v0.29.2

scripts/deploy/deploy_core.py

@@ -34,6 +34,7 @@ import urllib.parse
 ROOT = Path(__file__).resolve().parents[2]
 UNIT_PATH = Path('/etc/systemd/system/rustproxy.service')
 SHELL_PATH_PROFILE = Path('/etc/profile.d/rustproxy-path.sh')
+LOGROTATE_PATH = Path('/etc/logrotate.d/rustproxy')
 SERVICE = 'rustproxy.service'
 GEOIP_SOURCES = {
     'user-country-ipv4.csv': 'https://github.com/sapics/ip-location-db/releases/download/latest/user-country-ipv4.csv',
@@ -95,7 +96,7 @@ def digest(path: Path) -> str:
 def fetch_https(url: str, max_bytes: int) -> bytes:
     if urllib.parse.urlparse(url).scheme != 'https':
         raise ValueError('GeoIP downloads require HTTPS.')
-    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer/0.29.0'})
+    request = urllib.request.Request(url, headers={'User-Agent': 'RustProxy-installer'})
     with urllib.request.urlopen(request, timeout=30) as response:
         if urllib.parse.urlparse(response.geturl()).scheme != 'https':
             raise ValueError('GeoIP download redirected away from HTTPS.')
@@ -301,6 +302,24 @@ def install_shell_path(prefix: Path) -> None:
     write_private(SHELL_PATH_PROFILE, shell_path_profile(prefix), 0o644)
 
 
+def logrotate_config(user: str, group: str) -> bytes:
+    # User/group are validated system account names, never interpolated from a request.
+    for value in (user, group):
+        if not re.fullmatch(r'[a-z_][a-z0-9_-]*\$?', value):
+            raise ValueError('Unsafe service account for logrotate configuration.')
+    return (f"# Managed by RustProxy installer; service account: {user}:{group}\n"
+            '/var/log/rustproxy/*.jsonl /var/log/rustproxy/*.log /var/log/rustproxy/vhosts/*.jsonl /var/log/rustproxy/vhosts/*.log {\n'
+            '    daily\n    maxsize 100M\n    rotate 14\n    missingok\n    notifempty\n'
+            '    compress\n    delaycompress\n    copytruncate\n'
+            f'    su {user} {group}\n'
+            '}\n').encode()
+
+
+def install_logrotate(record: dict) -> None:
+    """Keep logrotate in sync with the actual managed service account."""
+    write_private(LOGROTATE_PATH, logrotate_config(record['user'], record['group']), 0o644)
+
+
 def check_shell_path(prefix: Path) -> bool:
     expected = shell_path_profile(prefix)
     try: