From 9364d27e9d191d6b862b07e5782ff1030c967a84 Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Tue, 24 Jun 2025 11:40:16 +0100 Subject: [PATCH 1/4] r71691-init-linotp-db-after-upgrade --- .../apt_unattended_upgrades/defaults/main.yml | 1 + .../apt_unattended_upgrades/tasks/main.yml | 24 +++++++++++++++++++ .../templates/79linotp-pre-backup.j2 | 12 ++++++++++ .../templates/80linotp-post-init.j2 | 11 +++++++++ 4 files changed, 48 insertions(+) create mode 100644 roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 create mode 100644 roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 diff --git a/roles/debian/apt_unattended_upgrades/defaults/main.yml b/roles/debian/apt_unattended_upgrades/defaults/main.yml index 1a52d0a11..855c7f924 100644 --- a/roles/debian/apt_unattended_upgrades/defaults/main.yml +++ b/roles/debian/apt_unattended_upgrades/defaults/main.yml @@ -4,6 +4,7 @@ _apt_unattended_upgrades_default_origins: - "origin=Debian,codename=${distro_codename}-security,label=Debian-Security" apt_unattended_upgrades: enable: true + linotp: "false" # unattended-upgrades template vars. # booleans must be strings to avoid Jinja2 interpretting. origins: "{{ _apt_unattended_upgrades_default_origins }}" diff --git a/roles/debian/apt_unattended_upgrades/tasks/main.yml b/roles/debian/apt_unattended_upgrades/tasks/main.yml index 935cad765..cdf0e7bed 100644 --- a/roles/debian/apt_unattended_upgrades/tasks/main.yml +++ b/roles/debian/apt_unattended_upgrades/tasks/main.yml @@ -25,6 +25,30 @@ force: true when: apt_unattended_upgrades.enable +- name: Copy unattended-upgrades linotp configuration file. + ansible.builtin.template: + src: 79linotp-pre-backup.j2 + dest: /etc/apt/apt.conf.d/79linotp-pre-backup + owner: root + group: root + mode: "0644" + force: true + when: + - apt_unattended_upgrades.enable + - apt_unattended_upgrades.linotp + +- name: Copy unattended-upgrades linotp configuration file. + ansible.builtin.template: + src: 80linotp-post-init.j2 + dest: /etc/apt/apt.conf.d/80linotp-post-init + owner: root + group: root + mode: "0644" + force: true + when: + - apt_unattended_upgrades.enable + - apt_unattended_upgrades.linotp + - name: Enable and start service unattended-upgrades. ansible.builtin.service: name: unattended-upgrades diff --git a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 new file mode 100644 index 000000000..f60752267 --- /dev/null +++ b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 @@ -0,0 +1,12 @@ +// r71691 Makes sure linotp database is backed up prior to upgrade. +DPkg::Pre-Invoke { + "if apt list --upgradable 2>/dev/null | grep -q '^linotp/'; then \ + echo '[linotp-pre] linotp will be upgraded. Backing up database...' | tee -a /var/log/linotp-upgrade.log; \ + mkdir -p /home/deploy/linotp_dbbackups; \ + mysqldump --defaults-file=/home/deploy/.mysql.creds linotp > /home/deploy/linotp_dbbackups/linotp_backup_$(date +%F_%H-%M-%S).sql && \ + echo '[linotp-pre] Backup complete.' | tee -a /var/log/linotp-upgrade.log || \ + echo '[linotp-pre] WARNING: Backup failed!' | tee -a /var/log/linotp-upgrade.log; \ + else \ + echo '[linotp-pre] linotp not listed for upgrade. Skipping backup.' | tee -a /var/log/linotp-upgrade.log; \ + fi"; +}; diff --git a/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 b/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 new file mode 100644 index 000000000..39a342452 --- /dev/null +++ b/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 @@ -0,0 +1,11 @@ +// r71691 Makes sure linotp database is initialised after upgrade. +DPkg::Post-Invoke { + "if grep -q 'Upgrade: linotp:' /var/log/apt/history.log; then \ + echo '[linotp-post] linotp was upgraded. Running database init...' | tee -a /var/log/linotp-upgrade.log; \ + linotp init database && \ + echo '[linotp-post] linotp init database completed.' | tee -a /var/log/linotp-upgrade.log || \ + echo '[linotp-post] linotp init database failed!' | tee -a /var/log/linotp-upgrade.log; \ + else \ + echo '[linotp-post] linotp not upgraded. Skipping database init.' | tee -a /var/log/linotp-upgrade.log; \ + fi"; +}; From 0f743552ea000baea94220a8c235bdb19af02e64 Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Tue, 24 Jun 2025 11:58:29 +0100 Subject: [PATCH 2/4] Wrapped script in sh and escaped to avoid syntax error --- .../templates/79linotp-pre-backup.j2 | 18 +++++++++--------- .../templates/80linotp-post-init.j2 | 16 ++++++++-------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 index f60752267..b914f1364 100644 --- a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 +++ b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 @@ -1,12 +1,12 @@ // r71691 Makes sure linotp database is backed up prior to upgrade. DPkg::Pre-Invoke { - "if apt list --upgradable 2>/dev/null | grep -q '^linotp/'; then \ - echo '[linotp-pre] linotp will be upgraded. Backing up database...' | tee -a /var/log/linotp-upgrade.log; \ - mkdir -p /home/deploy/linotp_dbbackups; \ - mysqldump --defaults-file=/home/deploy/.mysql.creds linotp > /home/deploy/linotp_dbbackups/linotp_backup_$(date +%F_%H-%M-%S).sql && \ - echo '[linotp-pre] Backup complete.' | tee -a /var/log/linotp-upgrade.log || \ - echo '[linotp-pre] WARNING: Backup failed!' | tee -a /var/log/linotp-upgrade.log; \ - else \ - echo '[linotp-pre] linotp not listed for upgrade. Skipping backup.' | tee -a /var/log/linotp-upgrade.log; \ - fi"; + "sh -c 'if apt list --upgradable 2>/dev/null | grep -q ^linotp/; then \ + echo \"[linotp-pre] linotp will be upgraded. Backing up database...\" | tee -a /var/log/linotp-upgrade.log; \ + mkdir -p /home/deploy/linotp_dbbackups; \ + mysqldump --defaults-file=/home/deploy/.mysql.creds linotp > /home/deploy/linotp_dbbackups/linotp_backup_$(date +%F_%H-%M-%S).sql && \ + echo \"[linotp-pre] Backup complete.\" | tee -a /var/log/linotp-upgrade.log || \ + echo \"[linotp-pre] WARNING: Backup failed!\" | tee -a /var/log/linotp-upgrade.log; \ + else \ + echo \"[linotp-pre] linotp not listed for upgrade. Skipping backup.\" | tee -a /var/log/linotp-upgrade.log; \ + fi'"; }; diff --git a/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 b/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 index 39a342452..8d0d5121d 100644 --- a/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 +++ b/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 @@ -1,11 +1,11 @@ // r71691 Makes sure linotp database is initialised after upgrade. DPkg::Post-Invoke { - "if grep -q 'Upgrade: linotp:' /var/log/apt/history.log; then \ - echo '[linotp-post] linotp was upgraded. Running database init...' | tee -a /var/log/linotp-upgrade.log; \ - linotp init database && \ - echo '[linotp-post] linotp init database completed.' | tee -a /var/log/linotp-upgrade.log || \ - echo '[linotp-post] linotp init database failed!' | tee -a /var/log/linotp-upgrade.log; \ - else \ - echo '[linotp-post] linotp not upgraded. Skipping database init.' | tee -a /var/log/linotp-upgrade.log; \ - fi"; + "sh -c 'if grep -q \"Upgrade: linotp:\" /var/log/apt/history.log; then \ + echo \"[linotp-post] linotp was upgraded. Running database init...\" | tee -a /var/log/linotp-upgrade.log; \ + linotp init database && \ + echo \"[linotp-post] linotp init database completed.\" | tee -a /var/log/linotp-upgrade.log || \ + echo \"[linotp-post] linotp init database failed!\" | tee -a /var/log/linotp-upgrade.log; \ + else \ + echo \"[linotp-post] linotp not upgraded. Skipping database init.\" | tee -a /var/log/linotp-upgrade.log; \ + fi'"; }; From 5e71b51629858fe511e9a3549c1d48b794bfcb88 Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Tue, 24 Jun 2025 12:35:36 +0100 Subject: [PATCH 3/4] refactor shell logic to script --- .../apt_unattended_upgrades/tasks/main.yml | 12 +++++------ .../templates/79linotp-pre-and-post.j2 | 3 +++ .../templates/79linotp-pre-backup.j2 | 12 ----------- .../templates/80linotp-post-init.j2 | 11 ---------- .../templates/linotp-apt-hook.sh.j2 | 20 +++++++++++++++++++ 5 files changed, 29 insertions(+), 29 deletions(-) create mode 100644 roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 delete mode 100644 roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 delete mode 100644 roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 create mode 100644 roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 diff --git a/roles/debian/apt_unattended_upgrades/tasks/main.yml b/roles/debian/apt_unattended_upgrades/tasks/main.yml index cdf0e7bed..52b6d681a 100644 --- a/roles/debian/apt_unattended_upgrades/tasks/main.yml +++ b/roles/debian/apt_unattended_upgrades/tasks/main.yml @@ -25,13 +25,13 @@ force: true when: apt_unattended_upgrades.enable -- name: Copy unattended-upgrades linotp configuration file. +- name: Copy unattended-upgrades linotp APT hook script. ansible.builtin.template: - src: 79linotp-pre-backup.j2 - dest: /etc/apt/apt.conf.d/79linotp-pre-backup + src: linotp-apt-hook.sh.j2 + dest: /usr/local/sbin/linotp-apt-hook.sh owner: root group: root - mode: "0644" + mode: "0755" force: true when: - apt_unattended_upgrades.enable @@ -39,8 +39,8 @@ - name: Copy unattended-upgrades linotp configuration file. ansible.builtin.template: - src: 80linotp-post-init.j2 - dest: /etc/apt/apt.conf.d/80linotp-post-init + src: 79linotp-pre-and-post.j2 + dest: /etc/apt/apt.conf.d/79linotp-pre-and-post owner: root group: root mode: "0644" diff --git a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 new file mode 100644 index 000000000..2c7a235ac --- /dev/null +++ b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 @@ -0,0 +1,3 @@ +// r71691 Makes sure linotp database is backed up prior to upgrade. +DPkg::Pre-Invoke { "/usr/local/sbin/linotp-apt-hook.sh"; }; +DPkg::Post-Invoke { "/usr/local/sbin/linotp-apt-hook.sh"; }; diff --git a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 deleted file mode 100644 index b914f1364..000000000 --- a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-backup.j2 +++ /dev/null @@ -1,12 +0,0 @@ -// r71691 Makes sure linotp database is backed up prior to upgrade. -DPkg::Pre-Invoke { - "sh -c 'if apt list --upgradable 2>/dev/null | grep -q ^linotp/; then \ - echo \"[linotp-pre] linotp will be upgraded. Backing up database...\" | tee -a /var/log/linotp-upgrade.log; \ - mkdir -p /home/deploy/linotp_dbbackups; \ - mysqldump --defaults-file=/home/deploy/.mysql.creds linotp > /home/deploy/linotp_dbbackups/linotp_backup_$(date +%F_%H-%M-%S).sql && \ - echo \"[linotp-pre] Backup complete.\" | tee -a /var/log/linotp-upgrade.log || \ - echo \"[linotp-pre] WARNING: Backup failed!\" | tee -a /var/log/linotp-upgrade.log; \ - else \ - echo \"[linotp-pre] linotp not listed for upgrade. Skipping backup.\" | tee -a /var/log/linotp-upgrade.log; \ - fi'"; -}; diff --git a/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 b/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 deleted file mode 100644 index 8d0d5121d..000000000 --- a/roles/debian/apt_unattended_upgrades/templates/80linotp-post-init.j2 +++ /dev/null @@ -1,11 +0,0 @@ -// r71691 Makes sure linotp database is initialised after upgrade. -DPkg::Post-Invoke { - "sh -c 'if grep -q \"Upgrade: linotp:\" /var/log/apt/history.log; then \ - echo \"[linotp-post] linotp was upgraded. Running database init...\" | tee -a /var/log/linotp-upgrade.log; \ - linotp init database && \ - echo \"[linotp-post] linotp init database completed.\" | tee -a /var/log/linotp-upgrade.log || \ - echo \"[linotp-post] linotp init database failed!\" | tee -a /var/log/linotp-upgrade.log; \ - else \ - echo \"[linotp-post] linotp not upgraded. Skipping database init.\" | tee -a /var/log/linotp-upgrade.log; \ - fi'"; -}; diff --git a/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 b/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 new file mode 100644 index 000000000..2e0a4c455 --- /dev/null +++ b/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 @@ -0,0 +1,20 @@ +#!/bin/bash + +LOG="/var/log/linotp-upgrade.log" +BACKUP_DIR="/home/deploy/linotp_dbbackups" +CREDS="/home/deploy/.mysql.creds" + +if apt list --upgradable 2>/dev/null | grep -q '^linotp/'; then + echo "[linotp-pre] linotp will be upgraded. Backing up database..." | tee -a "$LOG" + mkdir -p "$BACKUP_DIR" + mysqldump --defaults-file="$CREDS" linotp > "$BACKUP_DIR/linotp_backup_$(date +%F_%H-%M-%S).sql" && \ + echo "[linotp-pre] Backup complete." | tee -a "$LOG" || \ + echo "[linotp-pre] WARNING: Backup failed!" | tee -a "$LOG" +fi + +if grep -q 'Upgrade: linotp:' /var/log/apt/history.log; then + echo "[linotp-post] linotp was upgraded. Running database init..." | tee -a "$LOG" + linotp init database && \ + echo "[linotp-post] linotp init database completed." | tee -a "$LOG" || \ + echo "[linotp-post] linotp init database failed!" | tee -a "$LOG" +fi From b9f1fbae7378863be29af33a5d7df500532cad5d Mon Sep 17 00:00:00 2001 From: Nick Fawbert Date: Thu, 26 Jun 2025 12:01:38 +0100 Subject: [PATCH 4/4] making pre and post hooks more robust --- .../templates/79linotp-pre-and-post.j2 | 2 +- .../apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 index 2c7a235ac..98f4a5c2a 100644 --- a/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 +++ b/roles/debian/apt_unattended_upgrades/templates/79linotp-pre-and-post.j2 @@ -1,3 +1,3 @@ -// r71691 Makes sure linotp database is backed up prior to upgrade. +// r71691 Makes sure linotp database is backed up prior to upgrade then initialised. DPkg::Pre-Invoke { "/usr/local/sbin/linotp-apt-hook.sh"; }; DPkg::Post-Invoke { "/usr/local/sbin/linotp-apt-hook.sh"; }; diff --git a/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 b/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 index 2e0a4c455..45d88660b 100644 --- a/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 +++ b/roles/debian/apt_unattended_upgrades/templates/linotp-apt-hook.sh.j2 @@ -10,11 +10,13 @@ if apt list --upgradable 2>/dev/null | grep -q '^linotp/'; then mysqldump --defaults-file="$CREDS" linotp > "$BACKUP_DIR/linotp_backup_$(date +%F_%H-%M-%S).sql" && \ echo "[linotp-pre] Backup complete." | tee -a "$LOG" || \ echo "[linotp-pre] WARNING: Backup failed!" | tee -a "$LOG" + export LINOTP_UPGRADING=1 fi -if grep -q 'Upgrade: linotp:' /var/log/apt/history.log; then +if [ "$LINOTP_UPGRADING" = "1" ]; then echo "[linotp-post] linotp was upgraded. Running database init..." | tee -a "$LOG" linotp init database && \ echo "[linotp-post] linotp init database completed." | tee -a "$LOG" || \ echo "[linotp-post] linotp init database failed!" | tee -a "$LOG" + export LINOTP_UPGRADING=0 fi