`migrate-fleet.sh`

67 lines
#!/usr/bin/env bash
# Tailscale Serve fleet migration — register + smoke + report.
# RUN ONLY AFTER enabling HTTPS Certificates at https://login.tailscale.com/admin/dns
#
# Phase 1 (this script): register all 18 services with `tailscale serve --bg --https`
#                        services stay live on 0.0.0.0 + Basic Auth during this step
# Phase 2 (manual, per service, your call):
#   - edit server.js: '0.0.0.0' → '127.0.0.1', remove Basic Auth middleware
#   - pm2 restart <svc>
#   - verify https URL still works
#   - pm2 save
#
# Rollback any service: `tailscale serve --https=<port> off`

set -uo pipefail

FQDN="stevestudio2s-mac-studio.tail79cb8e.ts.net"

echo "=== prerequisite check ==="
mkdir -p /tmp/tscerts.test && cd /tmp/tscerts.test
tailscale cert "$FQDN" > /tmp/tscert.log 2>&1 &
P=$!
for i in $(seq 1 12); do sleep 1; ! kill -0 $P 2>/dev/null && break; done
kill -9 $P 2>/dev/null
if [ ! -s "$FQDN.crt" ]; then
  echo "FATAL: HTTPS cert NOT provisioned. Visit https://login.tailscale.com/admin/dns and enable HTTPS Certificates."
  cat /tmp/tscert.log 2>/dev/null
  rm -rf /tmp/tscerts.test /tmp/tscert.log
  exit 1
fi
echo "  ✓ cert exists ($(wc -c < $FQDN.crt) bytes)"
rm -rf /tmp/tscerts.test /tmp/tscert.log
cd ~

echo ""
echo "=== registering 18 services with tailscale serve --bg --https ==="
declare -a PORTS=(9762 9763 9706 9707 9871 9873 9874 9875 9890 9891 9892 9720 9721 9722 9723 9648 9881 9882 9725)
for port in "${PORTS[@]}"; do
  out=$(tailscale serve --bg --https=$port http://localhost:$port 2>&1)
  if echo "$out" | grep -q "Available within your tailnet\|Started serving\|already exists\|configured"; then
    echo "  ✓ $port"
  elif echo "$out" | grep -q "error"; then
    echo "  ✗ $port: $(echo "$out" | head -1)"
  else
    echo "  ? $port: $(echo "$out" | head -1)"
  fi
done

echo ""
echo "=== tailscale serve status ==="
tailscale serve status

echo ""
echo "=== smoke test (HTTP via Serve, services still on 0.0.0.0+BasicAuth at this stage) ==="
for port in 9762 9763 9881; do
  code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 -u admin:DWSecure2024! "https://${FQDN}:${port}/healthz" 2>/dev/null || echo "ERR")
  printf "  https://%s:%s/healthz → %s\n" "$FQDN" "$port" "$code"
done

echo ""
echo "DONE. Services are now reachable BOTH via:"
echo "  • Old: http://100.65.187.120:<port>/  (Basic Auth)  ← still works"
echo "  • New: https://${FQDN}:<port>/        (tailnet-gated, no auth)"
echo ""
echo "Phase 2: per-service code edit (0.0.0.0 → 127.0.0.1, remove BasicAuth middleware)"
echo "Rollback any service: tailscale serve --https=<port> off"