KNEL/KNELCloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nuisance: creds chain env > sm vault > legacy file

Browse Source 
sm re-auth pending (#925); /tmp/cr.env is the documented interim.

Redmine: https://projects.knownelement.com/issues/925
This commit is contained in:
mrcharles
2026-09-07 09:16:52 -05:00
parent b0785c211b
commit 583d499b2c
1 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
perf/nuisance/nuisance-sweep.sh
+20 -4
View File
@@ -47,16 +47,32 @@ timeout 120 env VM_IP="$HOST_NAME" VM_USER=root bash tests/remote.sh vm \
deny_lines=$(wc -l < "$TMP/scan")
# --- 2. current blocklist from the Cloudron API ---
# Creds: pre-exported env (e.g. `sm env cloudron`) wins; ~/.creds fallback is
# legacy (the textfile pattern was RETIRED 2026-09-06 — vault via sm is the way).
# Creds precedence: pre-exported env → TSGCOO vault via `sm` (sanctioned path,
# needs a live sm session) → ~/.creds legacy file (textfiles RETIRED 2026-09-06;
# /tmp/cr.env is the documented interim until sm is re-authed).
if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
[ -f "$HOME/.creds/cloudron.env" ] || fail "no CLOUDRON_URL/CLOUDRON_API_TOKEN in env and $HOME/.creds/cloudron.env missing"
if command -v sudo >/dev/null 2>&1; then
eval "$(sudo -n -u TSGCOO /data2/TSGCOO/.local/bin/sm env cloudron 2>/dev/null)" || true
fi
fi
if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ] && [ -f /tmp/cr.env ]; then
set -a
# interim token file, documented above
# shellcheck disable=SC1091
. /tmp/cr.env
set +a
export CLOUDRON_URL="${CLOUDRON_URL:-https://my.knownelement.com}"
fi
if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
[ -f "$HOME/.creds/cloudron.env" ] || fail "no Cloudron creds: env empty, sm unavailable, /tmp/cr.env and ~/.creds/cloudron.env missing"
set -a
# shellcheck disable=SC1091 # creds file path built above
. "$HOME/.creds/cloudron.env"
set +a
fi
[ -n "${CLOUDRON_URL:-}" ] && [ -n "${CLOUDRON_API_TOKEN:-}" ] || fail "creds file lacks CLOUDRON_URL/CLOUDRON_API_TOKEN"
if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
fail "no CLOUDRON_URL/CLOUDRON_API_TOKEN from any source"
fi
curl -sf --max-time 15 "$CLOUDRON_URL/api/v1/network/blocklist" \
-H "Authorization: Bearer $CLOUDRON_API_TOKEN" \
| jq -r .blocklist > "$TMP/current" || fail "blocklist GET failed"