fix: sichere Tuning-Dateisynchronisation trotz lokaler Ansible-Abweichungen

app.py

@@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from contextlib import asynccontextmanager
 
 log = logging.getLogger("butler")
-VERSION = "2.3.4"
+VERSION = "2.3.5"
 
 API_DIR = os.environ.get("API_KEY_DIR", "/data/api")
 VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache")
@@ -1574,6 +1574,24 @@ async def ansible_run(request: Request, _=Depends(_verify)):
         return JSONResponse({"error": "action must be setup, tune or pvetune"}, status_code=400)
     if not re.fullmatch(r"[a-zA-Z0-9_.:-]+", hostname):
         return JSONResponse({"error": "invalid hostname/limit"}, status_code=400)
+    if action in {"tune", "pvetune"}:
+        approved_files = (
+            "roles/sysctl/defaults/main.yml",
+            "roles/sysctl/tasks/main.yml",
+            "group_vars/vps/sysctl.yml",
+            "sysctl-proxmox.yaml",
+            "roles/sysctl_proxmox/tasks/main.yml",
+        )
+        file_sync = " && ".join(
+            f"git show origin/master:{path} > {path}" for path in approved_files
+        )
+        command = (
+            "cd /app-config/ansible && "
+            "git fetch origin master && "
+            f"{file_sync} && "
+            f"bash pfannkuchen.sh {action} {hostname}"
+        )
+    else:
         command = (
             "cd /app-config/ansible && "
             "git pull --ff-only origin master && "