`check-nginx-cotenant.sh`

65 lines
#!/bin/bash
# Weekly check: pastdoor + Site Factory co-tenant nginx confs on Kamatera.
#
# Pulls /etc/nginx/sites-enabled/{wholivedthere,bubbesblock,claimmyaddress}.com.conf
# and verifies each still contains:
#   1. "Site Factory routes" comment marker
#   2. proxy_pass to the SF port (3091/3002/3003)
#   3. proxy_pass to pastdoor (9821)
#   4. matching `location ~ ^/api/(...)` pattern
#
# Also probes both backends via the public domain and confirms 200/400 (live)
# rather than 502 (broken upstream) or 5xx (config bug).
#
# On any failure, emits a macOS notification + writes details to log.
# On success, just appends an OK line to the log so we know it ran.

set -u
LOG=/Users/macstudio3/Projects/pastdoor-nginx-watch/nginx-watch.log
TS=$(date '+%Y-%m-%d %H:%M:%S')

sf_port_for() {
  case "$1" in
    wholivedthere.com)  echo 3091 ;;
    bubbesblock.com)    echo 3002 ;;
    claimmyaddress.com) echo 3003 ;;
    *) echo "" ;;
  esac
}

failures=()

for D in wholivedthere.com bubbesblock.com claimmyaddress.com; do
  CONF=$(ssh -o ConnectTimeout=10 -o BatchMode=yes root@45.61.58.125 "cat /etc/nginx/sites-enabled/$D.conf" 2>/dev/null)
  if [ -z "$CONF" ]; then
    failures+=("$D: ssh/cat failed")
    continue
  fi
  SF=$(sf_port_for "$D")
  grep -q "Site Factory routes" <<<"$CONF"          || failures+=("$D: missing 'Site Factory routes' marker")
  grep -q "proxy_pass http://127.0.0.1:$SF;" <<<"$CONF" || failures+=("$D: missing SF proxy_pass :$SF")
  grep -q "proxy_pass http://127.0.0.1:9821;" <<<"$CONF" || failures+=("$D: missing pastdoor proxy_pass :9821")
  grep -q "location ~ ^/api/(" <<<"$CONF"          || failures+=("$D: missing path-route location regex")

  PD=$(curl -s --max-time 15 -o /dev/null -w '%{http_code}' "https://$D/restaurants" || echo "ERR")
  SFCODE=$(curl -s --max-time 15 -o /dev/null -w '%{http_code}' "https://$D/api/health" || echo "ERR")
  [[ "$PD" == "200" ]] || failures+=("$D: pastdoor /restaurants returned $PD (expected 200)")
  [[ "$SFCODE" == "200" ]] || failures+=("$D: SF /api/health returned $SFCODE (expected 200)")
done

if (( ${#failures[@]} == 0 )); then
  echo "[$TS] OK — all 3 co-tenant confs intact" >> "$LOG"
  exit 0
fi

{
  echo "[$TS] FAIL — pastdoor/SF nginx co-tenant drift detected:"
  printf '  - %s\n' "${failures[@]}"
  echo "  → fix: ssh root@45.61.58.125 'python3 /root/patch-nginx.py'"
  echo
} >> "$LOG"

osascript -e "display notification \"${#failures[@]} co-tenant nginx issues — see ~/Projects/pastdoor-nginx-watch/nginx-watch.log\" with title \"pastdoor/SF nginx drift\" sound name \"Basso\""

exit 1