nepomuk.gail/hapx-ui-releases
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

install.sh build-e738594

Browse Source
This commit is contained in:
nepomuk.gail
2026-09-07 15:44:04 +00:00
parent e3a4df7bdc
commit 9d07711091
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.sh
+11 -3
View File
@@ -188,7 +188,7 @@ need() { command -v "$1" &>/dev/null; }
# ── Step 1: System packages ─────────────────────────────────────────────────── # ── Step 1: System packages ───────────────────────────────────────────────────
step "Installing system dependencies" step "Installing system dependencies"
apt-get update -qq apt-get update -qq
PACKAGES=(git curl openssl ca-certificates) PACKAGES=(git curl openssl ca-certificates acl)
[[ $SKIP_HAPROXY -eq 0 ]] && PACKAGES+=(haproxy) [[ $SKIP_HAPROXY -eq 0 ]] && PACKAGES+=(haproxy)
apt-get install -y -qq "${PACKAGES[@]}" apt-get install -y -qq "${PACKAGES[@]}"
success "System packages installed" success "System packages installed"
@@ -558,8 +558,16 @@ if getent group haproxy &>/dev/null; then
usermod -aG haproxy "$CERTEXPORT_USER" 2>/dev/null || true usermod -aG haproxy "$CERTEXPORT_USER" 2>/dev/null || true
fi fi
# grants.json lives here: SERVICE_USER writes it, certexport group can read it # grants.json lives here: SERVICE_USER writes it, certexport group can read it.
install -d -m 0750 -o "$SERVICE_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_DATA" # setgid (2750): Dateien im Verzeichnis erben die Gruppe certexport, damit der
# als certexport laufende SSH-Forced-Command sie lesen kann.
install -d -m 2750 -o "$SERVICE_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_DATA"
# certexport muss DATA_DIR nur durchqueren (x), nicht lesen — execute-only-ACL.
if command -v setfacl >/dev/null 2>&1; then
setfacl -m u:${CERTEXPORT_USER}:--x "$DATA_DIR" 2>/dev/null || echo " ! setfacl auf $DATA_DIR fehlgeschlagen — certexport-Traverse prüfen"
else
echo " ! setfacl fehlt (Paket 'acl'?) — certexport kann $DATA_DIR evtl. nicht durchqueren"
fi
# audit log dir: certexport user writes here (runs outside systemd as certexport) # audit log dir: certexport user writes here (runs outside systemd as certexport)
install -d -m 0750 -o "$CERTEXPORT_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_LOG" install -d -m 0750 -o "$CERTEXPORT_USER" -g "$CERTEXPORT_USER" "$CERTEXPORT_LOG"