From f1f855c59693675fdf1589598abf010a9d194931 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:49:35 +0200 Subject: [PATCH 1/2] fix: sichere Tuning-Dateisynchronisation trotz lokaler Ansible-Abweichungen --- app.py | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/app.py b/app.py index 83a2186..70fd72a 100644 --- a/app.py +++ b/app.py @@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse from contextlib import asynccontextmanager log = logging.getLogger("butler") -VERSION = "2.3.4" +VERSION = "2.3.5" API_DIR = os.environ.get("API_KEY_DIR", "/data/api") VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache") @@ -1574,11 +1574,29 @@ async def ansible_run(request: Request, _=Depends(_verify)): return JSONResponse({"error": "action must be setup, tune or pvetune"}, status_code=400) if not re.fullmatch(r"[a-zA-Z0-9_.:-]+", hostname): return JSONResponse({"error": "invalid hostname/limit"}, status_code=400) - command = ( - "cd /app-config/ansible && " - "git pull --ff-only origin master && " - f"bash pfannkuchen.sh {action} {hostname}" - ) + if action in {"tune", "pvetune"}: + approved_files = ( + "roles/sysctl/defaults/main.yml", + "roles/sysctl/tasks/main.yml", + "group_vars/vps/sysctl.yml", + "sysctl-proxmox.yaml", + "roles/sysctl_proxmox/tasks/main.yml", + ) + file_sync = " && ".join( + f"git show origin/master:{path} > {path}" for path in approved_files + ) + command = ( + "cd /app-config/ansible && " + "git fetch origin master && " + f"{file_sync} && " + f"bash pfannkuchen.sh {action} {hostname}" + ) + else: + command = ( + "cd /app-config/ansible && " + "git pull --ff-only origin master && " + f"bash pfannkuchen.sh {action} {hostname}" + ) rc, out, err = _ssh(AUTOMATION1, command, timeout=600) _audit("/ansible/run", "POST", 200 if rc == 0 else 502, f"{action} {hostname}") if action != "setup": -- 2.49.1 From 815b5acf8d173f043873f9ed2855a53225370893 Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 8 Aug 2026 22:49:35 +0200 Subject: [PATCH 2/2] fix: sichere Tuning-Dateisynchronisation trotz lokaler Ansible-Abweichungen --- tests/test_app.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/test_app.py b/tests/test_app.py index 1b0f3bf..e9960d4 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -42,7 +42,7 @@ def test_health_exposes_current_version(): with TestClient(app.app) as client: response = client.get("/health") assert response.status_code == 200 - assert response.json()["version"] == app.VERSION == "2.3.4" + assert response.json()["version"] == app.VERSION == "2.3.5" def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch): @@ -108,7 +108,7 @@ def test_inventory_upsert_uses_base64_script(monkeypatch): assert "\\nname =" not in calls[0][1] -def test_ansible_run_supports_safe_tune_action_and_syncs_git(monkeypatch): +def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypatch): calls = [] def fake_ssh(host, command, timeout=600): @@ -124,7 +124,9 @@ def test_ansible_run_supports_safe_tune_action_and_syncs_git(monkeypatch): ) assert response.status_code == 200 assert response.json()["action"] == "tune" - assert "git pull --ff-only origin master" in calls[0][1] + assert "git fetch origin master" in calls[0][1] + assert "git show origin/master:roles/sysctl/tasks/main.yml" in calls[0][1] + assert "git pull --ff-only" not in calls[0][1] assert "bash pfannkuchen.sh tune emby-sascha" in calls[0][1] assert len(calls) == 1 -- 2.49.1