monitoring: koopa login-health timer snapshot on SSH login

scripts/login-health/install-login-health.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# Install koopa-login-health:
+#   - ~/.local/bin/koopa-login-health  (show + collect)
+#   - user systemd timer → collect every 5 min (fresh snapshot)
+#   - bashrc hook → show only (no probes on login; never blocks shell)
+#
+# On koopa as hernani:
+#   cd ~/src/koopa/koopa-admin-log
+#   ./scripts/login-health/install-login-health.sh
+
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")" && pwd)
+REPO_ROOT=$(cd "$ROOT/../.." && pwd)
+SRC="$ROOT/koopa-login-health.sh"
+UNIT_SRC_DIR="$REPO_ROOT/configs/systemd/user"
+BIN_DIR="${HOME}/.local/bin"
+DEST="$BIN_DIR/koopa-login-health"
+BASHRC="${HOME}/.bashrc"
+UNIT_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user"
+MARKER_BEGIN="# >>> koopa-login-health (koopa-admin-log) >>>"
+MARKER_END="# <<< koopa-login-health (koopa-admin-log) <<<"
+
+if [ ! -f "$SRC" ]; then
+  echo "missing $SRC" >&2
+  exit 1
+fi
+
+# Login: ONLY show snapshot. Never collect. Instant cat; always continue.
+HOOK_BODY=$(cat <<'HOOK'
+# Best-effort: print last health snapshot. MUST NOT break login. MUST NOT probe.
+# Skip: KOOPA_SKIP_HEALTH=1
+# Refresh is the user timer koopa-login-health.timer (not this hook).
+__koopa_lh() {
+  [ -n "${KOOPA_SKIP_HEALTH:-}" ] && return 0
+  case $- in *i*) ;; *) return 0 ;; esac
+  _b="${HOME}/.local/bin/koopa-login-health"
+  [ -x "$_b" ] || return 0
+  if [ -z "${SSH_CONNECTION:-}" ] && [ -z "${SSH_TTY:-}" ]; then
+    [ "${SHLVL:-1}" -le 2 ] 2>/dev/null || return 0
+  fi
+  # show only — no collect; 2s wall cap is enough to cat a few KB
+  if command -v timeout >/dev/null 2>&1; then
+    timeout -k 1s 2s env KOOPA_HEALTH_FROM_LOGIN=1 "$_b" show </dev/null >/dev/tty 2>/dev/null \
+      || timeout -k 1s 2s env KOOPA_HEALTH_FROM_LOGIN=1 "$_b" show </dev/null 2>/dev/null \
+      || true
+  else
+    env KOOPA_HEALTH_FROM_LOGIN=1 "$_b" show </dev/null 2>/dev/null || true
+  fi
+  return 0
+}
+set +e
+__koopa_lh || true
+unset -f __koopa_lh 2>/dev/null || true
+HOOK
+)
+
+mkdir -p "$BIN_DIR" "$UNIT_DIR"
+install -m 0755 "$SRC" "$DEST"
+echo "installed $DEST"
+
+for u in koopa-login-health.service koopa-login-health.timer; do
+  if [ ! -f "$UNIT_SRC_DIR/$u" ]; then
+    echo "missing unit $UNIT_SRC_DIR/$u" >&2
+    exit 1
+  fi
+  install -m 0644 "$UNIT_SRC_DIR/$u" "$UNIT_DIR/$u"
+  echo "installed $UNIT_DIR/$u"
+done
+
+touch "$BASHRC"
+if grep -qF "$MARKER_BEGIN" "$BASHRC" 2>/dev/null; then
+  tmp=$(mktemp)
+  awk -v b="$MARKER_BEGIN" -v e="$MARKER_END" '
+    $0 == b {skip=1; next}
+    $0 == e {skip=0; next}
+    !skip {print}
+  ' "$BASHRC" >"$tmp"
+  mv "$tmp" "$BASHRC"
+  echo "removed previous bashrc hook"
+fi
+{
+  echo ""
+  echo "$MARKER_BEGIN"
+  printf '%s\n' "$HOOK_BODY"
+  echo "$MARKER_END"
+} >>"$BASHRC"
+echo "installed bashrc hook (show-only; no probes on login)"
+
+hook_tmp=$(mktemp)
+{
+  echo "$MARKER_BEGIN"
+  printf '%s\n' "$HOOK_BODY"
+  echo "$MARKER_END"
+} >"$hook_tmp"
+if ! bash -n "$hook_tmp" || ! bash -n "$BASHRC"; then
+  echo "ERROR: bashrc syntax check failed — removing hook" >&2
+  tmp=$(mktemp)
+  awk -v b="$MARKER_BEGIN" -v e="$MARKER_END" '
+    $0 == b {skip=1; next}
+    $0 == e {skip=0; next}
+    !skip {print}
+  ' "$BASHRC" >"$tmp"
+  mv "$tmp" "$BASHRC"
+  rm -f "$hook_tmp"
+  exit 1
+fi
+rm -f "$hook_tmp"
+echo "bash -n OK"
+
+if ! echo ":$PATH:" | grep -q ":$BIN_DIR:"; then
+  if ! grep -q '\.local/bin' "$BASHRC" 2>/dev/null; then
+    echo "export PATH=\"\$HOME/.local/bin:\$PATH\"" >>"$BASHRC"
+    echo "appended PATH += ~/.local/bin"
+  fi
+fi
+
+# Enable timer + first collect (needs lingering for boot without login)
+systemctl --user daemon-reload
+systemctl --user enable --now koopa-login-health.timer
+systemctl --user start koopa-login-health.service || true
+echo "timer: $(systemctl --user is-enabled koopa-login-health.timer 2>/dev/null || echo unknown)"
+systemctl --user list-timers koopa-login-health.timer --no-pager 2>/dev/null || true
+
+# linger so timer runs without interactive session
+if command -v loginctl >/dev/null 2>&1; then
+  if [ "$(loginctl show-user "$USER" -p Linger --value 2>/dev/null || echo no)" != "yes" ]; then
+    echo "NOTE: enable linger so the timer runs after reboot without login:"
+    echo "  sudo loginctl enable-linger $USER"
+  else
+    echo "linger already enabled for $USER"
+  fi
+fi
+
+echo "smoke show (FROM_LOGIN):"
+KOOPA_HEALTH_FROM_LOGIN=1 "$DEST" show -q || true
+echo "done. Login cats snapshot only; collect runs every 5 min via systemd --user."