Wires safe-shutdown-prep.sh into the dashboard so an operator can
prep a node for hardware maintenance from a browser instead of SSH.
New RPC methods (0x20/0x21):
- ShutdownPrepCheck runs `--dry-run` to completion and returns the
full report. Never stops anything, safe to call repeatedly.
- ShutdownPrepExecute starts the real run detached (`systemd-run
--user --scope --collect`), placing it in a cgroup outside
claw-store.service's own -- the script's own step 6 stops that
service, i.e. the process that would otherwise be running it, so
it has to survive its own parent dying. Returns immediately with
a "started" message; full output lands in
/var/lib/claw-store/shutdown-prep.log for whoever's at the machine
once it's gone dark, since there's no way to stream a live result
past the point the daemon stops itself.
- Execute double-checks confirm_node_name against the peer's own
configured name server-side, on top of the aggregator's own path
match -- defense in depth for a highly consequential action.
Aggregator endpoints (admin-token gated, AuthedCaller::require_admin):
POST /api/v2/node/:name/shutdown-prep/check
POST /api/v2/node/:name/shutdown-prep/execute
Frontend: ShutdownPrepPanel on NodeDetail. Check button always
enabled; the real "stop services" button only unlocks after a ready
check, and additionally requires typing the exact node name to
confirm before it's clickable.
Also fixes a script bug found while testing this against the live
daemon process (not caught in manual interactive-shell testing): the
zpool-detection line parsed raw `mount` output positionally, which
returned the wrong field under the daemon's process context for
reasons that didn't reproduce interactively. Switched to
`df --output=source`, which is stable across both.
Verified end-to-end against tank, architect, and morpheus, including
cross-node targeting (tank's dashboard successfully triggered a
check on morpheus over the fleet RPC layer).
Co-Authored-By: Claude Sonnet 5 <[email protected]>
