docs: sync README version 2.1.6-SAC; add push-github-snapshot.sh

2026-07-07 20:27:44 +10:00
parent 9e756674d0
commit 141a841f6f
2 changed files with 151 additions and 2 deletions
@@ -0,0 +1,149 @@
+#!/usr/bin/env bash
+# Публичный snapshot на github: без prod URL, токенов и kalinamall-only путей.
+set -Eeuo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/ssh-monitor-github-snapshot.XXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+REF="${1:-HEAD}"
+VERSION="$(git -C "$ROOT" show "$REF":version.txt 2>/dev/null | tr -d '[:space:]' || true)"
+MSG="${2:-chore: public release ${VERSION:-snapshot} (SSH Monitor, no Cursor IDE traces)}"
+
+echo "[snapshot] export $REF -> $WORK"
+git -C "$ROOT" archive --format=tar "$REF" \
+  | tar -x -C "$WORK" \
+  --exclude='.cursor' \
+  --exclude='.env'
+
+apply_sed() {
+  local expr=$1
+  if [[ "$(uname -s)" == Darwin ]]; then
+    find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
+      ! -path '*/scripts/push-github-snapshot.sh' \
+      -print0 | xargs -0 sed -i '' -E "$expr" 2>/dev/null || true
+  else
+    find "$WORK" -type f \( -name '*.md' -o -name '*.sh' -o -name '*.example' \) \
+      ! -path '*/scripts/push-github-snapshot.sh' \
+      -print0 | xargs -0 sed -i -E "$expr" 2>/dev/null || true
+  fi
+}
+
+echo "[snapshot] rewrite hosts and internal URLs"
+apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
+apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
+apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
+apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
+apply_sed 's#remote add kalinamall#remote add origin#g'
+apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
+apply_sed 's#local name=kalinamall#local name=origin#g'
+
+cat >"$WORK/.gitignore" <<'EOF'
+.DS_Store
+CalculatorApp/
+.env
+.env.*
+ssh-monitor.conf
+ssh-monitor-*.tar.gz
+rutube-download.py
+.ytdl-archive.txt
+EOF
+
+cat >"$WORK/ssh-monitor.conf.example" <<'EOF'
+# Example configuration — copy to /etc/ssh-monitor.conf and chmod 600.
+# Never commit real tokens or passwords to git.
+
+TELEGRAM_BOT_TOKEN="YOUR_TELEGRAM_BOT_TOKEN"
+TELEGRAM_CHAT_ID="YOUR_TELEGRAM_CHAT_ID"
+
+# At least one notification channel (telegram or email) is required.
+NOTIFY_ORDER=""
+
+# Security Alert Center (optional)
+USE_SAC="off"
+SAC_URL="https://sac.example.com/api/v1/events"
+# SAC_API_KEY="your-ingest-api-key"
+
+# SMTP (optional, requires python3)
+MAIL_SMTP_HOST=""
+MAIL_SMTP_PORT="587"
+MAIL_SMTP_USER=""
+MAIL_SMTP_PASSWORD=""
+MAIL_FROM=""
+MAIL_TO=""
+MAIL_SMTP_STARTTLS="1"
+MAIL_SMTP_SSL="0"
+
+# Auto-update script default (override on your server)
+# REPO_URL=https://github.com/PTah/ssh-monitor.git
+EOF
+
+if [[ -f "$WORK/README.md" ]]; then
+  if [[ "$(uname -s)" == Darwin ]]; then
+    sed -i '' '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md"
+    sed -i '' '1s/^# ssh-monitor$/# ssh-monitor\
+\
+Bash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\
+\
+**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\
+\
+# ssh-monitor/' "$WORK/README.md"
+  else
+    sed -i '/^> \*\*Закрытый инстанс Gitea:\*\*/d' "$WORK/README.md"
+    sed -i '1s/^# ssh-monitor$/# ssh-monitor\n\nBash monitor for **SSH**, **sudo**, and **systemd-logind** on Linux: Telegram\/SMTP alerts, optional IP ban (ipset\/iptables), daily report, SAC integration.\n\n**Repository:** https:\/\/github.com\/PTah\/ssh-monitor\n\n# ssh-monitor/' "$WORK/README.md"
+  fi
+
+  python3 - "$WORK/README.md" <<'PY'
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+old = "## Лицензия\n\nПроект распространяется по лицензии **MIT** — см. файл [LICENSE](LICENSE).\n"
+new = """## Topics (GitHub)
+
+`ssh`, `linux`, `telegram-bot`, `smtp`, `iptables`, `ipset`, `systemd`, `security`, `monitoring`, `openssh`
+
+## License
+
+MIT — see [LICENSE](LICENSE). Copyright (c) 2026 Andrey "PapaTramp" Lutsenko.
+
+<details>
+<summary><strong>English summary</strong></summary>
+
+Single-file Bash agent parsing journalctl, notification chain, brute-force IP blocking, heartbeat, optional Prometheus textfile and Security Alert Center ingest via sac-client.sh.
+
+</details>
+"""
+if old not in text:
+    raise SystemExit("README footer block not found; update push-github-snapshot.sh")
+path.write_text(text.replace(old, new), encoding="utf-8")
+PY
+fi
+
+if [[ -f "$WORK/LICENSE" ]]; then
+  if [[ "$(uname -s)" == Darwin ]]; then
+    sed -i '' 's/Copyright \(c\) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
+  else
+    sed -i 's/Copyright (c) 2026 PTah/Copyright (c) 2026 Andrey "PapaTramp" Lutsenko/' "$WORK/LICENSE"
+  fi
+fi
+
+echo "[snapshot] secret scan"
+if grep -R -E 'AAE[a-zA-Z0-9_-]{30,}|sac_[A-Za-z0-9]{20,}|[0-9]{8,}:[A-Za-z0-9_-]{30,}' "$WORK" 2>/dev/null; then
+  echo "  BLOCKED: possible secrets in snapshot tree"
+  exit 1
+fi
+
+echo "[snapshot] git commit in temp repo"
+cd "$WORK"
+git init -q
+git checkout -q -b main
+git add -A
+git -c user.name="Andrey Lutsenko" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
+
+echo "[snapshot] push github main (force snapshot)"
+git remote add github "$(git -C "$ROOT" remote get-url github)"
+git push github main --force
+
+echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"