edcdf00aca
Split the single tree into three owner-isolated roots and fix the backup permission failure (restic, running as the container user, could not write the manager-owned /docker/backups). Ownership helper (libreportal-ownership), rewritten for three baked roots: SYSTEM_DIR (manager) CONTAINERS_DIR + BACKUPS_DIR (container user) - reconcile now drives each tree to its single owner; backups + the WebUI dir go to the container user (the actual fix). The container user reaches only the WebUI bind-mount sources (configs/webui/*) via a scoped _webui_bind_access — traverse the system root + configs, read configs/webui only, nothing else. - defence-in-depth: refuse dangerous/relative roots even if mis-baked; new backups-top action. Baking: init.sh initRootHelpers now seds __SYSTEM_DIR__/__CONTAINERS_DIR__/ __BACKUPS_DIR__ (alongside __MANAGER__) into every helper at install — the trust boundary stays root-controlled. svc/socket/appcfg helpers updated to derive from the baked SYSTEM_DIR; the svc unit now exports LP_*_DIR so the processor resolves roots authoritatively. A baking-safe '*"__"*' sentinel check survives the sed. Install/uninstall: initFolders creates the three roots; initContainerLayer hands containers + backups to the container user; uninstall removes all three (idempotent on legacy single-tree installs). Remaining functional /docker literals in init.sh (config reads, setupConfigsFromRepo, uninstall) parameterised. Compose: the WebUI's two relative ../../configs mounts (the only cross-tree relative mounts in the tree) are now absolute, filled at generation via a new CONFIGS_DIR_TAG; CONTAINERS_DIR_TAG likewise for the LP_CONTAINERS_DIR env. Live box unaffected: installed helpers + the live compose only change on reinstall/ rebuild (both of which fill the tags); the CLI-wrapper heredoc paths are baked in phase 3. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>
106 lines
3.9 KiB
Bash
106 lines
3.9 KiB
Bash
#!/bin/bash
|
|
# LibrePortal task-processor systemd helper — the only root-privileged management
|
|
# of the libreportal.service unit the manager may trigger. Installed root:root
|
|
# 0755 to /usr/local/sbin by init.sh. Self-contained: it GENERATES the unit from
|
|
# config (mode + install-user uid + the baked manager name + fixed script paths)
|
|
# — it does NOT accept unit content from the caller (that would be root: an
|
|
# arbitrary systemd unit runs anything as root). So the scoped sudoers can allow
|
|
# it instead of blanket `sudo tee /etc/systemd/...` + `sudo systemctl`.
|
|
#
|
|
# Idempotent: only rewrites + daemon-reloads + restarts when the unit changed,
|
|
# else just ensures it's enabled + running (no needless restart of in-flight work).
|
|
|
|
set -u
|
|
|
|
[[ $EUID -eq 0 ]] || { echo "libreportal-svc: must run as root" >&2; exit 1; }
|
|
|
|
# Baked at install (placeholders replaced). Unbaked copies still contain the "__"
|
|
# sentinel, which no real absolute path does — fall back to defaults then.
|
|
MANAGER="__MANAGER__"
|
|
SYSTEM_DIR="__SYSTEM_DIR__"
|
|
CONTAINERS_DIR="__CONTAINERS_DIR__"
|
|
BACKUPS_DIR="__BACKUPS_DIR__"
|
|
[[ "$MANAGER" == *"__"* || -z "$MANAGER" ]] && MANAGER="libreportal"
|
|
[[ "$SYSTEM_DIR" == *"__"* || -z "$SYSTEM_DIR" ]] && SYSTEM_DIR="/libreportal-system"
|
|
[[ "$CONTAINERS_DIR" == *"__"* || -z "$CONTAINERS_DIR" ]] && CONTAINERS_DIR="/libreportal-containers"
|
|
[[ "$BACKUPS_DIR" == *"__"* || -z "$BACKUPS_DIR" ]] && BACKUPS_DIR="/libreportal-backups"
|
|
|
|
SERVICE_FILE="/etc/systemd/system/libreportal.service"
|
|
INSTALL_SCRIPTS_DIR="$SYSTEM_DIR/install/scripts"
|
|
TASK_PROCESSOR="$INSTALL_SCRIPTS_DIR/crontab/task/crontab_task_processor.sh"
|
|
DB_CFG="$SYSTEM_DIR/configs/general/general_docker_install"
|
|
|
|
_mode() {
|
|
local m
|
|
m=$(grep -h '^CFG_DOCKER_INSTALL_TYPE=' "$DB_CFG" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
|
|
echo "${m:-rootless}"
|
|
}
|
|
|
|
_gen_unit() {
|
|
local env_block=""
|
|
if [[ "$(_mode)" == "rootless" ]]; then
|
|
local u uid
|
|
u=$(grep -h '^CFG_DOCKER_INSTALL_USER=' "$DB_CFG" 2>/dev/null | head -1 | cut -d= -f2 | awk '{print $1}')
|
|
uid=$(id -u "${u:-dockerinstall}" 2>/dev/null)
|
|
if [[ -n "$uid" ]]; then
|
|
env_block="Environment=DOCKER_HOST=unix:///run/user/${uid}/docker.sock
|
|
Environment=XDG_RUNTIME_DIR=/run/user/${uid}"
|
|
fi
|
|
fi
|
|
cat <<EOF
|
|
[Unit]
|
|
Description=LibrePortal Task Processor
|
|
After=network.target
|
|
Wants=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=$MANAGER
|
|
Group=$MANAGER
|
|
WorkingDirectory=$INSTALL_SCRIPTS_DIR
|
|
# Relocatable path roots — baked here by root so the processor resolves them
|
|
# authoritatively (not via the legacy compat default in paths.sh).
|
|
Environment=LP_SYSTEM_DIR=$SYSTEM_DIR
|
|
Environment=LP_CONTAINERS_DIR=$CONTAINERS_DIR
|
|
Environment=LP_BACKUPS_DIR=$BACKUPS_DIR
|
|
ExecStart=$TASK_PROCESSOR start_script
|
|
Restart=always
|
|
RestartSec=5
|
|
SyslogIdentifier=libreportal
|
|
${env_block}
|
|
|
|
# Security
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
}
|
|
|
|
install_unit() {
|
|
local desired current=""
|
|
desired="$(_gen_unit)"
|
|
[[ -f "$SERVICE_FILE" ]] && current="$(cat "$SERVICE_FILE" 2>/dev/null)"
|
|
if [[ "$desired" != "$current" ]]; then
|
|
printf '%s\n' "$desired" > "$SERVICE_FILE"
|
|
systemctl daemon-reload
|
|
systemctl enable libreportal.service >/dev/null 2>&1
|
|
systemctl restart libreportal.service
|
|
echo "updated"
|
|
else
|
|
systemctl enable libreportal.service >/dev/null 2>&1
|
|
systemctl is-active --quiet libreportal.service || systemctl start libreportal.service
|
|
echo "unchanged"
|
|
fi
|
|
}
|
|
|
|
action="${1:-}"
|
|
case "$action" in
|
|
install) install_unit ;;
|
|
enable) systemctl enable libreportal.service >/dev/null 2>&1 ;;
|
|
restart) systemctl restart libreportal.service ;;
|
|
start) systemctl start libreportal.service ;;
|
|
status) systemctl is-active libreportal.service ;;
|
|
*) echo "usage: libreportal-svc {install|enable|restart|start|status}" >&2; exit 2 ;;
|
|
esac
|