dc9e74ca12
All checks were successful
Check / eval-and-lint (push) Successful in 6m57s
Ten state-mutating sites across seven scripts wrote through a predictable, world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`) before the atomic `sudo mv`. Because the `>` redirect runs as the invoking user (sudo doesn't cover redirects), the shared fixed path is a symlink/ TOCTOU target and collides if two of these run concurrently. Switch each to a per-invocation `mktemp`; the atomic rename into place is unchanged. nomarchy-theme-set already used a temp var for its home-state write — this makes its system-state write consistent and cleans the temp up on failure. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1010 B
Bash
Executable File
37 lines
1010 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
# Configure DNS declaratively for Nomarchy NixOS.
|
|
# Hybrid: updates /etc/nixos/state.json and runs sys-update.
|
|
|
|
STATE_FILE="/etc/nixos/state.json"
|
|
|
|
if [[ -z $1 ]]; then
|
|
dns=$(gum choose --height 6 --header "Select DNS provider" Cloudflare Google DHCP Custom)
|
|
else
|
|
dns=$1
|
|
fi
|
|
|
|
case "$dns" in
|
|
Cloudflare|Google|DHCP)
|
|
tmp=$(mktemp); sudo jq --arg dns "$dns" '.dns = $dns' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
|
|
;;
|
|
|
|
Custom)
|
|
echo "Enter your DNS servers (space-separated, e.g. '192.168.1.1 1.1.1.1'):"
|
|
read -r dns_servers
|
|
|
|
if [[ -z $dns_servers ]]; then
|
|
echo "Error: No DNS servers provided."
|
|
exit 1
|
|
fi
|
|
|
|
# Convert to JSON array safely
|
|
dns_array=$(echo "$dns_servers" | jq -R 'split(" ")')
|
|
tmp=$(mktemp); sudo jq --arg dns "Custom" --argjson servers "$dns_array" '.dns = $dns | .customDns = $servers' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
|
|
;;
|
|
esac
|
|
|
|
echo "DNS configured to $dns. Applying changes..."
|
|
sudo nomarchy-sys-update
|