taler-monitoring v1.13.12

Multi-phase global SUMMARY, warn-filter dimmed context, SUMMARY chrome as meta; FP stage host-agent via francpaysan-stage-user (stagepaysan); monpages GOA + FP stage.
2026-07-19 04:21:16 +02:00 · 2026-07-19 04:21:16 +02:00 · 66df0a7b8f
commit 66df0a7b8f
88 changed files with 21996 additions and 0 deletions
--- a/check_mattermost.sh
+++ b/check_mattermost.sh
@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# check_mattermost.sh — outside-in checks for Taler Mattermost (chat)
+#
+# Default host: mattermost.taler.net
+# Override: MATTERMOST_PUBLIC=https://mattermost.example.org
+#           MATTERMOST_HOST=mattermost.example.org
+#
+# Outside-only (no SSH). Phase name: mattermost
+#
+set -euo pipefail
+ROOT=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=lib.sh
+source "$ROOT/lib.sh"
+
+set_area mattermost
+section "mattermost · public chat (outside-in)"
+
+if [ -n "${MATTERMOST_PUBLIC:-}" ]; then
+  BASE="${MATTERMOST_PUBLIC%/}"
+elif [ -n "${MATTERMOST_HOST:-}" ]; then
+  BASE="https://${MATTERMOST_HOST}"
+else
+  BASE="https://mattermost.taler.net"
+fi
+HOST=${BASE#https://}
+HOST=${HOST#http://}
+HOST=${HOST%%/*}
+
+info "target" "$BASE"
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+# GET with follow redirects (Mattermost SPA often 302 → /)
+mm_get() {
+  local url="$1" out="$2"
+  curl -skS -L --max-redirs 5 -m "${TIMEOUT:-12}" -o "$out" -w '%{http_code}' "$url" 2>/dev/null || echo 000
+}
+
+# --- DNS / HTTPS landing ---
+set_group landing
+code=$(mm_get "$BASE/" "$tmp/root.html")
+if [ "$code" = "200" ] && head -c 512 "$tmp/root.html" | grep -qiE '<!doctype html|<html'; then
+  ok "landing" "$BASE/ → HTTP $code HTML"
+else
+  fail "landing" "$BASE/ → HTTP $code (want 200 HTML Mattermost SPA)"
+fi
+
+# --- Official Mattermost health API ---
+set_group api
+code=$(mm_get "$BASE/api/v4/system/ping" "$tmp/ping.json")
+if [ "$code" != "200" ]; then
+  fail "system/ping" "$BASE/api/v4/system/ping → HTTP $code (want 200 JSON)"
+else
+  # Ping returns JSON object (fields vary by MM version)
+  if python3 - "$tmp/ping.json" <<'PY' 2>/dev/null
+import json, sys
+p = sys.argv[1]
+with open(p) as f:
+    d = json.load(f)
+if not isinstance(d, dict):
+    sys.exit(2)
+# older builds may include status; newer still return object with backends
+sys.exit(0)
+PY
+  then
+    ok "system/ping" "$BASE/api/v4/system/ping → HTTP 200 JSON"
+  else
+    fail "system/ping" "$BASE/api/v4/system/ping → HTTP 200 but not valid JSON object"
+  fi
+fi
+
+# --- Login SPA (must be served for users) ---
+set_group login
+code=$(mm_get "$BASE/login" "$tmp/login.html")
+if [ "$code" = "200" ] && head -c 512 "$tmp/login.html" | grep -qiE '<!doctype html|<html'; then
+  ok "login" "$BASE/login → HTTP $code HTML"
+else
+  fail "login" "$BASE/login → HTTP $code (want 200 HTML)"
+fi
+
+# --- TLS certificate expiry (openssl s_client if available) ---
+set_group tls
+if command -v openssl >/dev/null 2>&1; then
+  end=$(echo | openssl s_client -servername "$HOST" -connect "${HOST}:443" 2>/dev/null \
+    | openssl x509 -noout -enddate 2>/dev/null | sed 's/notAfter=//')
+  if [ -n "$end" ]; then
+    # days remaining
+    end_epoch=$(date -d "$end" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$end" +%s 2>/dev/null || echo 0)
+    now_epoch=$(date +%s)
+    if [ "$end_epoch" -gt 0 ]; then
+      days=$(( (end_epoch - now_epoch) / 86400 ))
+      if [ "$days" -lt 0 ]; then
+        fail "tls cert" "$HOST cert expired ($end)"
+      elif [ "$days" -lt 14 ]; then
+        warn "tls cert" "$HOST expires in ${days}d ($end)"
+      elif [ "$days" -lt 30 ]; then
+        warn "tls cert" "$HOST expires in ${days}d ($end)"
+      else
+        ok "tls cert" "$HOST valid · ${days}d left · $end"
+      fi
+    else
+      info "tls cert" "$HOST notAfter=$end"
+    fi
+  else
+    warn "tls cert" "$HOST could not read certificate"
+  fi
+else
+  info "tls cert" "openssl not available — skip expiry check"
+fi
+
+info "hint" "surface catalog also lists $HOST; this phase is Mattermost-specific (SPA + /api/v4/system/ping)"
+exit 0