poc2_worked

scripts/upgrade-routeros-container.sh

@@ -28,6 +28,7 @@ ROOT_DIR="/containers/${CONTAINER_NAME}/root"
 : "${CONTAINER_VETH:=veth-ids}"
 : "${CONTAINER_ENVLIST:=IDS_ENV}"
 : "${CONTAINER_MOUNTLIST:=IDS_MOUNTS}"
+: "${ROUTER_DISK:=disk1}"
 
 usage() {
   cat <<USAGE
@@ -37,9 +38,9 @@ This is an image-only container upgrade. It DOES NOT change:
   - bridge/IP/NAT/veth configuration,
   - TZSP/sniffer configuration,
   - firewall or REST configuration,
-  - envlist or mount definitions.
+  - envlist definitions.
 
-It only disables/stops older suricata_* containers, creates:
+It normalizes the mount list to one persistent /data mount and then creates:
   name=${CONTAINER_NAME}
   file=<TAR>
   root-dir=${ROOT_DIR}
@@ -47,7 +48,7 @@ It only disables/stops older suricata_* containers, creates:
 and reuses:
   interface=${CONTAINER_VETH}
   envlist=${CONTAINER_ENVLIST}
-  mountlists=${CONTAINER_MOUNTLIST}
+  mountlists=${CONTAINER_MOUNTLIST} -> ${ROUTER_DISK}/containers/suricata-data:/data
 USAGE
 }
 
@@ -67,7 +68,7 @@ case "$ROUTER_PORT" in
   *[!0-9]*|'') echo "ROUTER_PORT must be numeric" >&2; exit 2 ;;
 esac
 
-for value in "$IMAGE_TAR_ROS" "$CONTAINER_VETH" "$CONTAINER_ENVLIST" "$CONTAINER_MOUNTLIST"; do
+for value in "$IMAGE_TAR_ROS" "$CONTAINER_VETH" "$CONTAINER_ENVLIST" "$CONTAINER_MOUNTLIST" "$ROUTER_DISK"; do
   case "$value" in
     *'"'*|*'\\'*|*'$'*|*';'*|*'`'*) echo "Unsupported character in RouterOS value: $value" >&2; exit 3 ;;
   esac
@@ -86,7 +87,7 @@ printf '[upgrade] version: %s\n' "$VERSION"
 printf '[upgrade] new container: %s\n' "$CONTAINER_NAME"
 printf '[upgrade] image on RouterOS: %s\n' "$IMAGE_TAR_ROS"
 printf '[upgrade] root-dir: %s\n' "$ROOT_DIR"
-printf '[upgrade] reusing interface/env/mounts: %s / %s / %s\n' "$CONTAINER_VETH" "$CONTAINER_ENVLIST" "$CONTAINER_MOUNTLIST"
+printf '[upgrade] reusing interface/env and normalizing mounts: %s / %s / %s\n' "$CONTAINER_VETH" "$CONTAINER_ENVLIST" "$CONTAINER_MOUNTLIST"
 
 echo '[upgrade] read-only preflight'
 ssh_run '/container/print' >/dev/null
@@ -104,10 +105,6 @@ if ! ssh_run "/container/envs/print without-paging where list=\"${CONTAINER_ENVL
   echo "Existing envlist not found or empty: $CONTAINER_ENVLIST" >&2
   exit 5
 fi
-if ! ssh_run "/container/mounts/print without-paging where list=\"${CONTAINER_MOUNTLIST}\"" | grep -F "$CONTAINER_MOUNTLIST" >/dev/null 2>&1; then
-  echo "Existing mountlist not found or empty: $CONTAINER_MOUNTLIST" >&2
-  exit 5
-fi
 if ssh_run "/container/print without-paging where name=\"${CONTAINER_NAME}\"" | grep -F "$CONTAINER_NAME" >/dev/null 2>&1; then
   echo "Container already exists: $CONTAINER_NAME" >&2
   echo "Bump VERSION or remove that container explicitly before retrying." >&2
@@ -122,7 +119,7 @@ REMOTE_RSC_NAME="upgrade-${CONTAINER_NAME}-${DEPLOY_ID}.rsc"
 cat > "$LOCAL_RSC" <<RSC
 # Image-only Suricata container upgrade.
 # This script intentionally does not modify networking, sniffer, firewall,
-# envlist definitions or mount definitions.
+# envlist definitions. Mounts are normalized to the single persistent /data volume.
 
 :foreach c in=[/container/find where name~"^suricata_"] do={
     /container/set \$c start-on-boot=no
@@ -134,6 +131,9 @@ cat > "$LOCAL_RSC" <<RSC
     :delay 3s
 }
 
+/container/mounts/remove [find where list="${CONTAINER_MOUNTLIST}"]
+/container/mounts/add list="${CONTAINER_MOUNTLIST}" src="${ROUTER_DISK}/containers/suricata-data" dst=/data
+
 /container/add name="${CONTAINER_NAME}" file="${IMAGE_TAR_ROS}" interface="${CONTAINER_VETH}" root-dir="${ROOT_DIR}" mountlists="${CONTAINER_MOUNTLIST}" envlist="${CONTAINER_ENVLIST}" start-on-boot=yes logging=yes
 
 :local tries 0