scripts: sanity/dns/wallet-cli helpers; ops cleanup
This commit is contained in:
Hernâni Marques
parent
1181680a4b
commit
be05666737
18 changed files with 1440 additions and 0 deletions
48
scripts/taler-dns/README.md
Normal file
48
scripts/taler-dns/README.md
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
# Container DNS pins (hacktivism.ch)
|
||||
|
||||
Pasta networking often has **no usable DNS**. Wirewatch needs:
|
||||
|
||||
```text
|
||||
https://bank.hacktivism.ch/accounts/exchange/taler-wire-gateway/
|
||||
```
|
||||
|
||||
## Bake into images (preferred)
|
||||
|
||||
On koopa:
|
||||
|
||||
```bash
|
||||
# copy bake assets, then:
|
||||
SRC_DIR=/tmp/taler-dns-bake ./bake-hosts-into-images.sh
|
||||
```
|
||||
|
||||
This:
|
||||
|
||||
1. Installs `/usr/local/bin/pin-hacktivism-hosts` **inside** each container
|
||||
2. Hooks `start_base_services_for_taler*.sh` (bank + merchant)
|
||||
3. Enables systemd `pin-hacktivism-hosts.service` (exchange, before wirewatch)
|
||||
4. **Commits** images:
|
||||
- `localhost/taler-hacktivism-banking:live` (+ `:hosts-pinned`)
|
||||
- `localhost/taler-hacktivism-live:landing` (+ `:hosts-pinned`)
|
||||
- `localhost/taler-hacktivism-exchange-ansible:landing` (+ `:hosts-pinned`)
|
||||
|
||||
Pin IP default: `212.51.151.254` (`PIN_IP=` to override).
|
||||
|
||||
## One-shot without bake
|
||||
|
||||
```bash
|
||||
./pin-container-hosts.sh # apply now
|
||||
./pin-container-hosts.sh --check # report resolve + /config
|
||||
```
|
||||
|
||||
## After recreate
|
||||
|
||||
If you start from an **old** image without the bake, run `pin-container-hosts.sh` once.
|
||||
If you use `:hosts-pinned` / updated `:live`/`:landing` images, start_base / systemd re-pin on boot.
|
||||
|
||||
Optional podman flags when recreating (extra safety):
|
||||
|
||||
```bash
|
||||
--add-host=bank.hacktivism.ch:212.51.151.254 \
|
||||
--add-host=exchange.hacktivism.ch:212.51.151.254 \
|
||||
--add-host=taler.hacktivism.ch:212.51.151.254
|
||||
```
|
||||
116
scripts/taler-dns/bake-hosts-into-images.sh
Normal file
116
scripts/taler-dns/bake-hosts-into-images.sh
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
#!/bin/bash
|
||||
# Install in-container pin script (+ systemd on exchange), hook start_base scripts,
|
||||
# commit images so recreate keeps the bake.
|
||||
#
|
||||
# Run on koopa:
|
||||
# ./bake-hosts-into-images.sh
|
||||
set -euo pipefail
|
||||
|
||||
PIN_IP="${PIN_IP:-212.51.151.254}"
|
||||
SRC_DIR="${SRC_DIR:-/tmp/taler-dns-bake}"
|
||||
mkdir -p "$SRC_DIR"
|
||||
|
||||
# expect these next to us or in SRC_DIR
|
||||
SCRIPT_IN="${SCRIPT_IN:-$SRC_DIR/pin-hacktivism-hosts.in-container.sh}"
|
||||
UNIT_IN="${UNIT_IN:-$SRC_DIR/pin-hacktivism-hosts.service}"
|
||||
|
||||
[ -f "$SCRIPT_IN" ] || { echo "missing $SCRIPT_IN" >&2; exit 1; }
|
||||
|
||||
install_into() {
|
||||
local C="$1"
|
||||
if ! podman ps --format '{{.Names}}' | grep -qx "$C"; then
|
||||
echo "SKIP $C (not running)"
|
||||
return 0
|
||||
fi
|
||||
echo "=== install into $C ==="
|
||||
podman cp "$SCRIPT_IN" "$C:/usr/local/bin/pin-hacktivism-hosts"
|
||||
podman exec "$C" chmod 755 /usr/local/bin/pin-hacktivism-hosts
|
||||
# run once now
|
||||
podman exec -e PIN_IP="$PIN_IP" "$C" /usr/local/bin/pin-hacktivism-hosts
|
||||
podman exec "$C" grep hacktivism /etc/hosts || true
|
||||
}
|
||||
|
||||
hook_start_base() {
|
||||
local C="$1" base="$2"
|
||||
podman exec "$C" bash -lc "
|
||||
set -e
|
||||
f='$base'
|
||||
if [ ! -f \"\$f\" ]; then echo \"no \$f\"; exit 0; fi
|
||||
if grep -q pin-hacktivism-hosts \"\$f\"; then
|
||||
echo \"already hooked: \$f\"
|
||||
exit 0
|
||||
fi
|
||||
# insert right after shebang / first line block
|
||||
cp \"\$f\" \"\$f.bak-before-pin\"
|
||||
{
|
||||
head -n 1 \"\$f\"
|
||||
echo ''
|
||||
echo '# Pin public GOA hostnames (pasta DNS). Baked by bake-hosts-into-images.sh'
|
||||
echo 'if [ -x /usr/local/bin/pin-hacktivism-hosts ]; then'
|
||||
echo ' PIN_IP=${PIN_IP} /usr/local/bin/pin-hacktivism-hosts || true'
|
||||
echo 'fi'
|
||||
tail -n +2 \"\$f\"
|
||||
} > \"\$f.new\"
|
||||
mv \"\$f.new\" \"\$f\"
|
||||
chmod +x \"\$f\"
|
||||
echo \"hooked \$f\"
|
||||
"
|
||||
}
|
||||
|
||||
# --- bank ---
|
||||
install_into taler-hacktivism-bank
|
||||
hook_start_base taler-hacktivism-bank /root/start_base_services_for_taler_bank.sh
|
||||
|
||||
# --- merchant ---
|
||||
install_into taler-hacktivism
|
||||
hook_start_base taler-hacktivism /root/start_base_services_for_taler.sh
|
||||
|
||||
# --- exchange (systemd) ---
|
||||
install_into taler-hacktivism-exchange-ansible
|
||||
if [ -f "$UNIT_IN" ]; then
|
||||
podman cp "$UNIT_IN" taler-hacktivism-exchange-ansible:/etc/systemd/system/pin-hacktivism-hosts.service
|
||||
podman exec taler-hacktivism-exchange-ansible bash -lc '
|
||||
sed -i "s/PIN_IP=212.51.151.254/PIN_IP='"${PIN_IP}"'/" /etc/systemd/system/pin-hacktivism-hosts.service
|
||||
systemctl daemon-reload
|
||||
systemctl enable pin-hacktivism-hosts.service
|
||||
systemctl start pin-hacktivism-hosts.service
|
||||
systemctl is-enabled pin-hacktivism-hosts.service
|
||||
# ensure wirewatch starts after pin
|
||||
mkdir -p /etc/systemd/system/taler-exchange-wirewatch.service.d
|
||||
cat > /etc/systemd/system/taler-exchange-wirewatch.service.d/pin-hosts.conf <<EOF
|
||||
[Unit]
|
||||
After=pin-hacktivism-hosts.service
|
||||
Requires=pin-hacktivism-hosts.service
|
||||
EOF
|
||||
systemctl daemon-reload
|
||||
systemctl restart taler-exchange-wirewatch 2>/dev/null || true
|
||||
'
|
||||
fi
|
||||
|
||||
# --- commit images ---
|
||||
echo "=== commit images ==="
|
||||
podman commit taler-hacktivism-bank \
|
||||
localhost/taler-hacktivism-banking:live
|
||||
podman commit taler-hacktivism-bank \
|
||||
localhost/taler-hacktivism-banking:hosts-pinned
|
||||
|
||||
podman commit taler-hacktivism \
|
||||
localhost/taler-hacktivism-live:landing
|
||||
podman commit taler-hacktivism \
|
||||
localhost/taler-hacktivism-live:hosts-pinned
|
||||
|
||||
podman commit taler-hacktivism-exchange-ansible \
|
||||
localhost/taler-hacktivism-exchange-ansible:landing
|
||||
podman commit taler-hacktivism-exchange-ansible \
|
||||
localhost/taler-hacktivism-exchange-ansible:hosts-pinned
|
||||
|
||||
echo
|
||||
echo "Images updated:"
|
||||
podman images | grep -E 'hacktivism|hosts-pinned' | head -20
|
||||
echo
|
||||
echo "Verify:"
|
||||
for C in taler-hacktivism-bank taler-hacktivism-exchange-ansible taler-hacktivism; do
|
||||
echo -n "$C: "
|
||||
podman exec "$C" getent ahostsv4 bank.hacktivism.ch 2>/dev/null | head -1 || echo FAIL
|
||||
done
|
||||
echo "done."
|
||||
82
scripts/taler-dns/pin-container-hosts.sh
Executable file
82
scripts/taler-dns/pin-container-hosts.sh
Executable file
|
|
@ -0,0 +1,82 @@
|
|||
#!/bin/bash
|
||||
# Pin public GOA hostnames inside Taler containers (pasta often has no useful DNS).
|
||||
# Required so wirewatch can reach https://bank.hacktivism.ch/... wire-gateway.
|
||||
#
|
||||
# Run on koopa (host):
|
||||
# ./pin-container-hosts.sh # apply + show resolve
|
||||
# ./pin-container-hosts.sh --check # only show
|
||||
# PIN_IP=212.51.151.254 ./pin-container-hosts.sh
|
||||
set -euo pipefail
|
||||
|
||||
CHECK_ONLY=0
|
||||
[ "${1:-}" = "--check" ] && CHECK_ONLY=1
|
||||
|
||||
DOMAINS=(bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch)
|
||||
CONTAINERS=(
|
||||
taler-hacktivism-bank
|
||||
taler-hacktivism-exchange-ansible
|
||||
taler-hacktivism
|
||||
)
|
||||
|
||||
PIN_IP="${PIN_IP:-}"
|
||||
if [ -z "$PIN_IP" ]; then
|
||||
PIN_IP=$(getent ahostsv4 bank.hacktivism.ch 2>/dev/null | awk '{print $1; exit}' || true)
|
||||
fi
|
||||
[ -n "$PIN_IP" ] || PIN_IP=212.51.151.254
|
||||
|
||||
echo "PIN_IP=$PIN_IP"
|
||||
echo "domains: ${DOMAINS[*]}"
|
||||
echo
|
||||
|
||||
pin_one() {
|
||||
local C="$1"
|
||||
if ! podman ps --format '{{.Names}}' | grep -qx "$C"; then
|
||||
echo "=== $C === SKIP (not running)"
|
||||
return 0
|
||||
fi
|
||||
if [ "$CHECK_ONLY" != "1" ]; then
|
||||
# Keep localhost lines; drop previous hacktivism pins; append ours
|
||||
podman exec "$C" bash -lc "
|
||||
set -e
|
||||
TMP=\$(mktemp)
|
||||
# keep non-hacktivism lines
|
||||
if [ -f /etc/hosts ]; then
|
||||
grep -vE 'hacktivism\\.ch|[[:space:]]bank\\.hacktivism|[[:space:]]exchange\\.hacktivism|[[:space:]]taler\\.hacktivism' /etc/hosts > \"\$TMP\" || true
|
||||
fi
|
||||
# ensure localhost
|
||||
grep -qE '^127\\.0\\.0\\.1[[:space:]]+localhost' \"\$TMP\" 2>/dev/null || echo '127.0.0.1 localhost' >> \"\$TMP\"
|
||||
grep -qE '^::1[[:space:]]' \"\$TMP\" 2>/dev/null || echo '::1 localhost ip6-localhost ip6-loopback' >> \"\$TMP\"
|
||||
echo '${PIN_IP} bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch' >> \"\$TMP\"
|
||||
# de-dupe consecutive blank lines lightly
|
||||
cat \"\$TMP\" > /etc/hosts
|
||||
rm -f \"\$TMP\"
|
||||
"
|
||||
# wirewatch needs bank DNS after pin
|
||||
if [ "$C" = "taler-hacktivism-exchange-ansible" ]; then
|
||||
podman exec "$C" systemctl try-restart taler-exchange-wirewatch 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "=== $C ==="
|
||||
podman exec "$C" grep -E 'hacktivism|localhost' /etc/hosts 2>/dev/null || true
|
||||
for h in "${DOMAINS[@]}"; do
|
||||
# ahostsv4 first (matches what wire tools need)
|
||||
ip=$(podman exec "$C" getent ahostsv4 "$h" 2>/dev/null | awk '{print $1; exit}' || true)
|
||||
[ -n "$ip" ] || ip=$(podman exec "$C" getent hosts "$h" 2>/dev/null | awk '{print $1; exit}' || true)
|
||||
code=$(podman exec "$C" curl -skS -m 4 -o /dev/null -w '%{http_code}' "https://${h}/config" 2>/dev/null || echo 000)
|
||||
if [ -n "$ip" ] && [ "$code" = "200" ]; then
|
||||
echo " OK $h → $ip /config=$code"
|
||||
elif [ -n "$ip" ]; then
|
||||
echo " WARN $h → $ip /config=$code"
|
||||
else
|
||||
echo " FAIL $h → (no resolve) /config=$code"
|
||||
fi
|
||||
done
|
||||
echo
|
||||
}
|
||||
|
||||
for C in "${CONTAINERS[@]}"; do
|
||||
pin_one "$C"
|
||||
done
|
||||
|
||||
echo "done (CHECK_ONLY=$CHECK_ONLY)"
|
||||
31
scripts/taler-dns/pin-hacktivism-hosts.in-container.sh
Normal file
31
scripts/taler-dns/pin-hacktivism-hosts.in-container.sh
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
#!/bin/bash
|
||||
# Runs *inside* a Taler container. Pasta regenerates /etc/hosts on start —
|
||||
# call this from systemd (exchange) or start_base_*.sh (merchant/bank).
|
||||
set -euo pipefail
|
||||
|
||||
PIN_IP="${PIN_IP:-212.51.151.254}"
|
||||
MARKER="# hacktivism-goa-pin"
|
||||
|
||||
TMP=$(mktemp)
|
||||
if [ -f /etc/hosts ]; then
|
||||
# drop any previous pin marker lines and lines that name our domains
|
||||
grep -vE "${MARKER}|hacktivism\\.ch" /etc/hosts >"$TMP" || true
|
||||
else
|
||||
: >"$TMP"
|
||||
fi
|
||||
|
||||
grep -qE '^127\.0\.0\.1[[:space:]]' "$TMP" 2>/dev/null \
|
||||
|| echo '127.0.0.1 localhost' >>"$TMP"
|
||||
grep -qE '^::1[[:space:]]' "$TMP" 2>/dev/null \
|
||||
|| echo '::1 localhost ip6-localhost ip6-loopback' >>"$TMP"
|
||||
|
||||
{
|
||||
cat "$TMP"
|
||||
echo "$MARKER"
|
||||
echo "${PIN_IP} bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch"
|
||||
echo "$MARKER"
|
||||
} > /etc/hosts
|
||||
rm -f "$TMP"
|
||||
|
||||
logger -t pin-hacktivism-hosts "pinned ${PIN_IP} → bank/exchange/taler.hacktivism.ch" 2>/dev/null || true
|
||||
exit 0
|
||||
16
scripts/taler-dns/pin-hacktivism-hosts.service
Normal file
16
scripts/taler-dns/pin-hacktivism-hosts.service
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[Unit]
|
||||
Description=Pin bank/exchange/taler.hacktivism.ch in /etc/hosts (pasta DNS)
|
||||
DefaultDependencies=no
|
||||
After=local-fs.target
|
||||
Before=network-online.target taler-exchange-wirewatch.service taler-exchange-httpd.service
|
||||
Wants=network-pre.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
Environment=PIN_IP=212.51.151.254
|
||||
ExecStart=/usr/local/bin/pin-hacktivism-hosts
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
WantedBy=taler-exchange-wirewatch.service
|
||||
Loading…
Add table
Add a link
Reference in a new issue