crowdsec: disabled_scenarios removes hub scenarios replaced by local ones, absent_files removes retired local files

crowdsec/templates/crowdsec-hubupdate.sh.j2

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Managed by Ansible. crowdsec-hubupdate.service runs this script instead of /usr/libexec/crowdsec/hubupdate.sh.
+#
+# "cscli scenarios remove --force" taints the collection that holds the scenario, and a plain "cscli hub upgrade" skips tainted
+# collections for good. The upgrade therefore runs with --force, which also brings the removed scenarios back, and the removal is
+# applied again. crowdsec is reloaded only when the installed hub files or the data files differ afterwards; with NO_RELOAD=1
+# the script prints "changed" instead, for the role, which restarts crowdsec once at the end of its run.
+set -eu
+
+test -x /usr/bin/cscli || exit 0
+
+fingerprint() {
+  {
+    find -L /etc/crowdsec -path /etc/crowdsec/hub -prune -o -type f -exec sha256sum {} +
+    find /var/lib/crowdsec/data -maxdepth 1 -type f ! -name 'crowdsec.db*' ! -name trace -exec sha256sum {} +
+  } 2>/dev/null | sort -k2 | sha256sum
+}
+
+before="$(fingerprint)"
+
+/usr/bin/cscli --error hub update >/dev/null
+/usr/bin/cscli --error hub upgrade --force >/dev/null
+
+{% for scenario in crowdsec.disabled_scenarios.values() | reject('none') | unique | sort %}
+if /usr/bin/cscli scenarios list -o raw | cut -d, -f1 | grep -qxF '{{ scenario }}'; then
+  /usr/bin/cscli --error scenarios remove '{{ scenario }}' --force >/dev/null
+fi
+{% endfor %}
+
+if [ "$before" != "$(fingerprint)" ]; then
+  if [ -n "${NO_RELOAD:-}" ]; then
+    echo changed
+  else
+    systemctl reload crowdsec.service
+  fi
+fi