83 lines
3.5 KiB
Bash
83 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
# policy: dev_daemon — enable or disable systemd units via FreeIPA host-groups.
|
|
# dev_daemon-enable-<unit> ensure the unit is enabled and running
|
|
# dev_daemon-disable-<unit> ensure the unit is disabled and stopped
|
|
# Conflicts (same unit in both lists) are skipped with a warning.
|
|
|
|
DAEMON_ENABLE_STATE="$STATE_DIR/daemon-enabled"
|
|
DAEMON_DISABLE_STATE="$STATE_DIR/daemon-disabled"
|
|
[[ -f "$DAEMON_ENABLE_STATE" ]] || touch "$DAEMON_ENABLE_STATE"
|
|
[[ -f "$DAEMON_DISABLE_STATE" ]] || touch "$DAEMON_DISABLE_STATE"
|
|
|
|
_svc_unit() { [[ "$1" == *.* ]] && echo "$1" || echo "${1}.service"; }
|
|
_in_enable_list() { local n="$1"; for s in "${ACTIVE_DAEMON_ENABLE[@]}"; do [[ "$s" == "$n" ]] && return 0; done; return 1; }
|
|
_in_disable_list() { local n="$1"; for s in "${ACTIVE_DAEMON_DISABLE[@]}"; do [[ "$s" == "$n" ]] && return 0; done; return 1; }
|
|
|
|
# Apply enable policies
|
|
for _SVC in "${ACTIVE_DAEMON_ENABLE[@]+"${ACTIVE_DAEMON_ENABLE[@]}"}"; do
|
|
if _in_disable_list "$_SVC"; then
|
|
warn "Conflict: '$_SVC' is in both daemon-enable and daemon-disable groups — skipped"
|
|
continue
|
|
fi
|
|
_UNIT=$(_svc_unit "$_SVC")
|
|
_EN=$(systemctl is-enabled "$_UNIT" 2>/dev/null || echo "not-found")
|
|
_AC=$(systemctl is-active "$_UNIT" 2>/dev/null || echo "inactive")
|
|
if [[ "$_EN" != "enabled" || "$_AC" != "active" ]]; then
|
|
log "Enabling service: $_UNIT (enabled=$_EN active=$_AC)"
|
|
systemctl enable --now "$_UNIT" 2>/dev/null \
|
|
&& log "Service enabled: $_UNIT" \
|
|
|| warn "Failed to enable $_UNIT — unit may not exist on this host"
|
|
fi
|
|
done
|
|
|
|
# Apply disable policies
|
|
for _SVC in "${ACTIVE_DAEMON_DISABLE[@]+"${ACTIVE_DAEMON_DISABLE[@]}"}"; do
|
|
if _in_enable_list "$_SVC"; then
|
|
continue # conflict already warned above
|
|
fi
|
|
_UNIT=$(_svc_unit "$_SVC")
|
|
_EN=$(systemctl is-enabled "$_UNIT" 2>/dev/null || echo "not-found")
|
|
_AC=$(systemctl is-active "$_UNIT" 2>/dev/null || echo "inactive")
|
|
if [[ "$_EN" == "enabled" || "$_AC" == "active" ]]; then
|
|
log "Disabling service: $_UNIT (enabled=$_EN active=$_AC)"
|
|
systemctl disable --now "$_UNIT" 2>/dev/null \
|
|
&& log "Service disabled: $_UNIT" \
|
|
|| warn "Failed to disable $_UNIT — unit may not exist on this host"
|
|
fi
|
|
done
|
|
|
|
# Revert: host left a daemon-enable group → disable and stop the service
|
|
while IFS= read -r _OLD; do
|
|
[[ -z "$_OLD" ]] && continue
|
|
if ! _in_enable_list "$_OLD"; then
|
|
_UNIT=$(_svc_unit "$_OLD")
|
|
log "Reverting enable policy: disabling $_UNIT (host left daemon-enable group)"
|
|
systemctl disable --now "$_UNIT" 2>/dev/null \
|
|
|| warn "Failed to disable (revert) $_UNIT"
|
|
fi
|
|
done < "$DAEMON_ENABLE_STATE"
|
|
|
|
# Revert: host left a daemon-disable group → re-enable and start the service
|
|
while IFS= read -r _OLD; do
|
|
[[ -z "$_OLD" ]] && continue
|
|
if ! _in_disable_list "$_OLD"; then
|
|
_UNIT=$(_svc_unit "$_OLD")
|
|
log "Reverting disable policy: enabling $_UNIT (host left daemon-disable group)"
|
|
systemctl enable --now "$_UNIT" 2>/dev/null \
|
|
|| warn "Failed to enable (revert) $_UNIT"
|
|
fi
|
|
done < "$DAEMON_DISABLE_STATE"
|
|
|
|
# Persist current state
|
|
if [[ ${#ACTIVE_DAEMON_ENABLE[@]} -gt 0 ]]; then
|
|
printf '%s\n' "${ACTIVE_DAEMON_ENABLE[@]}" | sort -u > "$DAEMON_ENABLE_STATE"
|
|
else
|
|
> "$DAEMON_ENABLE_STATE"
|
|
fi
|
|
if [[ ${#ACTIVE_DAEMON_DISABLE[@]} -gt 0 ]]; then
|
|
printf '%s\n' "${ACTIVE_DAEMON_DISABLE[@]}" | sort -u > "$DAEMON_DISABLE_STATE"
|
|
else
|
|
> "$DAEMON_DISABLE_STATE"
|
|
fi
|
|
unset _SVC _UNIT _EN _AC _OLD
|