password

.gitea/workflows/build.yml

@@ -16,6 +16,7 @@ jobs:
     env:
       APP_HOME: /home/zaine/master-folder/projects/java_projects/org_backend
       SERVICE_NAME: org-backend.service
+      SUDO_PASSWORD: ${{ secrets.SUDO_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4

scripts/deploy-systemd.sh

@@ -12,6 +12,14 @@ APP_JAR="${APP_TARGET_DIR}/org-backend.jar"
 SOURCE_SERVICE="${SOURCE_DIR}/misc/${SERVICE_NAME}"
 SYSTEMD_SERVICE="/etc/systemd/system/${SERVICE_NAME}"
 
+run_sudo() {
+  if [[ -n "${SUDO_PASSWORD:-}" ]]; then
+    printf '%s\n' "${SUDO_PASSWORD}" | sudo -S -p '' "$@"
+  else
+    sudo -n "$@"
+  fi
+}
+
 if [[ ! -f "${SOURCE_JAR}" ]]; then
   echo "Missing built jar: ${SOURCE_JAR}" >&2
   exit 1
@@ -31,24 +39,24 @@ else
   echo "Built jar is already in place at ${APP_JAR}"
 fi
 
-echo "Checking passwordless sudo access"
-sudo -n true
+echo "Checking sudo access"
+run_sudo true
 
 echo "Installing systemd unit to ${SYSTEMD_SERVICE}"
-sudo -n install -m 0644 "${SOURCE_SERVICE}" "${SYSTEMD_SERVICE}"
+run_sudo install -m 0644 "${SOURCE_SERVICE}" "${SYSTEMD_SERVICE}"
 
 echo "Reloading systemd"
-sudo -n systemctl daemon-reload
+run_sudo systemctl daemon-reload
 
 echo "Enabling ${SERVICE_NAME}"
-sudo -n systemctl enable "${SERVICE_NAME}"
+run_sudo systemctl enable "${SERVICE_NAME}"
 
 echo "Restarting ${SERVICE_NAME}"
-if ! timeout "${SYSTEMCTL_TIMEOUT}" sudo -n systemctl --no-ask-password restart "${SERVICE_NAME}"; then
+if ! timeout "${SYSTEMCTL_TIMEOUT}" bash -c "$(declare -f run_sudo); run_sudo systemctl --no-ask-password restart \"${SERVICE_NAME}\""; then
   echo "Restart did not finish within ${SYSTEMCTL_TIMEOUT}s" >&2
-  sudo -n systemctl --no-pager --full status "${SERVICE_NAME}" || true
+  run_sudo systemctl --no-pager --full status "${SERVICE_NAME}" || true
   exit 1
 fi
 
 echo "Service status"
-sudo -n systemctl --no-pager --full status "${SERVICE_NAME}"
+run_sudo systemctl --no-pager --full status "${SERVICE_NAME}"