AkurAI-Build

Latest change b2fb6810b8844f39a9752f65118c05ffecf28160 - Fold AkurAI EC2 operations into Build CLI by Ólafur Búi Ólafsson

set -euo pipefail
domain="$1"; warn_days="$2"; recipient="$3"
sudo install -d -o root -g root -m 0755 /usr/local/libexec
sudo install -d -o bunfork -g bunfork -m 0700 /var/lib/bunfork-monitor
sudo tee /usr/local/libexec/bunfork-monitor >/dev/null <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
domain="${BUNFORK_MONITOR_DOMAIN:?}"
warn_days="${BUNFORK_TLS_WARN_DAYS:?}"
curl --fail --silent --show-error --output /dev/null --max-time 15 \
  "https://$domain/_bunfork/ready"
python3 - "$domain" "$warn_days" <<'PY'
import datetime, socket, ssl, sys
host, warning_days = sys.argv[1], int(sys.argv[2])
context = ssl.create_default_context()
with socket.create_connection((host, 443), timeout=10) as raw:
    with context.wrap_socket(raw, server_hostname=host) as tls:
        certificate = tls.getpeercert()
expiry = datetime.datetime.strptime(
    certificate["notAfter"], "%b %d %H:%M:%S %Y %Z"
).replace(tzinfo=datetime.timezone.utc)
remaining = int((expiry - datetime.datetime.now(datetime.timezone.utc)).total_seconds() // 86400)
if remaining < warning_days:
    raise SystemExit(f"TLS certificate has {remaining} days remaining; threshold is {warning_days}")
print(f"https_ready=true tls_hostname_verified=true tls_days_remaining={remaining}")
PY
rm -f /var/lib/bunfork-monitor/last-alert
SCRIPT
sudo tee /usr/local/libexec/bunfork-monitor-alert >/dev/null <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
umask 0077
unit="${1:-bunfork-monitor.service}"
recipient="${BUNFORK_MONITOR_RECIPIENT:?}"
state=/var/lib/bunfork-monitor/last-alert
now="$(date +%s)"
last=0
[ ! -e "$state" ] || last="$(stat -c %Y "$state")"
if [ $((now - last)) -lt 21600 ]; then
  exit 0
fi
{
  printf 'To: %s\n' "$recipient"
  printf 'From: Bunfork monitor <root@mail.olibuijr.com>\n'
  printf 'Subject: Bunfork production monitor failed\n'
  printf 'Content-Type: text/plain; charset=UTF-8\n\n'
  printf 'Bunfork production readiness or TLS verification failed.\n'
  printf 'Unit: %s\n' "$unit"
  printf 'Host: bunfork.olibuijr.com\n'
  printf 'Inspect with: akurai-ec2 logs bunfork-monitor\n'
} | /usr/sbin/sendmail -t
touch "$state"
SCRIPT
sudo chown root:root /usr/local/libexec/bunfork-monitor /usr/local/libexec/bunfork-monitor-alert
sudo chmod 0755 /usr/local/libexec/bunfork-monitor /usr/local/libexec/bunfork-monitor-alert
sudo tee /etc/systemd/system/bunfork-monitor.service >/dev/null <<UNIT
[Unit]
Description=Verify Bunfork HTTPS readiness and TLS lifetime
After=network-online.target
Wants=network-online.target
OnFailure=bunfork-monitor-alert@%n.service

[Service]
Type=oneshot
User=bunfork
Group=bunfork
Environment=BUNFORK_MONITOR_DOMAIN=$domain
Environment=BUNFORK_TLS_WARN_DAYS=$warn_days
ExecStart=/usr/local/libexec/bunfork-monitor
UMask=0077
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/bunfork-monitor
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictSUIDSGID=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target
UNIT
sudo tee /etc/systemd/system/bunfork-monitor-alert@.service >/dev/null <<UNIT
[Unit]
Description=Send bounded Bunfork monitor failure alert for %i

[Service]
Type=oneshot
User=bunfork
Group=bunfork
Environment=BUNFORK_MONITOR_RECIPIENT=$recipient
ExecStart=/usr/local/libexec/bunfork-monitor-alert %i
UMask=0077
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/bunfork-monitor
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictSUIDSGID=true
RestrictAddressFamilies=AF_UNIX
UNIT
sudo tee /etc/systemd/system/bunfork-monitor.timer >/dev/null <<'UNIT'
[Unit]
Description=Frequent Bunfork production readiness and TLS check

[Timer]
OnBootSec=2m
OnUnitActiveSec=15m
RandomizedDelaySec=1m
Persistent=true
Unit=bunfork-monitor.service

[Install]
WantedBy=timers.target
UNIT
sudo systemctl daemon-reload
sudo systemd-analyze verify /etc/systemd/system/bunfork-monitor.service \
  /etc/systemd/system/bunfork-monitor-alert@.service \
  /etc/systemd/system/bunfork-monitor.timer
sudo systemctl enable --now bunfork-monitor.timer
sudo systemctl start bunfork-monitor.service