deytenit
bd973d783d
Drop the hardcoded-domain FQDN regex and every hardcoded domain from commons. Node identity is now explicit in node.env: APEX_NODE_FQDN (real FQDN, traefik Host()), APEX_NODE_HOST (public host name — backup --host, obs/notify instance), APEX_SUBNET. The short name (log prefix, sync/<node> branch, messages) is derived as the first host label. notify instance is just the host (no hardcoded prefix); the git bot identity moves to APEX_GIT_AUTHOR_NAME/EMAIL (node.env) with generic defaults. Alloy node+instance labels use APEX_NODE_HOST. Fallbacks keep a node working if it omits a var (host<-fqdn<-hostname). BREAKING CHANGE: removes APEX_NODE and APEX_CLUSTER env vars; node name is now derived from APEX_NODE_FQDN
72 lines
3.4 KiB
Python
72 lines
3.4 KiB
Python
# actions/sync/packages.py
|
|
"""Port of sync/packages — apt upgradable + docker image (skopeo) update check; Telegram."""
|
|
import os, re, shutil
|
|
from engine.descriptor import Meta, Arg
|
|
|
|
METADATA = Meta(summary="Check pending apt updates + docker image updates; Telegram notify.",
|
|
args=[Arg("telegram_bot_url", "Telegram Bot URL for notifications")])
|
|
TITLE = "Node Security Updates"
|
|
|
|
def run(ctx, args):
|
|
log, node, url, s = ctx.log, ctx.node.name, args.telegram_bot_url, ctx.sys
|
|
try:
|
|
_check(ctx, args, log, node, url, s)
|
|
except SystemExit:
|
|
raise
|
|
except Exception as e: # bash ERR trap parity: unhandled failures page via Telegram
|
|
log.error(f"{type(e).__name__}: {e}")
|
|
ctx.notify.error(TITLE, url, f"Critical error: {e}")
|
|
raise SystemExit(1)
|
|
|
|
def _check(ctx, args, log, node, url, s):
|
|
if not os.path.isfile("/etc/debian_version"):
|
|
log.error("Requires a Debian-based system.")
|
|
ctx.notify.error(TITLE, url, "Requires a Debian-based system.")
|
|
raise SystemExit(1)
|
|
|
|
log.info("Updating package lists...")
|
|
if s.ok(["sudo", "apt-get", "update"]):
|
|
cp = s.run(["bash", "-c",
|
|
"sudo apt-get --just-print upgrade 2>/dev/null | grep '^Inst' | cut -d' ' -f2 | sort"],
|
|
check=False, capture=True)
|
|
upd = [l for l in (cp.stdout or "").splitlines() if l.strip()]
|
|
packages = (f"*Packages ({len(upd)}):* " + ", ".join(f"`{u}`" for u in upd)) if upd else "*Packages:* _none_"
|
|
else:
|
|
packages = "*Packages:* _Failed to check_"
|
|
|
|
if not shutil.which("docker"):
|
|
images = "*Images:* _Docker not available_"
|
|
elif not shutil.which("skopeo"):
|
|
images = "*Images:* _skopeo not available_"
|
|
else:
|
|
cp = s.run(["bash", "-c", "docker ps --format '{{.Image}}' | sort -u"], check=False, capture=True)
|
|
outdated = []
|
|
for image in [l for l in (cp.stdout or "").splitlines() if l.strip()]:
|
|
name, sep, tag = image.partition(":")
|
|
tag = tag or "latest"
|
|
ld = s.run(["bash", "-c",
|
|
f"docker image inspect '{image}' --format '{{{{index .RepoDigests 0}}}}' 2>/dev/null | cut -d'@' -f2"],
|
|
check=False, capture=True).stdout.strip()
|
|
if not ld:
|
|
continue
|
|
if "/" not in name:
|
|
reg = f"docker.io/library/{name}"
|
|
elif not re.match(r".*\..*/", name):
|
|
reg = f"docker.io/{name}"
|
|
else:
|
|
reg = name
|
|
rd = s.run(["bash", "-c",
|
|
f"skopeo inspect 'docker://{reg}:{tag}' 2>/dev/null | "
|
|
f"grep -o '\"Digest\"[[:space:]]*:[[:space:]]*\"[^\"]*\"' | cut -d'\"' -f4"],
|
|
check=False, capture=True).stdout.strip()
|
|
if rd and ld != rd:
|
|
disp = name[len("docker.io/"):] if name.startswith("docker.io/") else name
|
|
disp = disp[len("library/"):] if disp.startswith("library/") else disp
|
|
outdated.append(disp)
|
|
images = (f"*Images ({len(outdated)}):* " + ", ".join(f"`{i}`" for i in outdated)) if outdated else "*Images:* _none_"
|
|
|
|
# A failed send exits 1 (bash: telegram_info's return 1 tripped set -e).
|
|
if not ctx.notify.info(TITLE, url, f"*APT:*\n{packages}\n\n*Skopeo:*\n{images}"):
|
|
raise SystemExit(1)
|
|
log.success("Security update check completed.")
|