josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Account for runtime RCON passwords in config drift

Browse Source
This commit is contained in:
josh
2026-10-08 03:07:49 -04:00
parent 8de9247ff2
commit f8942c732a
13 changed files with 299 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/server/fleet/beta.ts
+3 -1
View File
@@ -38,6 +38,8 @@ import {
type ScriptVersionRow
} from './scripts.js';
import { composeServerCfg } from './config-compose.js';
import { applyRuntimePassword } from './runtime-config.js';
import { runtimePasswordForServer } from '../backends/native.js';
import { removeScript } from './inventory.js';
import { cancelStagedFiles, isFileApplied, queueFileChange, stagedFileChanges } from './staged-files.js';
import { emit } from '../pipeline/bus.js';
@@ -138,7 +140,7 @@ function composeCfgForServer(
.map(({ script, version }) => ({ id: script.id, text: getVersionContent(version.id).toString('utf8') }));
const composed = composeServerCfg(baselineText, [...promotedOverlays, ...inBetaScopedOverlays], serverGame, serverMap, getServer(serverName)?.map_slug);
return { text: composed, baselineScriptId };
return { text: applyRuntimePassword(composed, runtimePasswordForServer(serverName)), baselineScriptId };
}
export interface BetaRow {
src/lib/server/fleet/drift.ts
+21 -8
View File
@@ -8,7 +8,9 @@ import { configFileOf, destOfKind, serverDir, type ArtifactKind } from '../confi
import { db } from '../db/index.js';
import { emit } from '../pipeline/bus.js';
import { sha256Buffer } from './files.js';
import { getServerScript } from './inventory.js';
import { getServerScript, recordScript } from './inventory.js';
import { applyRuntimePassword } from './runtime-config.js';
import { runtimePasswordForServer } from '../backends/native.js';
import { getBaselineForScope, getVersion } from './scripts.js';
import { getPromotedServerConfig, getServerMapConfig, MAP_CONFIG_FILE } from './server-config.js';
import { selectedZombieMap } from './map-aliases.js';
@@ -235,13 +237,22 @@ async function scanManagedForServer(server: string, manifest: Map<string, FileFi
if (srv.game) {
const baseline = getBaselineForScope('game', srv.game);
if (baseline?.current_version_id) {
const composed = composeExpectedCfg(srv.game, srv.map, srv.map_slug);
const composed = composeExpectedCfg(server, srv.game, srv.map, srv.map_slug);
if (composed) {
const dest = destOfKind(server, 'config');
const targetRel = configFileOf(server);
const abs = join(dest, targetRel);
const inv = getServerScript(server, targetRel);
let inv = getServerScript(server, targetRel);
const content = await fingerprint(abs, manifest);
// Older launches tracked the promoted bytes before Plutainer
// applied the instance password. Reconcile only that known
// before-image, and only after verifying the full effective file.
if (composed.sha256 !== composed.promotedSha256 && content?.sha256 === composed.sha256
&& inv?.sha256 === composed.promotedSha256 && !hasActiveBeta(server)) {
recordScript(server, targetRel, inv.script_version_id, composed.sha256,
composed.content.byteLength, 'runtime-config-reconciliation');
inv = getServerScript(server, targetRel);
}
const onDiskMatches = content?.sha256 === composed.sha256 && inv?.sha256 === composed.sha256;
if (!onDiskMatches) {
out.push({
@@ -272,7 +283,7 @@ async function resolveManagedEntry(server: string, entry: DriftEntry): Promise<B
const srv = getServer(server);
if (!srv?.game) return null;
if (entry.relPath === MAP_CONFIG_FILE) return getServerMapConfig(srv.game, srv.map, srv.map_slug);
const composed = composeExpectedCfg(srv.game, srv.map, srv.map_slug);
const composed = composeExpectedCfg(server, srv.game, srv.map, srv.map_slug);
return composed?.content ?? null;
}
if (!entry.scriptVersionId) return null;
@@ -281,13 +292,15 @@ async function resolveManagedEntry(server: string, entry: DriftEntry): Promise<B
}
function composeExpectedCfg(
server: string,
game: string | null,
map: string | null,
mapSlug?: string | null
): { content: Buffer; sha256: string } | null {
const content = getPromotedServerConfig(game, map, mapSlug);
if (!content) return null;
return { content, sha256: sha256Buffer(content) };
): { content: Buffer; sha256: string; promotedSha256: string } | null {
const promoted = getPromotedServerConfig(game, map, mapSlug);
if (!promoted) return null;
const content = Buffer.from(applyRuntimePassword(promoted.toString('utf8'), runtimePasswordForServer(server)));
return { content, sha256: sha256Buffer(content), promotedSha256: sha256Buffer(promoted) };
}
/**
src/lib/server/fleet/launch-recipes.ts
+5 -5
View File
@@ -71,8 +71,8 @@ function buildEntries(input: unknown): BlueprintSelection[] {
return entries;
}
export function captureRecipe(game: ZombieGame, mapSlug: string): LaunchRecipe {
return buildRecipe(game, mapSlug, true);
export function captureRecipe(game: ZombieGame, mapSlug: string, rconPassword?: string): LaunchRecipe {
return buildRecipe(game, mapSlug, true, rconPassword);
}
/** Preview and admission keep file references; execution captures the current bytes. */
@@ -80,9 +80,9 @@ export function captureRecipePlan(game: ZombieGame, mapSlug: string): LaunchReci
return buildRecipe(game, mapSlug, false);
}
function buildRecipe(game: ZombieGame, mapSlug: string, includeContent: true): LaunchRecipe;
function buildRecipe(game: ZombieGame, mapSlug: string, includeContent: true, rconPassword?: string): LaunchRecipe;
function buildRecipe(game: ZombieGame, mapSlug: string, includeContent: false): LaunchRecipePlan;
function buildRecipe(game: ZombieGame, mapSlug: string, includeContent: boolean): LaunchRecipePlan {
function buildRecipe(game: ZombieGame, mapSlug: string, includeContent: boolean, rconPassword?: string): LaunchRecipePlan {
const map = zombieMapBySlug(game, mapSlug);
if (!map) throw new Error('Choose a supported game and map.');
const metadata = ({ kind, script, version }: ReturnType<typeof promotedArtifactMetadata>[number]): LaunchFileSummary => ({
@@ -96,7 +96,7 @@ function buildRecipe(game: ZombieGame, mapSlug: string, includeContent: boolean)
name, path, kind: 'config', versionId: null, version: null,
sha256: sha256Buffer(content), size: content.length, ...(includeContent ? { content: content.toString('base64') } : {})
});
const composed = getPromotedServerConfig(game, map.canonical, map.slug);
const composed = getPromotedServerConfig(game, map.canonical, map.slug, rconPassword);
let configSource = 'Plutainer defaults, seeded on first boot';
if (composed) {
const baseline = getBaselineForScope('game', game)!;
src/lib/server/fleet/runtime-config.ts
+35
View File
@@ -0,0 +1,35 @@
/** Match Plutainer's apply_rcon_password, including its newline handling.
* Keep the original bytes when the password already matches: its Python reader
* normalizes line endings, but only writes the normalized text after a change.
*/
export function applyRuntimePassword(text: string, password?: string | null): string {
if (!password) return text;
const lines = text.replace(/\r\n|\r/g, '\n').split('\n');
const replacement = `"${password.replaceAll('"', '')}"`;
const pattern = /^(\s*(?:set[a]?\s+)?rcon_password\s+)("[^"]*"|'[^']*'|\S+)(.*)$/i;
let matched = false;
let changed = false;
for (let i = 0; i < lines.length; i++) {
const match = pattern.exec(lines[i]);
if (!match) continue;
matched = true;
if (match[2] === replacement) continue;
lines[i] = match[1] + replacement + match[3];
changed = true;
}
if (!matched) {
if (lines.at(-1) === '') lines.pop();
lines.push('', '// Added by Plutainer from PLUTAINER_RCON_PASSWORD.', `set rcon_password ${replacement}`, '');
changed = true;
}
return changed ? lines.join('\n') : text;
}
/** Uses aliases o (operation) and i (instance). Rebuild commands target the old
* generation; their successful result owns the next one. Never use a queued
* rebuild's password for the instance that is still running.
*/
export const runtimeLaunchSql = `o.instance_id=i.id AND o.host_id=i.host_id
AND o.kind IN ('instance.create','instance.rebuild')
AND ((o.kind='instance.create' AND o.generation=i.generation)
OR (o.kind='instance.rebuild' AND o.generation+1=i.generation))`;
src/lib/server/fleet/server-config.ts
+3 -2
View File
@@ -2,6 +2,7 @@ import { getVersionContent } from './scripts.js';
import { composeServerCfg } from './config-compose.js';
import { getBaselineForScope, getVersion, listPromotedOverlaysForScope } from './scripts.js';
import { selectedZombieMap, mapRotation } from './map-aliases.js';
import { applyRuntimePassword } from './runtime-config.js';
export const MAP_CONFIG_FILE = 'electric_cherry_map.cfg';
@@ -12,7 +13,7 @@ export function getServerMapConfig(game: string | null, map: string | null, mapS
}
/** The promoted config used for first boot and drift reconciliation. */
export function getPromotedServerConfig(game: string | null, map: string | null, mapSlug?: string | null): Buffer | null {
export function getPromotedServerConfig(game: string | null, map: string | null, mapSlug?: string | null, rconPassword?: string | null): Buffer | null {
if (!game) return null;
const baseline = getBaselineForScope('game', game);
if (!baseline?.current_version_id) return null;
@@ -26,5 +27,5 @@ export function getPromotedServerConfig(game: string | null, map: string | null,
const current = overlay.current_version_id ? getVersion(overlay.current_version_id) : undefined;
return current ? [{ id: overlay.id, text: getVersionContent(current.id).toString('utf8') }] : [];
});
return Buffer.from(composeServerCfg(getVersionContent(version.id).toString('utf8'), overlays, game, map, mapSlug), 'utf8');
return Buffer.from(applyRuntimePassword(composeServerCfg(getVersionContent(version.id).toString('utf8'), overlays, game, map, mapSlug), rconPassword), 'utf8');
}