From 141a841f6f8970f3224b179c4d69458878d38bc6 Mon Sep 17 00:00:00 2001 From: PTah Date: Tue, 7 Jul 2026 20:27:44 +1000 Subject: [PATCH] docs: sync README version 2.1.6-SAC; add push-github-snapshot.sh --- README.md | 4 +- scripts/push-github-snapshot.sh | 149 ++++++++++++++++++++++++++++++++ 2 files changed, 151 insertions(+), 2 deletions(-) create mode 100755 scripts/push-github-snapshot.sh diff --git a/README.md b/README.md index 5375a4a..84ea0fa 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ -# ssh-monitor +# ssh-monitor -**Версия:** `2.1.5-SAC` +**Версия:** `2.1.6-SAC` Bash-мониторинг **SSH**, **sudo**, **systemd-logind**: Telegram/email, бан IP (ipset), ежедневный отчёт, heartbeat. diff --git a/scripts/push-github-snapshot.sh b/scripts/push-github-snapshot.sh new file mode 100755 index 0000000..9a8e2dd --- /dev/null +++ b/scripts/push-github-snapshot.sh @@ -0,0 +1,149 @@ +#!/usr/bin/env bash +# Публичный snapshot на github: без prod URL, токенов и kalinamall-only путей. +set -Eeuo pipefail + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +WORK="$(mktemp -d "${TMPDIR:-/tmp}/ssh-monitor-github-snapshot.XXXX")" +trap 'rm -rf "$WORK"' EXIT + +REF="${1:-HEAD}" +VERSION="$(git -C "$ROOT" show "$REF":version.txt 2>/dev/null | tr -d '[:space:]' || true)" +MSG="${2:-chore: public release ${VERSION:-snapshot} (SSH Monitor, no Cursor IDE traces)}" + +echo "[snapshot] export $REF -> $WORK" +git -C "$ROOT" archive --format=tar "$REF" \ + | tar -x -C "$WORK" \ + --exclude='.cursor' \ + --exclude='.env' + +apply_sed() { + local expr=$1 + if [[ "$(uname -s)" == Darwin ]]; then + find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \ + ! -path '*/scripts/push-github-snapshot.sh' \ + -print0 | xargs -0 sed -i '' -E "$expr" 2>/dev/null || true + else + find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \ + ! -path '*/scripts/push-github-snapshot.sh' \ + -print0 | xargs -0 sed -i -E "$expr" 2>/dev/null || true + fi +} + +echo "[snapshot] rewrite hosts and internal URLs" +apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g' +apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g' +apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g' +apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g' +apply_sed 's#remote add kalinamall#remote add origin#g' +apply_sed 's#remote set-url kalinamall#remote set-url origin#g' +apply_sed 's#local name=kalinamall#local name=origin#g' + +cat >"$WORK/.gitignore" <<'EOF' +.DS_Store +CalculatorApp/ +.env +.env.* +ssh-monitor.conf +ssh-monitor-*.tar.gz +rutube-download.py +.ytdl-archive.txt +EOF + +cat >"$WORK/ssh-monitor.conf.example" <<'EOF' +# Example configuration — copy to /etc/ssh-monitor.conf and chmod 600. +# Never commit real tokens or passwords to git. + +TELEGRAM_BOT_TOKEN="YOUR_TELEGRAM_BOT_TOKEN" +TELEGRAM_CHAT_ID="YOUR_TELEGRAM_CHAT_ID" + +# At least one notification channel (telegram or email) is required. +NOTIFY_ORDER="" + +# Security Alert Center (optional) +USE_SAC="off" +SAC_URL="https://sac.example.com/api/v1/events" +# SAC_API_KEY="your-ingest-api-key" + +# SMTP (optional, requires python3) +MAIL_SMTP_HOST="" +MAIL_SMTP_PORT="587" +MAIL_SMTP_USER="" +MAIL_SMTP_PASSWORD="" +MAIL_FROM="" +MAIL_TO="" +MAIL_SMTP_STARTTLS="1" +MAIL_SMTP_SSL="0" + +# Auto-update script default (override on your server) +# REPO_URL=https://github.com/PTah/ssh-monitor.git +EOF + +if [[ -f "$WORK/README.md" ]]; then + if [[ "$(uname -s)" == Darwin ]]; then + sed -i '' '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md" + sed -i '' '1s/^# ssh-monitor$/# ssh-monitor\ +\ +Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\ +\ +**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\ +\ +# ssh-monitor/' "$WORK/README.md" + else + sed -i '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md" + sed -i '1s/^# ssh-monitor$/# ssh-monitor\n\nBash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\n\n**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\n\n# ssh-monitor/' "$WORK/README.md" + fi + + python3 - "$WORK/README.md" <<'PY' +import pathlib +import sys + +path = pathlib.Path(sys.argv[1]) +text = path.read_text(encoding="utf-8") +old = "## Лицензия\n\nПроект распространяется по лицензии **MIT** — см. файл [LICENSE](LICENSE).\n" +new = """## Topics (GitHub) + +`ssh`, `linux`, `telegram-bot`, `smtp`, `iptables`, `ipset`, `systemd`, `security`, `monitoring`, `openssh` + +## License + +MIT — see [LICENSE](LICENSE). Copyright (c) 2026 Andrey "PapaTramp" Lutsenko. + +
+English summary + +Single-file Bash agent parsing journalctl, notification chain, brute-force IP blocking, heartbeat, optional Prometheus textfile and Security Alert Center ingest via sac-client.sh. + +
+""" +if old not in text: + raise SystemExit("README footer block not found; update push-github-snapshot.sh") +path.write_text(text.replace(old, new), encoding="utf-8") +PY +fi + +if [[ -f "$WORK/LICENSE" ]]; then + if [[ "$(uname -s)" == Darwin ]]; then + sed -i '' 's/Copyright \(c\) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE" + else + sed -i 's/Copyright (c) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE" + fi +fi + +echo "[snapshot] secret scan" +if grep -R -E 'AAE[a-zA-Z0-9_-]{30,}|sac_[A-Za-z0-9]{20,}|[0-9]{8,}:[A-Za-z0-9_-]{30,}' "$WORK" 2>/dev/null; then + echo " BLOCKED: possible secrets in snapshot tree" + exit 1 +fi + +echo "[snapshot] git commit in temp repo" +cd "$WORK" +git init -q +git checkout -q -b main +git add -A +git -c user.name="Andrey Lutsenko" -c user.email="papatramp@gmail.com" commit -q -m "$MSG" + +echo "[snapshot] push github main (force snapshot)" +git remote add github "$(git -C "$ROOT" remote get-url github)" +git push github main --force + +echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"