feat: unraid_api_key_renew — check-first idempotent renewal, wired to array_start and watchdog

2026-06-01 19:15:37 -04:00
parent ec2073346e
commit ee26eebc6b
1 changed files with 89 additions and 0 deletions
@@ -0,0 +1,89 @@
+#!/bin/bash
+# ==============================================================================================
+# ================================= Unraid API Key Renewal ====================================
+# ==============================================================================================
+#
+# PURPOSE
+# ─────────────────────────────────────────────────────────────────────────────
+# Creates/overwrites the Varaverk API key in the unraid-api service registry at
+# array start. The registry is ephemeral — OS updates and service restarts clear
+# it. This script re-registers the key every boot so Varaverk's enhanced
+# monitoring self-heals without manual intervention.
+#
+# Also updates HOST*_UNRAID_API_KEY in the local host conf so the partnership
+# page always reflects the live key value.
+#
+# ==============================================================================================
+# RUNTIME MODES
+# ==============================================================================================
+#
+# unraid_api_key_renew.sh
+#     Renew the key. Silent on success.
+#
+# unraid_api_key_renew.sh --dry-run
+#     Show what would happen — no changes made.
+#
+# unraid_api_key_renew.sh --log
+#     Verbose output.
+#
+# ==============================================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+source "$SCRIPT_DIR/../load_config.sh"
+
+parse_args "$@"
+acquire_lock
+detect_hosts
+
+# ──────────────────────────────────────────────────────────────────────────────
+CONF_FILE="$SCRIPT_DIR/../Configurations/${MY_ID,,}.conf"
+VAR_NAME="${MY_ID}_UNRAID_API_KEY"
+
+if [[ ! -f "$CONF_FILE" ]]; then
+    error "Conf file not found: $CONF_FILE"
+    exit 1
+fi
+
+if [[ "$DRY_RUN" == true ]]; then
+    warn "DRY RUN — would check registry, renew only if key missing"
+    exit 0
+fi
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Check if key already exists in the unraid-api registry before creating.
+# --overwrite generates a new key value every time, invalidating the old one.
+# Only renew if the registry has lost it.
+EXISTING=$(timeout 5 /usr/local/sbin/unraid-api apikey --name "Varaverk" --json </dev/null 2>/dev/null)
+KEY=$(echo "$EXISTING" | jq -r '.key // empty' 2>/dev/null)
+
+if [[ -n "$KEY" ]]; then
+    log "API key already valid in registry — no renewal needed"
+    exit 0
+fi
+
+RAW=$(timeout 10 /usr/local/sbin/unraid-api apikey \
+    --name "Varaverk" --create --overwrite \
+    --description "Varaverk plugin" --roles ADMIN --json </dev/null 2>&1)
+
+if [[ -z "$RAW" ]]; then
+    error "unraid-api returned no output"
+    exit 1
+fi
+
+KEY=$(echo "$RAW" | jq -r '.key // empty' 2>/dev/null)
+if [[ -z "$KEY" ]]; then
+    error "No key in unraid-api response: ${RAW:0:200}"
+    exit 1
+fi
+
+# ──────────────────────────────────────────────────────────────────────────────
+if grep -q "^\s*${VAR_NAME}\s*=" "$CONF_FILE"; then
+    sed -i "s|^\(\s*${VAR_NAME}\s*=\s*\)\"[^\"]*\"|\1\"${KEY}\"|" "$CONF_FILE"
+else
+    # Field missing from conf — append it
+    echo "    ${VAR_NAME}=\"${KEY}\"" >> "$CONF_FILE"
+fi
+
+PREVIEW="${KEY:0:8}...${KEY: -4}"
+log "API key renewed — $VAR_NAME = $PREVIEW"