sync: auto-sync from HOWARD-HOME at 2026-07-05 19:59:52
Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-05 19:59:52
This commit is contained in:
@@ -1,20 +1,27 @@
|
||||
---
|
||||
name: owncloud
|
||||
description: "Read-only inventory of ACG's ownCloud server (cloud.acghosting.com / 172.16.3.22, ownCloud 10.16 Community) for GPS backup verification: who has an account, per-user storage used + quota + last login, and which GuruRMM endpoints actually run the ownCloud desktop client. Triggers: owncloud, cloud.acghosting, who backs up to owncloud, owncloud usage, owncloud audit."
|
||||
description: "Manage ACG's ownCloud server (cloud.acghosting.com / 172.16.3.22, ownCloud 10.16 Community) via occ over SSH: read-only GPS backup inventory (who has an account, per-user storage + quota + last login, which GuruRMM endpoints run the desktop client) PLUS gated admin writes - user lifecycle, quota, groups, apps/config, maintenance mode, files scan/transfer, trashbin/versions cleanup. Reads run freely; writes require --confirm. Triggers: owncloud, cloud.acghosting, who backs up to owncloud, owncloud usage, owncloud audit, create/disable owncloud user, set owncloud quota, owncloud group, owncloud maintenance mode."
|
||||
---
|
||||
|
||||
# ownCloud Skill
|
||||
|
||||
Read-only client for ACG's live **ownCloud 10.16.0 Community** server
|
||||
(`cloud.acghosting.com`, VM `172.16.3.22`, Rocky Linux 9.6). Answers the GPS
|
||||
backup-audit question: **which customers back up here and how much data do they
|
||||
hold** - and, with `--rmm`, which enrolled machines actually run the ownCloud
|
||||
desktop client. It never writes.
|
||||
Client for ACG's live **ownCloud 10.16.0 Community** server
|
||||
(`cloud.acghosting.com`, VM `172.16.3.22`, Rocky Linux 9.6), driven entirely
|
||||
through the `occ` admin CLI over SSH.
|
||||
|
||||
Two halves:
|
||||
- **Read (GPS audit, ungated):** which customers back up here and how much data
|
||||
they hold - and, with `--rmm`, which enrolled machines actually run the
|
||||
ownCloud desktop client.
|
||||
- **Manage (gated):** user/quota/group lifecycle, apps/config, maintenance mode,
|
||||
filesystem scans, ownership transfer, trashbin/versions cleanup. Every
|
||||
state-changing command **refuses without `--confirm`** (prints the WOULD line,
|
||||
exits 3), mirroring the `b2` / `seafile` fleet convention.
|
||||
|
||||
This skill is one of the backup-verification siblings alongside `seafile`,
|
||||
`b2` (Backblaze) and `datto-workplace`.
|
||||
|
||||
## Running
|
||||
## Running - read (GPS audit)
|
||||
|
||||
```bash
|
||||
OWNCLOUD=".claude/skills/owncloud/scripts/owncloud.py"
|
||||
@@ -27,6 +34,64 @@ py "$OWNCLOUD" audit [--client NAME] [--rmm] [--json]
|
||||
Add `--json` to `users` / `usage` / `audit` for machine-readable output.
|
||||
`--host` overrides the server IP (default `172.16.3.22`).
|
||||
|
||||
## Running - manage (writes gated behind `--confirm`)
|
||||
|
||||
```bash
|
||||
# users
|
||||
py "$OWNCLOUD" user-add jdoe --display-name "J Doe" --email j@x.com -g Clients --gen-password --confirm
|
||||
py "$OWNCLOUD" user-disable jdoe --confirm # user-enable to re-enable
|
||||
py "$OWNCLOUD" user-reset-password jdoe --password-env OC_NEW_PW --confirm
|
||||
py "$OWNCLOUD" user-modify jdoe --email new@x.com --confirm
|
||||
py "$OWNCLOUD" user-delete jdoe --confirm # DELETES the user AND all their data
|
||||
|
||||
# quota (quota <uid> reads it; value like '5 GB', 'none' = unlimited)
|
||||
py "$OWNCLOUD" quota jdoe
|
||||
py "$OWNCLOUD" quota-set jdoe "50 GB" --confirm # quota-reset -> back to default
|
||||
|
||||
# groups (groups / group-members / user-groups are read-only)
|
||||
py "$OWNCLOUD" groups
|
||||
py "$OWNCLOUD" group-add Clients --confirm
|
||||
py "$OWNCLOUD" group-add-member Clients -m jdoe -m asmith --confirm
|
||||
py "$OWNCLOUD" group-remove-member Clients -m jdoe --confirm
|
||||
py "$OWNCLOUD" group-delete Clients --confirm
|
||||
|
||||
# shares (read-only - occ cannot create shares; see Notes)
|
||||
py "$OWNCLOUD" shares [--user jdoe]
|
||||
|
||||
# server / apps / config
|
||||
py "$OWNCLOUD" maintenance status|on|off [--confirm] # on/off need --confirm
|
||||
py "$OWNCLOUD" apps
|
||||
py "$OWNCLOUD" app-enable|app-disable <app> --confirm
|
||||
py "$OWNCLOUD" config-get [name] # no name -> dump all system config
|
||||
py "$OWNCLOUD" config-set <name> --value V [--type string|integer|double|boolean|json] --confirm
|
||||
|
||||
# files admin
|
||||
py "$OWNCLOUD" files-scan (--user jdoe | --all) [--path sub/dir] --confirm
|
||||
py "$OWNCLOUD" transfer-ownership <src> <dst> [--path folder] --confirm
|
||||
py "$OWNCLOUD" trashbin-cleanup (--user jdoe ... | --all-users) --confirm
|
||||
py "$OWNCLOUD" versions-cleanup (--user jdoe ... | --all-users) --confirm
|
||||
```
|
||||
|
||||
### Passwords + the credential rule
|
||||
|
||||
`user-add` / `user-reset-password` take the password one of three ways:
|
||||
`--gen-password` (generates a strong one, prints it **once**), `--password-env VAR`
|
||||
(reads it from that env var - preferred, keeps it out of shell history), or a
|
||||
literal `--password` (discouraged: lands in history + `ps`). On the server the
|
||||
value is passed via occ's own `OC_PASS` + `--password-from-env`.
|
||||
|
||||
**Any password created or reset here MUST be stored in the SOPS vault** (house
|
||||
rule) - the command prints a `[CRITICAL]` reminder with the exact `vault.sh`
|
||||
line (suggested path `infrastructure/owncloud-users/<uid>.sops.yaml`).
|
||||
|
||||
### Gating / exit codes
|
||||
|
||||
- write command without `--confirm` -> prints `Would: ...`, **exit 3**, no change.
|
||||
- `trashbin-cleanup` / `versions-cleanup` with **no** `--user` and **no**
|
||||
`--all-users` -> **hard-fail exit 2** (occ treats "no user" as *every* user; a
|
||||
fleet-wide purge must be made explicit with `--all-users`).
|
||||
- invalid uid on `user-add` -> **exit 2**.
|
||||
|
||||
## Access channel
|
||||
|
||||
There is **no ownCloud admin web / OCS account** in the vault, so the channel is
|
||||
@@ -89,6 +154,16 @@ all 350+ agents.
|
||||
so orphans do not appear in `users`/`usage`.
|
||||
- **No OCS/web API:** deeper per-file / sharing queries would need an OCS admin
|
||||
cred we do not have; occ + filecache cover the audit needs.
|
||||
- **Shares are read-only here:** occ on this version exposes no share create/list
|
||||
(only `sharing:cleanup-remote-storages`), so `shares` reads straight from the
|
||||
`oc_share` DB table (joined to `oc_filecache` for the real path). Creating a
|
||||
share would need the OCS API / an admin web cred we do not have.
|
||||
- **occ command surface was verified live** against this exact 10.16 box (`occ
|
||||
list` / `occ help <cmd>`) before wiring the writes - flags differ by version.
|
||||
Notable ones used: `user:modify <uid> displayname|email`, quota via
|
||||
`user:setting <uid> files quota --value=`, passwords via `--password-from-env`,
|
||||
`files:transfer-ownership -s`, `trashbin:cleanup`/`versions:cleanup` (no user
|
||||
arg = ALL users, hence the `--all-users` guard).
|
||||
- Shared plumbing (repo-root resolve, vault read, GuruRMM client + endpoint
|
||||
detection) lives in `.claude/scripts/backup_common.py`, used by all the
|
||||
server-backup skills. Detection patterns must be precise per backend - this
|
||||
|
||||
Reference in New Issue
Block a user