CHAT_OUTPUT_BEGIN
COMMAND_ID=READER-CHANGE-GATE-INTERFACE-AUDIT-330
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=cluster-audit
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752
COMMAND_SHA256=0c6a6c62888e384581527e16d35802a1835bef622617b27a301d9077cc33f923
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGES_MADE=false
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=cccc50fe97b2ddc7711107f77a40cbebc700089145145f641d4ae62f19876fdd
SANITIZED_OUTPUT_SHA256=1c4864ae4d0b36b1d2cf7d1376c7ffa5415174750f0eda9b0201fbb4bb84c1ac
OUTPUT_BEGIN
DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/test
DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sha256sum
DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/awk
DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/sed
DETAIL=LOCAL_DEPENDENCY=PASS:/usr/bin/bash
DETAIL=CHANGE_GATE_SHA256=90470653345baac426d1ff6d3e3b1109a611ef7ba8d98b7453be0f732ced3597
DETAIL=CHANGE_GATE_INTEGRITY=PASS
DETAIL=CHANGE_GATE_SYNTAX=PASS
DETAIL=CHANGE_GATE_LINE_COUNT=74
DETAIL=CHANGE_GATE_SOURCE_BEGIN
#!/usr/bin/bash
set -Eeuo pipefail

VM=/usr/local/sbin/homelab-vm130-exec
NG=/usr/local/sbin/homelab-edge-nginx-exec
VM_SHA=1959773393723b013af7c93cd29a7b833fd607c903d044e2fcef6accaa29c275
NG_SHA=f900b15bfdd19a1b543037cf8b9c1583e71dc8115bbb5812cf74d474e3e7859b
TARGET=/opt/npmplus/custom_nginx/server_proxy.conf
DIR=/opt/npmplus/custom_nginx

fail() {
    printf 'CHANGE_GATE_ERROR=%s\n' "$1" >&2
    exit "${2:-1}"
}

(( $# == 2 )) || fail USAGE 64
candidate=$1
expected_current=$2

[[ "$expected_current" =~ ^[0-9a-f]{64}$ ]] || fail EXPECTED_SHA 65
[[ -x "$VM" ]] || fail VM_MISSING 69
[[ -x "$NG" ]] || fail NGINX_HELPER_MISSING 69
[[ "$(/usr/bin/sha256sum "$VM" | /usr/bin/awk '{print $1}')" == "$VM_SHA" ]] || fail VM_INTEGRITY 70
[[ "$(/usr/bin/sha256sum "$NG" | /usr/bin/awk '{print $1}')" == "$NG_SHA" ]] || fail NGINX_HELPER_INTEGRITY 70

[[ -f "$candidate" && ! -L "$candidate" ]] || fail CANDIDATE_TYPE 66
meta=$(/usr/bin/stat -c '%U:%G|%a|%s' "$candidate")
IFS='|' read -r owner mode size <<<"$meta"
[[ "$owner" == root:root && "$mode" == 600 ]] || fail CANDIDATE_METADATA 66
[[ "$size" =~ ^[0-9]+$ ]] && (( size > 0 && size <= 8192 )) || fail CANDIDATE_SIZE 66

cap=$(/usr/bin/systemctl show homelab-reader-v3.service -p Environment --value |
      /usr/bin/sed -n 's/.*HOMELAB_READER_CAPABILITY=\([^ ]*\).*/\1/p')
[[ "$cap" =~ ^[0-9a-f]{64}$ ]] || fail CAPABILITY 67

tmp=$(/usr/bin/mktemp)
trap '/usr/bin/rm -f -- "$tmp"' EXIT
/usr/bin/printf '%s\n' \
  "location ^~ /.well-known/homelab-reader/${cap}/ {" \
  "    proxy_pass http://[PRIVATE_IP]:18788/${cap}/;" \
  '    proxy_http_version 1.1;' \
  '    proxy_set_header Host $host;' \
  '    proxy_set_header Connection "";' \
  '    proxy_buffering off;' \
  '    proxy_cache off;' \
  '}' >"$tmp"
/usr/bin/cmp -s "$candidate" "$tmp" || fail CANDIDATE_CONTENT 66
candidate_sha=$(/usr/bin/sha256sum "$candidate" | /usr/bin/awk '{print $1}')

target_meta=$("$VM" /usr/bin/stat -c '%U:%G|%a|%F' "$TARGET")
IFS='|' read -r target_owner target_mode target_type <<<"$target_meta"
[[ "$target_owner" == root:root && "$target_mode" == 644 && "$target_type" == regular*file ]] || fail TARGET_METADATA 68
current_sha=$("$VM" /usr/bin/sha256sum "$TARGET" | /usr/bin/awk '{print $1}')
[[ "$current_sha" == "$expected_current" ]] || fail TARGET_CHANGED 68

dir_meta=$("$VM" /usr/bin/stat -c '%U:%G|%a|%F' "$DIR")
IFS='|' read -r dir_owner dir_mode dir_type <<<"$dir_meta"
[[ "$dir_owner" == root:root && "$dir_mode" == 755 && "$dir_type" == directory ]] || fail DIR_METADATA 68
"$VM" /usr/bin/test -w "$DIR" || fail DIR_NOT_WRITABLE 68

"$NG" /usr/local/bin/nginx -t >/dev/null 2>&1 || fail NGINX_CONFIG 69
[[ "$(/usr/bin/curl -fsS -m5 "http://[PRIVATE_IP]:18788/${cap}/health")" == '{"status":"ok","version":3}' ]] || fail LOCAL_READER 69
[[ "$("$VM" /usr/bin/curl -fsS -m5 "http://[PRIVATE_IP]:18788/${cap}/health")" == '{"status":"ok","version":3}' ]] || fail EDGE_READER 69
[[ "$(/usr/bin/curl -sS -m8 --resolve git.gram1.ru:443:[PRIVATE_IP] -o /dev/null -w '%{http_code}' https://git.gram1.ru/)" == 200 ]] || fail GITEA 69

printf 'CHANGE_GATE=READY\n'
printf 'CANDIDATE_SHA256=%s\n' "$candidate_sha"
printf 'CURRENT_SHA256=%s\n' "$current_sha"
printf 'TARGET_METADATA=%s\n' "$target_meta"
printf 'TARGET_DIRECTORY_METADATA=%s\n' "$dir_meta"
printf 'NGINX_CURRENT_CONFIG=PASS\n'
printf 'LOCAL_READER_CHECK=PASS\n'
printf 'EDGE_READER_CHECK=PASS\n'
printf 'GITEA_CHECK=PASS\n'
DETAIL=CHANGE_GATE_SOURCE_END
DETAIL=CHANGE_GATE_SOURCE_TRUNCATED=NO
CHANGES_MADE=NO

OUTPUT_END
CHAT_OUTPUT_END