Skip to content

Provision logi-owned W2MO DB folders on managed hosts #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
jplapp wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Provision logi-owned W2MO DB folders on managed hosts #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions scripts/deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,43 @@ fi
sudo -n chgrp superkey /data
sudo -n chmod 2775 /data

# W2MO hosts: whdb containers run as the logi user (deploy/linux/
# update_w2mo.sh), and every logi-group member must be able to back up /
# restore / prune the DB folders without root. Re-own anything root-mode
# containers left behind; setgid dirs keep the logi group on new subfolders.
# The find probe keeps this a no-op on already-migrated hosts.
if id logi &>/dev/null && [ -d /data/mysql_data ]; then
for d in /data/mysql_data /data/mysql_backup; do
[ -d "$d" ] || continue
if [ -n "$(sudo -n find "$d" ! -user logi -print -quit 2>/dev/null)" ] \
|| [ "$(stat -c %a "$d" 2>/dev/null)" != "2775" ]; then
echo " Migrating $d to logi ownership (group-writable)..."
sudo -n chown -R logi:logi "$d"
sudo -n chmod -R u+rwX,g+rwX "$d"
sudo -n find "$d" -type d -exec chmod g+s {} +
sudo -n chmod 2775 "$d"
fi
done

# rollback/autoupdate state + config: group-writable so the update and
# rollback scripts need no sudo for them either
sudo -n mkdir -p /data/w2mo_autoupdate
sudo -n chown -R logi:logi /data/w2mo_autoupdate
sudo -n chmod -R g+rwX /data/w2mo_autoupdate
sudo -n chmod 2775 /data/w2mo_autoupdate
if [ -d /data/appconfig_static ]; then
# top level only -- certs/ and the rest stay untouched
sudo -n chgrp logi /data/appconfig_static 2>/dev/null || true
sudo -n chmod g+rwxs /data/appconfig_static 2>/dev/null || true
for f in /data/appconfig_static/w2mo_autoupdate.conf /data/appconfig_static/server.settings; do
if [ -f "$f" ]; then
sudo -n chown logi:logi "$f"
sudo -n chmod g+rw "$f"
fi
done
fi
fi

# Grant the logi group scoped passwordless sudo for host troubleshooting
# (reboots, service management, reading system logs). Managed accounts are
# otherwise unprivileged; this replaces the implicit docker-based root path
Expand Down