mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 03:36:16 +00:00
mdella
037782e1ff
deployd#3 (DD-0620): every kit for a backend registered since 2026-09-08 died at `--site`. env-dev-08 (2026-09-11..13): two days of "identity is not readable" ticks — ziti-edge-tunnel re-creates the file with mode 0600, the ACL mask goes to ---, group membership stops helping. identity-acl.sh + monky-deployd-identity-acl.path re-apply the grant on every directory change. Doc-Drift: DD-0620 fixed Closes #3 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ASnneBmT7rfaJLE8NGNw7S
21 lines
986 B
Bash
Executable File
21 lines
986 B
Bash
Executable File
#!/bin/sh
|
|
# monky-deployd: (re)grant the agent read access to the host's ziti identity file(s).
|
|
# Idempotent; safe to run at any time. Invoked by install.sh, the package postinstall and the
|
|
# monky-deployd-identity-acl.path unit (whenever the identity directory changes).
|
|
#
|
|
# Why a re-runnable script and not a one-time ACL: ziti-edge-tunnel re-creates the identity on
|
|
# every controller config update with mode 0600. On a file with an ACL that sets the mask to ---,
|
|
# so the named-user entry AND the ziti-group read both become ineffective. Only re-applying the
|
|
# entries after each rewrite keeps the agent alive.
|
|
set -eu
|
|
DIR="${1:-/opt/openziti/etc/identities}"
|
|
[ -d "$DIR" ] || exit 0
|
|
command -v setfacl >/dev/null 2>&1 || exit 0
|
|
setfacl -m u:monky-deployd:rx,m::rx "$DIR" 2>/dev/null || true
|
|
setfacl -d -m u:monky-deployd:r,m::r "$DIR" 2>/dev/null || true
|
|
for f in "$DIR"/*.json; do
|
|
[ -f "$f" ] || continue
|
|
setfacl -m u:monky-deployd:r,m::r "$f" 2>/dev/null || true
|
|
done
|
|
exit 0
|