7aed9102c4
Running any tool jumped to the Tasks tab and left the user stranded there. That is right for an install — long, log-heavy, worth watching — and wrong for a tool, which is a short admin action whose answer is one line. Worse, half of these are only meaningful back on Tools: List Users opens a modal over that tab, and Create User Account returns a generated password that was being buried in a log the user then had to go read. Tools now stay put. On completion the tool's own outcome lines — the isSuccessful/isError/isNotice output, ANSI stripped and framework boilerplate filtered — are shown in a small result modal, with a View log button for anything needing the full detail. list_users is left alone because the existing account-list modal is already a better result view. Also stops generate_arrays.sh walking scripts/dev. That directory is `export-ignore`d, so it exists in a working clone but never in a shipped install; generating a files_dev.sh entry from it wrote a reference into files_source.sh that no install could satisfy, and the loader treats a missing array file as a broken installation — every libreportal command stopped with "files_dev.sh is missing from your LibrePortal Installation". Excluded alongside unused/, system/ and release/. Regenerating also picked up scripts/validation, which had never had an array file. And Matrix's account listing prints its aligned line from python rather than re-splitting the marker line in bash: TAB is IFS whitespace, so an empty display name collapsed into the previous delimiter and shifted every later column. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
51 lines
2.1 KiB
Bash
51 lines
2.1 KiB
Bash
#!/bin/bash
|
|
|
|
# Issue a new API key for the Traefik CrowdSec bouncer.
|
|
#
|
|
# This is the action crowdsec.config and the install script both point at when
|
|
# the key is lost or should be replaced. cscli cannot re-issue a key for an
|
|
# existing bouncer, so rotating means delete + re-add; the privileged helper
|
|
# does both and rewrites /etc/crowdsec/traefik_bouncer.key.
|
|
#
|
|
# The old key stops working the instant the bouncer is deleted, and Traefik
|
|
# holds the key file open — so Traefik is restarted afterwards to pick up the new
|
|
# one. Between those two points requests are authenticated with a dead key, which
|
|
# is why this is a deliberate action and not something the installer does on its
|
|
# own.
|
|
appCrowdsecRotateBouncerKey()
|
|
{
|
|
local app_name="crowdsec"
|
|
|
|
local result
|
|
result=$(runCrowdsec bouncer-traefik-rotate 2>&1)
|
|
|
|
if [[ "$result" != GENERATED:* ]]; then
|
|
isError "Could not rotate the Traefik bouncer key: $result"
|
|
isNotice "The previous key may already have been revoked — check 'cscli bouncers list' before retrying."
|
|
return 1
|
|
fi
|
|
|
|
local bouncer_key="${result#GENERATED:}"
|
|
isSuccessful "New Traefik bouncer API key issued."
|
|
|
|
# Mirror it the same way the installer does, so the config page and the key
|
|
# file agree. updateConfigOption escapes the value, writes as the owner of
|
|
# the containers tree, and re-sources.
|
|
local cfg_file="${containers_dir}${app_name}/${app_name}.config"
|
|
if [[ -f "$cfg_file" ]]; then
|
|
updateConfigOption "CFG_CROWDSEC_TRAEFIK_LAPI_KEY" "$bouncer_key" "$cfg_file"
|
|
else
|
|
isNotice "crowdsec.config is not deployed — the key is in /etc/crowdsec/traefik_bouncer.key only."
|
|
fi
|
|
|
|
# Traefik reads the key from the bind-mounted file at startup, so it keeps
|
|
# presenting the revoked key until it restarts. Without this the rotation
|
|
# looks successful while every bouncer check fails with 403.
|
|
if [[ -d "${containers_dir}traefik" ]]; then
|
|
dockerComposeRestart traefik
|
|
checkSuccess "Restarting Traefik to load the new bouncer key"
|
|
else
|
|
isNotice "Traefik is not installed here — nothing to restart."
|
|
fi
|
|
}
|