Admin/han-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ВМ1: реализован сбор логов

Browse Source
This commit is contained in:
mi
2026-09-07 12:46:45 +03:00
parent 44db38f6fe
commit 85df788f2d
42 changed files with 1669 additions and 310 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VM1_app/codebase/backend/deployment/preflight.sh
+40
View File
@@ -19,6 +19,7 @@ value() {
[ -f "$ROOT/docker-compose.yml" ] || fail "root docker-compose.yml is missing"
[ -f "$ENV_FILE" ] || fail ".env is missing"
[ -f "$MANIFEST" ] || fail "runtime secret manifest is missing"
[ -d /var/log/journal ] || fail "persistent journald directory is missing"
[ -L /opt/han-chat/current ] || fail "/opt/han-chat/current must be a root-controlled release link"
[ "$(/usr/bin/stat -c '%U:%G' /opt/han-chat/current)" = root:root ] ||
fail "active release link must be root:root"
@@ -59,6 +60,8 @@ if [ -d "$ROOT" ]; then
$ROOT/docker-compose.yml
$ROOT/deployment/preflight.sh
$ROOT/deployment/han-stack@.service
$ROOT/deployment/han-host-otel-collector@.service
$ROOT/deployment/observability/otel-host-collector.yaml
$ROOT/deployment/scripts/tls-deploy-hook.sh
$ROOT/deployment/secrets/han-compose
$ROOT/deployment/secrets/han-secrets
@@ -91,6 +94,10 @@ if [ -f "$ENV_FILE" ]; then
[ "$(value NGINX_TLS_ENABLED)" = true ] || fail "NGINX_TLS_ENABLED must be true"
[ "$(value NGINX_HTTP_PORT)" = 80 ] || fail "nginx must publish host port 80"
[ "$(value NGINX_HTTPS_PORT)" = 443 ] || fail "nginx must publish host port 443"
[ -n "$(value HOST_NAME)" ] || fail "HOST_NAME is required for telemetry correlation"
echo "$(value TELEMETRYGEN_IMAGE)" |
grep -Eq '^ghcr\.io/.+@sha256:[a-f0-9]{64}$' ||
fail "TELEMETRYGEN_IMAGE must be pinned by digest"
[ "$(value NGINX_TLS_CERTIFICATE)" = /run/tls/fullchain.pem ] ||
fail "nginx certificate must use staged /run/tls/fullchain.pem"
[ "$(value NGINX_TLS_CERTIFICATE_KEY)" = /run/tls/privkey.pem ] ||
@@ -278,6 +285,39 @@ if [ -f "$MANIFEST" ]; then
IFS=$old_ifs
fi
host_otel_config="$ROOT/deployment/observability/otel-host-collector.yaml"
if [ -f "$host_otel_config" ]; then
grep -Fq 'filelog/docker' "$host_otel_config" ||
fail "host collector must include Docker filelog"
grep -Fq 'journald/host' "$host_otel_config" ||
fail "host collector must include journald allow-list"
grep -Fq 'filter/allowlist' "$host_otel_config" ||
fail "host collector must drop non-allowlisted containers"
grep -Fq 'file_storage' "$host_otel_config" ||
fail "host collector must persist offsets and exporter queue"
! grep -Fq '/var/run/docker.sock' "$host_otel_config" ||
fail "Docker socket access is forbidden"
fi
[ -x /usr/local/bin/otelcol-contrib ] ||
fail "pinned host otelcol-contrib is not installed"
otel_checksum=/usr/local/share/han-otel/otelcol-contrib.sha256
otel_version=/usr/local/share/han-otel/otelcol-contrib.version
[ -f "$otel_checksum" ] || fail "host Collector checksum record is missing"
[ -f "$otel_version" ] || fail "host Collector version record is missing"
if [ -f "$otel_checksum" ]; then
(cd / && sha256sum -c "$otel_checksum") ||
fail "host Collector binary checksum mismatch"
fi
if [ -x /usr/local/bin/otelcol-contrib ] && [ -f "$otel_version" ]; then
/usr/local/bin/otelcol-contrib --version 2>&1 |
grep -Fq "$(cat "$otel_version")" ||
fail "host Collector binary version mismatch"
fi
if [ -x /usr/local/bin/otelcol-contrib ] && [ -f "$host_otel_config" ]; then
/usr/local/bin/otelcol-contrib validate --config="$host_otel_config" ||
fail "host collector config validation failed"
fi
if [ -x "$ROOT/scripts/validate-env" ] && [ -f "$ENV_FILE" ] && [ -f "$MANIFEST" ]; then
"$ROOT/scripts/validate-env" "$ENV_FILE" --runtime-manifest "$MANIFEST" ||
fail "config/runtime validator rejected the production inputs"