Issue #108 and issue #206 - nut-upsd enhancements (#227)

Author: instantlinux

README.md

@@ -121,5 +121,6 @@ Thank you to the following contributors!
 * [Devin Bayer](https://github.com/akvadrako)
 * [Daniel Muller](https://github.com/DanielMuller)
 * [Brian Hechinger](https://github.com/bhechinger)
+* [David Powers](https://github.com/dapowers87)
 
 Contents created 2017-25 under [Apache 2.0 License](https://www.apache.org/licenses/LICENSE-2.0) by Rich Braun.

images/nut-upsd/Dockerfile

@@ -8,13 +8,16 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \
     org.label-schema.vcs-ref=$VCS_REF \
     org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools
 ARG NUT_VERSION=2.8.3-r2
-ENV API_USER=upsmon \
+ENV ACTIONS= \
+    API_USER=upsmon \
     API_PASSWORD= \
     DESCRIPTION=UPS \
     DRIVER=usbhid-ups \
     GROUP=nut \
+    INSTCMDS= \
     MAXAGE=15 \
     NAME=ups \
+    NOTIFYCMD= \
     NUT_DEBUG_LEVEL=0 \
     NUT_QUIET_INIT_SSL=true \
     NUT_QUIET_INIT_UPSNOTIFY=true \
@@ -34,7 +37,7 @@ RUN echo '@edge http://dl-cdn.alpinelinux.org/alpine/edge/community' \
       >>/etc/apk/repositories && \
     apk add --no-cache dash && \
     apk add --update --no-cache nut@edge=$NUT_VERSION \
-      busybox linux-pam \
+      busybox curl linux-pam \
       libcrypto3 libssl3 \
       libusb musl net-snmp-libs util-linux
 

images/nut-upsd/README.md

@@ -38,13 +38,16 @@ These variables can be passed to the image from kubernetes.yaml or docker-compos
 
 Variable | Default | Description |
 -------- | ------- | ----------- |
+ACTIONS | | One or more user actions allowed (`set`, `fsd`)
 API_USER | upsmon| API user
 API_PASSWORD | | API password, if not using secret
 DESCRIPTION | UPS | user-assigned description
 DRIVER | usbhid-ups | driver (see [compatibility list](http://networkupstools.org/stable-hcl.html))
 GROUP | nut | local group
+INSTCMDS | | `all` or list of allowed commands, see [cmdvartab](https://github.com/networkupstools/nut/blob/master/data/cmdvartab) `CMDDESC` values
 MAXAGE | 15 | seconds before declaring driver non-responsive
 NAME | ups | user-assigned config name
+NOTIFYCMD | | full path of script to run upon notification
 NUT_DEBUG_LEVEL | 0 | verbosity of debug messages
 NUT_QUIET_INIT_SSL | true | inhibit superfluous startup warning
 NUT_QUIET_INIT_UPSNOTIFY | true | inhibit superfluous startup warning
@@ -59,6 +62,8 @@ USER | nut | local user
 VENDORID | | vendor ID for ups.conf
 ### Notes
 
+To define a notify script, volume-mount it via your docker-compose file under /usr/local/bin and set the NOTIFYCMD environment variable. (*Don't* mount any executable scripts under /etc/nut, put them under /usr/local).
+
 If you need a driver other than `usbhid-ups`, the full list of supported drivers can be listed as follows:
 ```
 docker run --rm --entrypoint /bin/ls instantlinux/nut-upsd /usr/lib/nut
@@ -121,9 +126,16 @@ udevadm control --reload-rules && udevadm trigger
 
 When starting up under Debian trixie, an out-of-memory error can be prevented by setting the nofile ulimit to a smaller value than system default: see [issue #1672](https://github.com/networkupstools/nut/issues/1672). The default is set here to 2048.
 
+If you see this error message on startup:
+```
+Unable to use old-style MONITOR line without a username
+Convert it and add a username to upsd.users - see the documentation
+```
+the most likely cause is a missing or empty secret (`nut-upsd-password`).
+
 ### Secrets
 
-If the API user needs a password, you have two ways to specify it: pass the value itself as environment variable API_PASSWORD, or define a Docker secret as follows:
+If the API user needs a password, you have two ways to specify it: pass the value itself as environment variable API_PASSWORD (which isn't secure), or define a Docker secret as follows:
 
 | Secret | Description |
 | ------ | ----------- |

images/nut-upsd/entrypoint.sh

@@ -47,8 +47,13 @@ EOF
 [$API_USER]
         password = $API_PASSWORD
         upsmon $SERVER
-        instcmds = ALL
 EOF
+    for ACTION in ${ACTIONS//,/ }; do
+      echo "        actions = $ACTION" >> /etc/nut/upsd.users
+    done
+    for CMD in ${INSTCMDS//,/ }; do
+      echo "        instcmds = $CMD" >> /etc/nut/upsd.users
+    done
   fi
   if [ -e /etc/nut/local/upsmon.conf ]; then
     cp /etc/nut/local/upsmon.conf /etc/nut/upsmon.conf
@@ -57,6 +62,7 @@ EOF
 MONITOR $NAME@localhost 1 $API_USER $API_PASSWORD $SERVER
 RUN_AS_USER $USER
 EOF
+    [ -z "$NOTIFYCMD" ] || echo "NOTIFYCMD \"$NOTIFYCMD\"" >> /etc/nut/upsmon.conf
   fi
   touch /etc/nut/.setup
 fi

images/nut-upsd/helm/Chart.yaml

@@ -6,7 +6,7 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/networkupstools/nut
 type: application
-version: 0.1.9
+version: 0.1.10
 appVersion: "2.8.3-r2"
 dependencies:
 - name: chartlib

images/nut-upsd/helm/templates/app.yaml

@@ -1,3 +1,5 @@
+{{- include "chartlib.configmap" . }}
+---
 {{- include "chartlib.deployment" . }}
 ---
 {{- include "chartlib.hpa" . }}

images/nut-upsd/helm/values.yaml

@@ -1,8 +1,11 @@
 # Default values for nut-upsd.
 deployment:
   env:
+    actions:
     driver: usbhid-ups
+    instcmds: 
     maxage: 15
+    notifycmd: 
     nut_debug_level: 0
     serial: mustbeset
   securityContext:
@@ -20,13 +23,25 @@ volumeMounts:
 # TODO make this work with pod security policies instead of securityContext
 # - name: usb
 #   mountpath: /dev/ttyUSB0
+
+# To define a notify script, add this in your value overrides, set
+#    configmap.enabled, and add script under configmap.data.notify
+# - name: notifycmd
+#   mountPath: /usr/local/bin/notify
+#   readOnly: true
+#   subPath: notify
 - name: secret
   mountPath: /run/secrets/nut-upsd-password
   readOnly: true
   subPath: nut-upsd-password
 volumes:
 # - name: usb
 #   hostPath: { path: /dev/ttyUSB0 }
+
+# - name: notifycmd
+#   configMap:
+#     name: nut-upsd
+#     defaultMode: 0555
 - name: secret
   secret:
     secretName: nut-upsd-password
@@ -50,3 +65,11 @@ service:
     targetPort: 3493
 autoscaling:
   enabled: false
+
+configmap:
+  enabled: false
+  name: nut-upsd
+  data: {}
+# data:
+#   notify: |
+#     your script here