Cobra
13900f9045
Fix #605: Remove MATRIX_HOMESERVER, MATRIX_ACCESS_TOKEN, MATRIX_ROOM_ID from module-level globals. Credentials are now read at call time in send_alert() via _read_env_value() to minimize credential lifetime in process memory. Fix #606: Update deploy.sh to use Infisical creds CLI instead of .secrets file. Fetches NET_ALERTER_PASSWORD from matrix folder in Infisical vault, then generates access token at deploy time. All 16 net_alerter tests pass when run individually or in groups.
73 lines
2.2 KiB
Bash
Executable File
73 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Deploy net_alerter to condo Pi
|
|
# Usage: ./deploy.sh [access_token]
|
|
|
|
set -euo pipefail
|
|
|
|
SSH_ALIAS="condo"
|
|
REMOTE_DIR="/opt/net_alerter"
|
|
SCRIPT="$(dirname "$0")/net_alerter.py"
|
|
|
|
# Matrix access token for net-alerter service account
|
|
# Get fresh token from Infisical or accept as argument
|
|
if [[ -n "${1:-}" ]]; then
|
|
TOKEN="$1"
|
|
else
|
|
echo "[*] Fetching Matrix credentials from Infisical..."
|
|
CREDS="${HOME}/.local/bin/creds"
|
|
if ! command -v "$CREDS" &>/dev/null; then
|
|
echo "[error] creds CLI not found at $CREDS — install Infisical client first"
|
|
exit 1
|
|
fi
|
|
|
|
MATRIX_PASS=$("$CREDS" get NET_ALERTER_PASSWORD matrix)
|
|
if [[ -z "$MATRIX_PASS" ]]; then
|
|
echo "[error] Could not fetch NET_ALERTER_PASSWORD from Infisical (matrix folder)"
|
|
exit 1
|
|
fi
|
|
|
|
echo "[*] Generating Matrix access token for net-alerter..."
|
|
TOKEN=$(curl -s -X POST https://m.example.org/_matrix/client/v3/login \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"net-alerter\"},\"password\":\"${MATRIX_PASS}\"}" \
|
|
| python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
|
|
fi
|
|
|
|
echo "[*] Deploying to $SSH_ALIAS..."
|
|
|
|
ssh -o StrictHostKeyChecking=no "$SSH_ALIAS" "
|
|
sudo mkdir -p $REMOTE_DIR
|
|
sudo chown \$USER: $REMOTE_DIR
|
|
"
|
|
|
|
scp -o StrictHostKeyChecking=no "$SCRIPT" "$SSH_ALIAS:$REMOTE_DIR/net_alerter.py"
|
|
|
|
ssh -o StrictHostKeyChecking=no "$SSH_ALIAS" "
|
|
if ! command -v nmap &>/dev/null; then
|
|
sudo apt-get install -y nmap
|
|
fi
|
|
|
|
cat > $REMOTE_DIR/.env <<EOF
|
|
MATRIX_HOMESERVER=https://m.example.org
|
|
MATRIX_ACCESS_TOKEN=$TOKEN
|
|
MATRIX_ROOM_ID=!REDACTED:example.org
|
|
NET_ALERTER_DB=$REMOTE_DIR/devices.db
|
|
EOF
|
|
chmod 600 $REMOTE_DIR/.env
|
|
|
|
cat > $REMOTE_DIR/run.sh <<'WRAPPER'
|
|
#!/usr/bin/env bash
|
|
set -a; source /opt/net_alerter/.env; set +a
|
|
exec python3 /opt/net_alerter/net_alerter.py
|
|
WRAPPER
|
|
chmod +x $REMOTE_DIR/run.sh
|
|
|
|
CRON='*/5 * * * * /opt/net_alerter/run.sh >> /opt/net_alerter/net_alerter.log 2>&1'
|
|
(crontab -l 2>/dev/null | grep -v net_alerter; echo \"\$CRON\") | crontab -
|
|
|
|
echo '[ok] Deployed. Running first scan...'
|
|
bash $REMOTE_DIR/run.sh && echo '[ok] First scan complete'
|
|
"
|
|
|
|
echo "[done] net_alerter deployed and cron set (every 5 min)"
|