Run keepalived notification scripts as domjudge user (#140)

meisterT · DOMjudge team · web-flow · commit f8d19ffd5cc5 · 2024-05-06T21:58:55.000+02:00
This both prevents/fixes some security alerts and also makes
sure that the files that the alerting script copies are the
right ones.

Co-authored-by: DOMjudge team &lt;team@domjudge.org&gt;
diff --git a/provision-contest/ansible/roles/keepalived/templates/keepalived.conf.j2 b/provision-contest/ansible/roles/keepalived/templates/keepalived.conf.j2
@@ -11,6 +11,7 @@ vrrp_instance lb_ipv4 {
 		auth_type PASS
 		auth_pass {{REPLICATION_PASSWORD}}
 	}
+	script_user domjudge domjudge
 	notify_backup /home/domjudge/bin/trigger_alert.sh
 	notify_master /home/domjudge/bin/trigger_alert.sh
 	notify_fault /home/domjudge/bin/trigger_alert.sh

Original file line number	Diff line number	Diff line change
`@@ -11,6 +11,7 @@ vrrp_instance lb_ipv4 {`
`11`	`11`	`auth_type PASS`
`12`	`12`	`auth_pass {{REPLICATION_PASSWORD}}`
`13`	`13`	`}`
	`14`	`+ script_user domjudge domjudge`
`14`	`15`	`notify_backup /home/domjudge/bin/trigger_alert.sh`
`15`	`16`	`notify_master /home/domjudge/bin/trigger_alert.sh`
`16`	`17`	`notify_fault /home/domjudge/bin/trigger_alert.sh`