5a5431bfa9
Multi-phase global SUMMARY, warn-filter dimmed context, SUMMARY chrome as meta; FP stage host-agent via francpaysan-stage-user (stagepaysan); monpages GOA + FP stage.
113 lines
3.5 KiB
Bash
Executable file
113 lines
3.5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# check_mattermost.sh — outside-in checks for Taler Mattermost (chat)
|
|
#
|
|
# Default host: mattermost.taler.net
|
|
# Override: MATTERMOST_PUBLIC=https://mattermost.example.org
|
|
# MATTERMOST_HOST=mattermost.example.org
|
|
#
|
|
# Outside-only (no SSH). Phase name: mattermost
|
|
#
|
|
set -euo pipefail
|
|
ROOT=$(cd "$(dirname "$0")" && pwd)
|
|
# shellcheck source=lib.sh
|
|
source "$ROOT/lib.sh"
|
|
|
|
set_area mattermost
|
|
section "mattermost · public chat (outside-in)"
|
|
|
|
if [ -n "${MATTERMOST_PUBLIC:-}" ]; then
|
|
BASE="${MATTERMOST_PUBLIC%/}"
|
|
elif [ -n "${MATTERMOST_HOST:-}" ]; then
|
|
BASE="https://${MATTERMOST_HOST}"
|
|
else
|
|
BASE="https://mattermost.taler.net"
|
|
fi
|
|
HOST=${BASE#https://}
|
|
HOST=${HOST#http://}
|
|
HOST=${HOST%%/*}
|
|
|
|
info "target" "$BASE"
|
|
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
|
|
# GET with follow redirects (Mattermost SPA often 302 → /)
|
|
mm_get() {
|
|
local url="$1" out="$2"
|
|
curl -skS -L --max-redirs 5 -m "${TIMEOUT:-12}" -o "$out" -w '%{http_code}' "$url" 2>/dev/null || echo 000
|
|
}
|
|
|
|
# --- DNS / HTTPS landing ---
|
|
set_group landing
|
|
code=$(mm_get "$BASE/" "$tmp/root.html")
|
|
if [ "$code" = "200" ] && head -c 512 "$tmp/root.html" | grep -qiE '<!doctype html|<html'; then
|
|
ok "landing" "$BASE/ → HTTP $code HTML"
|
|
else
|
|
fail "landing" "$BASE/ → HTTP $code (want 200 HTML Mattermost SPA)"
|
|
fi
|
|
|
|
# --- Official Mattermost health API ---
|
|
set_group api
|
|
code=$(mm_get "$BASE/api/v4/system/ping" "$tmp/ping.json")
|
|
if [ "$code" != "200" ]; then
|
|
fail "system/ping" "$BASE/api/v4/system/ping → HTTP $code (want 200 JSON)"
|
|
else
|
|
# Ping returns JSON object (fields vary by MM version)
|
|
if python3 - "$tmp/ping.json" <<'PY' 2>/dev/null
|
|
import json, sys
|
|
p = sys.argv[1]
|
|
with open(p) as f:
|
|
d = json.load(f)
|
|
if not isinstance(d, dict):
|
|
sys.exit(2)
|
|
# older builds may include status; newer still return object with backends
|
|
sys.exit(0)
|
|
PY
|
|
then
|
|
ok "system/ping" "$BASE/api/v4/system/ping → HTTP 200 JSON"
|
|
else
|
|
fail "system/ping" "$BASE/api/v4/system/ping → HTTP 200 but not valid JSON object"
|
|
fi
|
|
fi
|
|
|
|
# --- Login SPA (must be served for users) ---
|
|
set_group login
|
|
code=$(mm_get "$BASE/login" "$tmp/login.html")
|
|
if [ "$code" = "200" ] && head -c 512 "$tmp/login.html" | grep -qiE '<!doctype html|<html'; then
|
|
ok "login" "$BASE/login → HTTP $code HTML"
|
|
else
|
|
fail "login" "$BASE/login → HTTP $code (want 200 HTML)"
|
|
fi
|
|
|
|
# --- TLS certificate expiry (openssl s_client if available) ---
|
|
set_group tls
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
end=$(echo | openssl s_client -servername "$HOST" -connect "${HOST}:443" 2>/dev/null \
|
|
| openssl x509 -noout -enddate 2>/dev/null | sed 's/notAfter=//')
|
|
if [ -n "$end" ]; then
|
|
# days remaining
|
|
end_epoch=$(date -d "$end" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$end" +%s 2>/dev/null || echo 0)
|
|
now_epoch=$(date +%s)
|
|
if [ "$end_epoch" -gt 0 ]; then
|
|
days=$(( (end_epoch - now_epoch) / 86400 ))
|
|
if [ "$days" -lt 0 ]; then
|
|
fail "tls cert" "$HOST cert expired ($end)"
|
|
elif [ "$days" -lt 14 ]; then
|
|
warn "tls cert" "$HOST expires in ${days}d ($end)"
|
|
elif [ "$days" -lt 30 ]; then
|
|
warn "tls cert" "$HOST expires in ${days}d ($end)"
|
|
else
|
|
ok "tls cert" "$HOST valid · ${days}d left · $end"
|
|
fi
|
|
else
|
|
info "tls cert" "$HOST notAfter=$end"
|
|
fi
|
|
else
|
|
warn "tls cert" "$HOST could not read certificate"
|
|
fi
|
|
else
|
|
info "tls cert" "openssl not available — skip expiry check"
|
|
fi
|
|
|
|
info "hint" "surface catalog also lists $HOST; this phase is Mattermost-specific (SPA + /api/v4/system/ping)"
|
|
exit 0
|