hermes
8f07c377c0
Addresses the two valid items from the independent review (code/security/infra all
Approved; these were Minor/Needs-Change items).
1. provision.sh left the nginx vhost as a manual "see README" step, which broke the
project's own repeatability requirement (FR-9): a rebuild from scratch would have
served the distro default page instead of Atheos. The vhost is now written by the
script itself, the distro default.conf is removed, and the script ASSERTS the socket
contract (nginx fastcgi_pass == php-fpm pool listen) before Atheos is installed - so
a 502 can only ever mean an nginx/php-fpm problem, never be mistaken for an Atheos one.
2. `free` and `uptime` reported the PVE HOST inside the container (a container that had
restarted seconds earlier claimed "up 2 days"), which is misleading in monitoring and
in the test output.
The review suggested `apk add lxcfs` in the guest. That is NOT the fix - lxcfs is a
host-provided FUSE filesystem, not a guest package, and measurement showed it is
already working correctly here:
/proc/meminfo -> MemTotal: 1048576 kB (our 1024 MB limit)
/proc/uptime -> container seconds
/proc/cpuinfo -> 2 processors
The real cause: on Alpine, `free`/`uptime` are BUSYBOX applets that read via the
sysinfo() SYSCALL, which lxcfs cannot intercept. procps-ng ships binaries that read
the lxcfs-virtualised /proc files instead. Measured on the guest:
procps-ng free -> 1024 MB (correct)
busybox free -> 15701 MB (host)
procps-ng uptime -> up 2 min (correct)
busybox uptime -> up 2 days (host)
So provision.sh now installs procps-ng, and build-and-test.sh reports container-
accurate figures (detecting it via apk rather than a binary-existence probe, since
the busybox applets are plain files too).
Verified after the change: build-and-test 40 passed / 0 failed; socket contract MATCH;
resource line now reads "18MB used of 1024MB, up 2 min".
129 lines
7.1 KiB
Bash
129 lines
7.1 KiB
Bash
#!/bin/sh
|
|
# ==============================================================================
|
|
# build-and-test.sh — captures evidence for every acceptance criterion (AC-1..AC-8)
|
|
# Run ON THE GUEST: ssh root@192.168.178.57 'sh -s' < build-and-test.sh
|
|
# ==============================================================================
|
|
W=/var/www/atheos
|
|
B=$W/workspace/blog
|
|
pass=0; fail=0
|
|
ok() { echo " PASS $1"; pass=$((pass+1)); }
|
|
bad() { echo " FAIL $1"; fail=$((fail+1)); }
|
|
chk() { if [ "$2" = "$3" ]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
|
|
asuser() { su -s /bin/sh atheos -c "$1"; }
|
|
|
|
echo "=============================================================="
|
|
echo "AC-2 Atheos is served by nginx+PHP (not 502/404)"
|
|
echo "=============================================================="
|
|
CODE=$(wget -qO /tmp/idx.html --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
|
|
chk "HTTP status for /" "$CODE" "200"
|
|
if grep -qi '<title>Atheos IDE</title>' /tmp/idx.html 2>/dev/null; then ok "served page is the Atheos IDE"; else bad "served page is not Atheos"; fi
|
|
if grep -qiE 'install|setup' /tmp/idx.html 2>/dev/null; then ok "first-run installer/login markers present"; else bad "no installer markers"; fi
|
|
SOCK=$(sed -n 's/^listen = //p' /etc/php83/php-fpm.d/www.conf | head -1)
|
|
NGX=$(sed -n 's/.*fastcgi_pass unix:\([^;]*\);.*/\1/p' /etc/nginx/http.d/atheos.conf | head -1)
|
|
echo " --- socket contract (I-1):"
|
|
echo " php-fpm listen : $SOCK"
|
|
echo " nginx fastcgi : $NGX"
|
|
chk "socket paths byte-match" "$NGX" "$SOCK"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-3 'blog' is present with files that can be opened"
|
|
echo "=============================================================="
|
|
chk "posts found" "$(ls $B/src/content/*.md 2>/dev/null | wc -l | tr -d ' ')" "20"
|
|
if [ -d "$W/workspace/blog/.git" ]; then ok "it is a git working copy"; else bad "not a git working copy"; fi
|
|
chk "theme present" "$(ls $B/src/themes 2>/dev/null | tr -d ' ')" "cleanblog"
|
|
chk "workspace owner" "$(stat -c '%U' $W/workspace/blog)" "atheos"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-4 An edit persists to disk (as the FPM user)"
|
|
echo "=============================================================="
|
|
asuser "printf 'x\n' > $B/.ac4-probe" >/dev/null 2>&1
|
|
if [ "$(asuser "cat $B/.ac4-probe" 2>/dev/null)" = "x" ]; then ok "write+read back as 'atheos'"; else bad "cannot write as atheos"; fi
|
|
asuser "rm -f $B/.ac4-probe" >/dev/null 2>&1
|
|
for p in config.php data workspace plugins themes; do
|
|
if asuser "test -w $W/$p" 2>/dev/null; then ok "writable: $p"; else bad "NOT writable: $p"; fi
|
|
done
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-5 Remote points at Gitea; the SSH switch is documented"
|
|
echo "=============================================================="
|
|
REMOTE=$(asuser "git -C $B remote get-url origin" 2>/dev/null)
|
|
echo " remote now: $REMOTE"
|
|
case "$REMOTE" in
|
|
*aridgwayweb.com*armistace/blog*) ok "remote targets armistace/blog on Gitea (HTTPS)" ;;
|
|
gitea-blog:armistace/blog*) ok "remote targets armistace/blog via the deploy-key alias" ;;
|
|
*) bad "remote does not target the blog repo" ;;
|
|
esac
|
|
chk "branch" "$(asuser "git -C $B rev-parse --abbrev-ref HEAD" 2>/dev/null)" "master"
|
|
|
|
# Phase 2: once the SSH alias is in use, prove the transport actually authenticates
|
|
case "$REMOTE" in
|
|
gitea-blog:*)
|
|
AUTH=$(asuser 'ssh -o BatchMode=yes -o ConnectTimeout=8 -T gitea-blog 2>&1' | head -1)
|
|
case "$AUTH" in
|
|
*successfully\ authenticated*) ok "deploy key authenticates over SSH" ;;
|
|
*) bad "deploy key does NOT authenticate: $AUTH" ;;
|
|
esac
|
|
;;
|
|
esac
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-6 Survives reboot (services enabled, data intact)"
|
|
echo "=============================================================="
|
|
echo " container uptime: $(cut -d. -f1 /proc/uptime)s (reboot was issued during the test)"
|
|
for s in nginx php-fpm83 sshd; do
|
|
if rc-update show 2>/dev/null | grep -qE "^\s+$s\s+\|\s+default"; then ok "$s enabled at boot"; else bad "$s NOT enabled at boot"; fi
|
|
if rc-service "$s" status >/dev/null 2>&1; then ok "$s running"; else bad "$s not running"; fi
|
|
done
|
|
if [ -S "$SOCK" ]; then ok "fpm socket exists after reboot"; else bad "fpm socket missing"; fi
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-8 SCOPE GUARD: no build toolchain present (must be ABSENT)"
|
|
echo "=============================================================="
|
|
for t in python python3 pelican pip pip3 make; do
|
|
if command -v "$t" >/dev/null 2>&1; then bad "$t IS present - scope violated!"; else ok "$t absent (correct)"; fi
|
|
done
|
|
echo " --- also check no database engine was installed (Atheos needs none):"
|
|
for d in mysqld mariadbd postgres redis-server; do
|
|
if command -v "$d" >/dev/null 2>&1; then bad "$d present - unexpected"; else ok "$d absent (correct)"; fi
|
|
done
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "FR-11 GUARD: agent created NO identity or armistace credential"
|
|
echo "=============================================================="
|
|
chk "git user.name empty" "$(asuser 'git config --get user.name' 2>/dev/null)" ""
|
|
chk "git user.email empty" "$(asuser 'git config --get user.email' 2>/dev/null)" ""
|
|
if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
|
|
chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
|
|
chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"
|
|
chk "ssh config mode" "$(stat -c '%a' /home/atheos/.ssh/config 2>/dev/null)" "600"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "RESOURCES"
|
|
echo "=============================================================="
|
|
echo " rootfs: $(df -hP / | tail -1 | awk '{print $2" total, "$3" used, "$4" avail ("$5")"}')"
|
|
# NOTE: on Alpine, `free`/`uptime` are BUSYBOX applets that use the sysinfo() syscall, which
|
|
# lxcfs cannot intercept - so they report the PVE HOST, not this container. procps-ng (installed
|
|
# by provision.sh) replaces them with binaries that read the lxcfs-virtualised /proc files.
|
|
# Detect via apk, which is the reliable signal (the binaries are plain files either way).
|
|
if apk info -e procps-ng >/dev/null 2>&1; then
|
|
echo " memory: $(/usr/bin/free -m 2>/dev/null | awk 'NR==2{print $3"MB used of "$2"MB"}')"
|
|
echo " uptime: $(/usr/bin/uptime 2>/dev/null | sed 's/.*up /up /;s/,.*//') (container-accurate)"
|
|
else
|
|
echo " memory: (procps-ng NOT installed - busybox free/uptime would report the HOST)"
|
|
fi
|
|
echo " lxcfs virtualises /proc: meminfo=$(grep MemTotal /proc/meminfo | awk '{print $2"kB"}') uptime=$(cut -d. -f1 /proc/uptime)s"
|
|
echo " listening ports: $(netstat -tln 2>/dev/null | awk '/LISTEN/{split($4,a,":"); print a[length(a)]}' | sort -u | tr '\n' ' ')"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
printf 'RESULT: %d passed, %d failed\n' "$pass" "$fail"
|
|
echo "=============================================================="
|
|
[ "$fail" -eq 0 ] || exit 1
|