From 4a28bc55c0d3c07d08f8bedf5ca62e0a4fbb3aa4 Mon Sep 17 00:00:00 2001
From: Franziska Kunsmann <hi@kunsmann.eu>
Date: Fri, 27 Sep 2024 08:42:58 +0200
Subject: [PATCH] bundles/homeassistant: rework check_homeassistant_update

---
 .../files/check_homeassistant_update          | 72 +++++++++----------
 bundles/homeassistant/items.py                |  2 +-
 nodes/home.hass.toml                          |  2 +-
 3 files changed, 35 insertions(+), 41 deletions(-)

diff --git a/bundles/homeassistant/files/check_homeassistant_update b/bundles/homeassistant/files/check_homeassistant_update
index ff2b0d7..0e6f2e8 100644
--- a/bundles/homeassistant/files/check_homeassistant_update
+++ b/bundles/homeassistant/files/check_homeassistant_update
@@ -2,48 +2,42 @@
 
 from sys import exit
 
-import requests
 from packaging import version
+from requests import get
 
-bearer = "${bearer}"
-domain = "${domain}"
-OK = 0
-WARN = 1
-CRITICAL = 2
-UNKNOWN = 3
-
-status = 3
-message = "Unknown Update Status"
-
-
-domain = "hass.home.kunbox.net"
-
-s = requests.Session()
-s.headers.update({"Content-Type": "application/json"})
+API_TOKEN = "${token}"
+DOMAIN = "${domain}"
 
 try:
-    stable_version = version.parse(
-        s.get("https://version.home-assistant.io/stable.json").json()["homeassistant"][
-            "generic-x86-64"
-        ]
-    )
-    s.headers.update(
-        {"Authorization": f"Bearer {bearer}", "Content-Type": "application/json"}
-    )
-    running_version = version.parse(
-        s.get(f"https://{domain}/api/config").json()["version"]
-    )
-    if running_version == stable_version:
-        status = 0
-        message = f"OK - running version {running_version} equals stable version {stable_version}"
-    elif running_version > stable_version:
-        status = 1
-        message = f"WARNING - stable version {stable_version} is lower than running version {running_version}, check if downgrade is necessary."
-    else:
-        status = 2
-        message = f"CRITICAL - update necessary, running version {running_version} is lower than stable version {stable_version}"
+    r = get("https://version.home-assistant.io/stable.json")
+    r.raise_for_status()
+    stable_version = r.json()["homeassistant"]["generic-x86-64"]
 except Exception as e:
-    message = f"{message}: {repr(e)}"
+    print(f"Could not get stable version information from home-assistant.io: {e!r}")
+    exit(3)
 
-print(message)
-exit(status)
+try:
+    r = get(
+        f"https://{DOMAIN}/api/config",
+        headers={"Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json"},
+    )
+    r.raise_for_status()
+    running_version = r.json()["version"]
+except Exception as e:
+    print(f"Could not get running version information from homeassistant: {e!r}")
+    exit(3)
+
+try:
+    if stable_version > running_version:
+        print(
+            f"There is a newer version available: {stable_version} (currently installed: {running_version})"
+        )
+        exit(2)
+    else:
+        print(
+            f"Currently running version {running_version} matches newest release on home-assistant.io"
+        )
+        exit(0)
+except Exception as e:
+    print(repr(e))
+    exit(3)
diff --git a/bundles/homeassistant/items.py b/bundles/homeassistant/items.py
index 67042d1..92f097b 100644
--- a/bundles/homeassistant/items.py
+++ b/bundles/homeassistant/items.py
@@ -30,7 +30,7 @@ files = {
     '/usr/local/share/icinga/plugins/check_homeassistant_update': {
         'content_type': 'mako',
         'context': {
-            'bearer': repo.vault.decrypt(node.metadata.get('homeassistant/api_secret')),
+            'token': node.metadata.get('homeassistant/api_secret'),
             'domain': node.metadata.get('homeassistant/domain'),
         },
         'mode': '0755',
diff --git a/nodes/home.hass.toml b/nodes/home.hass.toml
index b29dd0e..2c52708 100644
--- a/nodes/home.hass.toml
+++ b/nodes/home.hass.toml
@@ -22,7 +22,7 @@ ram = 2
 
 [metadata.homeassistant]
 domain = 'hass.home.kunbox.net'
-api_secret = 'encrypt$gAAAAABjpyuqXLoilokQW5c0zV8shHcOzN1zkEbS-I6WAAX-xDO_OF33YbjbkpELU2HGBzqiWX40J0hsaEbYJOnCHFk8gJ-Xt0vdqqbQ5vca_TGPNQHZPAS4qZoPTcUhmX_I-0EdT6ukhxejXFYBiYRZikTLjH3lcNM5qnckCm-H9NbRdjLb9hbCDIjbEglHmBl_g08S1_ukvX3dDSCIHIxgXXGsdK_Go1KxPJd8G22FL_MMhCfsTW-6ioIqoHSeSA1NGk3MZHEIM2errckiopKBxoBaROsacO9Uqk1zrrgXOs2NsgiTRtrbV1TNlFVaIX9mZdsUnMGZ'
+api_secret = '!decrypt:encrypt$gAAAAABm9lNg_mNhyzb4S6WRtVRDmQFBnPpoCwyqMnilRrAFUXc-EDvv-nYXPbSIbjTf7ZReTPtqr8k3WrGPqiuqhJ60LVv4A5DMqT5c6hTVr4WbhP4DPEIPgfd5aq6U9_-H9WDyQYHKjnunLJEYtEREzmhTq3XsYeQ05DyE7hfnQ-zVoBb0CsAK7GdhihRTdvhXv2N9M04_rigyBP-roRcUgCqwyHuWJc0IPAyn3R4Mr43ZqgR2fn6dNV_YUVKn9c0nWxIwRnYy6Ff_Te9NoGVmXxkiNUX-90bBLKFiCzrRAtizxrTiQb2SRipaWbgOlV6wbMy2KNux'
 
 [metadata.nginx]
 restrict-to = [