Archived
beatzaplentyandClaude Sonnet 4.6
89cc8c8cc3
Installs and documents the FreeIPA identity management server at domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos, LDAP, and integrated DNS for the SWEET.HOME realm. New section: freeipa/ - docs/install.md: full step-by-step reproduction procedure including Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init), swap setup, static IP, /etc/hosts fix, ipa-server-install flags - docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home queries to the FreeIPA BIND instance - scripts/install.sh: idempotent install script with pre-flight checks; reads passwords from env or interactive prompt (never commits them) - scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup - scripts/verify.sh: read-only health check (13 checks, 0 side effects) - CLAUDE.md: host guardrails for domain-controller Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK
64 lines
1.9 KiB
Bash
Executable File
64 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Read-only health check for the FreeIPA server.
|
|
# Run locally on domain-controller or remotely:
|
|
# ssh wayne@domain-controller 'bash -s' < scripts/verify.sh
|
|
#
|
|
# Exit code 0 = all checks passed, non-zero = something is wrong.
|
|
|
|
set -uo pipefail
|
|
|
|
PASS=0
|
|
FAIL=0
|
|
|
|
check() {
|
|
local label="$1"
|
|
shift
|
|
if "$@" >/dev/null 2>&1; then
|
|
echo " OK $label"
|
|
(( PASS++ )) || true
|
|
else
|
|
echo "FAIL $label"
|
|
(( FAIL++ )) || true
|
|
fi
|
|
}
|
|
|
|
echo "=== FreeIPA health check: $(hostname -f) ==="
|
|
echo ""
|
|
|
|
echo "--- Services ---"
|
|
check "ipactl status" sudo ipactl status
|
|
check "dirsrv running" systemctl is-active dirsrv.target
|
|
check "krb5kdc running" systemctl is-active krb5kdc
|
|
check "named running" systemctl is-active named
|
|
check "httpd running" systemctl is-active httpd
|
|
check "pki-tomcatd running" systemctl is-active pki-tomcatd.target
|
|
|
|
echo ""
|
|
echo "--- DNS ---"
|
|
check "A record: domain-controller.sweet.home" dig +short domain-controller.sweet.home A @127.0.0.1
|
|
check "SRV: _kerberos._udp.sweet.home" dig +short _kerberos._udp.sweet.home SRV @127.0.0.1
|
|
check "SRV: _ldap._tcp.sweet.home" dig +short _ldap._tcp.sweet.home SRV @127.0.0.1
|
|
check "TXT: _kerberos.sweet.home" dig +short _kerberos.sweet.home TXT @127.0.0.1
|
|
|
|
echo ""
|
|
echo "--- LDAP ---"
|
|
check "LDAP port 389 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/389"
|
|
check "LDAPS port 636 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/636"
|
|
|
|
echo ""
|
|
echo "--- Kerberos ---"
|
|
check "KDC port 88 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/88"
|
|
|
|
echo ""
|
|
echo "--- HTTP ---"
|
|
check "IPA HTTP redirect" curl -sk -o /dev/null -w "%{http_code}" http://localhost/ | grep -qE "^(301|302|200)"
|
|
check "IPA HTTPS UI" curl -sk -o /dev/null -w "%{http_code}" https://localhost/ipa/ui/ | grep -q "200"
|
|
|
|
echo ""
|
|
if [[ $FAIL -eq 0 ]]; then
|
|
echo "All $PASS checks passed."
|
|
else
|
|
echo "$FAIL check(s) FAILED, $PASS passed."
|
|
exit 1
|
|
fi
|