dongarandClaude Opus 5.5
bf98445fcb
The operator chose single-space mode: the vault is mounted at /data, with memory/ read-only over it, and there are no accounts or setup wizard; Authelia in the operator's Caddy is the login. SB_NAME forces the mode, so an empty vault can't boot the wizard. SilverBullet's own data folder is gone. check now fails if the wizard could be open. The README says how to make memory/ writable for a while and back. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
34 lines
1.6 KiB
Bash
Executable File
34 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Checks the vault and SilverBullet on the agent host; run there as a user with
|
|
# sudo (scripts/agent-host.sh check sends it). Exits 1 if any check fails, and
|
|
# only says "all checks passed" once every one has run.
|
|
set -u
|
|
stack=${STACK:-/opt/stacks/silverbullet}
|
|
fail=0
|
|
ok() { echo "ok: $1"; }
|
|
bad() { echo "FAIL: $1"; fail=1; }
|
|
cd "$stack" || { echo "FAIL: no $stack"; exit 1; }
|
|
[ "$(sudo docker compose ps --status running -q | wc -l)" -ge 1 ] \
|
|
&& ok "SilverBullet is running" || bad "SilverBullet isn't running"
|
|
if sudo docker compose logs --no-color silverbullet 2>/dev/null | grep -q 'boot mode: single-space'; then
|
|
ok "it serves the vault as one space (no setup wizard)"
|
|
else
|
|
bad "it didn't boot one space: the setup wizard may be open"
|
|
fi
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/)
|
|
case $code in 2??|3??) ok "it answers locally ($code)" ;; *) bad "it answers $code" ;; esac
|
|
probe=.nisse-probe-$$
|
|
sudo docker compose exec -T -u 1000 silverbullet \
|
|
sh -c "touch /data/infrastructure/$probe && rm /data/infrastructure/$probe" \
|
|
&& ok "the operator's folders are writable" || bad "the operator's folders aren't writable"
|
|
if sudo docker compose exec -T silverbullet sh -c "touch /data/memory/$probe" 2>/dev/null; then
|
|
sudo docker compose exec -T silverbullet rm -f "/data/memory/$probe"
|
|
bad "memory/ is writable from SilverBullet, even as root in it"
|
|
else
|
|
ok "memory/ is read-only to SilverBullet"
|
|
fi
|
|
sudo iptables -S DOCKER-USER | grep -q -- '--comment nisse-firewall' \
|
|
&& ok "the firewall rule is in place" || bad "no firewall rule"
|
|
[ $fail = 0 ] && echo "all checks passed"
|
|
exit $fail
|