clawbot
95cfbdc03b
check / check (push) Canceled after 0s
The run script gave ${SWWAF_STATE_DIR:-/var/lib/smallwebwaf} to the
smallwebwaf user and never read SWWAF_STATE_DIR_FILE, so a new volume
at the directory that file names stayed root's and smallwebwaf could
not write it. The run script now reads the setting as smallwebwaf does:
the variable, or what is in the file. When both are set or the file
cannot be read, it leaves the owner alone, and smallwebwaf stops with
its message naming the setting. script/example-app checks that a
container with its state files on a new volume at /srv/state, named in
a file only the smallwebwaf user can read, becomes healthy.
Model: opus-5-5
34 lines
1.1 KiB
AMPL
Executable File
34 lines
1.1 KiB
AMPL
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# runit's run script for smallwebwaf, run again whenever smallwebwaf
|
|
# exits; the wait spaces out the restarts. The state directory and every
|
|
# file in it are given to the smallwebwaf user, so that a volume mounted
|
|
# there needs no change of owner; chown -R changes a symbolic link itself,
|
|
# never what it points to. exec, so that the signal `sv stop` sends
|
|
# reaches smallwebwaf itself.
|
|
main() {
|
|
sleep 1
|
|
local dir
|
|
if dir="$(state_dir)"; then
|
|
chown -R smallwebwaf:smallwebwaf "${dir:-/var/lib/smallwebwaf}"
|
|
fi
|
|
exec chpst -u smallwebwaf:smallwebwaf /usr/local/bin/smallwebwaf
|
|
}
|
|
|
|
# state_dir prints SWWAF_STATE_DIR as smallwebwaf reads it: the variable,
|
|
# or what is in the file SWWAF_STATE_DIR_FILE names. It fails when both
|
|
# are set or the file cannot be read; the state directory then keeps its
|
|
# owner, and smallwebwaf stops with a message naming the setting.
|
|
state_dir() {
|
|
if [[ ! -v SWWAF_STATE_DIR_FILE ]]; then
|
|
printf '%s\n' "${SWWAF_STATE_DIR:-}"
|
|
elif [[ ! -v SWWAF_STATE_DIR ]]; then
|
|
cat -- "$SWWAF_STATE_DIR_FILE" 2>/dev/null
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
main "$@"
|