updates

modules/capabilities/workbench/mount-obs.py

@@ -0,0 +1,35 @@
+"""Foreground read-only OBS mount; systemd owns lifecycle and retries."""
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+try:
+    projects = json.loads(subprocess.check_output(
+        ['sops', 'decrypt', '--extract', '["leafcloud"]', '--output-type', 'json', sys.argv[1]],
+        stderr=subprocess.DEVNULL))
+    if not projects:
+        raise ValueError('No projects')
+    env = os.environ.copy()
+    upstreams = []
+    for index, (project, credentials) in enumerate(projects.items()):
+        if not re.fullmatch(r'[A-Za-z0-9_-]+', project):
+            raise ValueError('Invalid project name')
+        remote = f'obs_project_{index}'
+        options = dict(type='s3', provider='Other', region='europe-nl-ams1',
+                       endpoint='https://leafcloud.store', force_path_style='true',
+                       access_key_id=credentials['access_key_id'],
+                       secret_access_key=credentials['secret_access_key'])
+        env.update({f'RCLONE_CONFIG_{remote.upper()}_{key.upper()}': str(value)
+                    for key, value in options.items()})
+        upstreams.append(f'{project}={remote}:')
+    env['RCLONE_CONFIG_OBS_TYPE'] = 'combine'
+    env['RCLONE_CONFIG_OBS_UPSTREAMS'] = ' '.join(upstreams)
+    mount = Path(sys.argv[2])
+    mount.mkdir(parents=True, exist_ok=True)
+    os.execvpe('rclone', ['rclone', 'mount', 'obs:', str(mount), '--config', '/dev/null',
+                        '--read-only', '--vfs-cache-mode', 'off', '--buffer-size', '8M'], env)
+except (subprocess.CalledProcessError, KeyError, ValueError, OSError):
+    raise SystemExit('OBS mount unavailable: check company SOPS provisioning and the machine age key.')