teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Fix leoclean auto-deploy restart sudoers
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source
This commit is contained in:
twentyOne2x 2026-07-10 02:19:30 +02:00
parent dbb79b22bc
commit 9f6961947b
4 changed files with 47 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
deploy/auto-deploy.sh
View file

@ -171,7 +171,9 @@ fi
if [ -n "$RESTART" ]; then
log "Restarting:$RESTART"
sudo systemctl restart $RESTART
for svc in $RESTART; do
sudo systemctl restart "$svc"
done
sleep 30
FAIL=0

16
deploy/install-auto-deploy-sudoers.sh Executable file
View file

@ -0,0 +1,16 @@
#!/usr/bin/env bash
# Install the narrow sudoers rule required by teleo-auto-deploy.service.
set -euo pipefail
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
SOURCE="$REPO_ROOT/deploy/sudoers/teleo-auto-deploy"
TARGET="/etc/sudoers.d/teleo-auto-deploy"
if [ "$(id -u)" -ne 0 ]; then
echo "ERROR: run as root on the VPS" >&2
exit 1
fi
install -m 0440 "$SOURCE" "$TARGET"
visudo -cf "$TARGET"
echo "Installed $TARGET"

14
deploy/sudoers/teleo-auto-deploy Normal file
View file

@ -0,0 +1,14 @@
# Narrow service privileges for teleo-auto-deploy.service, which runs as teleo.
# Keep command forms aligned with deploy/auto-deploy.sh.
teleo ALL=(root) NOPASSWD: /usr/bin/systemctl restart leoclean-gateway
teleo ALL=(root) NOPASSWD: /bin/systemctl restart leoclean-gateway
teleo ALL=(root) NOPASSWD: /usr/bin/systemctl restart leoclean-gateway.service
teleo ALL=(root) NOPASSWD: /bin/systemctl restart leoclean-gateway.service
teleo ALL=(root) NOPASSWD: /usr/bin/systemctl status leoclean-gateway
teleo ALL=(root) NOPASSWD: /bin/systemctl status leoclean-gateway
teleo ALL=(root) NOPASSWD: /usr/bin/systemctl status leoclean-gateway.service
teleo ALL=(root) NOPASSWD: /bin/systemctl status leoclean-gateway.service
teleo ALL=(root) NOPASSWD: /usr/bin/journalctl -u leoclean-gateway
teleo ALL=(root) NOPASSWD: /bin/journalctl -u leoclean-gateway
teleo ALL=(root) NOPASSWD: /usr/bin/journalctl -u leoclean-gateway.service
teleo ALL=(root) NOPASSWD: /bin/journalctl -u leoclean-gateway.service

14
tests/test_teleo_agent_systemd.py
View file

@ -83,15 +83,29 @@ def test_deploy_scripts_install_systemd_units_and_enable_agent_healthcheck():
def test_deploy_scripts_sync_leoclean_skills_and_restart_gateway_when_active():
auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()
sudoers = (REPO_ROOT / "deploy" / "sudoers" / "teleo-auto-deploy").read_text()
assert 'LEOCLEAN_SKILLS_DIR="/home/teleo/.hermes/profiles/leoclean/skills"' in auto_deploy
assert 'hermes-agent/leoclean-skills/vps/' in auto_deploy
assert 'add_restart_if_unit_active leoclean-gateway' in auto_deploy
assert 'sudo systemctl restart "$svc"' in auto_deploy
assert "sudo systemctl restart $RESTART" not in auto_deploy
assert "NOPASSWD: /usr/bin/systemctl restart leoclean-gateway" in sudoers
assert "NOPASSWD: /bin/systemctl restart leoclean-gateway" in sudoers
assert 'VPS_LEOCLEAN_SKILLS="/home/teleo/.hermes/profiles/leoclean/skills"' in manual_deploy
assert 'hermes-agent/leoclean-skills/vps/' in manual_deploy
assert 'systemctl is-active --quiet leoclean-gateway.service' in manual_deploy
def test_auto_deploy_sudoers_installer_is_root_only_and_visudo_checked():
installer = (REPO_ROOT / "deploy" / "install-auto-deploy-sudoers.sh").read_text()
assert 'TARGET="/etc/sudoers.d/teleo-auto-deploy"' in installer
assert 'id -u' in installer
assert 'install -m 0440 "$SOURCE" "$TARGET"' in installer
assert 'visudo -cf "$TARGET"' in installer
def test_gcp_leoclean_skill_sync_targets_parallel_runtime_without_secrets():
script_path = REPO_ROOT / "deploy" / "sync-gcp-leoclean-skills.sh"
script = script_path.read_text()