glass beadian
aa5e262f3a
Self-hosted multi-platform broadcast newsroom for activist collectives: publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style column wall with hostile-content-safe rendering, live control room with Auto Director, bridged chat governance with polls and quorum, distributed sandboxed transcode workers, encrypted content-addressed archive, monthly analytics. MIT licensed. See README.md and docs/.
35 lines
2.5 KiB
Python
35 lines
2.5 KiB
Python
"""Pipe the existing registration secret directly between SSH sessions. No file/argv/log."""
|
|
import argparse,json,re,shlex,subprocess,tempfile
|
|
from pathlib import Path
|
|
parser=argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--worker',required=True,help='SSH target user@WSL-host')
|
|
parser.add_argument('--name',required=True)
|
|
parser.add_argument('--root',default=r'C:\pt-worker')
|
|
parser.add_argument('--server',default='root@100.92.231.98')
|
|
parser.add_argument('--server-key',default=str(Path.home()/'.ssh/id_rsa'))
|
|
parser.add_argument('--worker-key',default=str(Path.home()/'.ssh/devserver'))
|
|
args=parser.parse_args()
|
|
assert re.fullmatch(r'[A-Za-z0-9_-]+',args.name),'Use a simple unique runner name'
|
|
assert re.fullmatch(r'[A-Za-z]:\\[^\r\n]+',args.root),'Require local Windows drive root'
|
|
SSH=['ssh','-o','BatchMode=yes','-o','StrictHostKeyChecking=yes']
|
|
server=SSH+['-i',args.server_key,args.server]
|
|
worker=SSH+['-i',args.worker_key,args.worker]
|
|
query='SELECT "registrationToken" FROM "runnerRegistrationToken" WHERE id=1;'
|
|
command="docker exec -i occ-tube-peertube-postgres-1 sh -c 'exec psql -X -v ON_ERROR_STOP=1 -U \"$POSTGRES_USER\" -d peertube -At'"
|
|
# metadata check is independent of, and never prints, token material.
|
|
p=subprocess.run(server+[command],input=f"SELECT (SELECT count(*) FROM \"runnerRegistrationToken\"),(SELECT count(*) FROM \"runner\" WHERE name='{args.name}');",text=True,capture_output=True,check=True)
|
|
assert p.stdout.strip()=='1|0','Expected existing token and no duplicate runner'
|
|
marker=Path(tempfile.gettempdir())/('pt-worker-'+args.name+'-enrollment.pending')
|
|
assert not marker.exists(),'Previous result uncertain; inspect server before retrying'
|
|
marker.write_text('Registration attempted; contains no secrets.\n')
|
|
source=subprocess.Popen(server+[command],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
|
|
source.stdin.write(query.encode());source.stdin.close()
|
|
node='/mnt/'+args.root[0].lower()+args.root[2:].replace('\\','/')+'/node/node.exe'
|
|
remote=shlex.join([node,args.root+r'\bin\ipc-nvenc.cjs','register',args.root])
|
|
receiver=subprocess.run(worker+[remote],stdin=source.stdout,capture_output=True)
|
|
source.stdout.close();source.wait(timeout=20)
|
|
if source.returncode or receiver.returncode:
|
|
raise SystemExit('Registration failed; secret-bearing outputs suppressed, inspect safe metadata before retry')
|
|
assert json.loads(receiver.stdout)['success'] is True
|
|
marker.unlink()
|
|
print(json.dumps({'runner_name':args.name,'registration_success':True,'secret_transport':'SSH stdout->SSH stdin->official named-pipe IPC','secret_saved':False}))
|