#!/usr/bin/env bash # check_mattermost.sh — outside-in checks for Taler Mattermost (chat) # # Default host: mattermost.taler.net # Override: MATTERMOST_PUBLIC=https://mattermost.example.org # MATTERMOST_HOST=mattermost.example.org # # Outside-only (no SSH). Phase name: mattermost # set -euo pipefail ROOT=$(cd "$(dirname "$0")" && pwd) # shellcheck source=lib.sh source "$ROOT/lib.sh" set_area mattermost section "mattermost · public chat (outside-in)" if [ -n "${MATTERMOST_PUBLIC:-}" ]; then BASE="${MATTERMOST_PUBLIC%/}" elif [ -n "${MATTERMOST_HOST:-}" ]; then BASE="https://${MATTERMOST_HOST}" else BASE="https://mattermost.taler.net" fi HOST=${BASE#https://} HOST=${HOST#http://} HOST=${HOST%%/*} info "target" "$BASE" tmp=$(mktemp -d) trap 'rm -rf "$tmp"' EXIT # GET with follow redirects (Mattermost SPA often 302 → /) mm_get() { local url="$1" out="$2" curl -skS -L --max-redirs 5 -m "${TIMEOUT:-12}" -o "$out" -w '%{http_code}' "$url" 2>/dev/null || echo 000 } # --- DNS / HTTPS landing --- set_group landing code=$(mm_get "$BASE/" "$tmp/root.html") if [ "$code" = "200" ] && head -c 512 "$tmp/root.html" | grep -qiE '/dev/null import json, sys p = sys.argv[1] with open(p) as f: d = json.load(f) if not isinstance(d, dict): sys.exit(2) # older builds may include status; newer still return object with backends sys.exit(0) PY then ok "system/ping" "$BASE/api/v4/system/ping → HTTP 200 JSON" else fail "system/ping" "$BASE/api/v4/system/ping → HTTP 200 but not valid JSON object" fi fi # --- Login SPA (must be served for users) --- set_group login code=$(mm_get "$BASE/login" "$tmp/login.html") if [ "$code" = "200" ] && head -c 512 "$tmp/login.html" | grep -qiE '/dev/null 2>&1; then end=$(echo | openssl s_client -servername "$HOST" -connect "${HOST}:443" 2>/dev/null \ | openssl x509 -noout -enddate 2>/dev/null | sed 's/notAfter=//') if [ -n "$end" ]; then # days remaining end_epoch=$(date -d "$end" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$end" +%s 2>/dev/null || echo 0) now_epoch=$(date +%s) if [ "$end_epoch" -gt 0 ]; then days=$(( (end_epoch - now_epoch) / 86400 )) if [ "$days" -lt 0 ]; then fail "tls cert" "$HOST cert expired ($end)" elif [ "$days" -lt 14 ]; then warn "tls cert" "$HOST expires in ${days}d ($end)" elif [ "$days" -lt 30 ]; then warn "tls cert" "$HOST expires in ${days}d ($end)" else ok "tls cert" "$HOST valid · ${days}d left · $end" fi else info "tls cert" "$HOST notAfter=$end" fi else warn "tls cert" "$HOST could not read certificate" fi else info "tls cert" "openssl not available — skip expiry check" fi info "hint" "surface catalog also lists $HOST; this phase is Mattermost-specific (SPA + /api/v4/system/ping)" exit 0