awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hardening: strengthen deploy and validation gates

Browse Source
This commit is contained in:
igor04091968
2026-05-15 08:07:18 +03:00
parent 15941e48cb
commit 9927cdb195
8 changed files with 516 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/deploy_aw_server.yml
+4
View File
@@ -330,6 +330,10 @@
AW_DLP_INFLUX_TOKEN={{ aw_dlp_influx_token | default('') }}
AW_DLP_AW_API_BASE=http://127.0.0.1:5600/api/0
AW_DLP_CASE_API_BASE=http://127.0.0.1:5602/api/0/dlp/cases
AW_EXPECT_START_OF_DAY={{ aw_worktime_start_of_day | default('') }}
AW_EXPECT_ALWAYS_ACTIVE_PATTERN={{ aw_server_always_active_pattern | default('') }}
AW_EXPECT_LANDINGPAGE={{ aw_server_landingpage | default('') }}
AW_HEALTH_STRICT_FILEOPS={{ aw_health_strict_fileops | default(0) }}
- name: Создать каталог DLP policy engine
ansible.builtin.file:
ansible/deploy_aw_windows.yml
+35 -9
View File
@@ -265,6 +265,21 @@
}
}
# Force managed collectors/watchers to reload the freshly deployed scripts.
Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
Where-Object {
(
($_.Name -ieq 'powershell.exe' -or $_.Name -ieq 'pwsh.exe') -and
$_.CommandLine -match 'C:\\ProgramData\\AWatch-rus\\' -and
$_.CommandLine -match '(collector|launch-watchers|recovery-loop)\.ps1'
) -or
($_.Name -ieq 'aw-watcher-afk.exe') -or
($_.Name -ieq 'aw-watcher-window.exe')
} |
ForEach-Object {
Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue
}
Start-Sleep -Seconds 2
# Ensure tasks are enabled (some environments keep them disabled, causing "0s" in WebUI).
@@ -277,9 +292,15 @@
try { Enable-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue | Out-Null } catch {}
}
Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
$recoveryTask = Get-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}" -ErrorAction SilentlyContinue
if ($recoveryTask -and $recoveryTask.State -notin @('Running', 'Queued')) {
Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
}
foreach ($taskDef in @($config.userTasks)) {
Start-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
$launchTask = Get-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
if ($launchTask -and $launchTask.State -notin @('Running', 'Queued')) {
Start-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
}
}
- name: Получить Windows hostname для AW smoke-check bucket
@@ -289,17 +310,16 @@
register: aw_windows_hostname_result
changed_when: false
- name: Вычислить AW AFK smoke-check bucket
- name: Вычислить AW worktime smoke-check bucket
when:
- aw_windows_api_smoke_check_enabled | bool
- aw_windows_afk_enabled_effective | bool
- aw_windows_hostname_result.stdout is defined
ansible.builtin.set_fact:
aw_windows_api_smoke_check_bucket_effective: >-
{{
aw_windows_api_smoke_check_bucket
if (aw_windows_api_smoke_check_bucket | default('') | string | length) > 0
else 'aw-watcher-afk_' ~ (aw_windows_hostname_result.stdout | trim)
else 'aw-worktime-sessions_' ~ (aw_windows_hostname_result.stdout | trim)
}}
- name: Вычислить AW Window smoke-check bucket
@@ -316,10 +336,9 @@
else 'aw-watcher-window_' ~ (aw_windows_hostname_result.stdout | trim)
}}
- name: Выполнить AW API smoke-check (AFK bucket должен получать события)
- name: Выполнить AW API smoke-check (worktime bucket должен получать события)
when:
- aw_windows_api_smoke_check_enabled | bool
- aw_windows_afk_enabled_effective | bool
ansible.builtin.uri:
url: "{{ aw_windows_server_scheme }}://{{ aw_windows_server_host }}:{{ aw_windows_server_port }}/api/0/buckets/{{ aw_windows_api_smoke_check_bucket_effective }}/events?limit={{ aw_windows_api_smoke_check_limit }}"
method: GET
@@ -330,6 +349,12 @@
until: >-
(aw_windows_api_smoke_result.status | default(0)) == 200
and ((aw_windows_api_smoke_result.json | default([])) | length) >= aw_windows_api_smoke_check_min_events
and (
(aw_windows_api_smoke_result.json | default([]))
| selectattr('data.source', 'equalto', 'worktime-session-collector')
| list
| length
) > 0
retries: 12
delay: 5
ignore_errors: "{{ (not aw_windows_fail_on_validation_error | bool) }}"
@@ -363,7 +388,7 @@
$ErrorActionPreference = 'Stop'
$result = & "{{ aw_windows_deploy_root }}\windows\validate-deployment.ps1" `
-ConfigPath "{{ aw_windows_state_root }}\deployment-config.json"
$result | ConvertTo-Json -Depth 8 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8
$result | ConvertTo-Json -Depth 12 | Out-File -FilePath "{{ aw_windows_validation_remote_path }}" -Encoding utf8
return $result
- name: Создать локальную директорию для отчётов валидации
@@ -386,7 +411,8 @@
with open('{{ aw_windows_validation_local_dir }}/{{ inventory_hostname }}-aw_validate_ansible.json', 'r', encoding='utf-8-sig') as f:
data = json.load(f)
if not data.get('overallOk', False):
print(f"Validation failed for {{ inventory_hostname }}: {data.get('summary', 'Unknown error')}")
failed = ", ".join(data.get("summary", {}).get("failedSections", [])) or "unknown"
print(f"Validation failed for {{ inventory_hostname }}: {failed}")
sys.exit(1)
PY
delegate_to: localhost
ansible/group_vars/all.example.yml
+1
View File
@@ -50,6 +50,7 @@ aw_worktime_to: "17:00"
aw_worktime_start_of_day: "{{ aw_worktime_from }}"
aw_server_always_active_pattern: "aw-watcher-window"
aw_server_landingpage: "/activity/SHARKON2025/view/"
aw_health_strict_fileops: 0
aw_dlp_policy_engine_enabled: true
aw_dlp_policy_engine_bind_host: "0.0.0.0"
ansible/group_vars/all.yml
+3
View File
@@ -58,3 +58,6 @@ aw_server_post_deploy_health_check_enabled: true
aw_worktime_from: "00:00"
aw_worktime_to: "17:00"
aw_worktime_start_of_day: "{{ aw_worktime_from }}"
aw_server_always_active_pattern: "aw-watcher-window"
aw_server_landingpage: "/activity/SHARKON2025/view/"
aw_health_strict_fileops: 0
ansible/post_validate_aw_windows.yml
+15 -5
View File
@@ -18,16 +18,21 @@
aw_windows_api_smoke_check_enabled: true
aw_windows_api_smoke_check_bucket: ""
aw_windows_api_smoke_check_limit: 10
aw_windows_api_smoke_check_wait_seconds: 20
tasks:
- name: Принудительно запустить ActivityWatch recovery и launch tasks
- name: Аккуратно запустить ActivityWatch recovery и launch tasks, если они не в Running
when: aw_windows_force_task_restart | bool
ansible.windows.win_powershell:
script: |
$ErrorActionPreference = 'Stop'
Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
$recovery = Get-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}" -ErrorAction SilentlyContinue
if ($recovery -and $recovery.State -notin @('Running', 'Queued')) {
Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
}
Get-ScheduledTask |
Where-Object TaskName -like "{{ aw_windows_launch_task_pattern }}" |
Where-Object State -notin @('Running', 'Queued') |
ForEach-Object { Start-ScheduledTask -TaskName $_.TaskName }
- name: Получить Windows hostname для AW smoke-check bucket
@@ -43,10 +48,15 @@
{{
aw_windows_api_smoke_check_bucket
if (aw_windows_api_smoke_check_bucket | default('') | string | length) > 0
else 'aw-watcher-afk_' ~ (aw_windows_hostname_result.stdout | trim)
else 'aw-worktime-sessions_' ~ (aw_windows_hostname_result.stdout | trim)
}}
- name: Дождаться свежих AFK событий на AW server
- name: Дождаться короткого окна стабилизации после перезапуска задач
when: aw_windows_api_smoke_check_enabled | bool
ansible.builtin.pause:
seconds: "{{ aw_windows_api_smoke_check_wait_seconds | int }}"
- name: Дождаться свежих worktime-событий на AW server
when: aw_windows_api_smoke_check_enabled | bool
delegate_to: localhost
ansible.builtin.uri:
@@ -60,7 +70,7 @@
(aw_windows_api_smoke.json | length) > 0 and
(
aw_windows_api_smoke.json
| selectattr('data.status', 'equalto', 'not-afk')
| selectattr('data.source', 'equalto', 'worktime-session-collector')
| list
| length
) > 0