feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)
Backend: - Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date) - NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle) - System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler) - Domain-Response-Headers + Rate-Limit (Migration 0024) - Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out - apt-Service für Update-Banner (apt-get update + Versionsprüfung) - Backup-Retry mit exponential backoff (retry_apt 3×) - publish.sh fail-fast + cleanup-old.sh (max 10 Versionen) Frontend: - Audit-Log-Page (/audit) mit Filter + Pagination - ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+) - Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix) - EmptyState-Komponente überall ausgerollt - SSL: Aggregate-Karte (total/expiring/expired/errors) - Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now - NTP: Sync-Status-Karte (chronyc tracking live) - Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats - Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN) - Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler) - Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention - Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint - System-Regeln im Firewall als eigener Tab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
95
scripts/apt-repo/cleanup-old.sh
Executable file
95
scripts/apt-repo/cleanup-old.sh
Executable file
@@ -0,0 +1,95 @@
|
||||
#!/bin/bash
|
||||
# Cleanup-old: löscht alle EdgeGuard-Versionen im Gitea Package
|
||||
# Registry außer den letzten N (default 10).
|
||||
#
|
||||
# Wird vom Makefile direkt nach erfolgreichem Upload aufgerufen. Reihen-
|
||||
# folge ist wichtig: ERST der neue Build hochladen, DANN die ältesten
|
||||
# wegschmeißen — sonst riskieren wir bei Cleanup-vor-Upload eine Lücke.
|
||||
#
|
||||
# Voraussetzungen:
|
||||
# - ~/.gitea-token mit write-Package-Scope
|
||||
# - jq + curl
|
||||
#
|
||||
# Aufruf:
|
||||
# ./cleanup-old.sh # KEEP=10 (default)
|
||||
# KEEP=20 ./cleanup-old.sh # mehr behalten
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
KEEP="${KEEP:-10}"
|
||||
OWNER="projekte"
|
||||
DIST="trixie"
|
||||
COMPONENT="main"
|
||||
BASE="https://git.netcell-it.de"
|
||||
|
||||
if [ -z "${GITEA_TOKEN:-}" ]; then
|
||||
if [ -r "$HOME/.gitea-token" ]; then
|
||||
GITEA_TOKEN="$(tr -d '\n' < "$HOME/.gitea-token")"
|
||||
else
|
||||
echo "cleanup-old: missing ~/.gitea-token and GITEA_TOKEN env" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
TOK="$GITEA_TOKEN"
|
||||
|
||||
# Pkg-Spec: "name:arch". arch="all" für noarch-Pakete (meta + UI),
|
||||
# "amd64" für edgeguard-api. Mehrere arch je name = mehrere Zeilen.
|
||||
PKGS=(
|
||||
"edgeguard:all"
|
||||
"edgeguard-api:amd64"
|
||||
"edgeguard-ui:all"
|
||||
)
|
||||
|
||||
cleanup_pkg() {
|
||||
local pkg="$1"
|
||||
local arch="$2"
|
||||
|
||||
# Versionen sammeln. Gitea Package-API liefert flache Liste:
|
||||
# /api/v1/packages/{owner}?type=debian&q={name}
|
||||
# Wir filtern client-seitig auf name (exact-match — Gitea-Query ist
|
||||
# leider substring-fuzzy) und sort -V (semver) absteigend.
|
||||
local raw
|
||||
raw="$(curl -fsS -H "Authorization: token $TOK" \
|
||||
"$BASE/api/v1/packages/$OWNER?type=debian&q=$pkg&limit=1000")"
|
||||
|
||||
local versions
|
||||
versions="$(printf '%s' "$raw" | jq -r --arg n "$pkg" \
|
||||
'.[] | select(.name==$n) | .version' | sort -V -r | awk '!seen[$0]++')"
|
||||
|
||||
if [ -z "$versions" ]; then
|
||||
echo " $pkg ($arch): no versions found, skip"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local count
|
||||
count="$(printf '%s\n' "$versions" | wc -l)"
|
||||
if [ "$count" -le "$KEEP" ]; then
|
||||
echo " $pkg ($arch): $count versions, ≤ keep=$KEEP, nothing to delete"
|
||||
return 0
|
||||
fi
|
||||
|
||||
local to_delete
|
||||
to_delete="$(printf '%s\n' "$versions" | tail -n +$((KEEP+1)))"
|
||||
|
||||
local kept_count=$((count - $(printf '%s\n' "$to_delete" | wc -l)))
|
||||
echo " $pkg ($arch): $count versions total, keeping $kept_count newest, deleting $(printf '%s\n' "$to_delete" | wc -l)"
|
||||
|
||||
while IFS= read -r v; do
|
||||
[ -z "$v" ] && continue
|
||||
# DELETE-Endpoint für Debian-Pakete:
|
||||
# /api/packages/{owner}/debian/pool/{dist}/{comp}/{name}/{version}/{arch}
|
||||
local url="$BASE/api/packages/$OWNER/debian/pool/$DIST/$COMPONENT/$pkg/$v/$arch"
|
||||
local http
|
||||
http="$(curl -sS -o /dev/null -w '%{http_code}' \
|
||||
-X DELETE -H "Authorization: token $TOK" "$url")"
|
||||
case "$http" in
|
||||
204|404) echo " delete $pkg $v $arch -> $http" ;;
|
||||
*) echo " delete $pkg $v $arch -> $http (failed)" ;;
|
||||
esac
|
||||
done <<< "$to_delete"
|
||||
}
|
||||
|
||||
for spec in "${PKGS[@]}"; do
|
||||
IFS=':' read -r pkg arch <<< "$spec"
|
||||
cleanup_pkg "$pkg" "$arch"
|
||||
done
|
||||
91
scripts/apt-repo/publish.sh
Executable file
91
scripts/apt-repo/publish.sh
Executable file
@@ -0,0 +1,91 @@
|
||||
#!/bin/bash
|
||||
# Publish EdgeGuard deb packages to the Gitea Package Registry in
|
||||
# the correct dependency order, with fail-fast on partial failure.
|
||||
#
|
||||
# Wichtig: das Meta-Paket `edgeguard` deklariert harte Versions-
|
||||
# Dependencies auf `edgeguard-api (= X.Y.Z)` und `edgeguard-ui (= X.Y.Z)`.
|
||||
# Wenn beim Upload die api/ui-Pakete fehlschlagen, darf das Meta NICHT
|
||||
# hochgeladen werden — sonst sieht apt eine inkonsistente Lage:
|
||||
# "edgeguard X.Y.Z available, depends api X.Y.Z, but api only Y.Z-1 in
|
||||
# Packages" → "no choices are installable" → Self-Service-Update broken.
|
||||
# Befund 2026-05-17 nach Gitea-Disk-Full-Vorfall.
|
||||
#
|
||||
# Aufruf:
|
||||
# ./publish.sh <version> <arch>
|
||||
# arch = amd64 | arm64. arm64 publiziert NUR edgeguard-api (das einzige
|
||||
# arch-spezifische Paket); amd64 publiziert alle drei.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
VERSION="${1:?usage: publish.sh <version> <arch>}"
|
||||
ARCH="${2:?usage: publish.sh <version> <arch>}"
|
||||
|
||||
BASE="https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload"
|
||||
|
||||
if [ -z "${GITEA_TOKEN:-}" ]; then
|
||||
if [ -r "$HOME/.gitea-token" ]; then
|
||||
GITEA_TOKEN="$(tr -d '\n' < "$HOME/.gitea-token")"
|
||||
else
|
||||
echo "publish: missing ~/.gitea-token and GITEA_TOKEN env" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
TOK="$GITEA_TOKEN"
|
||||
|
||||
# upload_one <local-deb-path>
|
||||
# 201 → OK, frisch hochgeladen
|
||||
# 409 → bereits vorhanden (idempotent, OK)
|
||||
# alles andere → harter Fehler, abort
|
||||
upload_one() {
|
||||
local file="$1"
|
||||
if [ ! -f "$file" ]; then
|
||||
echo " ✗ $file: not found" >&2
|
||||
return 1
|
||||
fi
|
||||
local name
|
||||
name="$(basename "$file")"
|
||||
echo " -> publish $name"
|
||||
# curl -w schreibt HTTP-Code in stdout-tail, body in /tmp.
|
||||
local body http
|
||||
body="$(mktemp)"
|
||||
http="$(curl -sS -o "$body" -w '%{http_code}' \
|
||||
-H "Authorization: token $TOK" \
|
||||
--upload-file "$file" "$BASE")"
|
||||
case "$http" in
|
||||
201)
|
||||
rm -f "$body"
|
||||
;;
|
||||
409)
|
||||
echo " (already exists in registry — OK, idempotent skip)"
|
||||
rm -f "$body"
|
||||
;;
|
||||
*)
|
||||
echo " ✗ HTTP $http"
|
||||
cat "$body" >&2
|
||||
rm -f "$body"
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Upload order: api zuerst, dann ui, dann zuletzt das Meta-Paket.
|
||||
# Diese Reihenfolge garantiert: wenn ein Schritt failt, ist das Meta
|
||||
# NICHT im Registry (die strikte Dep-Constraint bleibt erfüllbar).
|
||||
case "$ARCH" in
|
||||
amd64)
|
||||
upload_one "build/deb/edgeguard-api_${VERSION}_amd64.deb"
|
||||
upload_one "build/deb/edgeguard-ui_${VERSION}_all.deb"
|
||||
upload_one "build/deb/edgeguard_${VERSION}_all.deb"
|
||||
;;
|
||||
arm64)
|
||||
upload_one "build/deb/edgeguard-api_${VERSION}_arm64.deb"
|
||||
# Meta + UI sind arch=all → werden vom amd64-Publish abgedeckt.
|
||||
# arm64-Publish lädt NUR das api-Binary.
|
||||
;;
|
||||
*)
|
||||
echo "publish: unknown arch '$ARCH' (expected amd64 or arm64)" >&2
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "publish: ok ($VERSION/$ARCH)"
|
||||
Reference in New Issue
Block a user