Add post-install verification script.

Document and add a reusable postinstall-check.sh to validate Gitea, external HAProxy health, SSH reachability, and backup presence after bootstrap. Made-with: Cursor
2026-04-21 22:14:21 +10:00
parent 57340e1349
commit 949c334e68
2 changed files with 150 additions and 0 deletions
@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Post-install checks for OwnGit topology:
+# - Gitea runs on current host
+# - HAProxy may be external and checked over SSH
+
+SERVER_DOMAIN="${SERVER_DOMAIN:-git.papatramp.ru}"
+GITEA_LOCAL_URL="${GITEA_LOCAL_URL:-http://127.0.0.1:3000}"
+CHECK_REMOTE_HAPROXY="${CHECK_REMOTE_HAPROXY:-true}"
+REMOTE_HAPROXY_HOST="${REMOTE_HAPROXY_HOST:-192.168.128.65}"
+REMOTE_HAPROXY_PORT="${REMOTE_HAPROXY_PORT:-22}"
+REMOTE_HAPROXY_USER="${REMOTE_HAPROXY_USER:-papatramp}"
+REMOTE_HAPROXY_PASSWORD="${REMOTE_HAPROXY_PASSWORD:-}"
+SSH_TEST_USER="${SSH_TEST_USER:-git}"
+SSH_TEST_PORT="${SSH_TEST_PORT:-2222}"
+
+PASS_COUNT=0
+WARN_COUNT=0
+FAIL_COUNT=0
+
+log()  { echo "[INFO] $*"; }
+pass() { echo "[PASS] $*"; PASS_COUNT=$((PASS_COUNT + 1)); }
+warn() { echo "[WARN] $*"; WARN_COUNT=$((WARN_COUNT + 1)); }
+fail() { echo "[FAIL] $*"; FAIL_COUNT=$((FAIL_COUNT + 1)); }
+
+run_check() {
+  local name="$1"
+  shift
+  if "$@"; then
+    pass "$name"
+  else
+    fail "$name"
+  fi
+}
+
+require_cmd() {
+  local c="$1"
+  if command -v "$c" >/dev/null 2>&1; then
+    return 0
+  fi
+  fail "Не найдена команда: $c"
+  return 1
+}
+
+remote_ssh() {
+  local cmd="$1"
+  local target="${REMOTE_HAPROXY_USER}@${REMOTE_HAPROXY_HOST}"
+  local opts=(-p "$REMOTE_HAPROXY_PORT" -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
+  if [[ -n "$REMOTE_HAPROXY_PASSWORD" ]]; then
+    SSHPASS="$REMOTE_HAPROXY_PASSWORD" sshpass -e ssh "${opts[@]}" "$target" "$cmd"
+  else
+    ssh "${opts[@]}" "$target" "$cmd"
+  fi
+}
+
+check_gitea_container() {
+  require_cmd docker || return 1
+  docker ps --format '{{.Names}} {{.Status}}' | grep -E '^gitea[[:space:]]+Up' >/dev/null
+}
+
+check_local_gitea_http() {
+  require_cmd curl || return 1
+  local code
+  code="$(curl -sS -o /dev/null -w '%{http_code}' "$GITEA_LOCAL_URL")"
+  [[ "$code" =~ ^(200|30[0-9]|401|403)$ ]]
+}
+
+check_public_https() {
+  require_cmd curl || return 1
+  local code
+  code="$(curl -sS -o /dev/null -w '%{http_code}' "https://${SERVER_DOMAIN}")"
+  [[ "$code" =~ ^(200|30[0-9]|401|403)$ ]]
+}
+
+check_ssh_port() {
+  if command -v nc >/dev/null 2>&1; then
+    nc -z -w 5 "$SERVER_DOMAIN" "$SSH_TEST_PORT" >/dev/null 2>&1
+    return $?
+  fi
+  if command -v timeout >/dev/null 2>&1; then
+    timeout 5 bash -c ">/dev/tcp/${SERVER_DOMAIN}/${SSH_TEST_PORT}" >/dev/null 2>&1
+    return $?
+  fi
+  warn "Нет nc/timeout для проверки порта ${SSH_TEST_PORT}, пропускаю."
+  return 0
+}
+
+check_haproxy_remote() {
+  require_cmd ssh || return 1
+  if [[ -n "$REMOTE_HAPROXY_PASSWORD" ]]; then
+    require_cmd sshpass || return 1
+  fi
+  remote_ssh "sudo haproxy -c -f /etc/haproxy/haproxy.cfg >/dev/null && sudo systemctl is-active --quiet haproxy"
+}
+
+check_remote_backup_presence() {
+  require_cmd ssh || return 1
+  if [[ -n "$REMOTE_HAPROXY_PASSWORD" ]]; then
+    require_cmd sshpass || return 1
+  fi
+  remote_ssh "ls -1 /etc/haproxy/haproxy.cfg.bak.* >/dev/null 2>&1"
+}
+
+main() {
+  log "Запускаю post-install проверки для ${SERVER_DOMAIN}"
+
+  run_check "Gitea контейнер запущен" check_gitea_container
+  run_check "Локальный HTTP Gitea отвечает (${GITEA_LOCAL_URL})" check_local_gitea_http
+  run_check "Публичный HTTPS отвечает (https://${SERVER_DOMAIN})" check_public_https
+  run_check "SSH порт доступен (${SERVER_DOMAIN}:${SSH_TEST_PORT})" check_ssh_port
+
+  if [[ "$CHECK_REMOTE_HAPROXY" == "true" ]]; then
+    run_check "Удаленный HAProxy валиден и active (${REMOTE_HAPROXY_HOST})" check_haproxy_remote
+    run_check "На удаленном HAProxy есть backup-конфиги" check_remote_backup_presence
+  else
+    warn "Проверка удаленного HAProxy пропущена (CHECK_REMOTE_HAPROXY=false)"
+  fi
+
+  echo
+  echo "Итог: PASS=${PASS_COUNT} WARN=${WARN_COUNT} FAIL=${FAIL_COUNT}"
+  if [[ "$FAIL_COUNT" -gt 0 ]]; then
+    exit 1
+  fi
+}
+
+main "$@"