69 lines
3.1 KiB
Bash
Executable File
69 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Remove the lab's host layer from test-server. Packages stay.
|
|
#
|
|
# sudo bash deploy/lab/host/teardown-host.sh
|
|
#
|
|
# The host's sudo asks for a password, so run this in a terminal — not over a
|
|
# non-interactive ssh, where sudo fails silently into an empty result.
|
|
#
|
|
# ★ Certificates are BACKED UP, NOT DELETED. Let's Encrypt allows 5 duplicate
|
|
# certificates per week for the same name set, and this lab's names resolve to
|
|
# a tailnet address (100.64.0.0/10, not routable from the public internet), so
|
|
# an HTTP-01 reissue cannot be validated from here. Deleting the files turns a
|
|
# free restore into a problem that has to be solved first. Restoring is:
|
|
#
|
|
# sudo tar xzf ~/letsencrypt-backup-<stamp>.tgz -C /etc
|
|
set -u
|
|
|
|
STAMP="$(date +%Y%m%d-%H%M%S)"
|
|
HOME_DIR="${SUDO_USER:+/home/$SUDO_USER}"
|
|
HOME_DIR="${HOME_DIR:-$HOME}"
|
|
|
|
echo "===== 1) 인증서 백업 (지우지 않는다) ====="
|
|
if [ -d /etc/letsencrypt ]; then
|
|
out="$HOME_DIR/letsencrypt-backup-$STAMP.tgz"
|
|
tar czf "$out" -C /etc letsencrypt
|
|
chown "${SUDO_USER:-root}" "$out"
|
|
echo "백업: $out ($(du -h "$out" | cut -f1))"
|
|
echo "현재 인증서:"
|
|
certbot certificates 2>/dev/null | grep -E "Certificate Name|Domains|Expiry Date" || true
|
|
echo "검증 방식 (재발급이 되는지의 답):"
|
|
grep -H authenticator /etc/letsencrypt/renewal/*.conf 2>/dev/null || echo " (renewal 설정 없음)"
|
|
else
|
|
echo "/etc/letsencrypt 없음 — 건너뜀"
|
|
fi
|
|
echo
|
|
|
|
echo "===== 2) nginx 실험대 설정 제거 ====="
|
|
if [ -f /etc/nginx/sites-available/keycloak-lab ]; then
|
|
cp /etc/nginx/sites-available/keycloak-lab "$HOME_DIR/keycloak-lab.nginx.$STAMP.bak"
|
|
echo "백업: $HOME_DIR/keycloak-lab.nginx.$STAMP.bak"
|
|
fi
|
|
rm -fv /etc/nginx/sites-enabled/keycloak-lab
|
|
rm -fv /etc/nginx/sites-available/keycloak-lab
|
|
systemctl disable --now nginx
|
|
echo
|
|
|
|
echo "===== 3) certbot 갱신 타이머 정지 ====="
|
|
# 인증서 파일은 남기지만, 갱신 시도는 멈춘다. 지금 DNS 로는 HTTP-01 검증이
|
|
# 실패하고, 실패가 로그에만 쌓이면서 「왜 안 되지」의 원인이 된다.
|
|
systemctl disable --now certbot-renew.timer 2>/dev/null || true
|
|
echo
|
|
|
|
echo "===== 4) 엣지 DNAT (있으면) ====="
|
|
systemctl disable --now lab-edge-dnat.service 2>/dev/null || true
|
|
rm -fv /etc/systemd/system/lab-edge-dnat.service /etc/nftables.d/lab-edge-dnat.nft
|
|
systemctl daemon-reload
|
|
nft delete table ip lab_edge 2>/dev/null || true
|
|
echo
|
|
|
|
echo "===== 5) 확인 ====="
|
|
echo "-- nginx: $(systemctl is-active nginx) / $(systemctl is-enabled nginx 2>&1)"
|
|
echo "-- certbot timer: $(systemctl is-active certbot-renew.timer 2>&1) / $(systemctl is-enabled certbot-renew.timer 2>&1)"
|
|
echo "-- 80/443 리스너:"; ss -tlnp | grep -E ':(80|443) ' || echo " (없음 — 정상)"
|
|
echo "-- sites-enabled:"; ls -A /etc/nginx/sites-enabled 2>/dev/null || echo " (비었음 — 정상)"
|
|
echo "-- letsencrypt:"; ls /etc/letsencrypt/live 2>/dev/null || echo " (없음)"
|
|
echo "-- libvirt 도메인:"; virsh list --all 2>/dev/null | tail -n +3 | grep -v '^$' || echo " (없음 — 정상)"
|
|
echo
|
|
echo "완료. 패키지(nginx · libvirt · qemu · certbot · kubectl)와 base.qcow2 는 남아 있다."
|