patchmon: use fetch_and_deploy_gh_release for SCAP content

ct/paperless-ngx.sh

@@ -165,7 +165,7 @@ function update_script() {
 
       msg_info "Updating Paperless-ngx"
       if ((BRIDGE_UPDATE == 0)); then
-        sed -i 's|^ExecStart=.*|ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
+        sed -i 's|^ExecStart=.*|ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
         grep -q "document_index reindex" /etc/systemd/system/paperless-webserver.service ||
           sed -i '/^ExecStart=/i ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
         $STD systemctl daemon-reload
@@ -207,10 +207,10 @@ function update_script() {
       msg_ok "Backup completed to $BACKUP_DIR"
 
       declare -A PATCHES=(
-        ["paperless-consumer.service"]="ExecStart=uv run --no-sync -- python manage.py document_consumer"
-        ["paperless-scheduler.service"]="ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO"
-        ["paperless-task-queue.service"]="ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO"
-        ["paperless-webserver.service"]="ExecStart=uv run --no-sync -- granian --interface asgi --ws \"paperless.asgi:application\""
+        ["paperless-consumer.service"]="ExecStart=uv run -- python manage.py document_consumer"
+        ["paperless-scheduler.service"]="ExecStart=uv run -- celery --app paperless beat --loglevel INFO"
+        ["paperless-task-queue.service"]="ExecStart=uv run -- celery --app paperless worker --loglevel INFO"
+        ["paperless-webserver.service"]="ExecStart=uv run -- granian --interface asgi --ws \"paperless.asgi:application\""
       )
 
       for svc in "${!PATCHES[@]}"; do

ct/patchmon.sh

@@ -9,7 +9,7 @@ APP="PatchMon"
 var_tags="${var_tags:-monitoring}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-4}"
+var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -30,6 +30,8 @@ function update_script() {
     exit
   fi
 
+  CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
+
   if check_for_gh_release "PatchMon" "PatchMon/PatchMon"; then
     msg_info "Stopping Service"
     systemctl stop patchmon-server

install/paperless-ngx-install.sh

@@ -108,7 +108,7 @@ Requires=redis.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO
+ExecStart=uv run -- celery --app paperless beat --loglevel INFO
 
 [Install]
 WantedBy=multi-user.target
@@ -122,7 +122,7 @@ After=postgresql.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO
+ExecStart=uv run -- celery --app paperless worker --loglevel INFO
 
 [Install]
 WantedBy=multi-user.target
@@ -136,7 +136,7 @@ Requires=redis.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStartPre=/bin/sleep 2
-ExecStart=uv run --no-sync -- python manage.py document_consumer
+ExecStart=uv run -- python manage.py document_consumer
 
 [Install]
 WantedBy=multi-user.target
@@ -152,7 +152,7 @@ Requires=redis.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 #ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar
-ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1

install/patchmon-install.sh

@@ -60,6 +60,7 @@ REDIS_PORT=6379
 # OIDC_ENFORCE_HTTPS=true
 
 AGENT_BINARIES_DIR=/opt/patchmon/agents
+SSG_CONTENT_DIR=/opt/patchmon/ssg-content
 EOF
 msg_ok "Configured PatchMon"
 
@@ -85,6 +86,8 @@ for arch in "${AGENT_NAME[@]}"; do
 done
 msg_ok "Fetched PatchMon agent binaries"
 
+fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
+
 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/patchmon-server.service
 [Unit]