jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sanity-check.sh: add a Versions block for every involved service

Browse Source 
Informational only, doesn't affect PASS/WARN/FAIL - lists apache/bind/
postfix/dovecot/rspamd/redis/mariadb/fail2ban/docker/certbot/php7.4/8.0
plus each Docker container's actual running version (not just its
image tag), queried from inside the container where the tag alone
doesn't say much.
This commit is contained in:
jens
2026-07-26 20:26:38 +02:00
parent f6adc3c55d
commit 45856f48f8
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -63,6 +63,15 @@ lookups, fail2ban's jail count and the custom `findtime` hardening, all 7
public vhosts by expected HTTP status code (plus a genuine Gitea API
check, not just a static-page response), and all 6 Docker containers.
Also prints a **Versions** block (added 2026-07-26, informational only —
doesn't affect the PASS/WARN/FAIL count) listing what's actually running
for every service above plus each Docker container's image tag and, where
the image tag alone doesn't say much (`:latest`/`:apache`/`:lts`/`:alpine`),
the real version queried from inside the running container itself
(Portainer's own `/api/status`, Nextcloud's `occ status`, the actual
`nginx`/`mariadb`/`redis-server` binaries, Gitea's API) — a quick reference
after any upgrade without having to SSH in and check each service by hand.
Runs automatically once per boot via `sanity-check.service` (a oneshot
unit, `systemctl enable`d, `After=` all the relevant services plus a 10s
settle delay before running) — covers OS upgrades, kernel updates, and
scripts/alpha/sanity-check.sh
+27
View File
@@ -24,6 +24,33 @@ echo "alpha.jayfield.org sanity check - $(date -Is)"
. /etc/os-release
echo "OS: $PRETTY_NAME, kernel $(uname -r), uptime $(uptime -p)"
# ---------- Versions ----------
# Informational only, not pass/fail - a quick reference for what's
# actually running without having to SSH in and check each service
# individually after an upgrade.
section "Versions"
echo "apache2: $(apache2 -v 2>/dev/null | head -1)"
echo "bind9: $(named -v 2>/dev/null | cut -d' ' -f1-2)"
echo "postfix: $(postconf mail_version 2>/dev/null)"
echo "dovecot: $(dovecot --version 2>/dev/null)"
echo "rspamd: $(rspamd --version 2>/dev/null | head -1)"
echo "redis-server: $(redis-server --version 2>/dev/null)"
echo "mariadb: $(mysql --version 2>/dev/null)"
echo "fail2ban: $(fail2ban-client --version 2>/dev/null)"
echo "docker: $(docker --version 2>/dev/null)"
echo "docker compose: $(docker compose version 2>/dev/null | head -1)"
echo "certbot: $(certbot --version 2>/dev/null)"
echo "php7.4: $(php7.4 -v 2>/dev/null | head -1)"
echo "php8.0: $(php8.0 -v 2>/dev/null | head -1)"
echo
echo "Docker containers:"
echo " portainer: $(sudo docker inspect portainer -f '{{.Config.Image}}' 2>/dev/null), app $(curl -sk --max-time 3 https://127.0.0.1:9443/api/status 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin).get("Version","?"))' 2>/dev/null || echo unknown)"
echo " web (nginx): $(sudo docker exec web nginx -v 2>&1)"
echo " nextcloud: $(sudo docker inspect nextcloud -f '{{.Config.Image}}' 2>/dev/null), app $(sudo docker exec -u www-data nextcloud php occ status 2>/dev/null | grep versionstring | awk '{print $3}')"
echo " nextcloud-db: $(sudo docker exec nextcloud-db mariadb --version 2>/dev/null)"
echo " nextcloud-redis: $(sudo docker exec nextcloud-redis redis-server --version 2>/dev/null)"
echo " gitea: $(sudo docker inspect gitea -f '{{.Config.Image}}' 2>/dev/null), API reports $(curl -s --max-time 3 https://git.jayfield.org/api/v1/version 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin).get("version","?"))' 2>/dev/null || echo unknown)"
# ---------- System package consistency ----------
section "System package consistency"
if [ -z "$(sudo dpkg --audit 2>&1)" ]; then