feat: install ssh-monitor-watchdog on agent update (2.0.4-SAC)

Co-authored-by: Cursor <cursoragent@cursor.com>

ssh-monitor

@@ -7,7 +7,7 @@ IFS=$'\n\t'
 # ============================================
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
-SSH_MONITOR_VERSION="2.0.3-SAC"
+SSH_MONITOR_VERSION="2.0.4-SAC"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 if [ -f "$SCRIPT_DIR/sac-client.sh" ]; then

update_ssh_monitor.sh

@@ -21,6 +21,7 @@ SUMMARY_CONFIG="—"
 SUMMARY_GIT="—"
 SUMMARY_SERVICE_RESTART="—"
 SUMMARY_UPDATER="—"
+SUMMARY_WATCHDOG="—"
 
 CONFIG_FILE="/etc/ssh-monitor.conf"
 DEPLOY_INSTALL_PATH="/opt/scripts/update_ssh_monitor.sh"
@@ -28,6 +29,9 @@ EXPECTED_HEARTBEAT_INTERVAL_MINUTES=240
 EXPECTED_WATCHDOG_MAX_HEARTBEAT_AGE=$((EXPECTED_HEARTBEAT_INTERVAL_MINUTES * 60 + 3600))
 SAC_SPOOL_DIR_DEFAULT="/var/lib/ssh-monitor/sac-spool"
 SYSTEMD_UNIT_PATH="/etc/systemd/system/ssh-monitor.service"
+LOCAL_WATCHDOG_PATH="/usr/local/bin/ssh-monitor-watchdog"
+WATCHDOG_SERVICE_PATH="/etc/systemd/system/ssh-monitor-watchdog.service"
+WATCHDOG_TIMER_PATH="/etc/systemd/system/ssh-monitor-watchdog.timer"
 
 # === Список переменных, объявленных в скрипте (для логирования при DEBUG=1) ===
 SCRIPT_VARS=("UPDATE_DIR" "SCRIPT_NAME" "REPO_URL" "LOCAL_SCRIPT_PATH" "LOG_FILE" "DEBUG" "REMOTE_SCRIPT_PATH" "LOCAL_CHECKSUM" "REMOTE_CHECKSUM")
@@ -391,6 +395,7 @@ log_update_summary() {
     log_action "конфиг: $SUMMARY_CONFIG"
     log_action "git: $SUMMARY_GIT"
     log_action "updater ($DEPLOY_INSTALL_PATH): $SUMMARY_UPDATER"
+    log_action "watchdog: $SUMMARY_WATCHDOG"
     log_action "перезапуск ssh-monitor.service: $SUMMARY_SERVICE_RESTART"
     log_action "полный лог: $LOG_FILE"
     log_action "==========================="
@@ -720,12 +725,9 @@ deploy_install_systemd() {
     say_step "systemd"
     if [ -f "$SYSTEMD_UNIT_PATH" ]; then
         say_info "Уже существует: $SYSTEMD_UNIT_PATH"
-        return 0
+    elif [ ! -f "$example" ]; then
-    fi
-    if [ ! -f "$example" ]; then
         say_warn "Unit example не найден: $example"
-        return 0
+    else
-    fi
         cp "$example" "$SYSTEMD_UNIT_PATH"
         if command -v systemctl &>/dev/null; then
             systemctl daemon-reload 2>/dev/null || true
@@ -734,6 +736,128 @@ deploy_install_systemd() {
         else
             say_ok "Скопирован $SYSTEMD_UNIT_PATH (systemctl не найден)"
         fi
+    fi
+    ensure_watchdog_installed || true
+}
+
+find_watchdog_remote() {
+    local p="$UPDATE_DIR/$SCRIPT_NAME/ssh-monitor-watchdog"
+    if [ -f "$p" ]; then
+        printf '%s\n' "$p"
+        return 0
+    fi
+    return 1
+}
+
+sync_watchdog_script() {
+    WATCHDOG_CHANGED=0
+    local remote local_sum remote_sum
+    remote=$(find_watchdog_remote) || {
+        SUMMARY_WATCHDOG="скрипт не найден в клоне"
+        log_action "WARNING: ssh-monitor-watchdog не найден в клоне git"
+        return 0
+    }
+
+    remote_sum=$(file_sha256 "$remote")
+    if [ -z "$remote_sum" ]; then
+        SUMMARY_WATCHDOG="ошибка sha256 remote"
+        return 1
+    fi
+
+    if [ -f "$LOCAL_WATCHDOG_PATH" ]; then
+        local_sum=$(file_sha256 "$LOCAL_WATCHDOG_PATH")
+        if [ "$local_sum" = "$remote_sum" ]; then
+            log_action "ssh-monitor-watchdog: checksum совпадает, копирование не требуется"
+            return 0
+        fi
+        log_action "ssh-monitor-watchdog: обновление (sha ${local_sum:0:16}… → ${remote_sum:0:16}…)"
+    else
+        log_action "ssh-monitor-watchdog: локальный файл отсутствует, будет установлен"
+    fi
+
+    if ! cp "$remote" "$LOCAL_WATCHDOG_PATH"; then
+        SUMMARY_WATCHDOG="ошибка копирования"
+        log_action "ERROR: не удалось скопировать ssh-monitor-watchdog → $LOCAL_WATCHDOG_PATH"
+        return 1
+    fi
+    chmod 750 "$LOCAL_WATCHDOG_PATH"
+    WATCHDOG_CHANGED=1
+    SUMMARY_WATCHDOG="скрипт обновлён"
+    if [ "$DEPLOY_MODE" -eq 1 ]; then
+        say_ok "ssh-monitor-watchdog → $LOCAL_WATCHDOG_PATH"
+    fi
+    return 0
+}
+
+install_watchdog_systemd_units() {
+    local svc_example timer_example units_changed=0
+    svc_example="$UPDATE_DIR/$SCRIPT_NAME/ssh-monitor-watchdog.service.example"
+    timer_example="$UPDATE_DIR/$SCRIPT_NAME/ssh-monitor-watchdog.timer.example"
+
+    if [ ! -f "$svc_example" ] || [ ! -f "$timer_example" ]; then
+        log_action "WARNING: watchdog unit examples не найдены в клоне"
+        return 0
+    fi
+
+    if [ ! -f "$WATCHDOG_SERVICE_PATH" ] \
+        || ! cmp -s "$svc_example" "$WATCHDOG_SERVICE_PATH" 2>/dev/null; then
+        cp "$svc_example" "$WATCHDOG_SERVICE_PATH"
+        units_changed=1
+        log_action "watchdog: установлен/обновлён $WATCHDOG_SERVICE_PATH"
+    fi
+
+    if [ ! -f "$WATCHDOG_TIMER_PATH" ] \
+        || ! cmp -s "$timer_example" "$WATCHDOG_TIMER_PATH" 2>/dev/null; then
+        cp "$timer_example" "$WATCHDOG_TIMER_PATH"
+        units_changed=1
+        log_action "watchdog: установлен/обновлён $WATCHDOG_TIMER_PATH"
+    fi
+
+    if [ "$units_changed" -eq 1 ]; then
+        WATCHDOG_CHANGED=1
+    fi
+
+    if ! command -v systemctl &>/dev/null; then
+        log_action "watchdog: systemctl не найден, units только скопированы"
+        return 0
+    fi
+
+    systemctl daemon-reload 2>/dev/null || true
+
+    if systemctl enable ssh-monitor-watchdog.timer 2>/dev/null; then
+        log_action "watchdog: enable ssh-monitor-watchdog.timer"
+    fi
+
+    if systemctl start ssh-monitor-watchdog.timer 2>/dev/null; then
+        log_action "watchdog: start ssh-monitor-watchdog.timer"
+        if [ -z "$SUMMARY_WATCHDOG" ] || [ "$SUMMARY_WATCHDOG" = "—" ]; then
+            SUMMARY_WATCHDOG="timer активен"
+        elif [ "${WATCHDOG_CHANGED:-0}" -eq 1 ]; then
+            SUMMARY_WATCHDOG="${SUMMARY_WATCHDOG}; timer активен"
+        fi
+    else
+        log_action "WARNING: systemctl start ssh-monitor-watchdog.timer не выполнен"
+    fi
+
+    if [ "$DEPLOY_MODE" -eq 1 ] && [ "${WATCHDOG_CHANGED:-0}" -eq 1 ]; then
+        say_ok "watchdog: units + timer (ssh-monitor-watchdog.timer)"
+    fi
+    return 0
+}
+
+ensure_watchdog_installed() {
+    sync_watchdog_script || return 1
+    install_watchdog_systemd_units || return 1
+    if [ -z "$SUMMARY_WATCHDOG" ] || [ "$SUMMARY_WATCHDOG" = "—" ]; then
+        if [ -f "$LOCAL_WATCHDOG_PATH" ] && systemctl is-enabled ssh-monitor-watchdog.timer &>/dev/null; then
+            SUMMARY_WATCHDOG="без изменений (timer enabled)"
+        elif [ -f "$LOCAL_WATCHDOG_PATH" ]; then
+            SUMMARY_WATCHDOG="скрипт на месте, timer настроен"
+        else
+            SUMMARY_WATCHDOG="не установлен"
+        fi
+    fi
+    return 0
 }
 
 deploy_install_self() {
@@ -768,6 +892,8 @@ print_config_variables_help() {
        /usr/local/bin/ssh-monitor --check-sac
        systemctl restart ssh-monitor.service
        systemctl status ssh-monitor.service
+       systemctl status ssh-monitor-watchdog.timer
+       systemctl list-timers | grep ssh-monitor-watchdog
 EOF
 }
 
@@ -929,6 +1055,11 @@ update_script() {
         return 1
     fi
 
+    WATCHDOG_CHANGED=0
+    if ! ensure_watchdog_installed; then
+        log_action "WARNING: установка watchdog завершилась с ошибкой"
+    fi
+
     CONFIG_CHANGED=0
     if ! ensure_ssh_monitor_config_from_example; then
         log_update_summary

version.txt

@@ -1 +1 @@
-2.0.3-SAC
+2.0.4-SAC