diff options
| author | Leitwolf11 | 2026-10-29 15:04:15 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-10-29 15:04:15 +0300 |
| commit | e644c9bb28ca59d93f09c2d732aa7f070ecdaf21 (patch) | |
| tree | 75ae9bccf293b8bc942749fa89a40e34c8628c3f | |
| parent | 44d14a8ad8cb41f0bb722898d216ab006798d5cd (diff) | |
| download | progmaweb-e644c9bb28ca59d93f09c2d732aa7f070ecdaf21.tar.gz | |
Publish ViGet plugins without putting the environment on a command line
The documented command passed the variables of account.env to env as
arguments, which shows them in the process list to every user while it
runs. systemd-run reads the environment file itself, runs as the service
user with the production environment, and the JAR goes through a private
incoming directory. The publisher must be an existing account.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| -rw-r--r-- | ops/README.md | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/ops/README.md b/ops/README.md index dd1ee9d..ac4b1de 100644 --- a/ops/README.md +++ b/ops/README.md @@ -174,15 +174,23 @@ semanage fcontext -a -t httpd_sys_content_t '/srv/viget/files(/.*)?' restorecon -R /srv/viget/files ``` -A plugin JAR is published with the configuration of the service, as its user: +A plugin JAR is published with the configuration of the service, as its user. `systemd-run` reads the environment +file itself, so no value of it appears on a command line: ```sh -cd /srv/progmaweb/current/api -runuser -u progmaweb -- env $(grep -v '^#' /etc/progmaweb/account.env | xargs) \ - ./Progmaweb.Api viget publish-tazel-plugin /tmp/CMake-0.1.0.jar +install -d -m 0750 -o progmaweb -g progmaweb /srv/viget/incoming +install -m 0640 -o progmaweb -g progmaweb CMake-0.1.0.jar /srv/viget/incoming/ +systemd-run --quiet --wait --pipe --uid=progmaweb --gid=progmaweb \ + -p EnvironmentFile=/etc/progmaweb/account.env -p Environment=ASPNETCORE_ENVIRONMENT=Production \ + -p WorkingDirectory=/srv/progmaweb/current/api \ + /usr/bin/dotnet /srv/progmaweb/current/api/Progmaweb.Api.dll \ + viget publish-tazel-plugin /srv/viget/incoming/CMake-0.1.0.jar +rm /srv/viget/incoming/CMake-0.1.0.jar restorecon -R /srv/viget/files ``` +The publisher of the descriptor must be the name of an existing Progmasoft Account, spelled the same way. + The command checks the descriptor of the JAR, the publisher, its account and the version, which is never replaced. `viget yank-tazel-plugin <Publisher> <Name> <Version>` yanks a version, and `--undo` takes the yank back. |