mariano/soleprint
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

berth updates

Browse Source
This commit is contained in:
buenosairesam
2026-09-16 19:22:16 -03:00
parent b3cf24e750
commit 907b616d1b
8 changed files with 399 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
berth/ctrl/selftest.sh
View File

@@ -195,6 +195,48 @@ check "a roaming peer's port is not the overlay's port" "51820" \
check "the capture warning clears once keys are in" "0" \
"$(bash ./check.sh 2>/dev/null | grep -c 'public keys not captured')"
note "host snapshot + check — rig's check, asked of a remote box"
# Announce-first made mechanical: without --run nothing reaches ssh or disk.
before="$(ls -1 .snapshots 2>/dev/null | wc -l)"
out="$(bash ./host.sh snapshot 2>&1)"
check "snapshot without --run says it ran nothing" "1" "$(grep -c 'and NOT run' <<< "$out")"
check "snapshot without --run writes nothing" "$before" "$(ls -1 .snapshots 2>/dev/null | wc -l)"
# The printed probe IS the sent probe — no second copy to drift from.
check "what is announced is byte-for-byte what is sent" "same" \
"$(diff -q <(sed -n 's/^ | //p; s/^ |$//p' <<< "$out" | sed -n "1,$(wc -l < remote/probe.sh)p") remote/probe.sh >/dev/null && echo same || echo differs)"
check "snapshots are gitignored" "yes" \
"$(cd .. && git check-ignore -q ctrl/.snapshots/x/raw && echo yes || echo no)"
# A snapshot is written to another machine's disk. Environments, compose files
# and logs carry secrets, so the probes must never read them. Comments excluded:
# probe.sh's header names exactly these things in order to forbid them.
check "the probes never read env, compose, or logs" "0" \
"$(grep -hvE '^\s*#' remote/probe.sh remote/probe-admin.sh \
| grep -cE 'docker logs|docker inspect [^-]|docker inspect \$|\.env\b|compose\.ya?ml|printenv|/environ')"
hfix="$(mktemp -d)"
T="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
printf '%s\nfixture\n' "$T" > "$hfix/meta"
printf 'Filesystem 1048576-blocks Used Available Capacity Mounted\n/dev/x 15731 15714 0 100%% /\n' > "$hfix/df"
printf 'Filesystem Inodes IUsed IFree IUse%% Mounted\n/dev/x 100 10 90 10%% /\n' > "$hfix/df_inodes"
printf 'MemTotal: 2000000 kB\nMemAvailable: 1000000 kB\nSwapTotal: 0 kB\nSwapFree: 0 kB\n' > "$hfix/meminfo"
printf 'mongo\trestarting\tRestarting (1) 2s ago\tmongo:6\n' > "$hfix/containers"
printf 'aaaaaaaaaaaa\t/mongo\t99\talways\tjson-file\t<no value>\t/x\n' > "$hfix/container_config"
printf 'TYPE TOTAL ACTIVE SIZE RECLAIMABLE\nImages 3 1 5GB 4GB (80%%)\nBuild Cache 1 0 1GB 1GB\n' > "$hfix/docker_df"
: > "$hfix/journal"; : > "$hfix/du_root"; : > "$hfix/du_home"
hout="$(bash ./host.sh check "$hfix" 2>&1)"
check "a full disk is flagged" "1" "$(grep -c '^ ! / ' <<< "$hout")"
check "a crash-looping container is flagged" "1" "$(grep -c '! mongo .*restarting' <<< "$hout")"
check "an unbounded json log is flagged" "1" "$(grep -c 'NO max-size' <<< "$hout")"
check "reclaimable ≥ deficit → pruning is enough" "1" "$(grep -c 'Pruning is enough' <<< "$hout")"
printf 'TYPE TOTAL ACTIVE SIZE RECLAIMABLE\nImages 3 3 5GB 0B (0%%)\n' > "$hfix/docker_df"
check "reclaimable < deficit → pruning will NOT fix it" "1" \
"$(bash ./host.sh check "$hfix" 2>&1 | grep -c 'Pruning will NOT fix')"
rm -rf "$hfix"
check "no snapshot is exit 1, not a silent pass" "1" \
"$(empty="$(mktemp -d)"; SNAP_ROOT="$empty" bash ./host.sh check >/dev/null 2>&1; echo $?; rmdir "$empty")"
note "every STALE entry has a check here"
# Not "$0": line 15 cd's into this script's directory, so a relative $0 no