wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(recovery): harden runner failclosed authority copy [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-28 16:32:14 +08:00
parent f52ec0db26
commit 2104f0f01a
9 changed files with 40 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ops/runner/README.md
View File

@@ -418,7 +418,9 @@ quarantine restore source 或 `systemd-run` 讓它們恢復 active。
- `ops/runner/awoooi-runner-failclosed-authority.service`
- `ops/runner/awoooi-runner-failclosed-authority.timer`
live 110 必須安裝 canonical `/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh`，
live 110 必須安裝 authority copy `/usr/local/lib/awoooi/enforce-110-runner-failclosed.authority.sh`
與 canonical `/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh`；cron / systemd authority 一律執行
authority copy，讓外部 opener 覆寫 canonical 時仍可自動修復。
`/usr/local/bin/awoooi-enforce-runner-failclosed-110.sh` 只作相容 wrapper。必須啟用
`awoooi-runner-failclosed-enforcer.timer` 與 `awoooi-runner-failclosed-authority.timer`。
`/etc/cron.d/awoooi-runner-failclosed-authority` 必須存在，作為 systemd timers 被短命外部 opener mask 掉時的第三層收斂 authority。

4
ops/runner/awoooi-runner-failclosed-authority.service
View File

@@ -1,10 +1,10 @@
[Unit]
Description=AWOOOI 110 runner/CD lane fail-closed authority
Documentation=file:/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh
Documentation=file:/usr/local/lib/awoooi/enforce-110-runner-failclosed.authority.sh
Wants=network-online.target
After=network-online.target docker.service
[Service]
Type=oneshot
ExecStart=/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh --apply
ExecStart=/usr/local/lib/awoooi/enforce-110-runner-failclosed.authority.sh --apply
TimeoutStartSec=180

4
ops/runner/awoooi-runner-failclosed-enforcer.service
View File

@@ -1,10 +1,10 @@
[Unit]
Description=AWOOOI 110 runner/CD lane fail-closed enforcer
Documentation=file:/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh
Documentation=file:/usr/local/lib/awoooi/enforce-110-runner-failclosed.authority.sh
Wants=network-online.target
After=network-online.target docker.service
[Service]
Type=oneshot
ExecStart=/usr/local/lib/awoooi/enforce-110-runner-failclosed.sh --apply
ExecStart=/usr/local/lib/awoooi/enforce-110-runner-failclosed.authority.sh --apply
TimeoutStartSec=180