Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+readonly ROOT="$(cd -- "$(dirname -- "$BASH_SOURCE")/../.." && pwd -P)"
+readonly DENY="$ROOT/infrastructure/networking/host-nginx/learn-services-grafana-deny-guard.conf"
+readonly FULL="$ROOT/infrastructure/networking/host-nginx/learn-services-observability.conf"
+
+fail() {
+  printf 'FAIL: %s\n' "$*" >&2
+  exit 1
+}
+
+[[ -f "$DENY" && ! -L "$DENY" ]] || fail 'deny-guard source is missing'
+[[ -f "$FULL" && ! -L "$FULL" ]] || fail 'full observability source is missing'
+
+python3 - "$DENY" "$FULL" <<'PY'
+import pathlib
+import sys
+
+deny_path, full_path = map(pathlib.Path, sys.argv[1:])
+deny = deny_path.read_text()
+full = full_path.read_text()
+old = "        proxy_pass http://127.0.0.1:1;"
+new = "        proxy_pass http://127.0.0.1:30080;"
+
+if deny.count(old) != 1:
+    raise SystemExit("FAIL: deny guard does not have one closed Grafana upstream")
+if deny.count(new) != 4:
+    raise SystemExit("FAIL: deny guard existing service upstream set changed")
+expected = deny.replace(old, new, 1)
+if full != expected:
+    raise SystemExit("FAIL: full candidate differs from deny guard outside the Grafana upstream")
+if full.count(old) != 0 or full.count(new) != 5:
+    raise SystemExit("FAIL: full candidate Grafana upstream is not exact")
+
+required = (
+    "ssl_reject_handshake on;",
+    "server_name git.learn.hyeonworks.com;",
+    "server_name id.learn.hyeonworks.com;",
+    "server_name storage-admin.learn.hyeonworks.com;",
+    "server_name db-admin.learn.hyeonworks.com;",
+    "server_name grafana.learn.hyeonworks.com;",
+    "location = /metrics {",
+    "allow 192.168.0.0/24;",
+    "allow 100.64.0.0/10;",
+    "deny all;",
+)
+for token in required:
+    if token not in full:
+        raise SystemExit(f"FAIL: full candidate lacks {token}")
+if full.count("location = /metrics {") != 2:
+    raise SystemExit("FAIL: Gitea and Grafana metrics guards are not exact")
+PY
+
+printf 'HOST NGINX OBSERVABILITY SOURCE CONTRACT PASS\n'