chore: remove superseded bootstrap/probe scripts
Consolidate to 3 scripts: - agent-bootstrap.sh (in-guest) - bootstrap-all.sh (workstation driver) - access-matrix.sh (fleet verification) Removed: probe-ssh.sh, probe-ssh-localuser.sh, ga-push-key.sh, pivot-probe.sh, probe-ga.sh (one-time diagnostics, superseded by access-matrix.sh).
This commit is contained in:
@@ -1,44 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# shellcheck disable=SC2016 # intentional: $vars expand in-guest, not locally
|
||||
# ga-push-key.sh — push agent SSH key + NOPASSWD sudo to all GA-OK VMs via guest-agent.
|
||||
# Runs from the workstation, routing each call through remote.sh vm-guest on the VM's host.
|
||||
set -u
|
||||
cd /home/reachableceo/projects/PFVCluster || exit 1
|
||||
|
||||
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'
|
||||
|
||||
INGUEST='for u in root localuser; do getent passwd "$u" >/dev/null || continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "'"${KEY}"'" "$AK" || echo "'"${KEY}"'" >> "$AK"; chown -R "$u": "$H/.ssh"; done; [ -d /etc/sudoers.d ] && { echo "localuser ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; echo PUSHDONE $(hostname)'
|
||||
|
||||
# host:vmid list of GA-OK VMs (excluding pfv-bms=100 policy-excluded, ultix-streaming=5111 self)
|
||||
pairs="
|
||||
pfv-tsys1:101
|
||||
pfv-tsys1:102
|
||||
pfv-tsys1:104
|
||||
pfv-tsys3:313
|
||||
pfv-tsys5:500
|
||||
pfv-tsys5:5000
|
||||
pfv-tsys5:5105
|
||||
pfv-tsys5:5106
|
||||
pfv-tsys5:5107
|
||||
pfv-tsys5:5108
|
||||
pfv-tsys5:5109
|
||||
pfv-tsys5:5112
|
||||
pfv-tsys5:51012
|
||||
pfv-tsys5:51013
|
||||
pfv-tsys5:53100
|
||||
pfv-tsys5:53102
|
||||
pfv-tsys6:600
|
||||
pfv-tsys6:601
|
||||
pfv-tsys6:602
|
||||
pfv-tsys6:603
|
||||
pfv-tsys7:701
|
||||
pfv-tsys7:703
|
||||
pfv-tsys7:705
|
||||
pfv-tsys7:706
|
||||
pfv-tsys9:905
|
||||
"
|
||||
for p in $pairs; do
|
||||
host="${p%%:*}"; vid="${p##*:}"
|
||||
out=$(PROX_HOST="$host" VM_ID="$vid" GUEST_TIMEOUT=120 bash tests/remote.sh vm-guest "$INGUEST" </dev/null 2>&1)
|
||||
printf '%-12s %-6s %s\n' "$host" "$vid" "${out//$'\n'/ | }"
|
||||
done
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/bin/sh
|
||||
# pivot-probe.sh — runs ON a Proxmox host (tsys5).
|
||||
# Tests whether THIS host's root key grants SSH (root/localuser) into the
|
||||
# GA-NO / no-SSH VMs over Tailscale. Output: "ip name user PIVOT-OK|FAIL reason"
|
||||
IPS="
|
||||
100.125.183.68:tsys-proxmox-datacenter:105
|
||||
100.109.13.110:tsys-ucs-01:108
|
||||
100.114.81.107:pfv-proxmox-backup-server:400
|
||||
100.77.14.7:preprod-hfnoc-uisp:515
|
||||
100.108.121.18:sectestbed-siem:5101
|
||||
100.80.72.71:sectestbed-proxmox-pve:5102
|
||||
100.94.1.34:sectestbed-proxmox-datacenter:5103
|
||||
100.127.238.29:sectestbed-proxmox-pbs:5104
|
||||
100.97.140.105:sectestbed-cloudron:51011
|
||||
100.117.24.21:sectestbed-proxmox-mailgw:51014
|
||||
100.113.245.124:sectestbed-ca:51015
|
||||
100.86.176.105:sectestbed-voip:51016
|
||||
100.98.162.14:preprod-siem:53101
|
||||
100.114.9.49:preprod-proxmox-mailgw:53103
|
||||
100.94.119.5:preprod-ca:53104
|
||||
100.101.250.10:preprod-proxmox-datacenter:53105
|
||||
100.79.52.34:preprod-librenms:53106
|
||||
100.109.99.109:preprod-voip:53107
|
||||
100.95.69.89:preprod-cloudron:53108
|
||||
100.94.188.89:hfnoc-uisp:702
|
||||
100.72.35.113:tsys-siem:707
|
||||
100.82.30.115:kali-tsys:708
|
||||
"
|
||||
for line in $IPS; do
|
||||
ip="${line%%:*}"; rest="${line#*:}"; name="${rest%%:*}"; vmid="${rest##*:}"
|
||||
if ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "root@${ip}" 'true' >/dev/null 2>&1; then
|
||||
printf '%s\t%s\t%s\troot\tPIVOT-OK\n' "$ip" "$name" "$vmid"
|
||||
elif ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "localuser@${ip}" 'true' >/dev/null 2>&1; then
|
||||
printf '%s\t%s\t%s\tlocaluser\tPIVOT-OK\n' "$ip" "$name" "$vmid"
|
||||
else
|
||||
printf '%s\t%s\t%s\t-\tPIVOT-FAIL\n' "$ip" "$name" "$vmid"
|
||||
fi
|
||||
done
|
||||
-32
@@ -1,32 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Fleet probe: for each running VM, report guest-agent status + primary IP.
|
||||
# Run on a Proxmox host. Output: "VMID NAME GA-STATUS IP(s)"
|
||||
set -u
|
||||
qm list 2>/dev/null | awk 'NR>1 && $3=="running" {print $1, $2}' | while read -r vmid name; do
|
||||
[ -n "$vmid" ] || continue
|
||||
if timeout 10 qm agent "$vmid" ping >/dev/null 2>&1; then
|
||||
gastatus="GA-OK"
|
||||
ips=$(timeout 10 qm agent "$vmid" network-get-interfaces 2>/dev/null \
|
||||
| python3 -c '
|
||||
import sys, json
|
||||
try:
|
||||
data = json.load(sys.stdin)
|
||||
except Exception:
|
||||
sys.exit(0)
|
||||
seen = []
|
||||
for iface in data:
|
||||
ifname = iface.get("name","")
|
||||
if ifname == "lo": continue
|
||||
for a in iface.get("ip-addresses", []):
|
||||
ip = a.get("ip-address","")
|
||||
if ":" in ip: continue
|
||||
if ip.startswith("127."): continue
|
||||
seen.append(ip)
|
||||
print(",".join(seen))
|
||||
' 2>/dev/null)
|
||||
else
|
||||
gastatus="GA-NO"
|
||||
ips=""
|
||||
fi
|
||||
printf '%s\t%s\t%s\t%s\n' "$vmid" "$name" "$gastatus" "$ips"
|
||||
done
|
||||
@@ -1,54 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Test SSH (localuser) over Tailscale for the ROOT-FAIL nodes.
|
||||
# Format: "tsname tailscale_ip"
|
||||
set -u
|
||||
cd /home/reachableceo/projects/PFVCluster || exit 1
|
||||
# ROOT-FAIL linux nodes (from probe-ssh pass 1), excluding policy-excluded:
|
||||
# tsys-umbrel, tsys-cloudron, devbox-cloudron, pfv-bms (api-only)
|
||||
nodes="
|
||||
hfnoc-uisp 100.94.188.89
|
||||
netbird 100.123.45.23
|
||||
pfv-jetson-nano-1 100.82.230.119
|
||||
pfv-netinfra-01 100.70.181.72
|
||||
pfv-netinfra-02 100.71.171.20
|
||||
pfv-proxmox-backup-server 100.114.81.107
|
||||
pfvsvrpi 100.91.151.113
|
||||
preprod-ca 100.94.119.5
|
||||
preprod-cloudron 100.95.69.89
|
||||
preprod-hfnoc-uisp 100.77.14.7
|
||||
preprod-librenms 100.79.52.34
|
||||
preprod-proxmox-datacenter 100.101.250.10
|
||||
preprod-proxmox-mailgw 100.114.9.49
|
||||
preprod-siem 100.98.162.14
|
||||
preprod-voip 100.109.99.109
|
||||
sectestbed-ca 100.113.245.124
|
||||
sectestbed-cloudron 100.97.140.105
|
||||
sectestbed-proxmox-datacenter 100.94.1.34
|
||||
sectestbed-proxmox-mailgw 100.117.24.21
|
||||
sectestbed-proxmox-pbs 100.127.238.29
|
||||
sectestbed-proxmox-pve 100.80.72.71
|
||||
sectestbed-sandbox 100.64.20.60
|
||||
sectestbed-siem 100.108.121.18
|
||||
sectestbed-voip 100.86.176.105
|
||||
stlpc-artroom 100.120.77.113
|
||||
stlpc-garage 100.72.192.22
|
||||
subopi-dev-3 100.64.231.65
|
||||
subopi-dev-4 100.65.224.85
|
||||
subopi3 100.93.17.77
|
||||
tsys-proxmox-datacenter 100.125.183.68
|
||||
tsys-siem 100.72.35.113
|
||||
tsys-ucs-01 100.109.13.110
|
||||
tsys-ucs-02 100.68.10.17
|
||||
tsys-voip 100.83.126.67
|
||||
ultix-field 100.115.233.124
|
||||
"
|
||||
echo "$nodes" | while read -r name ip; do
|
||||
[ -n "$name" ] || continue
|
||||
res=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm \
|
||||
'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
|
||||
| tr '\n' '/' )
|
||||
case "$res" in
|
||||
*SSHOK*) printf '%-28s %-16s LOCALUSER-OK %s\n' "$name" "$ip" "$res" ;;
|
||||
*) printf '%-28s %-16s LOCALUSER-FAIL %s\n' "$name" "$ip" "${res##*/}" ;;
|
||||
esac
|
||||
done
|
||||
@@ -1,15 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Test SSH (root) over Tailscale to every online Linux node.
|
||||
# Routes through remote.sh (the only allowed ssh path). Concise one-line output.
|
||||
set -u
|
||||
cd /home/reachableceo/projects/PFVCluster || exit 1
|
||||
tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $1, $2}' | while read -r ip name; do
|
||||
[ -n "$ip" ] || continue
|
||||
res=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm \
|
||||
'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
|
||||
| tr '\n' '/' )
|
||||
case "$res" in
|
||||
*SSHOK*) printf '%-28s %-16s ROOT-OK %s\n' "$name" "$ip" "$res" ;;
|
||||
*) printf '%-28s %-16s ROOT-FAIL %s\n' "$name" "$ip" "${res#/}" ;;
|
||||
esac
|
||||
done
|
||||
Reference in New Issue
Block a user