hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

scripts: sanity/dns/wallet-cli helpers; ops cleanup

Browse source
This commit is contained in:
Hernâni Marques 2026-07-09 19:57:14 +02:00
parent 1181680a4b
commit be05666737
No known key found for this signature in database
18 changed files with 1440 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

82
scripts/taler-dns/pin-container-hosts.sh Executable file
View file

@ -0,0 +1,82 @@
#!/bin/bash
# Pin public GOA hostnames inside Taler containers (pasta often has no useful DNS).
# Required so wirewatch can reach https://bank.hacktivism.ch/... wire-gateway.
#
# Run on koopa (host):
# ./pin-container-hosts.sh # apply + show resolve
# ./pin-container-hosts.sh --check # only show
# PIN_IP=212.51.151.254 ./pin-container-hosts.sh
set -euo pipefail
CHECK_ONLY=0
[ "${1:-}" = "--check" ] && CHECK_ONLY=1
DOMAINS=(bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch)
CONTAINERS=(
taler-hacktivism-bank
taler-hacktivism-exchange-ansible
taler-hacktivism
)
PIN_IP="${PIN_IP:-}"
if [ -z "$PIN_IP" ]; then
PIN_IP=$(getent ahostsv4 bank.hacktivism.ch 2>/dev/null | awk '{print $1; exit}' || true)
fi
[ -n "$PIN_IP" ] || PIN_IP=212.51.151.254
echo "PIN_IP=$PIN_IP"
echo "domains: ${DOMAINS[*]}"
echo
pin_one() {
local C="$1"
if ! podman ps --format '{{.Names}}' | grep -qx "$C"; then
echo "=== $C === SKIP (not running)"
return 0
fi
if [ "$CHECK_ONLY" != "1" ]; then
# Keep localhost lines; drop previous hacktivism pins; append ours
podman exec "$C" bash -lc "
set -e
TMP=\$(mktemp)
# keep non-hacktivism lines
if [ -f /etc/hosts ]; then
grep -vE 'hacktivism\\.ch|[[:space:]]bank\\.hacktivism|[[:space:]]exchange\\.hacktivism|[[:space:]]taler\\.hacktivism' /etc/hosts > \"\$TMP\" || true
fi
# ensure localhost
grep -qE '^127\\.0\\.0\\.1[[:space:]]+localhost' \"\$TMP\" 2>/dev/null || echo '127.0.0.1 localhost' >> \"\$TMP\"
grep -qE '^::1[[:space:]]' \"\$TMP\" 2>/dev/null || echo '::1 localhost ip6-localhost ip6-loopback' >> \"\$TMP\"
echo '${PIN_IP} bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch' >> \"\$TMP\"
# de-dupe consecutive blank lines lightly
cat \"\$TMP\" > /etc/hosts
rm -f \"\$TMP\"
"
# wirewatch needs bank DNS after pin
if [ "$C" = "taler-hacktivism-exchange-ansible" ]; then
podman exec "$C" systemctl try-restart taler-exchange-wirewatch 2>/dev/null || true
fi
fi
echo "=== $C ==="
podman exec "$C" grep -E 'hacktivism|localhost' /etc/hosts 2>/dev/null || true
for h in "${DOMAINS[@]}"; do
# ahostsv4 first (matches what wire tools need)
ip=$(podman exec "$C" getent ahostsv4 "$h" 2>/dev/null | awk '{print $1; exit}' || true)
[ -n "$ip" ] || ip=$(podman exec "$C" getent hosts "$h" 2>/dev/null | awk '{print $1; exit}' || true)
code=$(podman exec "$C" curl -skS -m 4 -o /dev/null -w '%{http_code}' "https://${h}/config" 2>/dev/null || echo 000)
if [ -n "$ip" ] && [ "$code" = "200" ]; then
echo " OK $h → $ip /config=$code"
elif [ -n "$ip" ]; then
echo " WARN $h → $ip /config=$code"
else
echo " FAIL $h → (no resolve) /config=$code"
fi
done
echo
}
for C in "${CONTAINERS[@]}"; do
pin_one "$C"
done
echo "done (CHECK_ONLY=$CHECK_ONLY)"