ef102b9657
Adds the Blueforce Field OS provisioning stack on top of the existing fleet architecture, without rewriting the working systems (installer, diagnostics, Ansible, WireGuard/SSH/xRDP/RustDesk, Docker policies, monitoring, Docusaurus). ISO build (the previous builder was a skeleton that produced no medium): - boot layout is read from the base ISO at build time via `xorriso -report_el_torito as_mkisofs` and rebuilt with `-as mkisofs`; `-boot_image any replay` cannot work on Ubuntu live ISOs because the GRUB2 MBR lives in the source image's first 16 sectors and the EFI system partition is an appended partition, neither of which is a file in the ISO9660 tree - preflight now asserts El Torito boot metadata positively: xorriso exits 0 on a non-ISO input, which previously let an arbitrary file pass --check - artifact produced and verified: dist/Blueforce-Field-OS-1.0.0-amd64.iso, 6 481 917 952 bytes, SHA256 cb0cc56f...d431296, BIOS+UEFI entries preserved, /autoinstall.yaml at the media root, casper/minimal.squashfs byte-identical to the base - recorded baseline deviation: the verified medium on the build host is the Desktop flavour, so the manifest carries a baseline_deviation block instead of hiding it; Server remains one flag away Offline and identity: - offline APT contract with concrete package requirements, pin format and an audit table; builds fail closed while pins are UNPINNED - autoinstall keeps interactive-sections: [storage]: the operator confirms the target disk, and no automatic wipe is ever performed - firstboot terminal wizard for the 8-digit dealer id, three-state lifecycle (PROVISIONED_OFFLINE -> ENROLLED -> READY) with fail-closed gates, so a missing internet link or WireGuard handshake cannot fail provisioning but can never produce a false READY Fleet and migration: - five read-only Ansible playbooks for Field OS version, provisioning, enrollment, remote channels and offline readiness, all wave-scoped with a separate production override - Windows pre-migration inventory and data export extended to the full brief scope, read-only, never collecting credentials Tests: tests/run-all.sh -> 8/8 pass, exit 0. Boot acceptance (UEFI, Legacy BIOS, Secure Boot), air-gapped install, real enrollment endpoint and Windows rollback remain LAB work and are listed in IMPLEMENTATION-REPORT.md.
252 lines
11 KiB
Bash
Executable file
252 lines
11 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# bf-status - Quick health glance for a Blueforce field terminal.
|
|
#
|
|
# Output contract: docs/14-MONITORING-AND-HEALTH.md ("bf-status ornek ciktisi")
|
|
# for the health block, plus the Field OS lifecycle block defined by
|
|
# docs/29-DEVICE-ENROLLMENT.md and provisioning/enrollment/README.md:
|
|
#
|
|
# Provisioning : PROVISIONED_OFFLINE | COMPLETE
|
|
# Enrollment : PENDING | ENROLLED | COMPLETE
|
|
# Fleet State : NOT READY | READY
|
|
#
|
|
# The lifecycle block is derived read-only from /var/lib/blueforce/state.json
|
|
# (override with BF_STATE_FILE). A missing state file shows PENDING, and a
|
|
# contract-violating state (skipped stage, backwards move, READY without
|
|
# verified central evidence) shows INVALID and counts as a critical alert.
|
|
# Never prints secrets, keys, or passwords.
|
|
#
|
|
# Install: install -m 0755 bf-status /usr/local/bin/bf-status
|
|
# Usage: bf-status [--help]
|
|
#
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage: bf-status [--help]
|
|
|
|
Print the BLUEFORCE FIELD TERMINAL health summary: the Field OS lifecycle
|
|
block (docs/29) followed by the 16-line health block (docs/14).
|
|
|
|
Lifecycle vocabulary:
|
|
Provisioning : PROVISIONED_OFFLINE | COMPLETE | PENDING
|
|
Enrollment : PENDING | ENROLLED | COMPLETE
|
|
Fleet State : NOT READY | READY
|
|
|
|
Options:
|
|
--help Show this help and exit
|
|
|
|
Exit status is always 0; individual failing probes report DOWN/UNKNOWN
|
|
inline instead of aborting the report.
|
|
EOF
|
|
}
|
|
|
|
if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
|
|
usage
|
|
exit 0
|
|
elif [[ $# -gt 0 ]]; then
|
|
echo "ERROR: unknown argument: $1" >&2; usage >&2; exit 2
|
|
fi
|
|
|
|
# Never abort the report on a failing probe.
|
|
set +e
|
|
|
|
HOST="$(hostname 2>/dev/null || echo unknown)"
|
|
DEVICE_ID="$(echo "${HOST}" | tr '[:lower:]' '[:upper:]')"
|
|
NOW="$(date '+%Y-%m-%d %H:%M %z' 2>/dev/null || echo unknown)"
|
|
OVERALL="OK"
|
|
|
|
uptime_str() {
|
|
uptime -p 2>/dev/null | sed 's/^up //' || echo unknown
|
|
}
|
|
load_str() {
|
|
awk '{print $1, $2, $3}' /proc/loadavg 2>/dev/null || echo "unknown"
|
|
}
|
|
cpu_pct() {
|
|
# 1-second sample from /proc/stat.
|
|
read -r _ a b c d e f g h i j < /proc/stat 2>/dev/null || { echo "?"; return; }
|
|
idle1=$((d + e)); total1=$((a+b+c+d+e+f+g+h+i+j))
|
|
sleep 1
|
|
read -r _ a b c d e f g h i j < /proc/stat 2>/dev/null || { echo "?"; return; }
|
|
idle2=$((d + e)); total2=$((a+b+c+d+e+f+g+h+i+j))
|
|
dt=$((total2 - total1)); di=$((idle2 - idle1))
|
|
if [[ "${dt}" -le 0 ]]; then echo "?"; else echo $(( (100 * (dt - di)) / dt )); fi
|
|
}
|
|
mem_str() {
|
|
local avail total
|
|
avail="$(awk '/MemAvailable/ {print $2}' /proc/meminfo 2>/dev/null)"
|
|
total="$(awk '/MemTotal/ {print $2}' /proc/meminfo 2>/dev/null)"
|
|
if [[ -n "${avail}" && -n "${total}" && "${total}" -gt 0 ]]; then
|
|
local used=$((total - avail))
|
|
local pct=$((100 * used / total))
|
|
printf '%s/%sG (%s%%)' \
|
|
"$(awk -v v="${used}" 'BEGIN{printf "%.1f", v/1048576}')" \
|
|
"$(awk -v v="${total}" 'BEGIN{printf "%.1f", v/1048576}')" \
|
|
"${pct}"
|
|
else
|
|
echo "unknown"
|
|
fi
|
|
}
|
|
disk_str() {
|
|
df -BG / 2>/dev/null | awk 'NR==2 {gsub(/G/,"",$2); gsub(/G/,"",$3); gsub(/%/,"",$5); printf "%s/%sG (%s%%)", $3, $2, $5}' || echo "unknown"
|
|
}
|
|
svc_state() { # $1 = unit
|
|
if ! command -v systemctl >/dev/null 2>&1; then echo "UNKNOWN"; return; fi
|
|
if systemctl is-active --quiet "$1" 2>/dev/null; then echo "OK"; return; fi
|
|
if systemctl list-unit-files --type=service 2>/dev/null | grep -q "^$1"; then echo "DOWN"; else echo "OFF"; fi
|
|
}
|
|
wg_info() {
|
|
if ! command -v wg >/dev/null 2>&1; then echo "wg0 MISSING (no wg tool)"; return; fi
|
|
if ! ip link show wg0 >/dev/null 2>&1; then echo "wg0 DOWN (no interface)"; return; fi
|
|
local hs
|
|
hs="$(wg show wg0 latest-handshakes 2>/dev/null | awk '{print $2}' | head -1)"
|
|
if [[ -z "${hs}" || "${hs}" == "0" ]]; then echo "wg0 UP, no handshake yet"; return; fi
|
|
local now ago
|
|
now="$(date +%s)"; ago=$((now - hs))
|
|
echo "wg0 UP, handshake ${ago}s ago"
|
|
}
|
|
net_counters() {
|
|
local rx=0 tx=0 f
|
|
for f in /sys/class/net/*/statistics/rx_bytes; do rx=$((rx + $(cat "$f" 2>/dev/null || echo 0))); done
|
|
for f in /sys/class/net/*/statistics/tx_bytes; do tx=$((tx + $(cat "$f" 2>/dev/null || echo 0))); done
|
|
echo "rx $(numfmt --to=iec "$rx" 2>/dev/null || echo "$rx") tx $(numfmt --to=iec "$tx" 2>/dev/null || echo "$tx")"
|
|
}
|
|
docker_info() {
|
|
if ! command -v docker >/dev/null 2>&1; then echo "daemon MISSING"; return; fi
|
|
if docker info >/dev/null 2>&1; then echo "daemon UP"; else echo "daemon DOWN"; fi
|
|
}
|
|
meg_info() {
|
|
# MEG container name convention: meg-* ; report first match.
|
|
if ! command -v docker >/dev/null 2>&1 || ! docker info >/dev/null 2>&1; then echo "meg:unknown (docker down)"; return; fi
|
|
local line
|
|
line="$(docker ps --format '{{.Names}} {{.Status}} {{.RestartCount}}' 2>/dev/null | grep -i '^meg' | head -1)"
|
|
if [[ -z "${line}" ]]; then echo "meg NOT RUNNING"; return; fi
|
|
echo "${line}"
|
|
}
|
|
meg_last_success() {
|
|
local f="/var/lib/blueforce/meg_last_success"
|
|
if [[ -f "${f}" ]]; then
|
|
local ts now
|
|
ts="$(cat "${f}" 2>/dev/null | tr -d '[:space:]')"
|
|
now="$(date +%s)"
|
|
if [[ "${ts}" =~ ^[0-9]+$ ]]; then echo "UP, last success $((now - ts))s ago"; else echo "UP, last success unknown"; fi
|
|
else
|
|
echo "unknown (no timestamp file)"
|
|
fi
|
|
}
|
|
unattended_state() {
|
|
local masked="no" cfg="unknown"
|
|
if systemctl is-enabled apt-daily.timer 2>/dev/null | grep -q masked; then masked="yes"; fi
|
|
if grep -Eq '"0"' /etc/apt/apt.conf.d/20auto-upgrades 2>/dev/null; then cfg="0"; fi
|
|
if [[ "${masked}" == "yes" && "${cfg}" == "0" ]]; then echo "DISABLED (timer masked)"; else echo "CHECK (timer/cfg drift)"; fi
|
|
}
|
|
ufw_str() {
|
|
if ! command -v ufw >/dev/null 2>&1; then echo "ufw not installed"; return; fi
|
|
if ufw status 2>/dev/null | head -1 | grep -qi active; then echo "active, default DENY in | 22/3389 wg0-only"; else echo "INACTIVE"; fi
|
|
}
|
|
gui_str() {
|
|
local target sessions="0"
|
|
target="$(systemctl get-default 2>/dev/null || echo unknown)"
|
|
if ss -ltn 2>/dev/null | grep -q ':3389 '; then sessions="$(ss -tn state established '( dport = :3389 or sport = :3389 )' 2>/dev/null | tail -n +2 | wc -l | tr -d ' ')"; fi
|
|
if [[ "${target}" == "graphical.target" ]]; then echo "ON (graphical) | rdp sessions: ${sessions}"; else echo "OFF (multi-user) | rdp sessions: ${sessions}"; fi
|
|
}
|
|
kuma_str() {
|
|
local f="/var/lib/blueforce/kuma_last_push"
|
|
if [[ -f "${f}" ]]; then
|
|
local ts now
|
|
ts="$(cat "${f}" 2>/dev/null | tr -d '[:space:]')"
|
|
now="$(date +%s)"
|
|
if [[ "${ts}" =~ ^[0-9]+$ ]]; then echo "OK $((now - ts))s ago"; else echo "unknown"; fi
|
|
else
|
|
echo "unknown (no push record)"
|
|
fi
|
|
}
|
|
scrape_str() {
|
|
local f="/var/lib/node_exporter/textfile/last_scrape"
|
|
if [[ -f "${f}" ]]; then echo "OK ($(cat "${f}" 2>/dev/null | tr -d '[:space:]'))"; else echo "unknown"; fi
|
|
}
|
|
rustdesk_str() {
|
|
if pgrep -x rustdesk >/dev/null 2>&1 || systemctl is-active --quiet rustdesk 2>/dev/null; then echo "online"; else echo "offline"; fi
|
|
}
|
|
mesh_str() {
|
|
if pgrep -i meshcentral >/dev/null 2>&1 || systemctl is-active --quiet meshagent 2>/dev/null; then echo "online"; else echo "offline"; fi
|
|
}
|
|
boot_str() {
|
|
local b
|
|
b="$(who -b 2>/dev/null | awk '{print $3, $4}' || echo unknown)"
|
|
echo "${b} (power-loss recovery OK)"
|
|
}
|
|
alerts_str() {
|
|
# Warning heuristic: disk use > 80% counts one warning.
|
|
# A lifecycle state that violates the forward-only contract is critical.
|
|
local pct
|
|
if [[ "${LIFECYCLE_INVALID:-0}" -eq 1 ]]; then
|
|
echo '1 critical, 0 warning (lifecycle state invalid)'
|
|
return
|
|
fi
|
|
pct="$(df / 2>/dev/null | awk 'NR==2 {gsub(/%/,"",$5); print $5}')"
|
|
if [[ -n "${pct}" && "${pct}" -ge 90 ]] 2>/dev/null; then echo "1 critical, 0 warning (disk ${pct}%)";
|
|
elif [[ -n "${pct}" && "${pct}" -ge 80 ]] 2>/dev/null; then echo "0 critical, 1 warning (disk trend)";
|
|
else echo "0 critical, 0 warning"; fi
|
|
}
|
|
|
|
DOCKER_SVC="$(svc_state docker)"
|
|
WG_SVC="$(svc_state "wg-quick@wg0")"
|
|
XRDP_SVC="$(svc_state xrdp)"
|
|
NODE_SVC="$(svc_state node_exporter)"
|
|
|
|
FIELD_STATE_FILE="${BF_STATE_FILE:-/var/lib/blueforce/state.json}"
|
|
LIFECYCLE_PHASE='PENDING'
|
|
LIFECYCLE_PROVISIONING='PENDING'
|
|
LIFECYCLE_ENROLLMENT='PENDING'
|
|
LIFECYCLE_FLEET='NOT READY'
|
|
LIFECYCLE_INVALID=0
|
|
# Lifecycle vocabulary is fixed by docs/29; values are never upgraded locally:
|
|
# only bf-enroll (ENROLLED) and the final install gate (READY) may advance them.
|
|
read_lifecycle() {
|
|
local out lifecycle enrollment fleet
|
|
out="$("$(dirname "$0")/bf-enrollment-status" 2>/dev/null)" || true
|
|
lifecycle="$(printf '%s\n' "$out" | sed -n 's/^Lifecycle: //p')"
|
|
enrollment="$(printf '%s\n' "$out" | sed -n 's/^Enrollment: //p')"
|
|
fleet="$(printf '%s\n' "$out" | sed -n 's/^Fleet: //p')"
|
|
case "$lifecycle" in
|
|
PROVISIONED_OFFLINE) LIFECYCLE_PHASE='PROVISIONED_OFFLINE'; LIFECYCLE_PROVISIONING='PROVISIONED_OFFLINE' ;;
|
|
ENROLLED) LIFECYCLE_PHASE='ENROLLED'; LIFECYCLE_PROVISIONING='COMPLETE' ;;
|
|
READY) LIFECYCLE_PHASE='READY'; LIFECYCLE_PROVISIONING='COMPLETE' ;;
|
|
INVALID) LIFECYCLE_PHASE='INVALID'; LIFECYCLE_PROVISIONING='PENDING'; LIFECYCLE_INVALID=1 ;;
|
|
*) LIFECYCLE_PHASE='PENDING'; LIFECYCLE_PROVISIONING='PENDING' ;;
|
|
esac
|
|
case "$enrollment" in
|
|
PENDING|ENROLLED|COMPLETE) LIFECYCLE_ENROLLMENT="$enrollment" ;;
|
|
*) LIFECYCLE_ENROLLMENT='PENDING' ;;
|
|
esac
|
|
case "$fleet" in
|
|
READY) LIFECYCLE_FLEET='READY' ;;
|
|
*) LIFECYCLE_FLEET='NOT READY' ;;
|
|
esac
|
|
}
|
|
release_commit() { git -C "$(cd "$(dirname "$0")/../.." && pwd)" rev-parse --short HEAD 2>/dev/null || echo unknown; }
|
|
|
|
release_info() { "$(dirname "$0")/bf-release" 2>&1 || true; }
|
|
|
|
read_lifecycle
|
|
[[ "$LIFECYCLE_INVALID" -eq 1 ]] && OVERALL='WARN'
|
|
printf 'Field OS lifecycle: %s | Release: %s\n' "$LIFECYCLE_PHASE" "$(release_info | paste -sd ';' -)"
|
|
printf 'Provisioning : %s\n' "$LIFECYCLE_PROVISIONING"
|
|
printf 'Enrollment : %s\n' "$LIFECYCLE_ENROLLMENT"
|
|
printf 'Fleet State : %s\n' "$LIFECYCLE_FLEET"
|
|
printf '%s %s %s\n' "${DEVICE_ID}" "${NOW}" "${OVERALL}"
|
|
printf 'uptime: %s | load: %s\n' "$(uptime_str)" "$(load_str)"
|
|
printf 'cpu: %s%% | mem: %s | disk /: %s\n' "$(cpu_pct)" "$(mem_str)" "$(disk_str)"
|
|
printf 'net: %s | %s\n' "$(wg_info)" "$(net_counters)"
|
|
printf 'docker: %s | %s\n' "$(docker_info)" "$(meg_info)"
|
|
printf 'meg: %s\n' "$(meg_last_success)"
|
|
printf 'systemd: docker %s | wg-quick@wg0 %s | xrdp %s | node_exporter %s\n' "${DOCKER_SVC}" "${WG_SVC}" "${XRDP_SVC}" "${NODE_SVC}"
|
|
printf 'unattended-upgrades: %s\n' "$(unattended_state)"
|
|
printf 'ufw: %s\n' "$(ufw_str)"
|
|
printf 'gui: %s\n' "$(gui_str)"
|
|
printf 'kuma push: %s | prometheus scrape: %s\n' "$(kuma_str)" "$(scrape_str)"
|
|
printf 'rustdesk: %s | meshcentral: %s\n' "$(rustdesk_str)" "$(mesh_str)"
|
|
printf 'boot: %s\n' "$(boot_str)"
|
|
printf 'alerts: %s\n' "$(alerts_str)"
|
|
printf 'next: support bundle: bf-support-bundle\n'
|