57 lines
1.9 KiB
Bash
57 lines
1.9 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -Eeuo pipefail
|
|
|
|
readonly ROOT="$(cd -- "$(dirname -- "$BASH_SOURCE")/../.." && pwd -P)"
|
|
readonly DENY="$ROOT/infrastructure/networking/host-nginx/learn-services-grafana-deny-guard.conf"
|
|
readonly FULL="$ROOT/infrastructure/networking/host-nginx/learn-services-observability.conf"
|
|
|
|
fail() {
|
|
printf 'FAIL: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
[[ -f "$DENY" && ! -L "$DENY" ]] || fail 'deny-guard source is missing'
|
|
[[ -f "$FULL" && ! -L "$FULL" ]] || fail 'full observability source is missing'
|
|
|
|
python3 - "$DENY" "$FULL" <<'PY'
|
|
import pathlib
|
|
import sys
|
|
|
|
deny_path, full_path = map(pathlib.Path, sys.argv[1:])
|
|
deny = deny_path.read_text()
|
|
full = full_path.read_text()
|
|
old = " proxy_pass http://127.0.0.1:1;"
|
|
new = " proxy_pass http://127.0.0.1:30080;"
|
|
|
|
if deny.count(old) != 1:
|
|
raise SystemExit("FAIL: deny guard does not have one closed Grafana upstream")
|
|
if deny.count(new) != 4:
|
|
raise SystemExit("FAIL: deny guard existing service upstream set changed")
|
|
expected = deny.replace(old, new, 1)
|
|
if full != expected:
|
|
raise SystemExit("FAIL: full candidate differs from deny guard outside the Grafana upstream")
|
|
if full.count(old) != 0 or full.count(new) != 5:
|
|
raise SystemExit("FAIL: full candidate Grafana upstream is not exact")
|
|
|
|
required = (
|
|
"ssl_reject_handshake on;",
|
|
"server_name git.learn.hyeonworks.com;",
|
|
"server_name id.learn.hyeonworks.com;",
|
|
"server_name storage-admin.learn.hyeonworks.com;",
|
|
"server_name db-admin.learn.hyeonworks.com;",
|
|
"server_name grafana.learn.hyeonworks.com;",
|
|
"location = /metrics {",
|
|
"allow 192.168.0.0/24;",
|
|
"allow 100.64.0.0/10;",
|
|
"deny all;",
|
|
)
|
|
for token in required:
|
|
if token not in full:
|
|
raise SystemExit(f"FAIL: full candidate lacks {token}")
|
|
if full.count("location = /metrics {") != 2:
|
|
raise SystemExit("FAIL: Gitea and Grafana metrics guards are not exact")
|
|
PY
|
|
|
|
printf 'HOST NGINX OBSERVABILITY SOURCE CONTRACT PASS\n'
|