4d9e77c968
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN open to Anywhere, tag the base role so firewall can be scoped, and schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage false so a converge cannot enable UFW there. T02 still needs operator approval for make converge-firewall HOST=Railiance01.
59 lines
1.6 KiB
Bash
Executable file
59 lines
1.6 KiB
Bash
Executable file
#!/bin/bash
|
|
# Recurring declared-vs-live check. Installed by the goss role.
|
|
# Writes TAP + a one-line status; notifies only on pass/fail transitions.
|
|
set -euo pipefail
|
|
|
|
GOSS_BIN="${GOSS_BIN:-/usr/local/bin/goss}"
|
|
GOSS_FILE="${GOSS_FILE:-/etc/goss/baseline.yaml}"
|
|
STATE_DIR="${STATE_DIR:-/var/lib/railiance/goss}"
|
|
NOTIFY_URL="${RAILIANCE_GOSS_NOTIFY_URL:-}"
|
|
HOST="$(hostname -s)"
|
|
|
|
mkdir -p "${STATE_DIR}"
|
|
chmod 0755 "${STATE_DIR}"
|
|
|
|
if [[ ! -x "${GOSS_BIN}" || ! -f "${GOSS_FILE}" ]]; then
|
|
echo "skip: goss binary or baseline missing" | tee "${STATE_DIR}/last.status"
|
|
exit 0
|
|
fi
|
|
|
|
set +e
|
|
"${GOSS_BIN}" -g "${GOSS_FILE}" validate --format tap > "${STATE_DIR}/last.tap"
|
|
rc=$?
|
|
set -e
|
|
|
|
if [[ "${rc}" -eq 0 ]]; then
|
|
result=pass
|
|
else
|
|
result=fail
|
|
fi
|
|
|
|
printf 'result=%s host=%s ts=%s rc=%s\n' \
|
|
"${result}" "${HOST}" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${rc}" \
|
|
> "${STATE_DIR}/last.status"
|
|
|
|
prev=""
|
|
if [[ -f "${STATE_DIR}/last.result" ]]; then
|
|
prev="$(cat "${STATE_DIR}/last.result")"
|
|
fi
|
|
echo "${result}" > "${STATE_DIR}/last.result"
|
|
|
|
logger -t railiance-goss "baseline ${result} on ${HOST} (rc=${rc})"
|
|
|
|
if [[ "${result}" == "fail" ]]; then
|
|
touch "${STATE_DIR}/FAILED"
|
|
else
|
|
rm -f "${STATE_DIR}/FAILED"
|
|
fi
|
|
|
|
if [[ -n "${NOTIFY_URL}" && "${result}" != "${prev}" ]]; then
|
|
payload=$(printf \
|
|
'{"summary":"Goss baseline %s on %s","event_type":"note","author":"railiance-goss-timer"}' \
|
|
"${result}" "${HOST}")
|
|
curl -sS -m 10 -X POST "${NOTIFY_URL}" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "${payload}" >/dev/null || \
|
|
logger -t railiance-goss "notify failed for ${HOST} ${result}"
|
|
fi
|
|
|
|
exit "${rc}"
|