From c748181de23595907efcf3ffca8d4742a6f4f8da Mon Sep 17 00:00:00 2001 From: stephan Date: Thu, 15 Jan 2026 12:45:22 +0100 Subject: [PATCH] feat: split update config into update.env --- .gitignore | 1 + CHANGELOG.md | 2 + README.md | 1 + docs/CONFIGURATION.md | 5 ++- docs/DEPLOYMENT.md | 1 + env.example | 9 ----- env.update.example | 9 +++++ project-management/PROJECT_STATUS.md | 2 + .../requirements/stories/US_000047.md | 16 ++++++++ .../requirements/tasks/TASK_000056.md | 20 ++++++++++ scripts/enroll_update_service.sh | 37 ++++++++++--------- scripts/install.sh | 14 +++++++ systemd/skd.service | 1 + 13 files changed, 91 insertions(+), 27 deletions(-) create mode 100644 env.update.example create mode 100644 project-management/requirements/stories/US_000047.md create mode 100644 project-management/requirements/tasks/TASK_000056.md diff --git a/.gitignore b/.gitignore index 724dab6..5bc8ed8 100644 --- a/.gitignore +++ b/.gitignore @@ -2,6 +2,7 @@ __pycache__/ *.py[cod] *$py.class .venv/ +upload.token venv/ ENV/ .env diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b56c4d..1e9aec8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -71,6 +71,8 @@ By: Codex (GPT-5) | 15.01.2026 | 🏗️ Planning | ID: US_000046/TASK_000055 Update-Service Erreichbarkeit anzeigen. By: Codex (GPT-5) | | 15.01.2026 | ⚙️ Code | ID: US_000046 Update-Service Statusanzeige implementiert. By: Codex (GPT-5) | | 15.01.2026 | ⚙️ Code | ID: Update-Service Status zeigt Dev/Prod und nutzt konsistente Panel-Styles. By: Codex (GPT-5) | +| 15.01.2026 | 🏗️ Planning | ID: US_000047/TASK_000056 Update-ENV getrennt. By: Codex (GPT-5) | +| 15.01.2026 | ⚙️ Code | ID: Update-Config in env.update.example ausgelagert. By: Codex (GPT-5) | | 15.01.2026 | ⚙️ Code | ID: Makefile restart-Target hinzugefuegt. By: Codex (GPT-5) | --- diff --git a/README.md b/README.md index 876b3e0..8d4afdc 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,7 @@ Derzeit keine offiziellen Badges, da im Repository keine CI, Coverage, Release o ## Hinweise - Abweichung von der Zielstruktur: Die OpenAPI-Spezifikation des Update-Services bleibt unter `docs/architecture/openapi.yaml` und `docs/architecture/openapi/` erhalten. - Altdokumente liegen unter `docs/_archive/` und sind nicht geloescht. +- Konfigurationsdateien: `/etc/skd/env` (Core) und `/etc/skd/update.env` (Update-Service). ## Legacy Script Das Script `sk.sh` bleibt als CLI-Fallback. Details und Beispiele: `docs/USAGE.md`. diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md index 7d6ccbf..6fd00d1 100644 --- a/docs/CONFIGURATION.md +++ b/docs/CONFIGURATION.md @@ -4,7 +4,9 @@ By: Codex (GPT-5) # Konfiguration ## Speicherort -Die Konfiguration erfolgt per ENV-Datei, standardmaessig `/etc/skd/env`. Vorlage: `env.example`. +Die Konfiguration erfolgt per ENV-Dateien: +- `/etc/skd/env` (Core-App, Vorlage: `env.example`) +- `/etc/skd/update.env` (Update-Service, Vorlage: `env.update.example`) ## Authentifizierung - `SKD_AUTH_MODE` (default `pam`): `pam` oder `oidc`. Ungueltige Werte fallen auf `pam` zurueck. Hinweis: Der Wert wird aktuell nicht zur Erzwingung genutzt; OIDC ist aktiv, sobald die OIDC-Variablen gesetzt sind. @@ -77,6 +79,7 @@ Hinweis: OIDC ist aktiv, sobald Issuer, Client-ID und Secret gesetzt sind. ## Hinweise - `scripts/install.sh` erstellt `/etc/skd/env` und setzt Default-Werte fuer PAM/Allowed-User. +- `scripts/install.sh` erstellt `/etc/skd/update.env` fuer Update-Service Variablen. - Aenderungen in `/etc/skd/env` erfordern einen Service-Restart (`sudo systemctl restart skd.service`). ## Weitere Dokumente diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index 53e15df..9034cf7 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -9,6 +9,7 @@ By: Codex (GPT-5) - kopiert das Projekt nach `/opt/sk` - erstellt/aktualisiert `.venv` - erstellt `/etc/skd/env` aus `env.example` +- erstellt `/etc/skd/update.env` aus `env.update.example` - schreibt eine systemd-Unit nach `/etc/systemd/system/skd.service` Beispiel: diff --git a/env.example b/env.example index d14e463..41120b9 100644 --- a/env.example +++ b/env.example @@ -21,14 +21,5 @@ SKD_OIDC_STATE_COOKIE_NAME=skd_oidc_state SKD_DEFAULT_COUNTDOWN=60 SKD_DEFAULT_SOUND=false SKD_NOTIFY_TIMEOUT=5 -# Update client configuration -SKD_UPDATE_SERVICE_URL=https://update.wlkns.org -SKD_UPDATE_PROJECT_ID=safe-kiddo-control -SKD_UPDATE_ENROLL_TOKEN= -SKD_UPDATE_TOKEN= -SKD_UPDATE_TOKEN_FILE=/var/lib/skd/update_token -SKD_UPDATE_INTERVAL=3600 -SKD_UPDATE_STATUS_FILE=/var/lib/skd/update_status.json -SKD_UPDATE_LOG_FILE=/var/lib/skd/update_logs.jsonl # Set to true to test without performing real system changes SKD_DRY_RUN=false diff --git a/env.update.example b/env.update.example new file mode 100644 index 0000000..ad60e17 --- /dev/null +++ b/env.update.example @@ -0,0 +1,9 @@ +# Copy to /etc/skd/update.env for update-service configuration +SKD_UPDATE_SERVICE_URL=https://update.wlkns.org +SKD_UPDATE_PROJECT_ID=safe-kiddo-control +SKD_UPDATE_ENROLL_TOKEN= +SKD_UPDATE_TOKEN= +SKD_UPDATE_TOKEN_FILE=/var/lib/skd/update_token +SKD_UPDATE_INTERVAL=3600 +SKD_UPDATE_STATUS_FILE=/var/lib/skd/update_status.json +SKD_UPDATE_LOG_FILE=/var/lib/skd/update_logs.jsonl diff --git a/project-management/PROJECT_STATUS.md b/project-management/PROJECT_STATUS.md index 053614a..25bfb6d 100644 --- a/project-management/PROJECT_STATUS.md +++ b/project-management/PROJECT_STATUS.md @@ -111,6 +111,8 @@ Sicheres, remote steuerbares System zum Sperren/Entsperren lokaler Nutzerkonten. - [x] TASK_000049: Script fuer Enrollment-Flow erstellen - [x] US_000046: Update-Service Erreichbarkeit anzeigen - [x] TASK_000055: Endpoint und UI fuer Update-Service Status +- [x] US_000047: Update-Config auslagern +- [x] TASK_000056: Update-ENV separieren ### EPIC_000009: Update Webservice (External Team) - [ ] US_000026: Client bezieht Updates (Pull) diff --git a/project-management/requirements/stories/US_000047.md b/project-management/requirements/stories/US_000047.md new file mode 100644 index 0000000..f978539 --- /dev/null +++ b/project-management/requirements/stories/US_000047.md @@ -0,0 +1,16 @@ +ID: US_000047 | Version: 0.2.1 | Status: Done +By: Codex (GPT-5) + +# US_000047: Update-Config auslagern + +Als Betreiber moechte ich die Update-Service Konfiguration in einer separaten ENV-Datei, +damit Core-App und Addon-Konfigurationen sauber getrennt sind. + +## Akzeptanzkriterien +- Given die App laeuft +- When Update-Variablen gesetzt werden +- Then werden sie aus `/etc/skd/update.env` gelesen +- And bestehende Installationen bleiben kompatibel + +## Task-Platzhalter +- TASK_000056: Update-ENV separieren und Installationsskript anpassen diff --git a/project-management/requirements/tasks/TASK_000056.md b/project-management/requirements/tasks/TASK_000056.md new file mode 100644 index 0000000..862ff4e --- /dev/null +++ b/project-management/requirements/tasks/TASK_000056.md @@ -0,0 +1,20 @@ +ID: TASK_000056 | Version: 0.2.1 | Status: Done +By: Codex (GPT-5) + +# TASK_000056: Update-ENV separieren + +## Outcome +Update-Variablen werden aus `/etc/skd/update.env` geladen, separate Vorlage vorhanden. + +## Story-Bezug +US_000047 + +## Beschreibung +- `env.update.example` anlegen. +- `env.example` auf Core-Variablen reduzieren. +- systemd Unit mit zweiter EnvironmentFile. +- Installer erstellt beide Dateien. +- Doku und Script anpassen. + +## Definition of Done (DoD) +- Update-Konfig getrennt, kompatibel und dokumentiert. diff --git a/scripts/enroll_update_service.sh b/scripts/enroll_update_service.sh index a797487..c174da9 100755 --- a/scripts/enroll_update_service.sh +++ b/scripts/enroll_update_service.sh @@ -2,6 +2,7 @@ set -euo pipefail ENV_FILE="${ENV_FILE:-/etc/skd/env}" +UPDATE_ENV_FILE="${UPDATE_ENV_FILE:-/etc/skd/update.env}" SERVICE_URL="${SKD_UPDATE_SERVICE_URL:-}" PROJECT_ID="${SKD_UPDATE_PROJECT_ID:-}" TOKEN_FILE="${SKD_UPDATE_TOKEN_FILE:-}" @@ -20,7 +21,8 @@ Options: --client-id ID Client ID (default: hostname) --software-id ID Software ID (default: safe-kiddo) --output PATH Write token to PATH (default: SKD_UPDATE_TOKEN_FILE if set) - --env-file PATH Read env file (default: /etc/skd/env) + --env-file PATH Read core env file (default: /etc/skd/env) + --update-env PATH Read update env file (default: /etc/skd/update.env) -h, --help Show this help EOF } @@ -34,6 +36,7 @@ while [[ $# -gt 0 ]]; do --enroll-token) ENROLL_TOKEN="$2"; shift 2 ;; --output) OUTPUT_PATH="$2"; shift 2 ;; --env-file) ENV_FILE="$2"; shift 2 ;; + --update-env) UPDATE_ENV_FILE="$2"; shift 2 ;; -h|--help) usage; exit 0 ;; *) echo "Unknown option: $1" >&2; usage; exit 1 ;; esac @@ -41,26 +44,26 @@ done read_env_value() { local key="$1" - python3 - <<'PY' "${ENV_FILE}" "${key}" + python3 - <<'PY' "${ENV_FILE}" "${UPDATE_ENV_FILE}" "${key}" from pathlib import Path import sys -path = Path(sys.argv[1]) -key = sys.argv[2] -if not path.exists(): - sys.exit(0) - -for raw in path.read_text(encoding="utf-8").splitlines(): - line = raw.strip() - if not line or line.startswith("#"): +env_paths = [Path(sys.argv[1]), Path(sys.argv[2])] +key = sys.argv[3] +for path in env_paths: + if not path.exists(): continue - if not line.startswith(f"{key}="): - continue - value = line.split("=", 1)[1].strip() - if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")): - value = value[1:-1] - print(value) - sys.exit(0) + for raw in path.read_text(encoding="utf-8").splitlines(): + line = raw.strip() + if not line or line.startswith("#"): + continue + if not line.startswith(f"{key}="): + continue + value = line.split("=", 1)[1].strip() + if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")): + value = value[1:-1] + print(value) + sys.exit(0) PY } diff --git a/scripts/install.sh b/scripts/install.sh index 5400797..2eb10c8 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -10,6 +10,7 @@ SERVICE_GROUP="${SERVICE_GROUP:-$SERVICE_USER}" INSTALL_DIR="${INSTALL_DIR:-/opt/sk}" ENV_DIR="/etc/${SERVICE_NAME}" ENV_FILE="${ENV_DIR}/env" +UPDATE_ENV_FILE="${ENV_DIR}/update.env" SYSTEMD_PATH="/etc/systemd/system/${SERVICE_NAME}.service" log() { @@ -56,6 +57,18 @@ if [[ ! -f "${ENV_FILE}" ]]; then sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}" fi +if [[ ! -f "${UPDATE_ENV_FILE}" ]]; then + if [[ -f "${SOURCE_DIR}/env.update.example" ]]; then + sudo cp "${SOURCE_DIR}/env.update.example" "${UPDATE_ENV_FILE}" + log "Copied env.update.example to ${UPDATE_ENV_FILE}; edit update service variables." + else + sudo touch "${UPDATE_ENV_FILE}" + log "Created empty ${UPDATE_ENV_FILE}; populate update variables." + fi + sudo chmod 640 "${UPDATE_ENV_FILE}" + sudo chown root:"${SERVICE_GROUP}" "${UPDATE_ENV_FILE}" +fi + is_debian_like() { if [[ ! -r /etc/os-release ]]; then return 1 @@ -113,6 +126,7 @@ User=root Group=root WorkingDirectory=${INSTALL_DIR} EnvironmentFile=${ENV_FILE} +EnvironmentFile=-${UPDATE_ENV_FILE} ExecStart=${INSTALL_DIR}/.venv/bin/uvicorn backend.app:app --host 0.0.0.0 --port 80 Restart=on-failure RestartSec=3 diff --git a/systemd/skd.service b/systemd/skd.service index f77d657..bf1dad6 100644 --- a/systemd/skd.service +++ b/systemd/skd.service @@ -8,6 +8,7 @@ User=root Group=root WorkingDirectory=/opt/sk EnvironmentFile=/etc/skd/env +EnvironmentFile=-/etc/skd/update.env ExecStart=/opt/sk/.venv/bin/uvicorn backend.app:app --host 0.0.0.0 --port 80 Restart=on-failure RestartSec=3