Fix: ensure_system() läuft bei JEDER mailwolt-update Ausführung
Scripts, Sudoers-Regeln und sbin-Binaries werden jetzt immer aktualisiert — auch wenn kein Update verfügbar ist. Damit entfällt das manuelle Nachtragen von Sudoers-Regeln nach neuen Releases. ensure_system() wird aufgerufen: - Vor jedem "bereits aktuell"-Exit (tags + branch mode) - Am Ende jedes erfolgreichen Updates Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>main v1.1.274
parent
096e983313
commit
17ed5b18d9
|
|
@ -141,6 +141,32 @@ frontend_build_quiet() {
|
|||
echo "[✓] Frontend gebaut."
|
||||
}
|
||||
|
||||
# -------- Systemzustand sicherstellen (läuft bei JEDER Ausführung) -----------
|
||||
# Neue Scripts/Sudoers-Regeln werden so auch ohne echtes Update eingespielt.
|
||||
_sbin_install(){
|
||||
local src="$1" dst="$2"
|
||||
[[ -f "$src" ]] && install -m 755 "$src" "$dst" && return 0 || return 0
|
||||
}
|
||||
_sudoers_add(){
|
||||
local file="$1" rule="$2"
|
||||
[[ -f "$file" ]] || return 0
|
||||
grep -qF "$rule" "$file" && return 0
|
||||
chmod 640 "$file"
|
||||
printf '%s\n' "$rule" >> "$file"
|
||||
chmod 440 "$file"
|
||||
}
|
||||
ensure_system(){
|
||||
# Scripts nach sbin
|
||||
_sbin_install "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains
|
||||
_sbin_install "${APP_DIR}/scripts/mailwolt-fetch-tags" /usr/local/sbin/mailwolt-fetch-tags
|
||||
_sbin_install "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update
|
||||
# Sudoers-Regeln nachrüsten
|
||||
for f in /etc/sudoers.d/mailwolt-certbot /etc/sudoers.d/mailwolt-dkim; do
|
||||
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags'
|
||||
_sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
|
||||
done
|
||||
}
|
||||
|
||||
# -------- Guards --------------------------------------------------------------
|
||||
[[ "$(id -u)" -eq 0 ]] || { echo "[!] Bitte als root ausführen"; exit 1; }
|
||||
[[ -d "$APP_DIR/.git" ]] || { echo "[!] $APP_DIR scheint kein Git-Repo zu sein"; exit 1; }
|
||||
|
|
@ -197,6 +223,7 @@ if [[ "$MODE" = "tags" ]]; then
|
|||
if [[ "$TARGET_REV" = "$OLD_REV" ]]; then
|
||||
echo "[✓] Bereits auf neuestem Release (${LATEST_TAG}) – nichts zu tun."
|
||||
write_build_info "$(get_version)" "$OLD_REV"
|
||||
ensure_system
|
||||
exit 0
|
||||
fi
|
||||
echo "[i] Checkout auf Release ${LATEST_TAG} (${TARGET_REV:0:7}) …"
|
||||
|
|
@ -210,6 +237,7 @@ else
|
|||
if [[ "$BEHIND" -eq 0 ]]; then
|
||||
echo "[✓] Branch origin/${BRANCH} ist bereits aktuell – nichts zu tun."
|
||||
write_build_info "$(get_version)" "$OLD_REV"
|
||||
ensure_system
|
||||
exit 0
|
||||
fi
|
||||
echo "[i] Es gibt ${BEHIND} neue Commit(s) – ziehe Änderungen …"
|
||||
|
|
@ -240,15 +268,7 @@ echo " PHP restart : $([[ $NEED_PHP_RESTART -eq 1 ]] && echo JA || echo nein
|
|||
echo " Sbin-Scripts : $([[ $NEED_SBIN_UPDATE -eq 1 ]] && echo JA || echo nein)"
|
||||
|
||||
# System-Scripts aus scripts/ sofort nach dem Pull einspielen (kein Downtime nötig)
|
||||
if [[ $NEED_SBIN_UPDATE -eq 1 ]]; then
|
||||
echo "[i] System-Scripts aktualisieren …"
|
||||
[[ -f "${APP_DIR}/scripts/mailwolt-apply-domains" ]] && \
|
||||
install -m 755 "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains && \
|
||||
echo "[✓] /usr/local/sbin/mailwolt-apply-domains aktualisiert."
|
||||
[[ -f "${APP_DIR}/scripts/mailwolt-fetch-tags" ]] && \
|
||||
install -m 755 "${APP_DIR}/scripts/mailwolt-fetch-tags" /usr/local/sbin/mailwolt-fetch-tags && \
|
||||
echo "[✓] /usr/local/sbin/mailwolt-fetch-tags aktualisiert."
|
||||
fi
|
||||
# ensure_system() am Ende des Scripts übernimmt das vollständig.
|
||||
|
||||
# Wenn gar nichts relevantes geändert wurde → sauber beenden
|
||||
if [[ $NEED_COMPOSER -eq 0 && $NEED_MIGRATIONS -eq 0 && $NEED_FRONTEND -eq 0 && $NEED_PHP_RESTART -eq 0 ]]; then
|
||||
|
|
@ -317,22 +337,4 @@ write_version_files "$NEW_VER" "$NEW_REV"
|
|||
|
||||
echo "[✓] Update abgeschlossen: ${OLD_VER} → ${NEW_VER} (${OLD_REV:0:7} → ${NEW_REV:0:7})"
|
||||
|
||||
# Immer: System-Scripts auf den neuesten Stand bringen (selbst wenn nicht in CHANGED_FILES)
|
||||
[[ -f "${APP_DIR}/scripts/mailwolt-apply-domains" ]] && \
|
||||
install -m 755 "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains
|
||||
[[ -f "${APP_DIR}/scripts/mailwolt-fetch-tags" ]] && \
|
||||
install -m 755 "${APP_DIR}/scripts/mailwolt-fetch-tags" /usr/local/sbin/mailwolt-fetch-tags
|
||||
install -m 755 "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update
|
||||
|
||||
# Sudoers: fehlende Einträge nachrüsten (Upgrade-Pfad für bestehende Instanzen)
|
||||
_sudoers_add() {
|
||||
local file="$1" rule="$2"
|
||||
if [[ -f "$file" ]] && ! grep -qF "$rule" "$file"; then
|
||||
chmod 640 "$file"
|
||||
echo "$rule" >> "$file"
|
||||
chmod 440 "$file"
|
||||
fi
|
||||
}
|
||||
_sudoers_add /etc/sudoers.d/mailwolt-certbot 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags'
|
||||
_sudoers_add /etc/sudoers.d/mailwolt-certbot 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
|
||||
_sudoers_add /etc/sudoers.d/mailwolt-dkim 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
|
||||
ensure_system
|
||||
Loading…
Reference in New Issue