jj.wang
38 lines
2.0 KiB
Bash
Executable File
38 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# LXC agentd-01 cron entry (*/2, root): one agentd tick under server-access exec (Plane tokens only in the
|
|
# process env), with a lock. The flock skips a tick while the previous one still runs; agentd also holds
|
|
# its own state lock. Logs: /var/log/plane-agentd/{agentd.log,cron.log}; state: /var/lib/plane-agentd.
|
|
# Also the webhook receiver's tick command (agentd/webhook.py): exit 75 = lock held (flock -E 75, or agentd's own
|
|
# state lock), the receiver then retries.
|
|
# AGENTD_SSH_KEY = the direct-ssh key (PAD-12). agent-access.py has no optional secrets: when Vault cannot hand it
|
|
# out (credential_unavailable / credential_invalid, nothing ran) the tick is repeated once without it, so the
|
|
# direct-ssh terminals use their warpgate fallback instead of every tick failing. The tick's stderr is appended to
|
|
# cron.log after its stdout (it has to be inspected for that error first).
|
|
LOCK=/var/lib/plane-agentd/cron.lock
|
|
LOG=/var/log/plane-agentd/cron.log
|
|
CLIENT=(python3 -I /root/.local/share/server-access-client/agent-access.py --config https://nas.tail9531b.ts.net:8443/identity/agent.json)
|
|
|
|
exec 9>>"$LOCK"
|
|
flock -n -E 75 9 || exit $?
|
|
|
|
tick() { # "$@" = extra exec arguments; fd 9 (the lock) is not handed to the tick's children
|
|
timeout 900 "${CLIENT[@]}" exec \
|
|
--secret-env PLANE_OREGON_API_TOKEN=PLANE_OREGON_API_TOKEN \
|
|
--secret-env PLANE_WINDOW10_API_TOKEN=PLANE_WINDOW10_API_TOKEN \
|
|
"$@" --timeout 850 -- \
|
|
python3 /opt/plane-agentd/cli/agentd --config /opt/plane-agentd/config/agentd.yaml tick --once 9>&-
|
|
}
|
|
|
|
err=$(mktemp) || exit 1
|
|
trap 'rm -f "$err"' EXIT
|
|
tick --secret-env AGENTD_SSH_KEY=AGENTD_SSH_KEY >>"$LOG" 2>"$err"
|
|
rc=$?
|
|
cat "$err" >>"$LOG"
|
|
case "$rc:$(cat "$err")" in
|
|
"1:access-hub: credential_unavailable" | "1:access-hub: credential_invalid")
|
|
echo "$(date -Is) AGENTD_SSH_KEY not available from Vault: tick repeated without it (direct-ssh terminals use their warpgate fallback)" >>"$LOG"
|
|
tick >>"$LOG" 2>&1
|
|
rc=$? ;;
|
|
esac
|
|
exit $rc
|