mrcharles
0fa0692c37
Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.
- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
(no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
script before commit.
Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
70 lines
3.6 KiB
Bash
Executable File
70 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# deep-audit-netboot.sh — READ-ONLY deep inspection. Uses `sudo` for docker/root files.
|
|
set -u
|
|
DG="sudo docker"
|
|
|
|
hdr() { printf '\n=== %s ===\n' "$1"; }
|
|
|
|
hdr "COMPOSE FILES: /root/pihole and /root/NTP"
|
|
for f in /root/pihole/docker-compose.yml /root/NTP/docker-compose.yml; do
|
|
printf '\n--- %s ---\n' "$f"
|
|
sudo cat "$f" 2>&1
|
|
done
|
|
|
|
hdr "DIR LAYOUT of compose project dirs"
|
|
sudo ls -la /root/pihole 2>&1
|
|
sudo ls -la /root/NTP 2>&1
|
|
sudo ls -la /root 2>&1
|
|
|
|
hdr "SEARCH entire FS for any technitium / dns compose files"
|
|
sudo find / -xdev -maxdepth 6 \( -iname 'docker-compose.y*ml' -o -iname 'compose.y*ml' \) -print 2>/dev/null \
|
|
| grep -Ei 'dns|technitium|tsys' || true
|
|
|
|
hdr "ALL CONTAINERS with compose labels"
|
|
$DG ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\tWDIR={{.Label "com.docker.compose.project.working_dir"}}\tCFG={{.Label "com.docker.compose.project.config_files"}}\tSVC={{.Label "com.docker.compose.service"}}' 2>&1
|
|
|
|
hdr "DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container)"
|
|
for c in $($DG ps -aq 2>/dev/null); do
|
|
nm=$($DG inspect --format '{{.Name}} | image={{.Config.Image}} | proj={{index .Config.Labels "com.docker.compose.project"}}' "$c" 2>/dev/null)
|
|
printf '\n###### %s ######\n' "$nm"
|
|
$DG inspect "$c" 2>&1
|
|
done
|
|
|
|
hdr "PI-HOLE internal config (sudo docker exec, READ-ONLY)"
|
|
echo "-- ls /etc/pihole --"; $DG exec pihole ls -la /etc/pihole 2>&1 || true
|
|
echo "-- ls /etc/dnsmasq.d --"; $DG exec pihole ls -la /etc/dnsmasq.d 2>&1 || true
|
|
for f in setupVars.conf pihole-FTL.conf adlists.list custom.list local.list regex.list dhcp.leases static_ip.conf; do
|
|
echo "--- /etc/pihole/$f ---"; $DG exec pihole cat "/etc/pihole/$f" 2>&1 || true
|
|
done
|
|
echo "-- /etc/dnsmasq.d/* --"
|
|
# shellcheck disable=SC2016 # $f/$t expand inside the container's sh, not locally — single quotes are intentional
|
|
$DG exec pihole sh -c 'for f in /etc/dnsmasq.d/*; do echo "--- $f ---"; cat "$f"; done' 2>&1 || true
|
|
echo "-- pihole version --"; $DG exec pihole pihole -v 2>&1 || true
|
|
echo "-- gravity row counts --"
|
|
# shellcheck disable=SC2016 # $t expands inside the container's sh, not locally
|
|
$DG exec pihole sh -c 'for t in adlist domainlist client "group" info; do printf "%s=" "$t"; sqlite3 /etc/pihole/gravity.db "SELECT COUNT(*) FROM $t;" 2>/dev/null; done' 2>&1 || true
|
|
echo "-- adlist addresses --"
|
|
$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT address,enabled,comment FROM adlist;" 2>&1 || true
|
|
echo "-- domainlist (allow+deny, first 60) --"
|
|
$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT type,domain,enabled,comment FROM domainlist LIMIT 60;" 2>&1 || true
|
|
|
|
hdr "CHRONY/NTP container config (tsys-ntp)"
|
|
$DG exec tsys-ntp sh -c 'echo "--- chrony.conf ---"; cat /etc/chrony/chrony.conf 2>/dev/null || cat /etc/chrony.conf 2>/dev/null || echo none; echo "--- ls /etc ---"; ls -la /etc 2>/dev/null | head -30' 2>&1 || true
|
|
$DG exec tsys-ntp chronyc -n sources 2>&1 || true
|
|
$DG exec tsys-ntp chronyc -n tracking 2>&1 || true
|
|
echo "-- bare metal ntpsec.conf --"; sudo cat /etc/ntpsec/ntp.conf 2>&1
|
|
|
|
hdr "TECHNITIUM volumes"
|
|
for v in dns_tsys-dns-config dns_tyss-dns-config; do
|
|
mnt=$($DG volume inspect --format '{{.Mountpoint}}' "$v" 2>/dev/null)
|
|
printf '\n--- volume %s -> %s ---\n' "$v" "$mnt"
|
|
[ -n "$mnt" ] || continue
|
|
sudo find "$mnt" -maxdepth 4 -type f 2>/dev/null | head -80
|
|
echo "-- config dir listing --"
|
|
sudo ls -laR "$mnt"/config 2>/dev/null | head -60 || sudo ls -laR "$mnt" 2>/dev/null | head -60 || true
|
|
echo "-- config.xml --"
|
|
sudo cat "$mnt"/config/config.xml 2>/dev/null | head -250 || true
|
|
done
|
|
|
|
hdr "DONE"
|