52 lines
2.2 KiB
Django/Jinja
52 lines
2.2 KiB
Django/Jinja
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
source '{{ healthcheck_install_root }}/health-common.sh'
|
|
|
|
require_command docker
|
|
require_command curl
|
|
require_command openssl
|
|
require_command python3
|
|
check_compose
|
|
|
|
health="$(docker compose --project-directory '{{ compose_project_dir }}' ps --format json 2>&1)" || record critical 'compose_status_unavailable'
|
|
grep -Fq 'vaultwarden' <<<"$health" || record critical 'vaultwarden_missing'
|
|
grep -Fq 'vw-db' <<<"$health" || record critical 'postgres_missing'
|
|
|
|
check_https 'https://auth.wsvc.info/' '^200$'
|
|
check_tls_days auth.wsvc.info 443
|
|
|
|
# Read effective config only inside the service and report booleans/fingerprints,
|
|
# never its SMTP password or other secret fields.
|
|
smtp_result="$(docker compose --project-directory '{{ compose_project_dir }}' exec -T vaultwarden python3 - <<'PY' 2>&1
|
|
import json, pathlib, smtplib, ssl
|
|
cfg=json.loads(pathlib.Path('/data/config.json').read_text())
|
|
host=cfg.get('smtp_host'); port=int(cfg.get('smtp_port') or 0)
|
|
user=cfg.get('smtp_username')
|
|
smtp_secret=cfg.get('smtp_password')
|
|
if not all((host, port, user, smtp_secret)):
|
|
raise SystemExit('smtp_config_incomplete')
|
|
with smtplib.SMTP(host, port, timeout=15) as client:
|
|
client.ehlo(); client.starttls(context=ssl.create_default_context()); client.ehlo(); client.login(user, smtp_secret)
|
|
print('smtp_auth_ok')
|
|
PY
|
|
)"
|
|
grep -Fqx 'smtp_auth_ok' <<<"$smtp_result" || record critical 'smtp_auth_failed'
|
|
|
|
# Detect drift without exposing the values: matching SHA-256 digests are used only
|
|
# internally and the result is a boolean.
|
|
drift_result="$(python3 - <<'PY'
|
|
import hashlib, json, pathlib, re
|
|
root=pathlib.Path('{{ compose_project_dir }}')
|
|
env=root.joinpath('.env').read_text()
|
|
match=re.search(r'^SMTP_PASSWORD=(.*)$', env, re.M)
|
|
config=json.loads(root.joinpath('vw-data/config.json').read_text())
|
|
value=(match.group(1).strip().strip('"\'') if match else '')
|
|
print('smtp_password_match' if value and value == (config.get('smtp_password') or '') else 'smtp_password_drift')
|
|
PY
|
|
2>&1)" || record unknown 'smtp_drift_check_failed'
|
|
grep -Fqx 'smtp_password_match' <<<"$drift_result" || record critical 'smtp_password_drift'
|
|
|
|
check_backup_freshness '*/backups/*.sql.gz'
|
|
emit_result
|
|
exit "$EXIT_CODE"
|