code wiki / _hdl_build / nx_vroom_autodeploy_cron.nx
`nx_vroom_autodeploy_cron.nx` source

1// nx_vroom_autodeploy_cron.nx -- STEP 2: add the /etc/crontab entry that runs nx_video_deploy.sh every
2// 2 min (operator "get the auto deploy going"). elderwesto has full sudo; Synology cron needs root to
3// edit /etc/crontab. SECURITY: the vault password is interpolated by THIS organ into a heredoc fed to
4// `sudo -S` stdin -- so it is never in argv (no `ps` leak), never printed, never in my view, and /tmp/nxcmd
5// is shredded after. SAFE: backs up /etc/crontab first (cp -n, preserves original), idempotent (grep guard
6// = no duplicate line), fail-safe (sudo-auth-fail -> sh -c never runs -> crontab untouched). The cron line
7// runs as elderwesto (owns the served dir). Run AFTER nx_machine_key + _offc/nx_vault.elf open, then nx_ssh_cmd.
8// license_tier: ORIGINAL
9import "nx_syscalls.nx"
10
11const CRON_A: *u8 = "echo CRON_SETUP:; sudo -S -p '' sh -c 'cp -n /etc/crontab /etc/crontab.bak-nxvideo 2>/dev/null; grep -q nx_video_deploy /etc/crontab || printf \"%s\\n\" \"*/2 * * * * elderwesto /volume1/homes/elderwesto/nishihost/nx_video_deploy.sh >> /volume1/homes/elderwesto/nishihost/nx_video_deploy.cron.log 2>&1\" >> /etc/crontab; (synosystemctl restart crond || synoservice --restart crond) 2>/dev/null; true' <<'PWEOF'\n"
12const CRON_B: *u8 = "\nPWEOF\necho SUDO_RC=$?; echo CRONTAB_CHECK:; grep -n nx_video_deploy /etc/crontab; echo TAIL:; tail -3 /etc/crontab; echo END\n"
13
14func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
15func pw(s: *u8) -> i64 { sys_write(1,s,slen(s)); return 0 }
16func pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 }
17
18func main() -> i64 {
19    let box: *i64 = sys_mmap(16) as *i64
20    let sec: *u8 = sys_read_file("/tmp/nxsecret.out" as *u8, box)
21    if (sec as i64)==0 { pw("CRON-STAGE: no /tmp/nxsecret.out -- run nx_machine_key + _offc/nx_vault.elf open first\n"); sys_exit(1); return 1 }
22    let n: i64 = box[0]
23    // trim trailing newline/CR so the heredoc password line is exact
24    var pwlen: i64 = n
25    while pwlen > 0 { if sec[pwlen-1]==10 as u8 { pwlen=pwlen-1 } else { if sec[pwlen-1]==13 as u8 { pwlen=pwlen-1 } else { break } } }
26    // /tmp/nxpw for SSH auth (nx_ssh_cmd trims its own copy)
27    let pf: i64 = sys_openat_wr("/tmp/nxpw" as *u8, 0x180)
28    if pf<0 { pw("CRON-STAGE: cannot write /tmp/nxpw\n"); sys_exit(1); return 1 }
29    sys_write(pf, sec, n); sys_close(pf)
30    // /tmp/nxcmd = CRON_A + <password> + CRON_B  (password only in the heredoc body -> sudo -S stdin)
31    let cf: i64 = sys_openat_wr("/tmp/nxcmd" as *u8, 0x180)
32    if cf<0 { pw("CRON-STAGE: cannot write /tmp/nxcmd\n"); sys_exit(1); return 1 }
33    sys_write(cf, CRON_A, slen(CRON_A))
34    sys_write(cf, sec, pwlen)
35    sys_write(cf, CRON_B, slen(CRON_B))
36    sys_close(cf)
37    pw("CRON-STAGE: credential -> /tmp/nxpw + crontab-setup command staged (password in heredoc only, not argv). Run nx_ssh_cmd to add the cron (sudo, backed up, idempotent).\n")
38    sys_exit(0); return 0
39}
nx_vroom_autodeploy_cron.nx source

`nx_vroom_autodeploy_cron.nx` source
