Gmer4Lfe
e8b114094a
Headers claimed protections the code never had, and several destructive paths had no guard against a collapsed config value.
259 lines
11 KiB
Bash
Executable File
259 lines
11 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================================
|
|
# ========================= Upgrade Webhook Handler ============================================
|
|
# ==============================================================================================
|
|
#
|
|
# PURPOSE
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Triggered by Sonarr/Radarr/Lidarr OnUpgrade webhook (via webhook_listener.js).
|
|
# Pushes the upgraded item folder to every other mesh node immediately, then
|
|
# triggers a library rescan on each remote arr so it accepts the new file as
|
|
# ground truth without initiating a redundant quality search.
|
|
#
|
|
# Closes the propagation window: without this, a remote node that already has
|
|
# the 720p copy will see the 1080p tagged in arr_sync but not on disk and
|
|
# begin searching — a search it will never win because we already have it.
|
|
#
|
|
# ==============================================================================================
|
|
# OPERATIONAL MODEL
|
|
# ==============================================================================================
|
|
#
|
|
# Invoked per import by webhook_listener.js with <arr_type> <item_path>:
|
|
#
|
|
# 1. Validate
|
|
# → arr_type must be sonarr|radarr|lidarr; item_path must exist and be a safe
|
|
# absolute path
|
|
#
|
|
# 2. Resolve arr specifics
|
|
# → API port, API version and rescan command for that arr type
|
|
#
|
|
# 3. Discover remote nodes
|
|
# → discover_remote_nodes(); no remotes configured means exit cleanly
|
|
#
|
|
# 4. Per remote node, independently:
|
|
# a. Resolve its Tailscale IP — unresolvable skips that node
|
|
# b. rsync the single item to the same absolute path (--no-delete)
|
|
# c. Skip the rescan if rsync failed — never scan a partial file
|
|
# d. Trigger the arr's refresh command, cache-first API key with SSH fallback
|
|
#
|
|
# One failing node is counted and skipped; the rest still receive the upgrade.
|
|
#
|
|
# ==============================================================================================
|
|
# DESIGN PRINCIPLES
|
|
# ==============================================================================================
|
|
#
|
|
# Closes the Propagation Window
|
|
# arr_sync runs every 4 hours. Without this handler, a remote node that already
|
|
# has the old version sees the upgrade tagged in arr_sync but the new file not
|
|
# yet on disk, and initiates a redundant quality search — a search it will never
|
|
# win because this host already has the file. Immediate push eliminates that window.
|
|
#
|
|
# Rescan as Ground Truth
|
|
# Pushing the file is not enough — the remote arr must also be told the file
|
|
# exists. Triggering a rescan makes the remote accept the pushed file as the
|
|
# current version without starting a new search.
|
|
#
|
|
# Cache-First API Key Lookup
|
|
# Remote arr API keys are read from conf if cached; otherwise fetched via SSH
|
|
# from the remote's config.xml. This avoids storing secrets redundantly while
|
|
# keeping API calls fast on hosts where the key is already known.
|
|
#
|
|
# ==============================================================================================
|
|
# OPERATIONAL SAFEGUARDS
|
|
# ==============================================================================================
|
|
#
|
|
# Root Enforcement
|
|
# rsync runs over SSH as root and writes to root@remote at the same absolute path.
|
|
#
|
|
# Argument Validation
|
|
# Exits with a usage message if arr_type or item_path is missing, and rejects an
|
|
# arr_type outside sonarr|radarr|lidarr rather than defaulting to one.
|
|
#
|
|
# Path Existence
|
|
# Exits if item_path is not a directory on disk.
|
|
#
|
|
# Item Path Depth Guard
|
|
# item_path must be an absolute path at least three levels deep. It arrives from the
|
|
# arr's webhook payload and is rsynced to the same path on the partner, so a truncated
|
|
# or malformed value would push a system directory — or the filesystem root — onto the
|
|
# remote. The existence check alone does not catch this, because / is a directory.
|
|
#
|
|
# No Lock — Deliberate
|
|
# This is an event handler invoked per import by webhook_listener.js. Concurrent
|
|
# upgrades are normal and expected. A default lock would silently drop overlapping
|
|
# events, and a waiting lock would queue them behind a slow transfer, so neither is
|
|
# used: each invocation rsyncs a different item path and they do not contend.
|
|
#
|
|
# Tailscale Resolution
|
|
# Skips a node if its Tailscale IP cannot be resolved, rather than attempting the
|
|
# transfer against an unresolved or stale address.
|
|
#
|
|
# rsync Exit Check
|
|
# The rescan is only triggered if rsync succeeded. A failed transfer never causes the
|
|
# remote arr to scan a partial file into its library.
|
|
#
|
|
# No Delete on Push
|
|
# rsync runs with --no-delete. This pushes one upgraded item; it is not a mirror, and
|
|
# must never remove content on the partner that this run does not know about.
|
|
#
|
|
# SSH Fallback
|
|
# If no cached API key is available, falls back to SSH to read config.xml on the
|
|
# remote rather than failing the rescan step.
|
|
#
|
|
# Per-Node Isolation
|
|
# One unreachable or failing node is counted and skipped; the remaining nodes still
|
|
# receive the upgrade.
|
|
#
|
|
# ==============================================================================================
|
|
# CONFIGURATION
|
|
# ==============================================================================================
|
|
#
|
|
# host*.conf
|
|
#
|
|
# HOST* — host names used to discover remote nodes
|
|
# HOST*_SONARR_API_KEY — cached API key for direct HTTP rescan (optional)
|
|
# HOST*_RADARR_API_KEY — cached API key for direct HTTP rescan (optional)
|
|
# HOST*_LIDARR_API_KEY — cached API key for direct HTTP rescan (optional)
|
|
#
|
|
# master.conf
|
|
#
|
|
# SSH_KEY — SSH key path for rsync and SSH fallback
|
|
# ARR_SYNC_CONNECT_TIMEOUT — SSH connect timeout in seconds
|
|
# DOCKER_APPDATA_BASE — base path for reading arr config.xml on remote
|
|
#
|
|
# ==============================================================================================
|
|
# RUNTIME MODES
|
|
# ==============================================================================================
|
|
#
|
|
# upgrade_webhook_handler.sh <arr_type> <item_path>
|
|
#
|
|
# arr_type — sonarr | radarr | lidarr
|
|
# item_path — absolute path to the series/movie/artist folder on local disk
|
|
# (series.path from Sonarr, movie.folderPath from Radarr,
|
|
# artist.path from Lidarr)
|
|
#
|
|
# Called by webhook_listener.js — not intended for direct invocation outside testing.
|
|
#
|
|
# ==============================================================================================
|
|
|
|
set -uo pipefail
|
|
|
|
ARR_TYPE="${1:-}"
|
|
ITEM_PATH="${2:-}"
|
|
|
|
[[ -z "$ARR_TYPE" || -z "$ITEM_PATH" ]] && {
|
|
echo "Usage: upgrade_webhook_handler.sh <arr_type> <item_path>" >&2
|
|
exit 1
|
|
}
|
|
|
|
[[ -d "$ITEM_PATH" ]] || { echo "Path not found: $ITEM_PATH" >&2; exit 1; }
|
|
|
|
if [[ "$EUID" -ne 0 ]]; then
|
|
echo "Must be run as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# ITEM_PATH is rsynced to root@remote at the same absolute path. It arrives from the arr's
|
|
# webhook payload, so a malformed or truncated value would push a system directory — or the
|
|
# filesystem root — onto the partner. -d alone does not catch that: / is a directory.
|
|
_depth="${ITEM_PATH//[^\/]/}"
|
|
if [[ "$ITEM_PATH" != /* || "${#_depth}" -lt 3 ]]; then
|
|
echo "Refusing unsafe item path: '$ITEM_PATH' — expected an absolute path at least 3 levels deep" >&2
|
|
exit 1
|
|
fi
|
|
unset _depth
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../load_config.sh"
|
|
detect_hosts
|
|
|
|
# ── Arr type → API port / version / rescan command ───────────────────────────────────────────
|
|
case "$ARR_TYPE" in
|
|
sonarr) PORT=8989; API_VER="v3"; RESCAN_CMD="RefreshSeries" ;;
|
|
radarr) PORT=7878; API_VER="v3"; RESCAN_CMD="RefreshMovie" ;;
|
|
lidarr) PORT=8686; API_VER="v1"; RESCAN_CMD="RefreshArtist" ;;
|
|
*) echo "Unknown arr type: $ARR_TYPE" >&2; exit 1 ;;
|
|
esac
|
|
|
|
# ── Remote node list ──────────────────────────────────────────────────────────────────────────
|
|
discover_remote_nodes
|
|
|
|
if [[ "${#REMOTE_NODES[@]}" -eq 0 ]]; then
|
|
echo "No remote nodes configured — nothing to push"
|
|
exit 0
|
|
fi
|
|
|
|
ENCODED=$(printf '{"name":"%s"}' "$RESCAN_CMD" | base64 -w0)
|
|
ITEM_NAME=$(basename "$ITEM_PATH")
|
|
|
|
echo "[$(date '+%H:%M:%S')] Upgrade push: ${ARR_TYPE} — ${ITEM_NAME}"
|
|
echo " Path: $ITEM_PATH"
|
|
echo " Targets: ${REMOTE_NODES[*]}"
|
|
|
|
NODE_FAIL=0
|
|
|
|
# ── Push and rescan each remote ───────────────────────────────────────────────────────────────
|
|
for node_id in "${REMOTE_NODES[@]}"; do
|
|
node_name="${!node_id}"
|
|
node_ip=$(resolve_tailscale_ip "$node_name") || {
|
|
echo " [${node_name}] Cannot resolve Tailscale IP — skipping"
|
|
(( NODE_FAIL++ ))
|
|
continue
|
|
}
|
|
|
|
# ── Targeted rsync — push only this item, no delete ──────────────────────────────────────
|
|
echo " [${node_name}] rsync ${ITEM_NAME}..."
|
|
rsync_out=$(rsync -av --no-delete \
|
|
-e "ssh -i $SSH_KEY -T -o Compression=no -o IPQoS=throughput -o StrictHostKeyChecking=no" \
|
|
"${ITEM_PATH}/" \
|
|
"root@${node_ip}:${ITEM_PATH}/" 2>&1)
|
|
rsync_exit=$?
|
|
transferred=$(echo "$rsync_out" | awk '/Total transferred file size:/{gsub(/,/,"",$NF); gsub(/[^0-9]/,"",$NF); print $NF+0}')
|
|
|
|
if [[ "$rsync_exit" -ne 0 ]]; then
|
|
echo " [${node_name}] rsync failed (exit ${rsync_exit}) — skipping rescan"
|
|
(( NODE_FAIL++ ))
|
|
continue
|
|
fi
|
|
echo " [${node_name}] rsync done (${transferred:-0} bytes)"
|
|
|
|
# ── Trigger arr rescan on remote — cache-first, SSH fallback ─────────────────────────────
|
|
_kvar="${node_id}_${ARR_TYPE^^}_API_KEY"
|
|
cached_key="${!_kvar:-}"
|
|
|
|
if [[ -n "$cached_key" ]]; then
|
|
body=$(printf '%s' "$ENCODED" | base64 -d)
|
|
http_code=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
|
|
-H "X-Api-Key: $cached_key" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$body" \
|
|
"http://${node_ip}:${PORT}/api/${API_VER}/command" 2>/dev/null)
|
|
else
|
|
config_xml="${DOCKER_APPDATA_BASE}/${ARR_TYPE^}/config.xml"
|
|
http_code=$(ssh -i "$SSH_KEY" -o ConnectTimeout="$ARR_SYNC_CONNECT_TIMEOUT" \
|
|
root@"$node_ip" bash <<REMOTE 2>/dev/null
|
|
KEY=\$(grep -oP '(?<=<ApiKey>)[^<]+' '${config_xml}' 2>/dev/null)
|
|
[[ -z "\$KEY" ]] && exit 1
|
|
BODY=\$(printf '%s' '${ENCODED}' | base64 -d)
|
|
curl -sf -o /dev/null -w '%{http_code}' -X POST \
|
|
-H "X-Api-Key: \$KEY" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "\$BODY" \
|
|
"http://localhost:${PORT}/api/${API_VER}/command"
|
|
REMOTE
|
|
)
|
|
fi
|
|
|
|
if [[ "$http_code" == "201" || "$http_code" == "200" ]]; then
|
|
echo " [${node_name}] ${RESCAN_CMD} triggered ✅"
|
|
else
|
|
echo " [${node_name}] ${RESCAN_CMD} failed (HTTP ${http_code:-timeout})"
|
|
(( NODE_FAIL++ ))
|
|
fi
|
|
done
|
|
|
|
echo "[$(date '+%H:%M:%S')] Done — ${ITEM_NAME}"
|
|
|
|
[[ "$NODE_FAIL" -gt 0 ]] && exit 1
|
|
exit 0
|