@logic-joe/fleek 0.1.3 → 0.2.0

package/service-agents/run-service

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Both system and user units keep D-Bus + the unlocked OS keyring in the broker's own service cgroup.
+set -eu
+export GNOME_KEYRING_CONTROL="$RUNTIME_DIRECTORY/keyring"
+mkdir -p -m 0700 "$GNOME_KEYRING_CONTROL"
+if [ "${1:-}" != --inside-private-bus ]; then
+  exec dbus-run-session -- "$0" --inside-private-bus "$@"
+fi
+shift
+[ "${1:-}" = review ] && [ "${2:-}" = /etc/fleek-agents/review.json ] || exit 2
+/opt/fleek-agents/unlock-keyring
+# WZ-CLI-SVC: host state for Fleek every minute (contract: "Alles grün" needs a report younger than 5 minutes). Same unit, same keyring;
+# KillMode=control-group ends it with the service. The unit only starts with its provider credential: "ok" unless the last
+# job recorded a failed provider sign-in ("expired", file written by run-job).
+(
+  while :; do
+    auth=$(cat "$STATE_DIRECTORY/provider-auth" 2>/dev/null || true)
+    case $auth in expired) ;; *) auth=ok ;; esac
+    last=$(cat "$STATE_DIRECTORY/last-job-at" 2>/dev/null || true)
+    case $last in [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z) set -- --last-job-at "$last" ;; *) set -- ;; esac
+    /opt/fleek/bin/fleek service host-report --provider-auth "$auth" "$@" --json >/dev/null 2>&1 || true
+    sleep 60
+  done
+) &
+exec /opt/fleek/bin/fleek listen --name review --concurrency 1 --timeout 660 --quiet-children --exec /opt/fleek-agents/run-job /etc/fleek-agents/review.json

package/service-agents/unlock-keyring

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+# No shell expansion of credential values, argv, files or terminal output.
+exec gnome-keyring-daemon --unlock --components=secrets --control-directory="$GNOME_KEYRING_CONTROL" < "$CREDENTIALS_DIRECTORY/keyring-unlock" > /dev/null 2>&1