dongarandClaude Opus 5.5
5ab0861e8e
The check went to the host on stdin, and the first docker compose exec read the rest of it: the memory and firewall checks never ran, and it passed. It is now its own file, sent as an argument, and ends with "all checks passed" only when every check has run. Tests fake the host with a docker that reads stdin. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
29 lines
1.4 KiB
Bash
Executable File
29 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Checks the vault and SilverBullet on the agent host; run there as a user with
|
|
# sudo (scripts/agent-host.sh check sends it). Exits 1 if any check fails, and
|
|
# only says "all checks passed" once every one has run.
|
|
set -u
|
|
stack=${STACK:-/opt/stacks/silverbullet}
|
|
fail=0
|
|
ok() { echo "ok: $1"; }
|
|
bad() { echo "FAIL: $1"; fail=1; }
|
|
cd "$stack" || { echo "FAIL: no $stack"; exit 1; }
|
|
[ "$(sudo docker compose ps --status running -q | wc -l)" -ge 1 ] \
|
|
&& ok "SilverBullet is running" || bad "SilverBullet isn't running"
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/)
|
|
case $code in 2??|3??) ok "it answers locally ($code)" ;; *) bad "it answers $code" ;; esac
|
|
probe=.nisse-probe-$$
|
|
sudo docker compose exec -T -u 1000 silverbullet \
|
|
sh -c "touch /vault/infrastructure/$probe && rm /vault/infrastructure/$probe" \
|
|
&& ok "the operator's folders are writable" || bad "the operator's folders aren't writable"
|
|
if sudo docker compose exec -T silverbullet sh -c "touch /vault/memory/$probe" 2>/dev/null; then
|
|
sudo docker compose exec -T silverbullet rm -f "/vault/memory/$probe"
|
|
bad "memory/ is writable from SilverBullet, even as root in it"
|
|
else
|
|
ok "memory/ is read-only to SilverBullet"
|
|
fi
|
|
sudo iptables -S DOCKER-USER | grep -q -- '--comment nisse-firewall' \
|
|
&& ok "the firewall rule is in place" || bad "no firewall rule"
|
|
[ $fail = 0 ] && echo "all checks passed"
|
|
exit $fail
|