chore(home): mirror from kalinamall (b0abf99) with papatramp URLs
This commit is contained in:
@@ -0,0 +1,41 @@
|
||||
#!/bin/bash
|
||||
# Проверка готовности хоста к пилоту UseSAC=exclusive (фаза 2.1).
|
||||
set -euo pipefail
|
||||
|
||||
CONFIG="${CONFIG_FILE:-/etc/ssh-monitor.conf}"
|
||||
MONITOR="${SSH_MONITOR_BIN:-/usr/local/bin/ssh-monitor}"
|
||||
|
||||
if [ -f "$CONFIG" ]; then
|
||||
# shellcheck disable=SC1090
|
||||
. "$CONFIG"
|
||||
fi
|
||||
|
||||
fail=0
|
||||
ok() { printf '[OK] %s\n' "$1"; }
|
||||
bad() { printf '[FAIL] %s\n' "$1"; fail=1; }
|
||||
|
||||
mode="$(printf '%s' "${UseSAC:-off}" | tr '[:upper:]' '[:lower:]')"
|
||||
[ "$mode" = "exclusive" ] || bad "UseSAC должен быть exclusive (сейчас: ${UseSAC:-off})"
|
||||
[ -n "${SAC_URL:-}" ] && [ -n "${SAC_API_KEY:-}" ] || bad "Задайте SAC_URL и SAC_API_KEY"
|
||||
[ -x "$MONITOR" ] || bad "Не найден $MONITOR"
|
||||
[ -f "${MONITOR%/*}/sac-client.sh" ] || bad "Нет sac-client.sh рядом с ssh-monitor"
|
||||
|
||||
if "$MONITOR" --check-sac; then
|
||||
ok "--check-sac"
|
||||
else
|
||||
bad "--check-sac"
|
||||
fi
|
||||
|
||||
spool="${SAC_SPOOL_DIR:-/var/lib/ssh-monitor/sac-spool}"
|
||||
pending=0
|
||||
if [ -d "$spool" ]; then
|
||||
pending=$(find "$spool" -maxdepth 1 -name '*.json' 2>/dev/null | wc -l)
|
||||
fi
|
||||
printf ' Spool %s: %s файл(ов)\n' "$spool" "$pending"
|
||||
|
||||
if [ "$fail" -eq 0 ]; then
|
||||
printf '\nПилот exclusive: хост готов. Сгенерируйте SSH/sudo событие и проверьте только в SAC UI.\n'
|
||||
exit 0
|
||||
fi
|
||||
printf '\nИсправьте ошибки выше.\n'
|
||||
exit 1
|
||||
@@ -0,0 +1,156 @@
|
||||
#!/usr/bin/env bash
|
||||
# Публичный snapshot на github: без prod URL, токенов и kalinamall-only путей.
|
||||
set -Eeuo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/ssh-monitor-github-snapshot.XXXX")"
|
||||
trap 'rm -rf "$WORK"' EXIT
|
||||
|
||||
REF="${1:-HEAD}"
|
||||
VERSION="$(git -C "$ROOT" show "$REF":version.txt 2>/dev/null | tr -d '[:space:]' || true)"
|
||||
MSG="${2:-chore: public release ${VERSION:-snapshot} (SSH Monitor, no Cursor IDE traces)}"
|
||||
|
||||
echo "[snapshot] export $REF -> $WORK"
|
||||
git -C "$ROOT" archive --format=tar "$REF" \
|
||||
| tar -x -C "$WORK" \
|
||||
--exclude='.cursor' \
|
||||
--exclude='.env'
|
||||
|
||||
apply_sed() {
|
||||
local expr=$1
|
||||
if [[ "$(uname -s)" == Darwin ]]; then
|
||||
find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
|
||||
! -path '*/scripts/push-github-snapshot.sh' \
|
||||
-print0 | xargs -0 sed -i '' -E "$expr" 2>/dev/null || true
|
||||
else
|
||||
find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
|
||||
! -path '*/scripts/push-github-snapshot.sh' \
|
||||
-print0 | xargs -0 sed -i -E "$expr" 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
echo "[snapshot] rewrite hosts and internal URLs"
|
||||
apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
|
||||
apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
|
||||
apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
|
||||
apply_sed 's#git\.kalinamall\.ru#github.com#g'
|
||||
apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
|
||||
apply_sed 's#remote add kalinamall#remote add origin#g'
|
||||
apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
|
||||
apply_sed 's#local name=kalinamall#local name=origin#g'
|
||||
apply_sed 's#всегда kalinamall#всегда origin#g'
|
||||
|
||||
cat >"$WORK/.gitignore" <<'EOF'
|
||||
.DS_Store
|
||||
CalculatorApp/
|
||||
.env
|
||||
.env.*
|
||||
ssh-monitor.conf
|
||||
ssh-monitor-*.tar.gz
|
||||
rutube-download.py
|
||||
.ytdl-archive.txt
|
||||
EOF
|
||||
|
||||
cat >"$WORK/ssh-monitor.conf.example" <<'EOF'
|
||||
# Example configuration — copy to /etc/ssh-monitor.conf and chmod 600.
|
||||
# Never commit real tokens or passwords to git.
|
||||
|
||||
TELEGRAM_BOT_TOKEN="YOUR_TELEGRAM_BOT_TOKEN"
|
||||
TELEGRAM_CHAT_ID="YOUR_TELEGRAM_CHAT_ID"
|
||||
|
||||
# At least one notification channel (telegram or email) is required.
|
||||
NOTIFY_ORDER=""
|
||||
|
||||
# Security Alert Center (optional)
|
||||
USE_SAC="off"
|
||||
SAC_URL="https://sac.example.com/api/v1/events"
|
||||
# SAC_API_KEY="your-ingest-api-key"
|
||||
|
||||
# SMTP (optional, requires python3)
|
||||
MAIL_SMTP_HOST=""
|
||||
MAIL_SMTP_PORT="587"
|
||||
MAIL_SMTP_USER=""
|
||||
MAIL_SMTP_PASSWORD=""
|
||||
MAIL_FROM=""
|
||||
MAIL_TO=""
|
||||
MAIL_SMTP_STARTTLS="1"
|
||||
MAIL_SMTP_SSL="0"
|
||||
|
||||
# Auto-update script default (override on your server)
|
||||
# REPO_URL=https://git.papatramp.ru/PapaTramp/ssh-monitor.git
|
||||
EOF
|
||||
|
||||
if [[ -f "$WORK/README.md" ]]; then
|
||||
python3 - "$WORK/README.md" <<'PY'
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
path = pathlib.Path(sys.argv[1])
|
||||
text = path.read_text(encoding="utf-8")
|
||||
text = "".join(
|
||||
line for line in text.splitlines(keepends=True)
|
||||
if not line.startswith("> **Закрытый инстанс Gitea:**")
|
||||
)
|
||||
header = "# ssh-monitor\n\n**Версия:**"
|
||||
if header in text and "Bash monitor for" not in text.split("**Версия:**", 1)[0]:
|
||||
text = text.replace(
|
||||
header,
|
||||
"""# ssh-monitor
|
||||
|
||||
Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram/SMTP alerts, optional IP ban (ipset/iptables), daily report, SAC integration.
|
||||
|
||||
**Repository:** https://git.papatramp.ru/PapaTramp/ssh-monitor
|
||||
|
||||
# ssh-monitor
|
||||
|
||||
**Версия:**""",
|
||||
1,
|
||||
)
|
||||
old = "## Лицензия\n\nПроект распространяется по лицензии **MIT** — см. файл [LICENSE](LICENSE).\n"
|
||||
new = """## Topics (GitHub)
|
||||
|
||||
`ssh`, `linux`, `telegram-bot`, `smtp`, `iptables`, `ipset`, `systemd`, `security`, `monitoring`, `openssh`
|
||||
|
||||
## License
|
||||
|
||||
MIT — see [LICENSE](LICENSE). Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.
|
||||
|
||||
<details>
|
||||
<summary><strong>English summary</strong></summary>
|
||||
|
||||
Single-file Bash agent parsing journalctl, notification chain, brute-force IP blocking, heartbeat, optional Prometheus textfile and Security Alert Center ingest via sac-client.sh.
|
||||
|
||||
</details>
|
||||
"""
|
||||
if old not in text:
|
||||
raise SystemExit("README footer block not found; update push-github-snapshot.sh")
|
||||
path.write_text(text.replace(old, new), encoding="utf-8")
|
||||
PY
|
||||
fi
|
||||
|
||||
if [[ -f "$WORK/LICENSE" ]]; then
|
||||
if [[ "$(uname -s)" == Darwin ]]; then
|
||||
sed -i '' 's/Copyright \(c\) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
|
||||
else
|
||||
sed -i 's/Copyright (c) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "[snapshot] secret scan"
|
||||
if grep -R -E 'AAE[a-zA-Z0-9_-]{30,}|sac_[A-Za-z0-9]{20,}|[0-9]{8,}:[A-Za-z0-9_-]{30,}' "$WORK" 2>/dev/null; then
|
||||
echo " BLOCKED: possible secrets in snapshot tree"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[snapshot] git commit in temp repo"
|
||||
cd "$WORK"
|
||||
git init -q
|
||||
git checkout -q -b main
|
||||
git add -A
|
||||
git -c user.name="Andrey Lutsenko" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
|
||||
|
||||
echo "[snapshot] push github main (force snapshot)"
|
||||
git remote add github "$(git -C "$ROOT" remote get-url github)"
|
||||
git push github main --force
|
||||
|
||||
echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"
|
||||
Reference in New Issue
Block a user