USB-AIO für automatische Geräteprüfung

live/intake-prepare.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+# Run as root once per boot. NEVER write to internal devices.
+DATA=/mnt/intake-data
+if ! id intake &>/dev/null; then
+  useradd --create-home --home-dir /home/intake --shell /bin/bash --user-group intake
+fi
+install -d -o intake -g intake -m 0700 /home/intake
+# Read protected DMI fields once as root; provide a boot-local, read-only snapshot.
+install -d -o root -g intake -m 0750 /run/csr-intake
+for field in product_uuid product_serial; do
+  if [[ -r /sys/class/dmi/id/$field ]]; then
+    install -o root -g intake -m 0440 "/sys/class/dmi/id/$field" "/run/csr-intake/$field"
+  fi
+done
+if [[ -r /sys/firmware/dmi/tables/DMI ]]; then
+  install -o root -g intake -m 0440 /sys/firmware/dmi/tables/DMI /run/csr-intake/DMI
+fi
+install -d -m 0755 "$DATA"
+part=$(blkid -L INTAKE_DATA || true)
+if [[ -z "$part" ]]; then
+  echo 'CS-R ERROR: INTAKE_DATA not found; scans must not run.' >&2
+else
+  if ! mountpoint -q "$DATA"; then
+    mount -o rw,nosuid,nodev "$part" "$DATA"
+  fi
+  for d in config database reports checklists inspections final-reports diagnostics; do
+    mkdir -p "$DATA/$d"
+    chown -R intake:intake "$DATA/$d"
+  done
+  chown intake:intake "$DATA"
+  [[ ! -f "$DATA/active-inspection.txt" ]] || chown intake:intake "$DATA/active-inspection.txt"
+  chmod 0750 "$DATA"
+  # Only provision when absent; the user can rotate credentials on persistent media.
+  if [[ -d /etc/csr-intake ]]; then
+    for f in inventory.json inventory-api-key workshop.json; do
+      if [[ -f /etc/csr-intake/$f && ! -e "$DATA/config/$f" ]]; then
+        install -o intake -g intake -m 0600 "/etc/csr-intake/$f" "$DATA/config/$f"
+      fi
+    done
+  fi
+  [[ ! -f "$DATA/config/inventory-api-key" ]] || chmod 0600 "$DATA/config/inventory-api-key"
+  # Workshop TLS certificates stay on persistent media, alongside inventory config.
+  # Preserve certificate and hostname verification for Python and curl.
+  if [[ -f "$DATA/config/inventory-server.crt" ]]; then
+    install -D -m 0644 "$DATA/config/inventory-server.crt" /etc/ca-certificates/trust-source/anchors/csr-inventory.crt
+    update-ca-trust
+  fi
+fi
+install -o intake -g intake -m 0644 /usr/local/bin/intake-login /home/intake/.bash_profile
+# .bash_profile sourced by the user's real console login.