awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ops): harden runtime placeholder guards

Browse Source
This commit is contained in:
igor04091968
2026-06-03 19:49:06 +03:00
parent 2e64f9b26c
commit 1312ee3ee5
11 changed files with 337 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/deploy_aw_server.yml
+12 -2
View File
@@ -611,6 +611,7 @@
that:
- aw_effective_worktime_influx_token is defined
- aw_effective_worktime_influx_token | length > 0
- (aw_effective_worktime_influx_token | string | lower | regex_search('^(change_me|changeme|replace-me|replace_me|token|secret|password|api_key|influx_token|write_token|your_.*|<.*>)$')) is none
fail_msg: "aw_worktime_influx_enabled=true, но token пуст и в локальном env, и в текущем /etc/activitywatch/aw-server.env. Exporter будет падать и Grafana не получит worktime-ряды."
when: aw_worktime_influx_enabled | default(false) | bool
@@ -619,6 +620,7 @@
that:
- aw_effective_dlp_influx_token is defined
- aw_effective_dlp_influx_token | length > 0
- (aw_effective_dlp_influx_token | string | lower | regex_search('^(change_me|changeme|replace-me|replace_me|token|secret|password|api_key|influx_token|write_token|your_.*|<.*>)$')) is none
fail_msg: "aw_dlp_influx_enabled=true, но token пуст и в локальном env, и в текущем /etc/activitywatch/aw-server.env. Exporter будет падать и Grafana не получит DLP-ряды."
when: aw_dlp_influx_enabled | default(false) | bool
@@ -629,10 +631,14 @@
- "'192.0.2.' not in (aw_worktime_influx_url | default('') | string)"
- "'198.51.100.' not in (aw_worktime_influx_url | default('') | string)"
- "'203.0.113.' not in (aw_worktime_influx_url | default('') | string)"
- (aw_worktime_influx_org | default('') | string | length) > 0
- (aw_worktime_influx_org | default('') | string | lower | regex_search('example|change_me|changeme|replace-me|replace_me|your_|<|>')) is none
- (aw_worktime_influx_bucket | default('') | string | length) > 0
- (aw_worktime_influx_bucket | default('') | string | lower | regex_search('example|change_me|changeme|replace-me|replace_me|your_|<|>')) is none
- (aw_worktime_influx_hosts | default('') | string | length) > 0
- "'HOST-EXAMPLE' not in (aw_worktime_influx_hosts | default('') | string)"
- "'WINDOWS_USER_EXAMPLE' not in (aw_worktime_influx_hosts | default('') | string)"
fail_msg: "aw_worktime_influx_enabled=true, но URL/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
fail_msg: "aw_worktime_influx_enabled=true, но URL/org/bucket/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
when: aw_worktime_influx_enabled | default(false) | bool
- name: Проверить destination для AW DLP Influx exporter
@@ -642,10 +648,14 @@
- "'192.0.2.' not in (aw_dlp_influx_url | default('') | string)"
- "'198.51.100.' not in (aw_dlp_influx_url | default('') | string)"
- "'203.0.113.' not in (aw_dlp_influx_url | default('') | string)"
- (aw_dlp_influx_org | default('') | string | length) > 0
- (aw_dlp_influx_org | default('') | string | lower | regex_search('example|change_me|changeme|replace-me|replace_me|your_|<|>')) is none
- (aw_dlp_influx_bucket | default('') | string | length) > 0
- (aw_dlp_influx_bucket | default('') | string | lower | regex_search('example|change_me|changeme|replace-me|replace_me|your_|<|>')) is none
- (aw_dlp_influx_hosts | default('') | string | length) > 0
- "'HOST-EXAMPLE' not in (aw_dlp_influx_hosts | default('') | string)"
- "'WINDOWS_USER_EXAMPLE' not in (aw_dlp_influx_hosts | default('') | string)"
fail_msg: "aw_dlp_influx_enabled=true, но URL/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
fail_msg: "aw_dlp_influx_enabled=true, но URL/org/bucket/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
when: aw_dlp_influx_enabled | default(false) | bool
- name: Записать /etc/activitywatch/aw-server.env перед хотфиксами