chore(archive): preserve KNELServerBuild remainder + layout notes [#474]

Archive the non-ported remainder of the legacy KNELServerBuild repo under archive/KNELServerBuild/ with its original structure intact, completing the legacy repo merge for everything except the live LibreNMS patterns (ported in the previous commit). Exclusions: - .git history (superseded; legacy repo remains at its original path) - ported files (Agents/librenms, Modules/OAM/oam-librenms.sh, ConfigFiles/SNMP/snmp-sudo.conf) - vendored KNELShellFramework tree (byte-identical duplicate of the copy already vendored at vendor/ in this repo) - SSH authorized-keys files (live access-control material; carrying them in an archive invites drift — key policy lives elsewhere) The whole tree is skip-listed in tests/shellcheck.sh (archived legacy code, not maintained — same standing as vendor/); check-rules.sh already prunes archive/. Rule 9 (conflict markers) now also excludes archive/ staged files: preserved-verbatim legacy scripts contain decorative "====" banners that false-positive as conflict markers (same archive exclusion precedent as rule 11). AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the Repository Layout, and fix the stale KNELIAC path to /home/reachableceo/projects/KNEL/KNELIAC. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-08-28 06:12:05 -05:00
parent 75de9d7104
commit 39bb855a98
89 changed files with 8589 additions and 3 deletions
@@ -0,0 +1,97 @@
+#!/usr/bin/bash
+#
+# remote.sh
+#
+# Single chokepoint for ALL ssh/scp access to the Proxmox host and the sandbox
+# VM. Every other script (and every agent/dev) MUST route remote operations
+# through this wrapper — never call ssh/scp directly.
+#
+# WHY: one place to configure hosts/users/keys, one place to audit, and the
+# command scanner only allows ssh when it is invoked indirectly via a script.
+#
+# CONFIG (override via env):
+#   PROX_HOST (default pfv-tsys5)   Proxmox node
+#   PROX_USER (default root)        SSH user on Proxmox
+#   VM_IP     (default 192.168.3.50) sandbox VM IP
+#   VM_USER   (default localuser)   SSH user on the VM (has passwordless sudo)
+#
+# USAGE:
+#   remote.sh prox <cmd...>            run command on Proxmox
+#   remote.sh vm <cmd...>              run command on VM as $VM_USER
+#   remote.sh vmroot <cmd...>          run command on VM as root via sudo
+#   remote.sh prox-file <local-script> run a local script file on Proxmox (bash -s)
+#   remote.sh vm-file <local-script>   run a local script file on the VM (bash -s)
+#   remote.sh vm-copy <local> <dest>   copy a local file to the VM (~$VM_USER space)
+#   remote.sh prox-copy <local> <dest> copy a local file to Proxmox
+#
+set -uo pipefail
+
+PROX_HOST="${PROX_HOST:-pfv-tsys5}"
+PROX_USER="${PROX_USER:-root}"
+VM_IP="${VM_IP:-192.168.3.50}"
+VM_USER="${VM_USER:-localuser}"
+VM_ID="${VM_ID:-}"
+GUEST_TIMEOUT="${GUEST_TIMEOUT:-900}"
+
+SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
+
+die() { echo "remote.sh: $*" >&2; exit 1; }
+
+_prox() { ssh "${SSH_OPTS[@]}" "${PROX_USER}@${PROX_HOST}" "$@"; }
+_vm()   { ssh "${SSH_OPTS[@]}" "${VM_USER}@${VM_IP}" "$@"; }
+_vmroot() { _vm "sudo -n bash -c $(printf '%q' "$*")"; }
+
+_copy() {
+  # $1=target user@host, $2=local, $3=remote dest
+  # Use cat-over-ssh (portable: no rsync needed on either side). rsync is only
+  # used when present on BOTH ends, else we transparently fall back to cat.
+  local target="$1" local="$2" dest="$3"
+  local userhost="${target%@*}@${target#*@}"
+  if command -v rsync >/dev/null 2>&1 \
+     && ssh "${SSH_OPTS[@]}" "$userhost" 'command -v rsync' >/dev/null 2>&1; then
+    rsync -az -e "ssh ${SSH_OPTS[*]}" "$local" "${userhost}:${dest}"
+  else
+    ssh "${SSH_OPTS[@]}" "$userhost" "cat > '$dest'" < "$local"
+  fi
+}
+
+# Out-of-band VM access via the Proxmox qemu-guest-agent. This runs commands
+# as root inside the VM and does NOT depend on SSH, so it works even after
+# secharden-ssh replaces authorized_keys and secharden-2fa enforces
+# publickey+keyboard-interactive (which blocks non-interactive SSH).
+GUEST_PARSER="/root/.knel-guest-parse.py"
+GUEST_PARSER_SRC="import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    sys.exit(3)
+sys.stdout.write(d.get('out-data', '') or '')
+sys.stderr.write(d.get('err-data', '') or '')
+ec = d.get('exitcode', 1)
+sys.exit(ec if ec is not None else 1)"
+
+_ensure_guest_parser() {
+  if _prox "test -f '$GUEST_PARSER'" >/dev/null 2>&1; then return 0; fi
+  printf '%s\n' "$GUEST_PARSER_SRC" | _prox "cat > '$GUEST_PARSER'" >/dev/null 2>&1
+}
+
+_vm_guest() {
+  [ -n "$VM_ID" ] || die "vm-guest requires VM_ID"
+  _ensure_guest_parser
+  local cmdb64; cmdb64="$(printf '%s' "$*" | base64 -w0)"
+  _prox "qm guest exec $VM_ID --timeout ${GUEST_TIMEOUT} -- /bin/sh -c 'echo $cmdb64 | base64 -d | /bin/sh' 2>/dev/null | python3 '$GUEST_PARSER'"
+}
+
+mode="${1:-}"; shift || true
+case "$mode" in
+  prox)         [ "$#" -ge 0 ] || die "need command"; _prox "$*" ;;
+  vm)           _vm "$*" ;;
+  vmroot)       [ "$#" -ge 1 ] || die "need command"; _vmroot "$*" ;;
+  prox-file)    [ -f "${1:-}" ] || die "need local script file"; _prox "bash -s" < "$1" ;;
+  vm-file)      [ -f "${1:-}" ] || die "need local script file"; _vm "bash -s" < "$1" ;;
+  vm-copy)      [ -f "${1:-}" ] || die "need local file"; _copy "${VM_USER}@${VM_IP}" "$1" "${2:-}" ;;
+  prox-copy)    [ -f "${1:-}" ] || die "need local file"; _copy "${PROX_USER}@${PROX_HOST}" "$1" "${2:-}" ;;
+  vm-guest)     [ "$#" -ge 1 ] || die "need command"; _vm_guest "$*" ;;
+  ""|-h|--help|help) sed -n '2,40p' "${BASH_SOURCE[0]}" >&2; exit 0 ;;
+  *) die "unknown mode '$mode'. Run '$0 help'." ;;
+esac