frontends: switch goprecords upload to unified script with separate token file

Deploy goprecords-upload-client.sh from goprecords/scripts/ instead of the
inline-token template. Token is now stored in /etc/goprecords-upload.token
(mode 600) and the script reads it at runtime. Old goprecords-upload.sh
(token baked in, mode 500) is removed. daily.local entry updated to pass
GOPRECORDS_HOST=<host> as environment variable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2 files changed, 98 insertions, 10 deletions

diff --git a/frontends/Rexfile b/frontends/Rexfile
index 09aa426..5ff2275 100644
--- a/frontends/Rexfile
+++ b/frontends/Rexfile
@@ -195,15 +195,19 @@ task 'goprecords_upload',
         return;
     }
 
-    file '/usr/local/bin/goprecords-upload.sh',
-      content => template(
-        './scripts/goprecords-upload.sh.tpl',
-        goprecords_host  => $short,
-        goprecords_token => $token,
-      ),
-      owner => 'root',
-      group => 'wheel',
-      mode  => '500';
+    file '/etc/goprecords-upload.token',
+      content => "$token\n",
+      owner   => 'root',
+      group   => 'wheel',
+      mode    => '600';
+
+    file '/usr/local/bin/goprecords-upload-client.sh',
+      source => './scripts/goprecords-upload-client.sh',
+      owner  => 'root',
+      group  => 'wheel',
+      mode   => '755';
+
+    file '/usr/local/bin/goprecords-upload.sh', ensure => 'absent';
 
     file '/etc/daily.local',
       ensure => 'present',
@@ -211,7 +215,9 @@ task 'goprecords_upload',
       group  => 'wheel',
       mode   => '644';
 
-    append_if_no_such_line '/etc/daily.local', '/usr/local/bin/goprecords-upload.sh';
+    run q{perl -ni -e 'print unless m{^/usr/local/bin/goprecords-upload\.sh$}' /etc/daily.local};
+
+    append_if_no_such_line '/etc/daily.local', "GOPRECORDS_HOST=${short} /usr/local/bin/goprecords-upload-client.sh";
   };
 
 desc 'Setup rsync';
diff --git a/frontends/scripts/goprecords-upload-client.sh b/frontends/scripts/goprecords-upload-client.sh
new file mode 100755
index 0000000..7e04cd9
--- /dev/null
+++ b/frontends/scripts/goprecords-upload-client.sh
@@ -0,0 +1,82 @@
+#!/bin/sh
+set -e
+GOPRECORDS_BASE_URL="${GOPRECORDS_BASE_URL:-https://goprecords.f3s.buetow.org}"
+GOPRECORDS_HOST="${GOPRECORDS_HOST:?set GOPRECORDS_HOST (e.g. f0, pi0, earth)}"
+PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:${PATH}"
+
+_default_token_file() {
+	if [ "$(id -u)" = "0" ]; then
+		printf '/etc/goprecords-upload.token'
+	else
+		config="${XDG_CONFIG_HOME:-${HOME}/.config}"
+		printf '%s/goprecords-upload-%s/token' "$config" "$GOPRECORDS_HOST"
+	fi
+}
+
+GOPRECORDS_TOKEN_FILE="${GOPRECORDS_TOKEN_FILE:-$(_default_token_file)}"
+
+if ! test -r "$GOPRECORDS_TOKEN_FILE"; then
+	echo "goprecords-upload-client: cannot read $GOPRECORDS_TOKEN_FILE" >&2
+	exit 1
+fi
+TOKEN=$(tr -d '\n\r' <"$GOPRECORDS_TOKEN_FILE")
+
+upload() {
+	kind=$1
+	file=$2
+	if ! test -f "$file"; then
+		echo "goprecords-upload-client: skip $kind (no $file)" >&2
+		return 0
+	fi
+	curl -fsS -X PUT --data-binary "@${file}" \
+		-H "Authorization: Bearer ${TOKEN}" \
+		"${GOPRECORDS_BASE_URL}/upload/${GOPRECORDS_HOST}/${kind}"
+}
+
+_find_records() {
+	for p in \
+		/var/spool/uptimed/records \
+		/var/db/uptimed/records \
+		/usr/local/var/uptimed/records; do
+		if test -f "$p"; then
+			printf '%s' "$p"
+			return 0
+		fi
+	done
+	echo "goprecords-upload-client: no uptimed records file found" >&2
+	exit 1
+}
+
+records_path=$(_find_records)
+
+tmp=$(mktemp)
+trap 'rm -f "$tmp"' 0 INT TERM HUP
+
+upload records "$records_path"
+
+if command -v uprecords >/dev/null 2>&1; then
+	uprecords -a -m 100 >"$tmp"
+	upload txt "$tmp"
+	uprecords -a | grep '^->' >"$tmp" || true
+	if test -s "$tmp"; then
+		upload cur.txt "$tmp"
+	fi
+fi
+
+if test -r /etc/os-release; then
+	upload os.txt /etc/os-release
+elif test -r /var/run/dmesg.boot; then
+	upload os.txt /var/run/dmesg.boot
+else
+	uname -a >"$tmp"
+	upload os.txt "$tmp"
+fi
+
+if test -r /proc/cpuinfo; then
+	upload cpuinfo.txt /proc/cpuinfo
+elif test -r /var/run/dmesg.boot; then
+	upload cpuinfo.txt /var/run/dmesg.boot
+else
+	sysctl hw.model hw.ncpu hw.machine >"$tmp" 2>/dev/null || uname -a >"$tmp"
+	upload cpuinfo.txt "$tmp"
+fi