clawbot
83525b5e73
check / check (push) Waiting to run
Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice. A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups. Model: opus-5-5
71 lines
2.5 KiB
AMPL
Executable File
71 lines
2.5 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for sww, run again whenever sww
|
|
# exits; the wait spaces out the restarts. SWW_COMMAND names the
|
|
# command to run: rproxy when it is unset or empty, or waf. With any
|
|
# other value the script starts nothing and stops with a message naming it.
|
|
# exec, so that the signal `sv stop` sends reaches sww itself.
|
|
main() {
|
|
sleep 1
|
|
local command="${SWW_COMMAND:-rproxy}"
|
|
case "$command" in
|
|
rproxy) ;;
|
|
waf)
|
|
give_state_dir_to_sww
|
|
make_cache_dir_for_sww
|
|
;;
|
|
*)
|
|
printf 'SWW_COMMAND: "%s" is not rproxy or waf\n' \
|
|
"$command" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
exec chpst -u sww:sww /usr/local/bin/sww "$command"
|
|
}
|
|
|
|
# give_state_dir_to_sww gives the state directory and every file in
|
|
# it to the sww user, so that a volume mounted there needs no change
|
|
# of owner; chown -R changes a symbolic link itself, never what it points
|
|
# to. When SWW_STATE_DIR, in either form, cannot be read or is not the
|
|
# absolute path of a directory, no owner is changed, and waf starts and
|
|
# stops with a message naming the setting. A change of owner that fails, as
|
|
# on a volume mounted read-only, does not end the script either: waf
|
|
# reports a directory it cannot write.
|
|
give_state_dir_to_sww() {
|
|
local dir
|
|
if dir="$(setting SWW_STATE_DIR /var/lib/sww)" &&
|
|
[[ "$dir" == /* && -d "$dir" ]]; then
|
|
chown -R sww:sww "$dir" || true
|
|
fi
|
|
}
|
|
|
|
# make_cache_dir_for_sww makes the cache directory, SWW_CACHE_DIR in
|
|
# either form, and gives it and every file in it to the sww user, as
|
|
# give_state_dir_to_sww does the state directory. Unlike that one, it is
|
|
# made when it is missing, since the cache files need no volume. As there,
|
|
# a setting that cannot be read or is not an absolute path changes
|
|
# nothing, and a failure does not end the script.
|
|
make_cache_dir_for_sww() {
|
|
local dir
|
|
if dir="$(setting SWW_CACHE_DIR /var/cache/sww)" && [[ "$dir" == /* ]]; then
|
|
{ mkdir -p -- "$dir" && chown -R sww:sww "$dir"; } || true
|
|
fi
|
|
}
|
|
|
|
# setting prints the setting named $1, $2 when it is unset, or what is in
|
|
# the file the setting $1_FILE names, less every newline at its end. It
|
|
# fails when both are set or the file cannot be read.
|
|
setting() {
|
|
local name="$1" file_name="$1_FILE"
|
|
if [[ ! -v "$file_name" ]]; then
|
|
printf '%s\n' "${!name-$2}"
|
|
elif [[ ! -v "$name" ]]; then
|
|
cat -- "${!file_name}" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|