From 1888f59c05fcc760a5e7886bf81c46acc9b047e7 Mon Sep 17 00:00:00 2001 From: stephan Date: Thu, 15 Jan 2026 09:28:05 +0100 Subject: [PATCH] scripts: add update-service enrollment helper --- CHANGELOG.md | 2 + docs/DEPLOYMENT.md | 6 ++ project-management/PROJECT_STATUS.md | 2 + .../requirements/epics/EPIC_000008.md | 1 + .../requirements/stories/US_000043.md | 17 ++++ .../requirements/tasks/TASK_000049.md | 19 ++++ scripts/enroll_update_service.sh | 97 +++++++++++++++++++ 7 files changed, 144 insertions(+) create mode 100644 project-management/requirements/stories/US_000043.md create mode 100644 project-management/requirements/tasks/TASK_000049.md create mode 100755 scripts/enroll_update_service.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 035300f..1811ae5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -63,6 +63,8 @@ By: Codex (GPT-5) | 15.01.2026 | 🏗️ Planning | ID: US_000042/TASK_000046-TASK_000048 Consumer-Doku und Audience-Split ergaenzen. By: Codex (GPT-5) | | 15.01.2026 | 📝 Req | ID: US_000042 Consumer-Doku, Audience-Split, External Dependencies und Power-User-Ergaenzungen umgesetzt. By: Codex (GPT-5) | | 15.01.2026 | 📝 Req | ID: Makefile als bevorzugter Einstieg in Doku ergaenzt. By: Codex (GPT-5) | +| 15.01.2026 | 🏗️ Planning | ID: US_000043/TASK_000049 Enrollment-Token Script geplant. By: Codex (GPT-5) | +| 15.01.2026 | ⚙️ Code | ID: US_000043 Enrollment-Script fuer Update-Service hinzugefuegt. By: Codex (GPT-5) | --- ## Legende diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index cdfc2f5..57d3fc4 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -92,6 +92,12 @@ Hinweis: Der Update-Check ist erst moeglich, wenn der Langzeit-Token gespeichert Enrollment-Tools: - `scripts/manual_enroll.py`: Enrollment direkt gegen den Update-Service, schreibt Token in `SKD_UPDATE_TOKEN_FILE`. - `scripts/enroll_local.py`: Enrollment ueber die lokale API (`/update/enroll`), benoetigt Admin-Session; `--token` setzen (Default-Token ist nur Prototyp-Altlast). +- `scripts/enroll_update_service.sh`: Holt den Langzeit-Token per curl vom Update-Service (liest `/etc/skd/env`). + +Beispiel (curl-Script): +```bash +sudo ./scripts/enroll_update_service.sh --enroll-token "enroll_example" +``` Lokale Status/Logs: - `SKD_UPDATE_STATUS_FILE` (default `/var/lib/skd/update_status.json`) diff --git a/project-management/PROJECT_STATUS.md b/project-management/PROJECT_STATUS.md index 8939960..6c32ac7 100644 --- a/project-management/PROJECT_STATUS.md +++ b/project-management/PROJECT_STATUS.md @@ -106,6 +106,8 @@ Sicheres, remote steuerbares System zum Sperren/Entsperren lokaler Nutzerkonten. - [x] TASK_000033: UI update logs view - [x] US_000033: Rollback im Web-UI anstossen - [x] TASK_000034: UI rollback action +- [x] US_000043: Enrollment-Token per Script abrufen +- [x] TASK_000049: Script fuer Enrollment-Flow erstellen ### EPIC_000009: Update Webservice (External Team) - [ ] US_000026: Client bezieht Updates (Pull) diff --git a/project-management/requirements/epics/EPIC_000008.md b/project-management/requirements/epics/EPIC_000008.md index 19f47c9..9d8c136 100644 --- a/project-management/requirements/epics/EPIC_000008.md +++ b/project-management/requirements/epics/EPIC_000008.md @@ -44,3 +44,4 @@ Ermoegliche einen robusten Client-Update-Flow mit Verifikation und Rollback. - US_000031: Update im Web-UI anstossen - US_000032: Update-Logs im Web-UI anzeigen - US_000033: Rollback im Web-UI anstossen +- US_000043: Enrollment-Token per Script abrufen diff --git a/project-management/requirements/stories/US_000043.md b/project-management/requirements/stories/US_000043.md new file mode 100644 index 0000000..399000b --- /dev/null +++ b/project-management/requirements/stories/US_000043.md @@ -0,0 +1,17 @@ +ID: US_000043 | Version: 0.2.1 | Status: Done +By: Codex (GPT-5) + +# US_000043: Enrollment-Token per Script abrufen + +Als Admin moechte ich ein einfaches Script, das den Enrollment-Flow +gegen den Update-Service per curl ausfuehrt, damit ich den Langzeit-Token +ohne manuelle Requests erzeugen kann. + +## Akzeptanzkriterien +- Given ein gueltiger Enrollment-Token vom Update-Service +- When das Script ausgefuehrt wird +- Then wird ein Langzeit-Token erstellt und optional in eine Datei geschrieben +- And Service-URL und Projekt-ID koennen per ENV oder Parameter gesetzt werden + +## Task-Platzhalter +- TASK_000049: Script fuer Enrollment-Flow erstellen und dokumentieren diff --git a/project-management/requirements/tasks/TASK_000049.md b/project-management/requirements/tasks/TASK_000049.md new file mode 100644 index 0000000..10ecb96 --- /dev/null +++ b/project-management/requirements/tasks/TASK_000049.md @@ -0,0 +1,19 @@ +ID: TASK_000049 | Version: 0.2.1 | Status: Done +By: Codex (GPT-5) + +# TASK_000049: Script fuer Enrollment-Flow erstellen + +## Outcome +Ein Bash-Script nutzt curl, um den Enrollment-Flow gegen den Update-Service auszufuehren. + +## Story-Bezug +US_000043 + +## Beschreibung +- Script liest `SKD_UPDATE_SERVICE_URL`, `SKD_UPDATE_PROJECT_ID` und optional `SKD_UPDATE_TOKEN_FILE`. +- Enrollment-Token als Parameter. +- Token extrahieren und Datei mit 0600 schreiben. + +## Definition of Done (DoD) +- Script im Repo vorhanden und dokumentiert. +- Funktioniert mit ENV oder Parametern. diff --git a/scripts/enroll_update_service.sh b/scripts/enroll_update_service.sh new file mode 100755 index 0000000..4dedc17 --- /dev/null +++ b/scripts/enroll_update_service.sh @@ -0,0 +1,97 @@ +#!/usr/bin/env bash +set -euo pipefail + +ENV_FILE="${ENV_FILE:-/etc/skd/env}" +SERVICE_URL="${SKD_UPDATE_SERVICE_URL:-}" +PROJECT_ID="${SKD_UPDATE_PROJECT_ID:-}" +TOKEN_FILE="${SKD_UPDATE_TOKEN_FILE:-}" +CLIENT_ID="" +SOFTWARE_ID="safe-kiddo" +ENROLL_TOKEN="" +OUTPUT_PATH="" + +usage() { + cat <<'EOF' +Usage: enroll_update_service.sh --enroll-token TOKEN [options] + +Options: + --service-url URL Update-Service URL (default: SKD_UPDATE_SERVICE_URL) + --project-id ID Project ID (default: SKD_UPDATE_PROJECT_ID) + --client-id ID Client ID (default: hostname) + --software-id ID Software ID (default: safe-kiddo) + --output PATH Write token to PATH (default: SKD_UPDATE_TOKEN_FILE if set) + --env-file PATH Read env file (default: /etc/skd/env) + -h, --help Show this help +EOF +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --service-url) SERVICE_URL="$2"; shift 2 ;; + --project-id) PROJECT_ID="$2"; shift 2 ;; + --client-id) CLIENT_ID="$2"; shift 2 ;; + --software-id) SOFTWARE_ID="$2"; shift 2 ;; + --enroll-token) ENROLL_TOKEN="$2"; shift 2 ;; + --output) OUTPUT_PATH="$2"; shift 2 ;; + --env-file) ENV_FILE="$2"; shift 2 ;; + -h|--help) usage; exit 0 ;; + *) echo "Unknown option: $1" >&2; usage; exit 1 ;; + esac +done + +if [[ -f "${ENV_FILE}" ]]; then + set -a + # shellcheck disable=SC1090 + . "${ENV_FILE}" + set +a +fi + +SERVICE_URL="${SERVICE_URL:-${SKD_UPDATE_SERVICE_URL:-}}" +PROJECT_ID="${PROJECT_ID:-${SKD_UPDATE_PROJECT_ID:-}}" +TOKEN_FILE="${OUTPUT_PATH:-${TOKEN_FILE}}" +CLIENT_ID="${CLIENT_ID:-$(hostname)}" + +if [[ -z "${SERVICE_URL}" || -z "${PROJECT_ID}" ]]; then + echo "Missing service URL or project ID." >&2 + echo "Set SKD_UPDATE_SERVICE_URL and SKD_UPDATE_PROJECT_ID or pass --service-url/--project-id." >&2 + exit 1 +fi + +if [[ -z "${ENROLL_TOKEN}" ]]; then + echo "Missing --enroll-token." >&2 + exit 1 +fi + +payload=$(python3 - < "${TOKEN_FILE}" + chmod 600 "${TOKEN_FILE}" + echo "Token written to ${TOKEN_FILE}" +else + echo "${token}" +fi