From 825a35924d7b219806e8daebe5978c38e869d2e4 Mon Sep 17 00:00:00 2001 From: David Schroeder Date: Sun, 26 Jul 2026 16:06:17 -0500 Subject: [PATCH] update --- README.md | 7 +++ defaults.inc | 28 +-------- inc/runtime-config.inc | 111 +++++++++++++++++++++++++++++++++++ run.sh | 23 +------- tests/test-runtime-config.sh | 45 ++++++++++++++ 5 files changed, 169 insertions(+), 45 deletions(-) create mode 100644 inc/runtime-config.inc create mode 100644 tests/test-runtime-config.sh diff --git a/README.md b/README.md index e1eb704..bd33e26 100644 --- a/README.md +++ b/README.md @@ -152,3 +152,10 @@ message when the variable is missing or invalid. `GITEA_DOMAIN` is a hostname, without `https://` or a path, and controls Gitea connectivity plus restoration of the `voltron/iDS-Defaults.git` repository. Repository updates do not overwrite the system configuration file. + +On the first V2 launch after installation or upgrade, TA-ProxMenu detects a +missing or incomplete `/etc/ta-proxmenu/config.env` and interactively requests +both values. Inputs are validated and written atomically with mode `0600` +before update checks or menu actions continue. A non-interactive launch without +valid configuration stops with an explicit setup message instead of selecting +a default company URL. diff --git a/defaults.inc b/defaults.inc index 34462ee..b81e636 100755 --- a/defaults.inc +++ b/defaults.inc @@ -3,7 +3,7 @@ action="${1:-}" FOLDER='/opt/idssys/ta-proxmenu' -VERS='2026.7.26-4' +VERS='2026.7.26-5' noupdate=' ' @@ -19,30 +19,8 @@ VIRTIO_STABLE_URL="https://fedorapeople.org/groups/virt/virtio-win/direct-downlo PULSE_RELEASE='v6.1.1' PULSE_PORT='7655' -TAPM_CONFIG_FILE='/etc/ta-proxmenu/config.env' -for config_key in TAPM_BROKER_URL GITEA_DOMAIN; do - if [[ -z "${!config_key:-}" && -r "$TAPM_CONFIG_FILE" ]]; then - config_value="$( - sed -n "s/^[[:space:]]*${config_key}[[:space:]]*=[[:space:]]*//p" \ - "$TAPM_CONFIG_FILE" | - tail -n 1 - )" - config_value="${config_value#\"}" - config_value="${config_value%\"}" - config_value="${config_value#\'}" - config_value="${config_value%\'}" - printf -v "$config_key" '%s' "$config_value" - fi -done -unset config_key config_value -TAPM_BROKER_URL="${TAPM_BROKER_URL:-}" -TAPM_BROKER_URL="${TAPM_BROKER_URL%/}" -GITEA_DOMAIN="${GITEA_DOMAIN:-}" -if [[ "$GITEA_DOMAIN" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]]; then - GITEA_URL="https://${GITEA_DOMAIN}" -else - GITEA_URL='' -fi +source "${FOLDER}/inc/runtime-config.inc" +TAPM_ENSURE_RUNTIME_CONFIG || return 1 2>/dev/null || exit 1 S1_BROKER_PACKAGE='sentinelone-linux' S1_PACKAGE='tapm-sentinelone.deb' diff --git a/inc/runtime-config.inc b/inc/runtime-config.inc new file mode 100644 index 0000000..98b8e1c --- /dev/null +++ b/inc/runtime-config.inc @@ -0,0 +1,111 @@ +#!/usr/bin/env bash + +TAPM_CONFIG_FILE="${TAPM_CONFIG_FILE:-/etc/ta-proxmenu/config.env}" + +TAPM_CONFIG_READ_VALUE() { + local key="$1" + local value='' + + if [[ -r "$TAPM_CONFIG_FILE" ]]; then + value="$( + sed -n "s/^[[:space:]]*${key}[[:space:]]*=[[:space:]]*//p" \ + "$TAPM_CONFIG_FILE" | + tail -n 1 + )" + value="${value#\"}" + value="${value%\"}" + value="${value#\'}" + value="${value%\'}" + fi + printf '%s' "$value" +} + +TAPM_VALID_BROKER_ORIGIN() { + [[ "${1:-}" =~ ^https://[A-Za-z0-9.-]+(:[0-9]+)?/?$ ]] +} + +TAPM_VALID_GITEA_DOMAIN() { + [[ "${1:-}" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] +} + +TAPM_LOAD_RUNTIME_CONFIG() { + if [[ -z "${TAPM_BROKER_URL:-}" ]]; then + TAPM_BROKER_URL="$(TAPM_CONFIG_READ_VALUE TAPM_BROKER_URL)" + fi + if [[ -z "${GITEA_DOMAIN:-}" ]]; then + GITEA_DOMAIN="$(TAPM_CONFIG_READ_VALUE GITEA_DOMAIN)" + fi + + TAPM_BROKER_URL="${TAPM_BROKER_URL:-}" + TAPM_BROKER_URL="${TAPM_BROKER_URL%/}" + GITEA_DOMAIN="${GITEA_DOMAIN:-}" + if TAPM_VALID_GITEA_DOMAIN "$GITEA_DOMAIN"; then + GITEA_URL="https://${GITEA_DOMAIN}" + else + GITEA_URL='' + fi +} + +TAPM_ENSURE_RUNTIME_CONFIG() { + local broker_url + local config_dir + local gitea_domain + local input_device='/dev/tty' + local temporary_file + + TAPM_LOAD_RUNTIME_CONFIG + if [[ -r "$TAPM_CONFIG_FILE" ]] && + TAPM_VALID_BROKER_ORIGIN "$TAPM_BROKER_URL" && + TAPM_VALID_GITEA_DOMAIN "$GITEA_DOMAIN"; then + return 0 + fi + + if [[ "${TAPM_CONFIG_TEST_STDIN:-0}" == 1 ]]; then + input_device='/dev/stdin' + exec 3>&2 + elif [[ ! -r /dev/tty || ! -w /dev/tty ]]; then + printf 'TA-ProxMenu requires %s with TAPM_BROKER_URL and GITEA_DOMAIN.\n' \ + "$TAPM_CONFIG_FILE" >&2 + return 1 + else + exec 3>/dev/tty + fi + + printf '\nTA-ProxMenu V2 requires deployment service configuration.\n' \ + >&3 + while true; do + printf 'TAPM broker HTTPS origin (example: https://tapm.example.com): ' \ + >&3 + IFS= read -r broker_url <"$input_device" || return 1 + broker_url="${broker_url%/}" + TAPM_VALID_BROKER_ORIGIN "$broker_url" && break + printf 'Enter an HTTPS origin without a path.\n' >&3 + done + while true; do + printf 'Gitea hostname (example: git.example.com): ' >&3 + IFS= read -r gitea_domain <"$input_device" || return 1 + TAPM_VALID_GITEA_DOMAIN "$gitea_domain" && break + printf 'Enter a hostname without https:// or a path.\n' >&3 + done + + config_dir="${TAPM_CONFIG_FILE%/*}" + [[ "$config_dir" != "$TAPM_CONFIG_FILE" ]] || config_dir='.' + mkdir -p "$config_dir" || return 1 + temporary_file="$(mktemp "${TAPM_CONFIG_FILE}.tmp.XXXXXX")" || return 1 + if ! { + printf 'TAPM_BROKER_URL=%s\n' "$broker_url" + printf 'GITEA_DOMAIN=%s\n' "$gitea_domain" + } >"$temporary_file" || + ! chmod 0600 "$temporary_file" || + ! mv -f "$temporary_file" "$TAPM_CONFIG_FILE"; then + rm -f "$temporary_file" + return 1 + fi + + TAPM_BROKER_URL="$broker_url" + GITEA_DOMAIN="$gitea_domain" + GITEA_URL="https://${GITEA_DOMAIN}" + printf 'Saved TA-ProxMenu configuration to %s.\n\n' "$TAPM_CONFIG_FILE" \ + >&3 + exec 3>&- +} diff --git a/run.sh b/run.sh index bdd1fae..657c3b6 100755 --- a/run.sh +++ b/run.sh @@ -5,26 +5,9 @@ DEFAULTS_REPOSITORY='/opt/idssys/defaults' DEFAULTS_CACHE_DIR='/var/cache/ta-proxmenu' DEFAULTS_CHECK_FILE="${DEFAULTS_CACHE_DIR}/defaults-last-check" DEFAULTS_CHECK_SECONDS=14400 -TAPM_CONFIG_FILE='/etc/ta-proxmenu/config.env' - -if [[ -z "${GITEA_DOMAIN:-}" && -r "$TAPM_CONFIG_FILE" ]]; then - GITEA_DOMAIN="$( - sed -n 's/^[[:space:]]*GITEA_DOMAIN[[:space:]]*=[[:space:]]*//p' \ - "$TAPM_CONFIG_FILE" | - tail -n 1 - )" - GITEA_DOMAIN="${GITEA_DOMAIN#\"}" - GITEA_DOMAIN="${GITEA_DOMAIN%\"}" - GITEA_DOMAIN="${GITEA_DOMAIN#\'}" - GITEA_DOMAIN="${GITEA_DOMAIN%\'}" -fi -if [[ "${GITEA_DOMAIN:-}" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]]; then - GITEA_URL="https://${GITEA_DOMAIN}" - DEFAULTS_REPOSITORY_URL="${GITEA_URL}/voltron/iDS-Defaults.git" -else - GITEA_URL='' - DEFAULTS_REPOSITORY_URL='' -fi +source /opt/idssys/ta-proxmenu/inc/runtime-config.inc +TAPM_ENSURE_RUNTIME_CONFIG || exit 1 +DEFAULTS_REPOSITORY_URL="${GITEA_URL}/voltron/iDS-Defaults.git" source /opt/idssys/ta-proxmenu/inc/git-update.inc diff --git a/tests/test-runtime-config.sh b/tests/test-runtime-config.sh new file mode 100644 index 0000000..4a1f36c --- /dev/null +++ b/tests/test-runtime-config.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +set -u -o pipefail + +TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +test_dir="$(mktemp -d)" +trap 'rm -rf "$test_dir"' EXIT + +TAPM_CONFIG_FILE="${test_dir}/etc/config.env" +TAPM_CONFIG_TEST_STDIN=1 +source "${TEST_ROOT}/inc/runtime-config.inc" + +if ! printf '%s\n%s\n' \ + 'https://tapm.example.com' \ + 'git.example.com' | + TAPM_ENSURE_RUNTIME_CONFIG >/dev/null; then + printf 'FAIL: configuration wizard failed\n' >&2 + exit 1 +fi + +expected=$'TAPM_BROKER_URL=https://tapm.example.com\nGITEA_DOMAIN=git.example.com' +actual="$(cat "$TAPM_CONFIG_FILE")" +if [[ "$actual" != "$expected" ]]; then + printf 'FAIL: unexpected configuration contents\n' >&2 + exit 1 +fi +if stat -c '%a' "$TAPM_CONFIG_FILE" >/dev/null 2>&1; then + config_mode="$(stat -c '%a' "$TAPM_CONFIG_FILE")" +else + config_mode="$(stat -f '%Lp' "$TAPM_CONFIG_FILE")" +fi +if [[ "$config_mode" != 600 ]]; then + printf 'FAIL: configuration mode is not 600\n' >&2 + exit 1 +fi + +unset TAPM_BROKER_URL GITEA_DOMAIN GITEA_URL +TAPM_LOAD_RUNTIME_CONFIG +if [[ "$TAPM_BROKER_URL" != 'https://tapm.example.com' || + "$GITEA_DOMAIN" != 'git.example.com' || + "$GITEA_URL" != 'https://git.example.com' ]]; then + printf 'FAIL: saved configuration did not reload\n' >&2 + exit 1 +fi + +printf 'PASS: runtime configuration wizard\n'