hermes
a6fb61d0ea
Provisions a LAN-only browser code editor (Atheos) in an Alpine 3.23 LXC on the scotty PVE node, with armistace/blog cloned and ready to edit. Built via the AI-DLC workflow; the full process trail is in aidlc-docs/. Deliverables - scripts/provision.sh rebuild the guest from scratch (re-runnable) - scripts/update-atheos.sh move Atheos to latest upstream and RE-PIN - scripts/build-and-test.sh captures evidence for every acceptance criterion - files/atheos.conf nginx vhost (socket path byte-matches the FPM pool) - files/ssh-config ~atheos/.ssh/config deploy-key alias - RUNBOOK.md operational guide (START AT STEP 1) - docs/security-notes.md credential model + wider-web hardening TODOs - docs/resiliency-notes.md what a non-PoC deployment would need Design decisions - D1 no git identity is configured by the agent; the operator sets it. Git will refuse the first commit until then, which is deliberate (requirement FR-11). - D2 Atheos pinned to commit f90cd18 (build 611) with a verified tarball sha256, plus update-atheos.sh as the deliberate escape hatch. - D3 nginx :80, web root /var/www/atheos, php-fpm over a unix socket. - D6 git auth is a per-repository DEPLOY KEY scoped to armistace/blog, not a personal access token (a PAT's write:repository scope reaches every repo the account can write). Verified on the live guest (40 checks, 0 failures) - AC-2 Atheos served over HTTP 200 by nginx+php-fpm; socket paths byte-match - AC-3 20 posts + themes/cleanblog present; owned by the php-fpm user - AC-4 all five writable paths writable as the service user - AC-5 remote targets armistace/blog; deploy key authenticates over SSH - AC-6 survival proven with a real container restart, marker byte-identical - AC-8 no python/pelican/pip/make and no DB engine - scope boundary enforced - FR-11 git identity is empty; deploy key mode 600 owned by the service user Traps documented in the RUNBOOK (each cost real debugging time) - The Gitea SSH user is `gitea`, NOT `git` (app.ini SSH_USER=gitea). With `git`, sshd answers "Invalid user git" and rejects before reading authorized_keys, which is indistinguishable from a bad key. - The Gitea SSH endpoint is the LAN address (:22 is not forwarded publicly). - `uptime` and `free` report the PVE HOST inside an LXC without lxcfs, so a container that just restarted can claim days of uptime.
129 lines
7.1 KiB
Bash
129 lines
7.1 KiB
Bash
#!/bin/sh
|
|
# ==============================================================================
|
|
# build-and-test.sh — captures evidence for every acceptance criterion (AC-1..AC-8)
|
|
# Run ON THE GUEST: ssh root@192.168.178.57 'sh -s' < build-and-test.sh
|
|
# ==============================================================================
|
|
W=/var/www/atheos
|
|
B=$W/workspace/blog
|
|
pass=0; fail=0
|
|
ok() { echo " PASS $1"; pass=$((pass+1)); }
|
|
bad() { echo " FAIL $1"; fail=$((fail+1)); }
|
|
chk() { if [ "$2" = "$3" ]; then ok "$1 ($2)"; else bad "$1 (got '$2', want '$3')"; fi; }
|
|
asuser() { su -s /bin/sh atheos -c "$1"; }
|
|
|
|
echo "=============================================================="
|
|
echo "AC-2 Atheos is served by nginx+PHP (not 502/404)"
|
|
echo "=============================================================="
|
|
CODE=$(wget -qO /tmp/idx.html --server-response http://127.0.0.1/ 2>&1 | sed -n 's/.*HTTP\/1\.[01] \([0-9]*\).*/\1/p' | head -1)
|
|
chk "HTTP status for /" "$CODE" "200"
|
|
if grep -qi '<title>Atheos IDE</title>' /tmp/idx.html 2>/dev/null; then ok "served page is the Atheos IDE"; else bad "served page is not Atheos"; fi
|
|
if grep -qiE 'install|setup' /tmp/idx.html 2>/dev/null; then ok "first-run installer/login markers present"; else bad "no installer markers"; fi
|
|
SOCK=$(sed -n 's/^listen = //p' /etc/php83/php-fpm.d/www.conf | head -1)
|
|
NGX=$(sed -n 's/.*fastcgi_pass unix:\([^;]*\);.*/\1/p' /etc/nginx/http.d/atheos.conf | head -1)
|
|
echo " --- socket contract (I-1):"
|
|
echo " php-fpm listen : $SOCK"
|
|
echo " nginx fastcgi : $NGX"
|
|
chk "socket paths byte-match" "$NGX" "$SOCK"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-3 'blog' is present with files that can be opened"
|
|
echo "=============================================================="
|
|
chk "posts found" "$(ls $B/src/content/*.md 2>/dev/null | wc -l | tr -d ' ')" "20"
|
|
if [ -d "$W/workspace/blog/.git" ]; then ok "it is a git working copy"; else bad "not a git working copy"; fi
|
|
chk "theme present" "$(ls $B/src/themes 2>/dev/null | tr -d ' ')" "cleanblog"
|
|
chk "workspace owner" "$(stat -c '%U' $W/workspace/blog)" "atheos"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-4 An edit persists to disk (as the FPM user)"
|
|
echo "=============================================================="
|
|
asuser "printf 'x\n' > $B/.ac4-probe" >/dev/null 2>&1
|
|
if [ "$(asuser "cat $B/.ac4-probe" 2>/dev/null)" = "x" ]; then ok "write+read back as 'atheos'"; else bad "cannot write as atheos"; fi
|
|
asuser "rm -f $B/.ac4-probe" >/dev/null 2>&1
|
|
for p in config.php data workspace plugins themes; do
|
|
if asuser "test -w $W/$p" 2>/dev/null; then ok "writable: $p"; else bad "NOT writable: $p"; fi
|
|
done
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-5 Remote points at Gitea; the SSH switch is documented"
|
|
echo "=============================================================="
|
|
REMOTE=$(asuser "git -C $B remote get-url origin" 2>/dev/null)
|
|
echo " remote now: $REMOTE"
|
|
case "$REMOTE" in
|
|
*aridgwayweb.com*armistace/blog*) ok "remote targets armistace/blog on Gitea (HTTPS)" ;;
|
|
gitea-blog:armistace/blog*) ok "remote targets armistace/blog via the deploy-key alias" ;;
|
|
*) bad "remote does not target the blog repo" ;;
|
|
esac
|
|
chk "branch" "$(asuser "git -C $B rev-parse --abbrev-ref HEAD" 2>/dev/null)" "master"
|
|
|
|
# Phase 2: once the SSH alias is in use, prove the transport actually authenticates
|
|
case "$REMOTE" in
|
|
gitea-blog:*)
|
|
AUTH=$(asuser 'ssh -o BatchMode=yes -o ConnectTimeout=8 -T gitea-blog 2>&1' | head -1)
|
|
case "$AUTH" in
|
|
*successfully\ authenticated*) ok "deploy key authenticates over SSH" ;;
|
|
*) bad "deploy key does NOT authenticate: $AUTH" ;;
|
|
esac
|
|
;;
|
|
esac
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-6 Survives reboot (services enabled, data intact)"
|
|
echo "=============================================================="
|
|
echo " container uptime: $(cut -d. -f1 /proc/uptime)s (reboot was issued during the test)"
|
|
for s in nginx php-fpm83 sshd; do
|
|
if rc-update show 2>/dev/null | grep -qE "^\s+$s\s+\|\s+default"; then ok "$s enabled at boot"; else bad "$s NOT enabled at boot"; fi
|
|
if rc-service "$s" status >/dev/null 2>&1; then ok "$s running"; else bad "$s not running"; fi
|
|
done
|
|
if [ -S "$SOCK" ]; then ok "fpm socket exists after reboot"; else bad "fpm socket missing"; fi
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "AC-8 SCOPE GUARD: no build toolchain present (must be ABSENT)"
|
|
echo "=============================================================="
|
|
for t in python python3 pelican pip pip3 make; do
|
|
if command -v "$t" >/dev/null 2>&1; then bad "$t IS present - scope violated!"; else ok "$t absent (correct)"; fi
|
|
done
|
|
echo " --- also check no database engine was installed (Atheos needs none):"
|
|
for d in mysqld mariadbd postgres redis-server; do
|
|
if command -v "$d" >/dev/null 2>&1; then bad "$d present - unexpected"; else ok "$d absent (correct)"; fi
|
|
done
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "FR-11 GUARD: agent created NO identity or armistace credential"
|
|
echo "=============================================================="
|
|
chk "git user.name empty" "$(asuser 'git config --get user.name' 2>/dev/null)" ""
|
|
chk "git user.email empty" "$(asuser 'git config --get user.email' 2>/dev/null)" ""
|
|
if [ -f /home/atheos/.ssh/id_ed25519_blog ]; then ok "deploy key present"; else bad "deploy key missing"; fi
|
|
chk "deploy key mode" "$(stat -c '%a' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "600"
|
|
chk "deploy key owner" "$(stat -c '%U' /home/atheos/.ssh/id_ed25519_blog 2>/dev/null)" "atheos"
|
|
chk "ssh config mode" "$(stat -c '%a' /home/atheos/.ssh/config 2>/dev/null)" "600"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
echo "RESOURCES"
|
|
echo "=============================================================="
|
|
echo " rootfs: $(df -hP / | tail -1 | awk '{print $2" total, "$3" used, "$4" avail ("$5")"}')"
|
|
# NOTE: on Alpine, `free`/`uptime` are BUSYBOX applets that use the sysinfo() syscall, which
|
|
# lxcfs cannot intercept - so they report the PVE HOST, not this container. procps-ng (installed
|
|
# by provision.sh) replaces them with binaries that read the lxcfs-virtualised /proc files.
|
|
# Detect via apk, which is the reliable signal (the binaries are plain files either way).
|
|
if apk info -e procps-ng >/dev/null 2>&1; then
|
|
echo " memory: $(/usr/bin/free -m 2>/dev/null | awk 'NR==2{print $3"MB used of "$2"MB"}')"
|
|
echo " uptime: $(/usr/bin/uptime 2>/dev/null | sed 's/.*up /up /;s/,.*//') (container-accurate)"
|
|
else
|
|
echo " memory: (procps-ng NOT installed - busybox free/uptime would report the HOST)"
|
|
fi
|
|
echo " lxcfs virtualises /proc: meminfo=$(grep MemTotal /proc/meminfo | awk '{print $2"kB"}') uptime=$(cut -d. -f1 /proc/uptime)s"
|
|
echo " listening ports: $(netstat -tln 2>/dev/null | awk '/LISTEN/{split($4,a,":"); print a[length(a)]}' | sort -u | tr '\n' ' ')"
|
|
|
|
echo
|
|
echo "=============================================================="
|
|
printf 'RESULT: %d passed, %d failed\n' "$pass" "$fail"
|
|
echo "=============================================================="
|
|
[ "$fail" -eq 0 ] || exit 1
|