154 lines
6.1 KiB
Bash
154 lines
6.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Is this estate coherent? Reports and instructs; never fixes.
|
|
#
|
|
# Takes no subcommand — there is one question to ask.
|
|
# Every check corresponds to something wrong in the estate today.
|
|
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
source ./lib/config.sh
|
|
source ./lib/estate.sh
|
|
load_config
|
|
|
|
WORST=0
|
|
note() { echo " $*"; }
|
|
warn() { echo " WARN $*"; [ "$WORST" -lt 1 ] && WORST=1; return 0; }
|
|
bad() { echo " FAIL $*"; WORST=2; return 0; }
|
|
|
|
echo "estate: $ESTATE target: $TARGET domain: $DOMAIN"
|
|
echo
|
|
|
|
# 1. cert coverage: a wildcard matches exactly one label.
|
|
echo "certs — does the cert cover every name the services serve?"
|
|
issued=$(estate_get "certs.issued" | python3 -c 'import json,sys
|
|
try: print("\n".join(json.load(sys.stdin)))
|
|
except Exception: pass')
|
|
if [ -z "$issued" ]; then
|
|
warn "no certs.issued in the estate file — cannot check coverage."
|
|
else
|
|
while IFS=$'\x1f' read -r name host up kind raw placement peer port lhost; do
|
|
[ -z "$host" ] && continue
|
|
fqdn="${host}.${DOMAIN}"
|
|
# A '*' host stands for "any single label here" — check the deepest
|
|
# name it can produce, which is the one that fails.
|
|
probe="$fqdn"
|
|
case "$host" in \*.*) probe="anyroom.${host#\*.}.${DOMAIN}" ;; esac
|
|
covered=""
|
|
while IFS= read -r san; do
|
|
[ -z "$san" ] && continue
|
|
if san_covers "$probe" "$san"; then covered=1; break; fi
|
|
done <<< "$issued"
|
|
if [ -z "$covered" ]; then
|
|
bad "$name: '$probe' is covered by NO issued SAN"
|
|
note " issued: $(echo "$issued" | tr '\n' ' ')"
|
|
note " a wildcard matches exactly ONE label — reissue with"
|
|
note " -d '*.${host#\*.}.${DOMAIN}' or move the name one level up"
|
|
fi
|
|
done < <(estate_services "$TARGET")
|
|
[ "$WORST" -lt 2 ] && note "every service name is covered."
|
|
fi
|
|
echo
|
|
|
|
# 2. unmatched names: DNS and the cert are wildcard, nginx is exact, so
|
|
# without a :443 default_server the fallback is whichever vhost loads first.
|
|
echo "gateway — is there a deliberate answer for unmatched names?"
|
|
DEFAULT_CONF="${PPL_DIR:-$HOME/wdir/semester/ppl}/gateway/nginx/conf.d/default.conf"
|
|
if [ ! -f "$DEFAULT_CONF" ]; then
|
|
note "ppl not on this machine at $DEFAULT_CONF — skipped."
|
|
elif grep -qE '^\s*listen\s+443.*default_server' "$DEFAULT_CONF"; then
|
|
note "default.conf has a :443 default_server."
|
|
else
|
|
bad "default.conf has NO :443 default_server."
|
|
note " Unmatched names fall through to the first-loaded vhost."
|
|
note " This is a PREREQUISITE for generating any config: adding a"
|
|
note " generated include changes load order, and load order is what"
|
|
note " currently decides the fallback."
|
|
fi
|
|
echo
|
|
|
|
# 3. a rule allowing a port nothing listens on is dead config; a service no
|
|
# compose file declares is undocumented state. Needs both halves to see.
|
|
echo "firewall — rules against listeners"
|
|
estate_get "firewall" | python3 -c '
|
|
import json,sys
|
|
try: fw = json.load(sys.stdin)
|
|
except Exception: fw = []
|
|
for r in fw:
|
|
n = r.get("note")
|
|
print(" %-6s %-5s %s" % (r["port"], r.get("proto","tcp"), r.get("desc","")))
|
|
if n: print(" UNRESOLVED: " + n)
|
|
'
|
|
note "listener side: unknown until captured (ss -ltnp over ssh $HOST)."
|
|
# Ask the structure, not the prose: the condition is "does a peer still lack a
|
|
# public key", not "is there a _status string". _status is ALWAYS non-empty —
|
|
# capture rewrites it to "CAPTURED ..." — so testing it for emptiness pinned
|
|
# this warning on permanently, including after the capture it asks for.
|
|
uncaptured=$(estate_get "vpn.overlays.estate.peers" 2>/dev/null | python3 -c '
|
|
import json, sys
|
|
try:
|
|
peers = json.load(sys.stdin)
|
|
except Exception:
|
|
sys.exit(0)
|
|
print(" ".join(n for n, p in peers.items() if not p.get("public_key")))
|
|
' 2>/dev/null)
|
|
if [ -n "$uncaptured" ]; then
|
|
warn "overlay: public keys not captured for:$uncaptured — see 'make vpn check'"
|
|
note " 10.8.0.1 carries the registry and woodpecker gRPC;"
|
|
note " 10.8.0.2 backs langfuse. Nothing in the tree creates the"
|
|
note " interface — a fresh box cannot start the gateway compose."
|
|
note " capture with: sudo wg show | make vpn capture --write"
|
|
else
|
|
note "overlay: $(estate_get 'vpn._status')"
|
|
fi
|
|
note "overlay detail: make vpn show estate"
|
|
echo
|
|
|
|
# 4. ssh aliases, never hostnames: a bare hostname offers every agent key and
|
|
# trips MaxAuthTries before reaching the right one.
|
|
echo "ssh — aliases, never hostnames"
|
|
for var in HOST HOST_ADMIN; do
|
|
val="${!var:-}"
|
|
if [ -z "$val" ]; then
|
|
warn "$var is unset."
|
|
elif [[ "$val" == *.* ]]; then
|
|
bad "$var='$val' looks like a hostname, not a ~/.ssh/config alias."
|
|
note " A bare hostname trips MaxAuthTries before reaching the key."
|
|
elif [ -f "$HOME/.ssh/config" ] && grep -qiE "^\s*Host\s+.*\b${val}\b" "$HOME/.ssh/config"; then
|
|
note "$var=$val — Host block present."
|
|
else
|
|
warn "$var='$val' has no matching Host block in ~/.ssh/config."
|
|
fi
|
|
done
|
|
for f in "$HOME/wdir/semester/ppl/ctrl/.env"; do
|
|
[ -f "$f" ] || continue
|
|
if grep -qE '^SERVER=.*\.' "$f"; then
|
|
warn "$f sets SERVER to a hostname, not an alias — every ppl script inherits it."
|
|
fi
|
|
done
|
|
echo
|
|
|
|
# ── 5. toolchain ───────────────────────────────────────────────────────────
|
|
echo "toolchain"
|
|
for t in python3 "$TOFU_BIN" aws gcloud ssh rsync wg; do
|
|
if command -v "$t" >/dev/null 2>&1; then
|
|
note "$(printf '%-8s' "$t") present"
|
|
else
|
|
note "$(printf '%-8s' "$t") MISSING — $(case $t in
|
|
tofu) echo 'blocks: estate plan/apply; terraform works identically' ;;
|
|
wg) echo 'blocks: vpn keygen and the overlay checks' ;;
|
|
aws) echo 'blocks: the control-plane inventory, dns on route53' ;;
|
|
gcloud) echo 'blocks: the gcp estate' ;;
|
|
*) echo 'blocks: most things' ;;
|
|
esac)"
|
|
fi
|
|
done
|
|
echo
|
|
|
|
case "$WORST" in
|
|
0) echo "OK" ;;
|
|
1) echo "OK, with warnings" ;;
|
|
2) echo "PROBLEMS FOUND — see FAIL lines above" ;;
|
|
esac
|
|
exit 0
|