Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -uo pipefail
+source '{{ healthcheck_install_root }}/health-common.sh'
+
+require_command docker
+require_command curl
+require_command openssl
+require_command python3
+check_compose
+
+health="$(docker compose --project-directory '{{ compose_project_dir }}' ps --format json 2>&1)" || record critical 'compose_status_unavailable'
+grep -Fq 'vaultwarden' <<<"$health" || record critical 'vaultwarden_missing'
+grep -Fq 'vw-db' <<<"$health" || record critical 'postgres_missing'
+
+check_https 'https://auth.wsvc.info/' '^200$'
+check_tls_days auth.wsvc.info 443
+
+# Read effective config only inside the service and report booleans/fingerprints,
+# never its SMTP password or other secret fields.
+smtp_result="$(docker compose --project-directory '{{ compose_project_dir }}' exec -T vaultwarden python3 - <<'PY' 2>&1
+import json, pathlib, smtplib, ssl
+cfg=json.loads(pathlib.Path('/data/config.json').read_text())
+host=cfg.get('smtp_host'); port=int(cfg.get('smtp_port') or 0)
+user=cfg.get('smtp_username')
+smtp_secret=cfg.get('smtp_password')
+if not all((host, port, user, smtp_secret)):
+    raise SystemExit('smtp_config_incomplete')
+with smtplib.SMTP(host, port, timeout=15) as client:
+    client.ehlo(); client.starttls(context=ssl.create_default_context()); client.ehlo(); client.login(user, smtp_secret)
+print('smtp_auth_ok')
+PY
+)"
+grep -Fqx 'smtp_auth_ok' <<<"$smtp_result" || record critical 'smtp_auth_failed'
+
+# Detect drift without exposing the values: matching SHA-256 digests are used only
+# internally and the result is a boolean.
+drift_result="$(python3 - <<'PY'
+import hashlib, json, pathlib, re
+root=pathlib.Path('{{ compose_project_dir }}')
+env=root.joinpath('.env').read_text()
+match=re.search(r'^SMTP_PASSWORD=(.*)$', env, re.M)
+config=json.loads(root.joinpath('vw-data/config.json').read_text())
+value=(match.group(1).strip().strip('"\'') if match else '')
+print('smtp_password_match' if value and value == (config.get('smtp_password') or '') else 'smtp_password_drift')
+PY
+ 2>&1)" || record unknown 'smtp_drift_check_failed'
+grep -Fqx 'smtp_password_match' <<<"$drift_result" || record critical 'smtp_password_drift'
+
+check_backup_freshness '*/backups/*.sql.gz'
+emit_result
+exit "$EXIT_CODE"