mi
266 lines
11 KiB
Bash
266 lines
11 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
ROOT=${1:-/opt/han-chat/services}
|
|
ENV_FILE=${2:-$ROOT/.env}
|
|
MANIFEST=${3:-/run/han-chat/secrets/manifest}
|
|
failures=0
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
[ "$(id -u)" -eq 0 ] || fail "preflight must inspect production files as root"
|
|
[ -f "$ROOT/docker-compose.yml" ] || fail "root docker-compose.yml is missing"
|
|
[ -d "$ROOT/message-safety" ] || fail "message-safety artifact directory is missing"
|
|
[ -d "$ROOT/bitrix-sync" ] || fail "bitrix-sync artifact directory is missing"
|
|
[ -f "$ENV_FILE" ] || fail ".env is missing"
|
|
[ -f "$MANIFEST" ] || fail "runtime secret manifest is missing"
|
|
[ -f /etc/han-chat/message-safety-mode.env ] ||
|
|
fail "root-owned Message Safety mode file is missing; initialize standard mode"
|
|
/usr/bin/getent group han-message-safety | /usr/bin/awk -F: '$3 == 10001 {found=1} END {exit !found}' ||
|
|
fail "han-message-safety group with GID 10001 is missing"
|
|
[ -x /opt/kaspersky/kesl/bin/kesl-control ] ||
|
|
fail "KESL 12.4 control utility is missing"
|
|
/usr/bin/systemctl is-active --quiet kesl.service ||
|
|
fail "kesl.service is not active"
|
|
/usr/bin/systemctl is-active --quiet han-kesl-scan-broker.socket ||
|
|
fail "KESL scan broker socket is not active"
|
|
[ "$(/usr/bin/stat -c '%U:%G:%a' /run/han-kesl 2>/dev/null || true)" = \
|
|
"root:han-message-safety:750" ] ||
|
|
fail "KESL broker runtime directory must be root:han-message-safety 0750"
|
|
[ -S /run/han-kesl/scan.sock ] || fail "KESL scan broker Unix socket is missing"
|
|
if [ -S /run/han-kesl/scan.sock ]; then
|
|
[ "$(/usr/bin/stat -c '%U:%G:%a' /run/han-kesl/scan.sock)" = \
|
|
"root:han-message-safety:660" ] ||
|
|
fail "KESL broker socket must be root:han-message-safety 0660"
|
|
fi
|
|
[ -x /usr/local/libexec/han-kesl-scan-broker ] &&
|
|
/usr/local/libexec/han-kesl-scan-broker --probe >/dev/null ||
|
|
fail "KESL scan broker readiness probe failed"
|
|
|
|
public_tls_dir=/var/lib/han-chat/public-tls
|
|
/usr/bin/getent group han-nginx-tls | /usr/bin/awk -F: '$3 == 11001 {found=1} END {exit !found}' ||
|
|
fail "han-nginx-tls group with GID 11001 is missing"
|
|
[ -d "$public_tls_dir" ] || fail "public TLS staging directory is missing"
|
|
for tls_file in fullchain.pem privkey.pem; do
|
|
path="$public_tls_dir/$tls_file"
|
|
[ -s "$path" ] || {
|
|
fail "public TLS file is missing or empty: $path"
|
|
continue
|
|
}
|
|
[ "$(/usr/bin/stat -c '%U:%G:%a' "$path")" = "root:han-nginx-tls:640" ] ||
|
|
fail "public TLS file must be root:han-nginx-tls 0640: $path"
|
|
done
|
|
|
|
if [ -f "$ENV_FILE" ]; then
|
|
if /usr/bin/grep -Eq '(^|_)(PASSWORD|SECRET|TOKEN|DATABASE_URL|REDIS_URL|PRIVATE_KEY|ACCESS_KEY)=' "$ENV_FILE"; then
|
|
fail ".env contains a secret-shaped key"
|
|
fi
|
|
if /usr/bin/grep -Eq '=<[^>]+>|change-me|example\.(com|org|net)' "$ENV_FILE"; then
|
|
fail ".env still contains placeholders"
|
|
fi
|
|
bitrix_enabled=$(/usr/bin/awk -F= '$1 == "BITRIX_SYNC_ENABLED" {print $2}' "$ENV_FILE")
|
|
bitrix_mode=$(/usr/bin/awk -F= '$1 == "BITRIX_SYNC_MODE" {print $2}' "$ENV_FILE")
|
|
case "$bitrix_enabled" in
|
|
true|false) ;;
|
|
*) fail "BITRIX_SYNC_ENABLED must be exactly true or false" ;;
|
|
esac
|
|
if { [ "$bitrix_enabled" = true ] && [ "$bitrix_mode" != full ]; } ||
|
|
{ [ "$bitrix_enabled" = false ] && [ "$bitrix_mode" != disabled ]; }; then
|
|
fail "BITRIX_SYNC_MODE must be full when enabled and disabled otherwise"
|
|
fi
|
|
otel_tls_insecure=$(/usr/bin/awk -F= \
|
|
'$1 == "OTEL_REMOTE_TLS_INSECURE" {print $2}' "$ENV_FILE")
|
|
case "$otel_tls_insecure" in
|
|
true|false) ;;
|
|
*) fail "OTEL_REMOTE_TLS_INSECURE must be exactly true or false" ;;
|
|
esac
|
|
for image_key in MESSAGE_SAFETY_IMAGE BITRIX_SYNC_IMAGE NGINX_IMAGE REDIS_IMAGE OTEL_COLLECTOR_IMAGE REDIS_EXPORTER_IMAGE NGINX_EXPORTER_IMAGE; do
|
|
image=$(/usr/bin/awk -F= -v key="$image_key" '$1 == key {print substr($0, index($0, "=") + 1)}' "$ENV_FILE")
|
|
echo "$image" | /usr/bin/grep -Eq '@sha256:[0-9a-f]{64}$' ||
|
|
fail "$image_key must be pinned by sha256 digest"
|
|
done
|
|
private_bind=$(/usr/bin/awk -F= '$1 == "PROCESSING_PRIVATE_BIND_ADDRESS" {print $2}' "$ENV_FILE")
|
|
case "$private_bind" in
|
|
""|0.0.0.0|::|127.*) fail "private 8443 bind address is unsafe" ;;
|
|
esac
|
|
fi
|
|
|
|
collector_config="$ROOT/observability/otel-collector.yaml"
|
|
[ -f "$collector_config" ] || fail "OpenTelemetry Collector config is missing"
|
|
if [ -f "$collector_config" ]; then
|
|
/usr/bin/grep -Fq 'service.namespace, value: han-chat' "$collector_config" ||
|
|
fail "Collector must enforce service.namespace=han-chat"
|
|
/usr/bin/grep -Fq 'receivers: [otlp, prometheus, hostmetrics]' "$collector_config" ||
|
|
fail "Collector metrics pipeline is incomplete"
|
|
/usr/bin/grep -Fq 'receivers: [otlp]' "$collector_config" ||
|
|
fail "Collector direct OTLP logs pipeline is missing"
|
|
! /usr/bin/grep -Fq 'filelog' "$collector_config" ||
|
|
fail "Collector filelog receiver is forbidden for direct OTLP logging"
|
|
/usr/bin/grep -Fq 'redis-exporter:9121' "$collector_config" ||
|
|
fail "Collector Redis exporter scrape target is missing"
|
|
/usr/bin/grep -Fq 'nginx-exporter:9113' "$collector_config" ||
|
|
fail "Collector nginx exporter scrape target is missing"
|
|
/usr/bin/grep -Fq 'tail_sampling:' "$collector_config" ||
|
|
fail "Collector tail sampling is missing"
|
|
fi
|
|
|
|
bitrix_allowlist="$ROOT/nginx/allowlists/bitrix-webhook-allowlist.conf"
|
|
private_allowlist="$ROOT/nginx/allowlists/private-caller-allowlist.conf"
|
|
for allowlist in "$bitrix_allowlist" "$private_allowlist"; do
|
|
[ -f "$allowlist" ] || {
|
|
fail "allow-list is missing: $allowlist"
|
|
continue
|
|
}
|
|
[ "$(/usr/bin/tail -n 1 "$allowlist" | /usr/bin/tr -d '[:space:]')" = "denyall;" ] ||
|
|
fail "allow-list must end in deny all: $allowlist"
|
|
done
|
|
|
|
if [ "${bitrix_enabled:-}" = true ]; then
|
|
/usr/bin/grep -Eq '^[[:space:]]*allow[[:space:]]+[^;]+;' "$bitrix_allowlist" ||
|
|
fail "enabled bitrix-sync requires reviewed webhook CIDRs"
|
|
else
|
|
! /usr/bin/grep -Eq '^[[:space:]]*allow[[:space:]]+[^;]+;' "$bitrix_allowlist" ||
|
|
fail "disabled bitrix-sync must keep public webhook allow-list closed"
|
|
fi
|
|
/usr/bin/grep -Eq '^[[:space:]]*allow[[:space:]]+[^;]+;' "$private_allowlist" ||
|
|
fail "private 8443 requires reviewed VM1/ops CIDRs"
|
|
|
|
required_secrets='
|
|
MESSAGE_SAFETY_DATABASE_URL
|
|
MESSAGE_SAFETY_CONFIG_ADMIN_DATABASE_URL
|
|
MESSAGE_SAFETY_REDIS_URL
|
|
MESSAGE_SAFETY_SERVICE_TOKEN
|
|
SELECTEL_S3_QUARANTINE_READ_ACCESS_KEY
|
|
SELECTEL_S3_QUARANTINE_READ_SECRET_KEY
|
|
VM2_INTERNAL_TLS_CERTIFICATE
|
|
VM2_INTERNAL_TLS_PRIVATE_KEY
|
|
BITRIX_SYNC_DATABASE_URL
|
|
BITRIX_SYNC_MIGRATION_DATABASE_URL
|
|
BITRIX_SYNC_CRM_REST_WEBHOOK_URL
|
|
BITRIX_SYNC_CONTACT_RECEIVER_TOKEN
|
|
BITRIX_SYNC_ALERT_RECEIVER_TOKEN
|
|
BITRIX_SYNC_SERVICE_TOKEN
|
|
REDIS_SAFETY_ACL
|
|
REDIS_EXPORTER_PASSWORD'
|
|
|
|
if [ -f "$MANIFEST" ]; then
|
|
old_ifs=$IFS
|
|
IFS='
|
|
'
|
|
for name in $required_secrets; do
|
|
[ -n "$name" ] || continue
|
|
path=$(/usr/bin/awk -F= -v key="$name" '$1 == key {print substr($0, index($0, "=") + 1)}' "$MANIFEST")
|
|
[ -n "$path" ] || {
|
|
fail "manifest is missing $name"
|
|
continue
|
|
}
|
|
[ -f "$path" ] || fail "secret file is missing for $name"
|
|
done
|
|
IFS=$old_ifs
|
|
|
|
redis_acl=$(/usr/bin/awk -F= \
|
|
'$1 == "REDIS_SAFETY_ACL" {print substr($0, index($0, "=") + 1)}' \
|
|
"$MANIFEST")
|
|
redis_exporter_password_file=$(/usr/bin/awk -F= \
|
|
'$1 == "REDIS_EXPORTER_PASSWORD" {print substr($0, index($0, "=") + 1)}' \
|
|
"$MANIFEST")
|
|
if [ -f "$redis_acl" ] && [ -f "$redis_exporter_password_file" ]; then
|
|
/usr/bin/grep -Eq '^user exporter reset on >[^[:space:]]+ -@all \+ping \+info$' "$redis_acl" ||
|
|
fail "Redis ACL must contain the restricted exporter user"
|
|
if exporter_password=$(/usr/bin/python3 -c '
|
|
import json
|
|
import sys
|
|
|
|
target = "redis://redis-safety:6379"
|
|
with open(sys.argv[1], encoding="utf-8") as source:
|
|
values = json.load(source)
|
|
if set(values) != {target}:
|
|
raise SystemExit("password map must contain exactly redis://redis-safety:6379")
|
|
password = values[target]
|
|
if not isinstance(password, str) or not password or any(char.isspace() for char in password):
|
|
raise SystemExit("password must be a non-empty whitespace-free string")
|
|
print(password, end="")
|
|
' "$redis_exporter_password_file"); then
|
|
/usr/bin/grep -Fq -- ">$exporter_password " "$redis_acl" ||
|
|
fail "Redis exporter password map does not match REDIS_SAFETY_ACL"
|
|
unset exporter_password
|
|
else
|
|
fail "REDIS_EXPORTER_PASSWORD must be a valid redis_exporter JSON password map"
|
|
fi
|
|
fi
|
|
|
|
internal_cert=$(/usr/bin/awk -F= \
|
|
'$1 == "VM2_INTERNAL_TLS_CERTIFICATE" {print substr($0, index($0, "=") + 1)}' \
|
|
"$MANIFEST")
|
|
internal_key=$(/usr/bin/awk -F= \
|
|
'$1 == "VM2_INTERNAL_TLS_PRIVATE_KEY" {print substr($0, index($0, "=") + 1)}' \
|
|
"$MANIFEST")
|
|
cert_valid=false
|
|
key_valid=false
|
|
if [ -f "$internal_cert" ] &&
|
|
/usr/bin/openssl x509 -in "$internal_cert" -noout >/dev/null 2>&1; then
|
|
cert_valid=true
|
|
else
|
|
fail "internal TLS certificate is not valid PEM"
|
|
fi
|
|
if [ -f "$internal_key" ] &&
|
|
/usr/bin/openssl pkey -in "$internal_key" -passin pass: \
|
|
-noout -check >/dev/null 2>&1; then
|
|
key_valid=true
|
|
else
|
|
fail "internal TLS private key is not valid unencrypted PEM"
|
|
fi
|
|
if [ "$cert_valid" = true ] && [ "$key_valid" = true ]; then
|
|
cert_public=$(
|
|
/usr/bin/openssl x509 -in "$internal_cert" -pubkey -noout |
|
|
/usr/bin/openssl pkey -pubin -outform DER 2>/dev/null |
|
|
/usr/bin/sha256sum | /usr/bin/awk '{print $1}'
|
|
)
|
|
key_public=$(
|
|
/usr/bin/openssl pkey -in "$internal_key" -passin pass: -pubout -outform DER 2>/dev/null |
|
|
/usr/bin/sha256sum | /usr/bin/awk '{print $1}'
|
|
)
|
|
[ "$cert_public" = "$key_public" ] ||
|
|
fail "internal TLS certificate and private key do not match"
|
|
fi
|
|
fi
|
|
|
|
mode_file=/etc/han-chat/message-safety-mode.env
|
|
if [ -f "$mode_file" ]; then
|
|
[ "$(/usr/bin/stat -c '%U:%G:%a' "$mode_file")" = root:han-message-safety:640 ] ||
|
|
fail "Message Safety mode file must be root:han-message-safety 0640"
|
|
mode_lines=$(/usr/bin/sort "$mode_file")
|
|
case "$mode_lines" in
|
|
*MESSAGE_SAFETY_MOCK_ENABLED=*MESSAGE_SAFETY_MOCK_FILE_FREE=*MESSAGE_SAFETY_MOCK_TEXT_FREE=*) ;;
|
|
*) fail "Message Safety mode file is incomplete" ;;
|
|
esac
|
|
fi
|
|
|
|
for protected in \
|
|
"$ROOT/docker-compose.yml" \
|
|
"$ROOT/deployment/han-message-safety-mode" \
|
|
"$ROOT/deployment/han-processing.service" \
|
|
"$ROOT/deployment/kesl/kesl_scan_broker.py" \
|
|
"$ROOT/deployment/kesl/han-kesl-scan-broker.service" \
|
|
"$ROOT/deployment/kesl/han-kesl-scan-broker.socket" \
|
|
"$ROOT/deployment/kesl/han-kesl-scan-broker.tmpfiles.conf"
|
|
do
|
|
[ -f "$protected" ] || continue
|
|
owner=$(/usr/bin/stat -c '%U:%G' "$protected")
|
|
[ "$owner" = root:root ] || fail "$protected must be root:root"
|
|
mode=$(/usr/bin/stat -c '%A' "$protected")
|
|
case "$mode" in
|
|
??????w???|????????w?) fail "$protected is writable by group/other" ;;
|
|
esac
|
|
done
|
|
|
|
if [ "$failures" -ne 0 ]; then
|
|
echo "preflight: $failures failure(s); deployment remains closed" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "preflight: static VM2 gates passed; run compose/nginx/TLS probes separately"
|