db)
|
||||
print("cfg rdp:", cfg.rdp_git_repo_url)
|
||||
print("cfg ssh:", cfg.ssh_git_repo_url)
|
||||
print("cfg branch:", cfg.git_branch)
|
||||
r = get_git_release_versions(cfg, db=db, force_refresh=True)
|
||||
print("versions:", r.versions)
|
||||
print("errors:", r.errors)
|
||||
print("from_cache:", r.from_cache)
|
||||
print("fetched_at:", r.fetched_at)
|
||||
finally:
|
||||
db.close()
|
||||
@@ -0,0 +1,82 @@
|
||||
#!/usr/bin/env bash
|
||||
# Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP.
|
||||
set -Eeuo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/sac-github-snapshot.XXXX")"
|
||||
trap 'rm -rf "$WORK"' EXIT
|
||||
|
||||
REF="${1:-HEAD}"
|
||||
MSG="${2:-chore: public release snapshot $(date +%F) (SAC $(git -C "$ROOT" show -s --format=%s "$REF" | sed -n 's/.*(\([0-9.]*\)).*/\1/p' | head -1))}"
|
||||
|
||||
echo "[snapshot] export $REF -> $WORK"
|
||||
git -C "$ROOT" archive --format=tar "$REF" \
|
||||
| tar -x -C "$WORK" \
|
||||
--exclude='.cursor' \
|
||||
--exclude='.venv' \
|
||||
--exclude='frontend/node_modules' \
|
||||
--exclude='frontend/dist' \
|
||||
--exclude='.env' \
|
||||
--exclude='deploy/.env'
|
||||
|
||||
apply_sed() {
|
||||
local expr=$1
|
||||
if [[ "$(uname -s)" == Darwin ]]; then
|
||||
find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
|
||||
! -path '*/tools/push-github-snapshot.sh' \
|
||||
-print0 | xargs -0 sed -i '' -E "$expr"
|
||||
else
|
||||
find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
|
||||
! -path '*/tools/push-github-snapshot.sh' \
|
||||
-print0 | xargs -0 sed -i -E "$expr"
|
||||
fi
|
||||
}
|
||||
|
||||
echo "[snapshot] rewrite hosts, domains, logins, IPs"
|
||||
apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
|
||||
apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
|
||||
apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
|
||||
apply_sed 's#git\.papatramp\.ru/PapaTramp#github.com/PTah#g'
|
||||
apply_sed 's#git\.papatramp\.lan:[0-9]+/PapaTramp#github.com/PTah#g'
|
||||
apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
|
||||
apply_sed 's#git\.kalinamall\.lan#github.com#g'
|
||||
apply_sed 's#kalinamall-sac\.conf#origin-sac.conf#g'
|
||||
apply_sed 's#remote add kalinamall#remote add origin#g'
|
||||
apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
|
||||
apply_sed 's#B26\\\\#CONTOSO\\\\#g'
|
||||
apply_sed 's#B26\\#CONTOSO\\#g'
|
||||
apply_sed 's#papatramp#example.user#g'
|
||||
apply_sed 's#PapaTramp#PTah#g'
|
||||
apply_sed 's#192\.168\.160\.#192.0.2.#g'
|
||||
apply_sed 's#192\.168\.128\.#192.0.2.#g'
|
||||
apply_sed 's#192\.168\.163\.#192.0.2.#g'
|
||||
apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g'
|
||||
apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g"
|
||||
apply_sed 's#postgresql\+psycopg2://sac:sac@#postgresql+psycopg2://sac:CHANGE_ME@#g'
|
||||
|
||||
if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then
|
||||
sed -i.bak '1a\
|
||||
_TEST_PASSWORD = "test-only"
|
||||
' "$WORK/backend/tests/conftest.py" && rm -f "$WORK/backend/tests/conftest.py.bak"
|
||||
fi
|
||||
|
||||
echo "[snapshot] git commit in temp repo"
|
||||
cd "$WORK"
|
||||
git init -q
|
||||
git checkout -q -b main
|
||||
git add -A
|
||||
git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
|
||||
|
||||
echo "[snapshot] secret scan (private keys only)"
|
||||
while IFS= read -r -d '' f; do
|
||||
if grep -q 'BEGIN OPENSSH PRIVATE KEY' "$f" 2>/dev/null || grep -q 'BEGIN RSA PRIVATE KEY' "$f" 2>/dev/null; then
|
||||
echo " BLOCKED: $f (private key)"
|
||||
exit 1
|
||||
fi
|
||||
done < <(find . -type f -print0)
|
||||
|
||||
echo "[snapshot] push github main (force snapshot)"
|
||||
git remote add github "$(git -C "$ROOT" remote get-url github)"
|
||||
git push github main --force
|
||||
|
||||
echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"
|
||||
@@ -0,0 +1,30 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Run agent git fetch test on SAC server."""
|
||||
import subprocess
|
||||
|
||||
SUDO_PW = "[eqyfhskj\n"
|
||||
REMOTE_CMD = (
|
||||
"set -e\n"
|
||||
"TMP=$(mktemp -d)\n"
|
||||
'trap "rm -rf \\"$TMP\\"" EXIT\n'
|
||||
"git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git \"$TMP/rdp\"\n"
|
||||
"git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/ssh-monitor.git \"$TMP/ssh\"\n"
|
||||
"echo RDP_version_txt:\n"
|
||||
"cat \"$TMP/rdp/version.txt\" 2>/dev/null || echo missing\n"
|
||||
"echo RDP_script:\n"
|
||||
"grep -m1 ScriptVersion \"$TMP/rdp/Login_Monitor.ps1\" 2>/dev/null || echo missing\n"
|
||||
"echo SSH_version:\n"
|
||||
"grep -m1 '^SSH_MONITOR_VERSION=' \"$TMP/ssh/ssh-monitor\" 2>/dev/null || cat \"$TMP/ssh/version.txt\" 2>/dev/null || echo missing\n"
|
||||
)
|
||||
|
||||
r = subprocess.run(
|
||||
["ssh", "sac.kalinamall.ru", "sudo", "-S", "-u", "sac", "bash", "-s"],
|
||||
input=SUDO_PW + REMOTE_CMD,
|
||||
text=True,
|
||||
capture_output=True,
|
||||
timeout=120,
|
||||
)
|
||||
print(r.stdout)
|
||||
if r.stderr:
|
||||
print("STDERR:", r.stderr[-400:])
|
||||
print("exit", r.returncode)
|
||||
@@ -0,0 +1,12 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
TMP=$(mktemp -d)
|
||||
trap 'rm -rf "$TMP"' EXIT
|
||||
git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git "$TMP/rdp"
|
||||
git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/ssh-monitor.git "$TMP/ssh"
|
||||
echo RDP_version_txt:
|
||||
cat "$TMP/rdp/version.txt" 2>/dev/null || echo missing
|
||||
echo RDP_script:
|
||||
grep -m1 ScriptVersion "$TMP/rdp/Login_Monitor.ps1" 2>/dev/null || echo missing
|
||||
echo SSH_version:
|
||||
grep -m1 '^SSH_MONITOR_VERSION=' "$TMP/ssh/ssh-monitor" 2>/dev/null || cat "$TMP/ssh/version.txt" 2>/dev/null || echo missing
|
||||
Reference in New Issue
Block a user