jj.wang
6dc7e72ac8
agentd webhook-serve (agentd/webhook.py, stdlib): verifies X-Plane-Signature
(HMAC-SHA256 hex of the body, constant-time; 401 on missing/bad), routes by
data.project to a configured tenant (others 202), coalesces deliveries within
3 s into one tick, runs one more tick when deliveries arrive during a tick,
and retries every 15 s for up to 2 min while the lock is held (tick command
exit 75: flock -E 75 in the cron scripts, cli tick on Busy). Ticks run in a
systemd scope so restarting the receiver never kills one. Log:
<log_dir>/webhook.log; GET /healthz.
Config: webhook section (key names only, PLANE_WEBHOOK_SECRET scrubbed from
child envs like the Plane tokens), notify: {kind: none} as a no-op hook
called on every state move; the unused per-project webhook_secret_key is
gone (Plane webhooks are workspace-level). systemd unit for the LXC and
tools/plane-webhook.py to create/rotate the Plane webhook as the workspace
admin (secret straight into the Vault, never printed).
13 lines
923 B
Bash
Executable File
13 lines
923 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# oregon cron entry (*/2) -- ROLLBACK ONLY since PAD-11: the dispatcher runs on the LXC agentd-01
|
|
# (cron/agentd-tick-lxc.sh). Never run both: two dispatchers double-dispatch. See docs/runbook.md "回滚到 oregon".
|
|
# One agentd tick under server-access exec (Plane tokens in the process env only), with a lock.
|
|
exec flock -n -E 75 /home/ubuntu/.gwent-board/agentd.lock \
|
|
timeout 900 python3 -I /home/ubuntu/.local/share/server-access-client/agent-access.py \
|
|
--config https://nas.tail9531b.ts.net:8443/identity/agent.json exec \
|
|
--secret-env PLANE_OREGON_API_TOKEN=PLANE_OREGON_API_TOKEN \
|
|
--secret-env PLANE_WINDOW10_API_TOKEN=PLANE_WINDOW10_API_TOKEN --timeout 850 -- \
|
|
python3 /home/ubuntu/Documents/wjj/project/plane-agentd/cli/agentd \
|
|
--config /home/ubuntu/Documents/wjj/project/plane-agentd/config/agentd.oregon.yaml \
|
|
tick --once >> /home/ubuntu/.gwent-board/agentd-cron.log 2>&1
|