31caa8f66a
Routing, html/template layout/content pattern, and the Pre-Publish check flow: POST /pruefen runs extraction (Stufe 1) then rules.Evaluate (Stufe 2) and renders the result as an htmx fragment. Nothing is persisted yet — that's the next step (wiring internal/store in). The needsClarification case is rendered explicitly as a request for more information rather than "no findings", matching the core principle. Every result carries the legal-advice disclaimer required by CLAUDE.md's guardrails. Server depends on a narrow Extractor interface rather than *extract. Client directly, so tests inject a fake instead of calling the real API — internal/web's test suite never touches the network. htmx is vendored locally (internal/web/static/htmx.min.js) instead of loaded from a CDN, keeping the UI usable without runtime internet access. cmd/deklarix/main.go now wires all of this together: reads ANTHROPIC_API_KEY (required) and RULES_DIR (default "rules"), builds the extract client and loads the rule set, and serves web.Server instead of the old inline health-only mux. This exposed the same crash-loop risk fixed earlier for DATABASE_URL: postinst's start guard only checked DATABASE_URL, so a fresh install would now crash-loop on a missing ANTHROPIC_API_KEY instead. The guard checks both. scripts/build.sh also now ships rules/*.yaml into the .deb under /usr/share/deklarix/rules (not a conffile — rules are updated via the release pipeline, never hand-edited on a server), and deklarix.env.example points RULES_DIR there by default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
68 lines
3.4 KiB
Bash
Executable File
68 lines
3.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Deklarix — postinst
|
|
set -e
|
|
|
|
SERVICE_USER="deklarix"
|
|
CONFIG_DIR="/etc/deklarix"
|
|
DATA_DIR="/var/lib/deklarix"
|
|
LOG_DIR="/var/log/deklarix"
|
|
|
|
case "$1" in
|
|
configure)
|
|
# ─── apt-Quelle einrichten/aktualisieren ────────────────────
|
|
# Gleiches Muster wie enconf: Gitea-Debian-Registry, Suite =
|
|
# OS-Codename, Komponente = Kanal (aktuell nur "testing"). Ein
|
|
# bereits gewählter Kanal bleibt über Upgrades hinweg erhalten.
|
|
mkdir -p /etc/apt/keyrings
|
|
curl -fsSL "https://git.netcell-it.de/api/packages/projekte/debian/repository.key" \
|
|
-o /etc/apt/keyrings/deklarix-gitea.asc 2>/dev/null || true
|
|
if [ -f /etc/apt/keyrings/deklarix-gitea.asc ]; then
|
|
DX_CODENAME="$(. /etc/os-release 2>/dev/null; echo "${VERSION_CODENAME:-}")"
|
|
case "$DX_CODENAME" in bookworm|trixie) ;; *) DX_CODENAME="trixie" ;; esac
|
|
DX_CHANNEL="$(grep -oE 'projekte/debian[[:space:]]+[a-z]+[[:space:]]+(stable|testing)' \
|
|
/etc/apt/sources.list.d/deklarix.list 2>/dev/null | awk '{print $NF}' | head -1)"
|
|
case "$DX_CHANNEL" in stable|testing) ;; *) DX_CHANNEL="testing" ;; esac
|
|
echo "deb [signed-by=/etc/apt/keyrings/deklarix-gitea.asc] https://git.netcell-it.de/api/packages/projekte/debian $DX_CODENAME $DX_CHANNEL" \
|
|
> /etc/apt/sources.list.d/deklarix.list
|
|
fi
|
|
|
|
# ─── System-User + Verzeichnisse ────────────────────────────
|
|
if ! id -u "$SERVICE_USER" >/dev/null 2>&1; then
|
|
useradd -r -s /usr/sbin/nologin -d "$DATA_DIR" "$SERVICE_USER"
|
|
fi
|
|
mkdir -p "$DATA_DIR" "$LOG_DIR" "$CONFIG_DIR"
|
|
chown "$SERVICE_USER:$SERVICE_USER" "$DATA_DIR" "$LOG_DIR"
|
|
|
|
# ─── Konfiguration ───────────────────────────────────────────
|
|
# Erstinstall: Vorlage kopieren, nicht scharf schalten (Secrets
|
|
# fehlen noch). Upgrade: bestehende deklarix.env bleibt unberührt.
|
|
if [ ! -f "$CONFIG_DIR/deklarix.env" ]; then
|
|
cp "$CONFIG_DIR/deklarix.env.example" "$CONFIG_DIR/deklarix.env"
|
|
chmod 640 "$CONFIG_DIR/deklarix.env"
|
|
chown "root:$SERVICE_USER" "$CONFIG_DIR/deklarix.env"
|
|
fi
|
|
|
|
systemctl daemon-reload 2>/dev/null || true
|
|
systemctl enable deklarix.service >/dev/null 2>&1 || true
|
|
|
|
# Nicht blind starten — ohne gesetzte DATABASE_URL/ANTHROPIC_API_KEY
|
|
# würde der Dienst nur in eine Restart-Schleife laufen (main.go
|
|
# bricht sonst bewusst mit log.Fatal ab, siehe CLAUDE.md "keine
|
|
# stillen Fallbacks"). Die Vorlage liefert beide auskommentiert aus —
|
|
# ein Treffer hier bedeutet also wirklich "vom Admin gesetzt", nicht
|
|
# den Platzhalter.
|
|
if grep -qE '^DATABASE_URL=.+' "$CONFIG_DIR/deklarix.env" 2>/dev/null \
|
|
&& grep -qE '^ANTHROPIC_API_KEY=.+' "$CONFIG_DIR/deklarix.env" 2>/dev/null; then
|
|
systemctl restart deklarix.service
|
|
else
|
|
echo ""
|
|
echo " → Deklarix installiert, aber noch nicht gestartet."
|
|
echo " DATABASE_URL und ANTHROPIC_API_KEY in $CONFIG_DIR/deklarix.env setzen, dann:"
|
|
echo " systemctl start deklarix"
|
|
echo ""
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
exit 0
|