37 lines
1.4 KiB
Django/Jinja
37 lines
1.4 KiB
Django/Jinja
#!/bin/sh
|
|
# Managed by Ansible. crowdsec-hubupdate.service runs this script instead of /usr/libexec/crowdsec/hubupdate.sh.
|
|
#
|
|
# "cscli scenarios remove --force" taints the collection that holds the scenario, and a plain "cscli hub upgrade" skips tainted
|
|
# collections for good. The upgrade therefore runs with --force, which also brings the removed scenarios back, and the removal is
|
|
# applied again. crowdsec is reloaded only when the installed hub files or the data files differ afterwards; with NO_RELOAD=1
|
|
# the script prints "changed" instead, for the role, which restarts crowdsec once at the end of its run.
|
|
set -eu
|
|
|
|
test -x /usr/bin/cscli || exit 0
|
|
|
|
fingerprint() {
|
|
{
|
|
find -L /etc/crowdsec -path /etc/crowdsec/hub -prune -o -type f -exec sha256sum {} +
|
|
find /var/lib/crowdsec/data -maxdepth 1 -type f ! -name 'crowdsec.db*' ! -name trace -exec sha256sum {} +
|
|
} 2>/dev/null | sort -k2 | sha256sum
|
|
}
|
|
|
|
before="$(fingerprint)"
|
|
|
|
/usr/bin/cscli --error hub update >/dev/null
|
|
/usr/bin/cscli --error hub upgrade --force >/dev/null
|
|
|
|
{% for scenario in crowdsec.disabled_scenarios.values() | reject('none') | unique | sort %}
|
|
if /usr/bin/cscli scenarios list -o raw | cut -d, -f1 | grep -qxF '{{ scenario }}'; then
|
|
/usr/bin/cscli --error scenarios remove '{{ scenario }}' --force >/dev/null
|
|
fi
|
|
{% endfor %}
|
|
|
|
if [ "$before" != "$(fingerprint)" ]; then
|
|
if [ -n "${NO_RELOAD:-}" ]; then
|
|
echo changed
|
|
else
|
|
systemctl reload crowdsec.service
|
|
fi
|
|
fi
|