pepsi: host-net highports + ensure mon-* users

scripts/pepsi/firewalld-pepsi-highports.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Open rootless pepsi high-ports on koopa (firewalld).
+# Compose map (LAN bind 192.168.100.95):
+#   1025→25  1465→465  1587→587  1993→993  18443→443
+# Freigabe: human this session. Run on koopa as root / sudo.
+set -euo pipefail
+
+PORTS=(1025/tcp 1465/tcp 1587/tcp 1993/tcp 18443/tcp)
+ZONE="${FIREWALLD_ZONE:-}"
+
+if [[ ${EUID:-$(id -u)} -ne 0 ]]; then
+  echo "STATUS=need_root HINT='sudo $0'"
+  exit 2
+fi
+
+if ! command -v firewall-cmd >/dev/null 2>&1; then
+  echo "STATUS=no_firewalld"
+  exit 3
+fi
+
+if ! firewall-cmd --state >/dev/null 2>&1; then
+  echo "STATUS=firewalld_down"
+  exit 4
+fi
+
+if [[ -z "$ZONE" ]]; then
+  # Prefer the zone that owns the LAN NIC; else default.
+  ZONE=$(firewall-cmd --get-zone-of-interface=eno1 2>/dev/null || true)
+  if [[ -z "$ZONE" ]]; then
+    ZONE=$(firewall-cmd --get-default-zone)
+  fi
+fi
+
+echo "STATUS=start ZONE=$ZONE HOST=$(hostname -s)"
+
+added=0
+present=0
+for p in "${PORTS[@]}"; do
+  if firewall-cmd --zone="$ZONE" --query-port="$p" >/dev/null 2>&1; then
+    echo "PORT=$p STATE=present"
+    present=$((present + 1))
+  else
+    firewall-cmd --zone="$ZONE" --add-port="$p" --permanent
+    echo "PORT=$p STATE=added_permanent"
+    added=$((added + 1))
+  fi
+done
+
+firewall-cmd --reload
+echo "STATUS=reloaded"
+
+ok=0
+for p in "${PORTS[@]}"; do
+  if firewall-cmd --zone="$ZONE" --query-port="$p" >/dev/null 2>&1; then
+    echo "VERIFY=$p OK=1"
+    ok=$((ok + 1))
+  else
+    echo "VERIFY=$p OK=0"
+  fi
+done
+
+echo "STATUS=done ZONE=$ZONE ADDED=$added PRESENT_BEFORE=$present VERIFY_OK=$ok EXPECT=${#PORTS[@]}"
+if [[ "$ok" -eq "${#PORTS[@]}" ]]; then
+  exit 0
+fi
+exit 1