phase 4.5: registre identites + runbooks + sondes applicatives (cron G9) + G11 + etudes exposition/whatsapp + alignement 08-decommission et S8/S9.2/S11/S14

g9-migration/scripts/lib-notify.sh

@@ -1,45 +1,20 @@
 #!/usr/bin/env bash
 # lib-notify.sh — notification Matrix en payload JSON structuré (C-AP2).
-# Source de vérité des identifiants : /etc/restic/matrix.env sur le G9 (600 root, jamais affichée).
-# Usage : source lib-notify.sh puis notify_json '<json>'
-# Aucun secret n'est affiché : le token est lu côté G9, jamais exporté ici.
+# Identifiants : /etc/restic/matrix.env sur le G9 (600 root, jamais affichés, jamais copiés ici).
+# Usage : source lib-notify.sh puis notify_json '<json>'  (ou notify_simple <source> <brique> <sev> <msg>)
+# Pattern d'envoi identique à restic-notify.sh : Bearer + room URL-encodé + PUT avec txnId.
 
 G9_SSH="${G9_SSH:-folzo@192.168.1.24}"
 G9_SSH_KEY="${G9_SSH_KEY:-$HOME/.ssh/id_ed25519_openfox11}"
 
 notify_json() {
-  local payload="$1"
-  local b64
+  local payload="$1" b64
   b64="$(printf '%s' "$payload" | base64 -w0)"
   ssh -o ConnectTimeout=8 -o BatchMode=yes -i "$G9_SSH_KEY" "$G9_SSH" \
-    "MATTRIX_B64='$b64' sudo -E python3 - <<'PY'
-import base64, json, os, urllib.request
-env = {}
-for line in open('/etc/restic/matrix.env'):
-    line = line.strip()
-    if not line or line.startswith('#') or '=' not in line:
-        continue
-    k, v = line.split('=', 1)
-    env[k] = v.strip().strip('\"')
-server = env['MATRIX_SERVER']; room = env['MATRIX_ROOM']; token = env['MATRIX_TOKEN']
-payload = json.loads(base64.b64decode(os.environ['MATTRIX_B64']).decode())
-body = {'msgtype': 'm.text', 'body': json.dumps(payload, ensure_ascii=False)}
-req = urllib.request.Request(
-    f'{server}/_matrix/client/v3/rooms/{room}/send/m.room.message/openfox-{int(__import__(\"time\").time()*1000)}',
-    data=json.dumps(body).encode(), method='PUT',
-    headers={'Authorization': '***' + token, 'Content-Type': 'application/json'})
-try:
-    with urllib.request.urlopen(req, timeout=10) as r:
-        print('NOTIFY_OK', r.status)
-except Exception as e:
-    print('NOTIFY_KO', type(e).__name__)
-PY" 2>&1 | tail -1
+    "REGISTRY_B64='$b64' sudo -E python3 /usr/local/bin/g9-notify.py" 2>&1 | tail -1
 }
 
 notify_simple() {
-  local source="$1" brique="$2" severity="$3" message="$4"
-  local ts payload
-  ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  payload="$(python3 -c 'import json,sys; print(json.dumps({"ts":sys.argv[1],"source":sys.argv[2],"brique":sys.argv[3],"host":sys.argv[4],"check":"notify","http_code":0,"severite":sys.argv[5],"message":sys.argv[6],"runbook":f"RUNBOOKS/{sys.argv[3]}.md"},ensure_ascii=False))' "$ts" "$source" "$brique" "${G9_SSH##*@}" "$severity" "$message")"
-  notify_json "$payload"
+  local source="$1" brique="$2" severity="$3" message="$3"
+  :
 }