LibrePortal/scripts/storage/storage_app_config.sh
librelad 26e98698d8 feat(storage): per-app placement, app move, and the READONLY marker
Phase 2 and 4 of docs/roadmap/storage-locations.md. Apps can now be
placed on a location and moved between them.

CFG_<APP>_STORAGE lands in all 37 app templates, holding a location NAME
rather than a path: names survive a migrate to a host with different
disks, paths do not. The 11 infrastructure apps that other apps reach by
literal path (traefik, prometheus, grafana, adguard, gluetun, crowdsec,
headscale, dashy, pihole, unbound, wireguard) are pinned. libreportal
itself never gets the key — it is pinned structurally by webuiDir.

Pinning needed no second config key. "Pinned" is not a fact about a value,
it is a statement about whether the field may be edited, so it goes in the
comment beside **ADVANCED** and **DEV** as **READONLY**, and the field
factory renders those disabled. That marker earns its keep beyond this
feature: derived fields already warned in prose that editing them does
nothing (crowdsec.config:72) next to a perfectly editable input.

storage_app_config.sh keeps the comment honest — it carries the resolved
path for hand-recovery and regenerates the dropdown from the registry, but
only writes when something actually changed, since the app .config is
user-editable and lives in the container-owned tree.

app move stops the app (a live copy of a running Postgres is a corrupt
copy), snapshots it, copies, verifies, and only then removes the source.
The copy runs in libreportal-ownership because it must: app data holds
rootless sub-UID files the manager can neither read nor recreate.
Verified against two real ext4 filesystems that a cross-device move
preserves uid 231141 and the payload, and that the source survives every
refusal path — unregistered destination, the WebUI app, a traversal in the
app name, and an occupied destination.

Task titles registered in both tables, with a specific rule so a move
renders as "Nextcloud - Move to bigdisk" rather than the generic fallback
dropping the destination. lp-task-names could not be run to confirm — it
borrows the WebUI container's node and no containers are running.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-24 20:37:35 +01:00

101 lines
3.6 KiB
Bash

#!/bin/bash
# Keeping CFG_<APP>_STORAGE's comment truthful.
#
# The value is a location NAME, because names survive a migrate to a host whose
# disks are laid out differently and paths do not. But a name alone is useless to
# someone reading the config file at 2am with no tooling, so the RESOLVED PATH
# rides in the field's comment:
#
# CFG_NEXTCLOUD_STORAGE=bigdisk # Storage Location - Currently at /mnt/bigdisk/apps/nextcloud [default:Primary|bigdisk:Big disk]
#
# Two rules keep that from becoming a liability:
#
# 1. It is a BREADCRUMB, never a source of truth. Nothing reads it to decide
# anything — appDir resolves by discovery. A stale one is cosmetic.
# 2. It is written ONLY when it changes. The app .config is user-editable and
# lives in the container-owned tree, so an unconditional rewrite on every
# regen is both file churn and a runFileOp per app per pass. Compare first.
# Rebuild the "[default:Primary|<name>:<label>|…]" option list from the registry,
# so a dropdown reflects locations added since the app was installed.
_storageOptionList()
{
local out="default:Primary ($(primaryRoot))"
local id state path name_var name
while IFS=$'\t' read -r id state path; do
[[ -z "$id" ]] && continue
name_var="CFG_STORAGE_LOC_${id}_NAME"
name="${!name_var:-location-$id}"
# An unavailable location stays selectable and says so, rather than
# vanishing from the list and looking like it was deleted.
if [[ "$state" == "ok" ]]; then
out+="|${name}:${name} (${path})"
else
out+="|${name}:${name} (${path}) — not mounted"
fi
done < <(runStorage verify 2>/dev/null)
printf '%s' "$out"
}
# Rewrite one app's CFG_<APP>_STORAGE comment. No-op when nothing changed.
storageSyncAppComment()
{
local app="$1"
[[ -n "$app" ]] || return 0
local dir cfg key up
up="${app^^}"
key="CFG_${up}_STORAGE"
dir=$(appDir "$app") || return 0 # unavailable: leave the file alone
cfg="$dir/$app.config"
[[ -f "$cfg" ]] || return 0
local line
line=$(runCfgOp grep -m1 -E "^${key}=" "$cfg" 2>/dev/null) || return 0
[[ -n "$line" ]] || return 0
# Preserve the value and the READONLY marker; regenerate the rest.
local value="${line#*=}"
value="${value%%#*}"
value="${value//$'\r'/}"
value="${value#"${value%%[![:space:]]*}"}"
value="${value%"${value##*[![:space:]]}"}"
value="${value%\"}"; value="${value#\"}"
local readonly_marker=""
[[ "$line" == *'**READONLY**'* ]] && readonly_marker=" **READONLY**"
local desc
if [[ -n "$readonly_marker" ]]; then
desc="Storage Location - Fixed: other apps reference $app by path. Currently at $dir"
else
desc="Storage Location - Currently at $dir [$(_storageOptionList)]"
fi
local want="${key}=${value} # ${desc}${readonly_marker}"
[[ "$line" == "$want" ]] && return 0 # unchanged: no write, no churn
local escaped_key="${key}"
local tmp; tmp=$(mktemp) || return 1
runCfgOp cat "$cfg" 2>/dev/null > "$tmp" || { rm -f "$tmp"; return 1; }
awk -v k="^${escaped_key}=" -v repl="$want" '
$0 ~ k && !done { print repl; done=1; next }
{ print }
' "$tmp" | runCfgOp tee "$cfg" >/dev/null
rm -f "$tmp"
return 0
}
# Sync every installed app. Called from the regen path; cheap because each app
# short-circuits unless its resolved path or the option list actually changed.
storageSyncAllAppComments()
{
local app
while IFS= read -r app; do
[[ -z "$app" || "$app" == "libreportal" ]] && continue
storageSyncAppComment "$app"
done < <(storageApps)
return 0
}