32 lines
1.9 KiB
Bash
32 lines
1.9 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
case "${1:-}" in check|apply|verify) ;; *) exit 2 ;; esac
|
|
exec python3 - "$1" "$2" <<'PY'
|
|
import json, pathlib, re, socket, subprocess, sys
|
|
mode, params_file = sys.argv[1:]
|
|
p = json.loads(pathlib.Path(params_file).read_text())
|
|
try:
|
|
version = subprocess.run(['pveversion'], check=True, capture_output=True, text=True, timeout=30).stdout
|
|
match = re.search(r'pve-manager/([^/\s]+)', version)
|
|
if not match or (p.get('allowed_versions') and match[1] not in p['allowed_versions']):
|
|
raise ValueError('PVE version verification failed')
|
|
for service in ('pve-cluster.service', 'pvedaemon.service', 'pveproxy.service', 'pvestatd.service'):
|
|
subprocess.run(['systemctl', 'is-active', '--quiet', service], check=True, timeout=30)
|
|
for name in p.get('dns_names', []):
|
|
socket.getaddrinfo(name, 443)
|
|
if p.get('require_time_sync', True):
|
|
sync = subprocess.run(['timedatectl', 'show', '-p', 'NTPSynchronized', '--value'], check=True, capture_output=True, text=True, timeout=30)
|
|
if sync.stdout.strip() != 'yes':
|
|
raise ValueError('System clock is not synchronized')
|
|
for storage_id in p.get('storage_ids', []):
|
|
if not isinstance(storage_id, str) or not re.fullmatch(r'[A-Za-z][A-Za-z0-9_-]{0,31}', storage_id):
|
|
raise ValueError('Invalid storage identifier')
|
|
result = subprocess.run(['pvesm', 'status', '--storage', storage_id], check=True, capture_output=True, text=True, timeout=30)
|
|
if not any(re.match(r'^' + re.escape(storage_id) + r'\s+\S+\s+active\s', line) for line in result.stdout.splitlines()):
|
|
raise ValueError('Required storage is not active')
|
|
print(json.dumps({'passed': True, 'pve_version': match[1], 'services': 'active', 'clock': 'checked', 'storage': 'checked'}))
|
|
except (ValueError, OSError, subprocess.SubprocessError) as exc:
|
|
print(str(exc), file=sys.stderr)
|
|
sys.exit(2)
|
|
PY
|