Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -uo pipefail
+source '{{ healthcheck_install_root }}/health-common.sh'
+
+require_command docker
+require_command curl
+require_command dig
+check_compose
+
+image="$(docker inspect pdns-auth --format '{{ '{{' }}.Config.Image{{ '}}' }}' 2>/dev/null)" || record critical 'pdns_container_missing'
+grep -Eq ':5\.0\.[6-9]|:5\.[1-9]\.' <<<"$image" || record warning 'pdns_version_not_confirmed'
+security="$(docker logs pdns-auth 2>&1 | grep -i 'Mandatory.*Security Update' || true)"
+[[ -z "$security" ]] || record critical 'pdns_security_update_banner'
+
+# The API key remains in the container environment; the request emits only the
+# reported version and no authentication material.
+api="$(docker compose --project-directory '{{ compose_project_dir }}' exec -T auth python3 - <<'PY' 2>&1
+import json, os, urllib.request
+request=urllib.request.Request('http://127.0.0.1:8081/api/v1/servers/localhost', headers={'X-API-Key': os.environ['PDNS_API_KEY']})
+print(json.load(urllib.request.urlopen(request, timeout=10))['version'])
+PY
+)" || record critical 'pdns_api_failed'
+grep -Eq '^5\.' <<<"$api" || record critical 'pdns_api_version_invalid'
+
+for zone in windy.me wsvc.info chans.xyz; do
+  primary="$(dig +short @154.36.174.161 SOA "$zone" 2>/dev/null)"
+  secondary="$(dig +short @202.91.35.141 SOA "$zone" 2>/dev/null)"
+  [[ -n "$primary" ]] || record critical "soa_primary_missing_${zone}"
+  [[ -n "$secondary" ]] || record critical "soa_secondary_missing_${zone}"
+  [[ "$primary" == "$secondary" ]] || record warning "soa_secondary_lag_${zone}"
+done
+
+check_https 'https://pdns.wsvc.info/' '^30[12]$'
+check_https 'https://pgweb.wsvc.info/' '^(200|401)$'
+check_backup_freshness '*/backup/*.sql.gz'
+emit_result
+exit "$EXIT_CODE"