157 lines
5.1 KiB
Bash
157 lines
5.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Публичный snapshot на github: без prod URL, токенов и kalinamall-only путей.
|
|
set -Eeuo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
WORK="$(mktemp -d "${TMPDIR:-/tmp}/ssh-monitor-github-snapshot.XXXX")"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
REF="${1:-HEAD}"
|
|
VERSION="$(git -C "$ROOT" show "$REF":version.txt 2>/dev/null | tr -d '[:space:]' || true)"
|
|
MSG="${2:-chore: public release ${VERSION:-snapshot} (SSH Monitor, no Cursor IDE traces)}"
|
|
|
|
echo "[snapshot] export $REF -> $WORK"
|
|
git -C "$ROOT" archive --format=tar "$REF" \
|
|
| tar -x -C "$WORK" \
|
|
--exclude='.cursor' \
|
|
--exclude='.env'
|
|
|
|
apply_sed() {
|
|
local expr=$1
|
|
if [[ "$(uname -s)" == Darwin ]]; then
|
|
find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
|
|
! -path '*/scripts/push-github-snapshot.sh' \
|
|
-print0 | xargs -0 sed -i '' -E "$expr" 2>/dev/null || true
|
|
else
|
|
find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
|
|
! -path '*/scripts/push-github-snapshot.sh' \
|
|
-print0 | xargs -0 sed -i -E "$expr" 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
echo "[snapshot] rewrite hosts and internal URLs"
|
|
apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
|
|
apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
|
|
apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
|
|
apply_sed 's#git\.kalinamall\.ru#github.com#g'
|
|
apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
|
|
apply_sed 's#remote add kalinamall#remote add origin#g'
|
|
apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
|
|
apply_sed 's#local name=kalinamall#local name=origin#g'
|
|
apply_sed 's#всегда kalinamall#всегда origin#g'
|
|
|
|
cat >"$WORK/.gitignore" <<'EOF'
|
|
.DS_Store
|
|
CalculatorApp/
|
|
.env
|
|
.env.*
|
|
ssh-monitor.conf
|
|
ssh-monitor-*.tar.gz
|
|
rutube-download.py
|
|
.ytdl-archive.txt
|
|
EOF
|
|
|
|
cat >"$WORK/ssh-monitor.conf.example" <<'EOF'
|
|
# Example configuration — copy to /etc/ssh-monitor.conf and chmod 600.
|
|
# Never commit real tokens or passwords to git.
|
|
|
|
TELEGRAM_BOT_TOKEN="YOUR_TELEGRAM_BOT_TOKEN"
|
|
TELEGRAM_CHAT_ID="YOUR_TELEGRAM_CHAT_ID"
|
|
|
|
# At least one notification channel (telegram or email) is required.
|
|
NOTIFY_ORDER=""
|
|
|
|
# Security Alert Center (optional)
|
|
USE_SAC="off"
|
|
SAC_URL="https://sac.example.com/api/v1/events"
|
|
# SAC_API_KEY="your-ingest-api-key"
|
|
|
|
# SMTP (optional, requires python3)
|
|
MAIL_SMTP_HOST=""
|
|
MAIL_SMTP_PORT="587"
|
|
MAIL_SMTP_USER=""
|
|
MAIL_SMTP_PASSWORD=""
|
|
MAIL_FROM=""
|
|
MAIL_TO=""
|
|
MAIL_SMTP_STARTTLS="1"
|
|
MAIL_SMTP_SSL="0"
|
|
|
|
# Auto-update script default (override on your server)
|
|
# REPO_URL=https://git.papatramp.ru/PapaTramp/ssh-monitor.git
|
|
EOF
|
|
|
|
if [[ -f "$WORK/README.md" ]]; then
|
|
python3 - "$WORK/README.md" <<'PY'
|
|
import pathlib
|
|
import sys
|
|
|
|
path = pathlib.Path(sys.argv[1])
|
|
text = path.read_text(encoding="utf-8")
|
|
text = "".join(
|
|
line for line in text.splitlines(keepends=True)
|
|
if not line.startswith("> **Закрытый инстанс Gitea:**")
|
|
)
|
|
header = "# ssh-monitor\n\n**Версия:**"
|
|
if header in text and "Bash monitor for" not in text.split("**Версия:**", 1)[0]:
|
|
text = text.replace(
|
|
header,
|
|
"""# ssh-monitor
|
|
|
|
Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram/SMTP alerts, optional IP ban (ipset/iptables), daily report, SAC integration.
|
|
|
|
**Repository:** https://git.papatramp.ru/PapaTramp/ssh-monitor
|
|
|
|
# ssh-monitor
|
|
|
|
**Версия:**""",
|
|
1,
|
|
)
|
|
old = "## Лицензия\n\nПроект распространяется по лицензии **MIT** — см. файл [LICENSE](LICENSE).\n"
|
|
new = """## Topics (GitHub)
|
|
|
|
`ssh`, `linux`, `telegram-bot`, `smtp`, `iptables`, `ipset`, `systemd`, `security`, `monitoring`, `openssh`
|
|
|
|
## License
|
|
|
|
MIT — see [LICENSE](LICENSE). Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.
|
|
|
|
<details>
|
|
<summary><strong>English summary</strong></summary>
|
|
|
|
Single-file Bash agent parsing journalctl, notification chain, brute-force IP blocking, heartbeat, optional Prometheus textfile and Security Alert Center ingest via sac-client.sh.
|
|
|
|
</details>
|
|
"""
|
|
if old not in text:
|
|
raise SystemExit("README footer block not found; update push-github-snapshot.sh")
|
|
path.write_text(text.replace(old, new), encoding="utf-8")
|
|
PY
|
|
fi
|
|
|
|
if [[ -f "$WORK/LICENSE" ]]; then
|
|
if [[ "$(uname -s)" == Darwin ]]; then
|
|
sed -i '' 's/Copyright \(c\) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
|
|
else
|
|
sed -i 's/Copyright (c) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
|
|
fi
|
|
fi
|
|
|
|
echo "[snapshot] secret scan"
|
|
if grep -R -E 'AAE[a-zA-Z0-9_-]{30,}|sac_[A-Za-z0-9]{20,}|[0-9]{8,}:[A-Za-z0-9_-]{30,}' "$WORK" 2>/dev/null; then
|
|
echo " BLOCKED: possible secrets in snapshot tree"
|
|
exit 1
|
|
fi
|
|
|
|
echo "[snapshot] git commit in temp repo"
|
|
cd "$WORK"
|
|
git init -q
|
|
git checkout -q -b main
|
|
git add -A
|
|
git -c user.name="Andrey Lutsenko" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
|
|
|
|
echo "[snapshot] push github main (force snapshot)"
|
|
git remote add github "$(git -C "$ROOT" remote get-url github)"
|
|
git push github main --force
|
|
|
|
echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"
|