56 lines
2.9 KiB
Bash
56 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Reproducible local syntax check. Fake credentials only; no published ports or VPS access.
|
|
set -euo pipefail
|
|
root=$(cd "$(dirname "$0")/../../.." && pwd)
|
|
cd "$root"
|
|
fixtures="$root/agents/codex/notes/r5-fixtures"
|
|
mkdir -p "$fixtures"
|
|
chmod 755 "$fixtures"
|
|
docker run --rm --name randomayzer-caddy-hash-fixture --network none --user 65534:65534 --cap-drop ALL --cap-add NET_BIND_SERVICE --security-opt no-new-privileges:true caddy:2.8-alpine caddy hash-password --plaintext FAKE_R5_CONFIG_TEST_ONLY > "$fixtures/fake-bcrypt.txt"
|
|
python3 - <<'PY'
|
|
from pathlib import Path
|
|
root=Path('agents/codex/notes/r5-fixtures')
|
|
h=(root/'fake-bcrypt.txt').read_text().strip()
|
|
assert h.startswith('$2'), 'Fake hash generation failed'
|
|
s=Path('deploy/randomayzer.Caddyfile').read_text()
|
|
assert s.count('owner BASIC_AUTH_HASH') == 1
|
|
p=root/'Caddyfile';p.write_text(s.replace('owner BASIC_AUTH_HASH','owner '+h));p.chmod(0o644)
|
|
s=Path('deploy/randomayzer.haproxy.cfg').read_text()
|
|
tls='\n'.join(x for x in s.splitlines() if x.startswith(('acl ','use_backend '))).replace('CADDY_TLS_BACKEND_FROM_ACTIVE_CONFIG','fixture_caddy_tls')
|
|
http='\n'.join(x[2:] for x in s.splitlines() if x.startswith(('# acl randomayzer_http','# use_backend CADDY_HTTP'))).replace('CADDY_HTTP_BACKEND_FROM_ACTIVE_CONFIG','fixture_caddy_http')
|
|
assert 'use_backend fixture_caddy_tls' in tls
|
|
assert 'use_backend fixture_caddy_http' in http
|
|
config='''global
|
|
master-worker
|
|
defaults
|
|
mode tcp
|
|
timeout connect 5s
|
|
timeout client 10s
|
|
timeout server 10s
|
|
frontend fixture_tls
|
|
bind :8443
|
|
tcp-request inspect-delay 5s
|
|
tcp-request content accept if { req.ssl_hello_type 1 }
|
|
'''+''.join(' '+x+'\n' for x in tls.splitlines())+''' default_backend fixture_other_tls
|
|
frontend fixture_http
|
|
mode http
|
|
bind :8080
|
|
'''+''.join(' '+x+'\n' for x in http.splitlines())+''' default_backend fixture_other_http
|
|
backend fixture_caddy_tls
|
|
mode tcp
|
|
server caddy 127.0.0.1:9443
|
|
backend fixture_other_tls
|
|
mode tcp
|
|
server other 127.0.0.1:9444
|
|
backend fixture_caddy_http
|
|
mode http
|
|
server caddy 127.0.0.1:9080
|
|
backend fixture_other_http
|
|
mode http
|
|
server other 127.0.0.1:9081
|
|
'''
|
|
p=root/'haproxy.cfg';p.write_text(config);p.chmod(0o644)
|
|
PY
|
|
docker run --rm --name randomayzer-caddy28-validate --network none --user 65534:65534 --cap-drop ALL --cap-add NET_BIND_SERVICE --security-opt no-new-privileges:true -e XDG_DATA_HOME=/tmp/caddy-data -e XDG_CONFIG_HOME=/tmp/caddy-config -v "$fixtures/Caddyfile:/etc/caddy/Caddyfile:ro" caddy:2.8-alpine caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
|
|
docker run --rm --name randomayzer-haproxy30-validate --network none --cap-drop ALL --security-opt no-new-privileges:true -v "$fixtures/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro" haproxy:3.0-alpine haproxy -c -V -f /usr/local/etc/haproxy/haproxy.cfg
|
|
printf 'PASS local Caddy 2.8 / HAProxy 3.0 template syntax (fake fixture, not live VPS acceptance)\n'
|