From c4a2f33293a30dd5225dfe8d5ebc279edb2f9fd2 Mon Sep 17 00:00:00 2001 From: boban Date: Sun, 26 Apr 2026 07:46:18 +0200 Subject: [PATCH] Fix: Update-Check via mailwolt-fetch-tags + Fehlerdetails in Settings-Toast MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Neu: scripts/mailwolt-fetch-tags ruft git ls-remote als App-User auf (hat Credentials), schreibt neuesten Tag nach /var/lib/mailwolt/version_remote - CheckUpdates.php nutzt jetzt sudo mailwolt-fetch-tags statt direktem git fetch als www-data (www-data hat keine Git-Credentials für private Repos) - SettingsForm.php zeigt tatsächliche Fehlerzeilen ([!], error, failed) im Toast statt generischer "fehlgeschlagen"-Meldung - installer.sh + update.sh installieren mailwolt-fetch-tags nach /usr/local/sbin/ - update.sh trägt mailwolt-fetch-tags automatisch in sudoers nach (Upgrade-Pfad) Co-Authored-By: Claude Sonnet 4.6 --- app/Console/Commands/CheckUpdates.php | 19 +++++++++---------- app/Livewire/Ui/System/SettingsForm.php | 10 ++++++++-- installer.sh | 2 ++ scripts/mailwolt-fetch-tags | 17 +++++++++++++++++ scripts/update.sh | 12 +++++++++++- 5 files changed, 47 insertions(+), 13 deletions(-) create mode 100755 scripts/mailwolt-fetch-tags diff --git a/app/Console/Commands/CheckUpdates.php b/app/Console/Commands/CheckUpdates.php index 5309497..536c03d 100644 --- a/app/Console/Commands/CheckUpdates.php +++ b/app/Console/Commands/CheckUpdates.php @@ -15,19 +15,18 @@ class CheckUpdates extends Command $currentRaw = $this->readInstalledVersionRaw() ?? ($currentNorm ? 'v'.$currentNorm : null); $appPath = base_path(); - $cmd = <</dev/null || true - cd {$appPath} - git fetch --tags --force --quiet origin +refs/tags/*:refs/tags/* - (git tag -l 'v*' --sort=-v:refname | head -n1) || true - BASH; - $latestTagRaw = trim((string) shell_exec($cmd)); - if ($latestTagRaw === '') { - $latestTagRaw = trim((string) shell_exec("cd {$appPath} && git tag -l --sort=-v:refname | head -n1")); + // Fetch remote tags via privileged helper (www-data has no git credentials for private repo) + $fetchHelper = '/usr/local/sbin/mailwolt-fetch-tags'; + if (file_exists($fetchHelper)) { + shell_exec('sudo -n ' . escapeshellarg($fetchHelper) . ' 2>/dev/null'); } + // Latest remote tag written by helper; fall back to local tags + $remoteRaw = trim((string) @file_get_contents('/var/lib/mailwolt/version_remote')); + $latestTagRaw = $remoteRaw !== '' ? $remoteRaw + : trim((string) shell_exec("git -C " . escapeshellarg($appPath) . " tag -l 'v*' --sort=-v:refname 2>/dev/null | head -n1")); + $latestNorm = $this->normalizeVersion($latestTagRaw); // Nichts gefunden -> alles leeren diff --git a/app/Livewire/Ui/System/SettingsForm.php b/app/Livewire/Ui/System/SettingsForm.php index a8951c9..963cac7 100644 --- a/app/Livewire/Ui/System/SettingsForm.php +++ b/app/Livewire/Ui/System/SettingsForm.php @@ -313,10 +313,16 @@ class SettingsForm extends Component duration: 5000, ); } else { + $lines = array_filter( + explode("\n", (string) $output), + fn($l) => preg_match('/\[!\]|error|failed|fehler|nginx\s+-t/i', trim($l)) + ); + $detail = implode(' · ', array_map('trim', array_slice(array_values($lines), 0, 3))); + $this->dispatch('toast', type: 'warn', badge: 'Nginx', title: 'Nginx-Konfiguration fehlgeschlagen', - text: 'Nginx konnte nicht neu geladen werden. Domains wurden trotzdem gespeichert. Siehe Laravel-Log.', - duration: 7000, + text: $detail ?: 'Nginx konnte nicht neu geladen werden. Domains gespeichert. Siehe Laravel-Log.', + duration: 10000, ); } } diff --git a/installer.sh b/installer.sh index 7670db9..7374555 100644 --- a/installer.sh +++ b/installer.sh @@ -580,6 +580,7 @@ chmod 775 /var/lib/mailwolt/wizard step "Hilfsskripte & Konfiguration installieren" "5 Sek" install -m 755 "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains +install -m 755 "${APP_DIR}/scripts/mailwolt-fetch-tags" /usr/local/sbin/mailwolt-fetch-tags # ===== mailwolt-update installieren ===== install -m 755 "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update @@ -587,6 +588,7 @@ install -m 755 "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update # ===== Sudoers für www-data (helper + update) ===== cat > /etc/sudoers.d/mailwolt-certbot <<'SUDOERS' www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-apply-domains +www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-update www-data ALL=(root) NOPASSWD: /usr/bin/certbot SUDOERS diff --git a/scripts/mailwolt-fetch-tags b/scripts/mailwolt-fetch-tags new file mode 100755 index 0000000..e25e4f7 --- /dev/null +++ b/scripts/mailwolt-fetch-tags @@ -0,0 +1,17 @@ +#!/usr/bin/env bash +# Fetch remote git tags as the app user (who has git credentials) and cache the latest tag. +# Called via sudo by www-data (CheckUpdates scheduler command). +set -uo pipefail + +APP_USER="${APP_USER:-mailwolt}" +APP_DIR="${APP_DIR:-/var/www/mailwolt}" +OUT_FILE="/var/lib/mailwolt/version_remote" + +LATEST="$(sudo -u "$APP_USER" bash -c \ + "git -C '${APP_DIR}' ls-remote --tags --sort=-v:refname origin 'v*' 2>/dev/null \ + | grep -v '\^{}' | head -1 | sed 's|.*refs/tags/||'" 2>/dev/null || true)" + +if [ -n "$LATEST" ]; then + mkdir -p "$(dirname "$OUT_FILE")" + printf '%s\n' "$LATEST" > "$OUT_FILE" +fi diff --git a/scripts/update.sh b/scripts/update.sh index 8be86bc..c749575 100644 --- a/scripts/update.sh +++ b/scripts/update.sh @@ -230,6 +230,9 @@ if [[ $NEED_SBIN_UPDATE -eq 1 ]]; then [[ -f "${APP_DIR}/scripts/mailwolt-apply-domains" ]] && \ install -m 755 "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains && \ echo "[✓] /usr/local/sbin/mailwolt-apply-domains aktualisiert." + [[ -f "${APP_DIR}/scripts/mailwolt-fetch-tags" ]] && \ + install -m 755 "${APP_DIR}/scripts/mailwolt-fetch-tags" /usr/local/sbin/mailwolt-fetch-tags && \ + echo "[✓] /usr/local/sbin/mailwolt-fetch-tags aktualisiert." fi # Wenn gar nichts relevantes geändert wurde → sauber beenden @@ -302,4 +305,11 @@ echo "[✓] Update abgeschlossen: ${OLD_VER} → ${NEW_VER} (${OLD_REV:0:7} → # Immer: System-Scripts auf den neuesten Stand bringen (selbst wenn nicht in CHANGED_FILES) [[ -f "${APP_DIR}/scripts/mailwolt-apply-domains" ]] && \ install -m 755 "${APP_DIR}/scripts/mailwolt-apply-domains" /usr/local/sbin/mailwolt-apply-domains -install -m 755 "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update \ No newline at end of file +[[ -f "${APP_DIR}/scripts/mailwolt-fetch-tags" ]] && \ + install -m 755 "${APP_DIR}/scripts/mailwolt-fetch-tags" /usr/local/sbin/mailwolt-fetch-tags +install -m 755 "${APP_DIR}/scripts/update.sh" /usr/local/sbin/mailwolt-update + +# Sudoers: sicherstellen dass mailwolt-fetch-tags eingetragen ist (Upgrade-Pfad für bestehende Instanzen) +if [[ -f /etc/sudoers.d/mailwolt-certbot ]] && ! grep -q 'mailwolt-fetch-tags' /etc/sudoers.d/mailwolt-certbot; then + echo 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags' >> /etc/sudoers.d/mailwolt-certbot +fi \ No newline at end of file