Initial own-git docs, configs, scripts, and hardening pack

2026-04-21 21:37:43 +10:00
commit f5899ebc56
25 changed files with 1843 additions and 0 deletions
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Быстрый preflight для проверки готовности own-git инфраструктуры.
+# Можно запускать локально или на сервере.
+
+GIT_DOMAIN="${GIT_DOMAIN:-git.papatramp.ru}"
+GITEA_LAN_IP="${GITEA_LAN_IP:-192.168.128.100}"
+GITEA_HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
+GITEA_SSH_PORT="${GITEA_SSH_PORT:-2222}"
+HA_PROXY_HTTP_PORT="${HA_PROXY_HTTP_PORT:-80}"
+HA_PROXY_HTTPS_PORT="${HA_PROXY_HTTPS_PORT:-443}"
+
+have_cmd() { command -v "$1" >/dev/null 2>&1; }
+
+check_port() {
+  local host="$1"
+  local port="$2"
+  if have_cmd nc; then
+    nc -z -w 3 "$host" "$port" >/dev/null 2>&1
+  elif have_cmd timeout; then
+    timeout 3 bash -c "cat < /dev/null > /dev/tcp/$host/$port" >/dev/null 2>&1
+  else
+    echo "  [WARN] neither nc nor timeout available, skip port test $host:$port"
+    return 0
+  fi
+}
+
+ok()   { echo "[OK]   $*"; }
+warn() { echo "[WARN] $*"; }
+err()  { echo "[ERR]  $*"; }
+
+echo "== own-git preflight =="
+echo "GIT_DOMAIN=$GIT_DOMAIN"
+echo "GITEA_LAN_IP=$GITEA_LAN_IP"
+echo
+
+if have_cmd dig; then
+  DNS_RESULT="$(dig +short "$GIT_DOMAIN" | tr '\n' ' ' || true)"
+  if [[ -n "${DNS_RESULT// }" ]]; then
+    ok "DNS resolve: $GIT_DOMAIN -> $DNS_RESULT"
+  else
+    warn "DNS empty for $GIT_DOMAIN"
+  fi
+elif have_cmd getent; then
+  DNS_RESULT="$(getent hosts "$GIT_DOMAIN" || true)"
+  if [[ -n "$DNS_RESULT" ]]; then
+    ok "DNS resolve via getent: $DNS_RESULT"
+  else
+    warn "DNS empty for $GIT_DOMAIN"
+  fi
+else
+  warn "no dig/getent, DNS check skipped"
+fi
+
+if check_port "$GIT_DOMAIN" "$HA_PROXY_HTTP_PORT"; then
+  ok "Port open: $GIT_DOMAIN:$HA_PROXY_HTTP_PORT"
+else
+  warn "Port closed/unreachable: $GIT_DOMAIN:$HA_PROXY_HTTP_PORT"
+fi
+
+if check_port "$GIT_DOMAIN" "$HA_PROXY_HTTPS_PORT"; then
+  ok "Port open: $GIT_DOMAIN:$HA_PROXY_HTTPS_PORT"
+else
+  warn "Port closed/unreachable: $GIT_DOMAIN:$HA_PROXY_HTTPS_PORT"
+fi
+
+if check_port "$GIT_DOMAIN" "$GITEA_SSH_PORT"; then
+  ok "Port open: $GIT_DOMAIN:$GITEA_SSH_PORT (SSH through HAProxy)"
+else
+  warn "Port closed/unreachable: $GIT_DOMAIN:$GITEA_SSH_PORT"
+fi
+
+if have_cmd curl; then
+  if curl -fsS -m 5 "http://$GITEA_LAN_IP:$GITEA_HTTP_PORT/api/healthz" >/dev/null; then
+    ok "Gitea LAN healthz OK: http://$GITEA_LAN_IP:$GITEA_HTTP_PORT/api/healthz"
+  else
+    warn "Gitea LAN healthz failed: http://$GITEA_LAN_IP:$GITEA_HTTP_PORT/api/healthz"
+  fi
+
+  if curl -fsS -m 8 "https://$GIT_DOMAIN/api/healthz" >/dev/null; then
+    ok "Public healthz OK: https://$GIT_DOMAIN/api/healthz"
+  else
+    warn "Public healthz failed: https://$GIT_DOMAIN/api/healthz"
+  fi
+else
+  warn "curl not found, HTTP checks skipped"
+fi
+
+if have_cmd ssh; then
+  if ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -p "$GITEA_SSH_PORT" "git@$GIT_DOMAIN" exit >/dev/null 2>&1; then
+    ok "SSH handshake OK (auth may still be key-dependent)"
+  else
+    warn "SSH check failed or key not configured: ssh -p $GITEA_SSH_PORT git@$GIT_DOMAIN"
+  fi
+else
+  warn "ssh not found, SSH check skipped"
+fi
+
+echo
+echo "Preflight complete."