@@ -0,0 +1,62 @@ |
| 1 | +#!/usr/bin/env bash |
| 2 | +# SPDX-License-Identifier: AGPL-3.0-or-later |
| 3 | +# |
| 4 | +# Nightly AIDE wrapper. Runs `aide --check` and: |
| 5 | +# - on no changes: silent (cron mail isn't sent) |
| 6 | +# - on changes: appends the diff to /var/log/shithub/aide.log |
| 7 | +# AND emits a tagged systemd journal record so the |
| 8 | +# operator can `journalctl -t shithub-aide`. |
| 9 | +# |
| 10 | +# Email delivery is intentionally not wired up yet: the droplet has |
| 11 | +# no MTA + the project's outbound SMTP (Postmark) is approval-gated. |
| 12 | +# Once Postmark is approved end-to-end, swap the journal emit for a |
| 13 | +# curl POST to https://api.postmarkapp.com/email — see the runbook |
| 14 | +# at docs/internal/runbooks/aide.md. |
| 15 | + |
| 16 | +set -uo pipefail # NOT -e: aide --check exits non-zero on diff, which |
| 17 | + # is the expected, non-fatal "you have alerts" signal. |
| 18 | + |
| 19 | +LOG=/var/log/shithub/aide.log |
| 20 | +mkdir -p "$(dirname "$LOG")" |
| 21 | + |
| 22 | +ts() { date -u +%Y-%m-%dT%H:%M:%SZ; } |
| 23 | + |
| 24 | +OUT="$(aide --check 2>&1)" |
| 25 | +RC=$? |
| 26 | + |
| 27 | +case "$RC" in |
| 28 | + 0) |
| 29 | + # No changes — be silent. Touch a heartbeat file so the |
| 30 | + # operator can confirm the cron actually ran today. |
| 31 | + date -u +%Y-%m-%dT%H:%M:%SZ > /var/run/shithub-aide.last-clean |
| 32 | + exit 0 |
| 33 | + ;; |
| 34 | + 1|2|3|4|5|6|7) |
| 35 | + # AIDE encodes which categories changed in the exit code |
| 36 | + # (added/removed/changed file bits OR'd together). Any |
| 37 | + # non-zero is operator-visible by design. |
| 38 | + { |
| 39 | + echo "[$(ts)] aide reported changes (rc=$RC)" |
| 40 | + echo "----------------------------------------" |
| 41 | + echo "$OUT" |
| 42 | + echo "----------------------------------------" |
| 43 | + } >> "$LOG" |
| 44 | + # systemd-cat tags the journal so `journalctl -t shithub-aide` |
| 45 | + # filters cleanly. Priority warning so it shows up in |
| 46 | + # default `journalctl --priority=warning` queries. |
| 47 | + printf '%s\n' "$OUT" \ |
| 48 | + | systemd-cat -t shithub-aide -p warning |
| 49 | + exit 0 |
| 50 | + ;; |
| 51 | + *) |
| 52 | + # Anything else: AIDE itself failed (missing DB, IO error, |
| 53 | + # config parse error). That's a different class — fail loud. |
| 54 | + { |
| 55 | + echo "[$(ts)] aide RUN FAILED rc=$RC" |
| 56 | + echo "$OUT" |
| 57 | + } >> "$LOG" |
| 58 | + printf 'aide run failed (rc=%s)\n%s\n' "$RC" "$OUT" \ |
| 59 | + | systemd-cat -t shithub-aide -p err |
| 60 | + exit "$RC" |
| 61 | + ;; |
| 62 | +esac |
