|
| 1 | +from __future__ import annotations |
| 2 | + |
| 3 | +import os |
| 4 | +import re |
| 5 | +import shlex |
| 6 | +import shutil |
| 7 | +import subprocess |
| 8 | +import sys |
| 9 | +from dataclasses import dataclass |
| 10 | +from typing import Dict, Iterable, List |
| 11 | + |
| 12 | +DEFAULT_EXTERNAL_URLS = ( |
| 13 | + "https://api.github.com", |
| 14 | + "https://raw.githubusercontent.com", |
| 15 | + "https://gin.btaa.org", |
| 16 | + "http://example.com", |
| 17 | +) |
| 18 | +RESULT_PREFIX = "RESULT\t" |
| 19 | + |
| 20 | + |
| 21 | +@dataclass |
| 22 | +class ProbeResult: |
| 23 | + url: str |
| 24 | + exit_code: int |
| 25 | + details: str |
| 26 | + |
| 27 | + @property |
| 28 | + def fields(self) -> Dict[str, str]: |
| 29 | + return dict(re.findall(r"([a-z_]+)=([^ ]*)", self.details)) |
| 30 | + |
| 31 | + @property |
| 32 | + def http_code(self) -> str: |
| 33 | + return self.fields.get("http", "") |
| 34 | + |
| 35 | + @property |
| 36 | + def remote_ip(self) -> str: |
| 37 | + return self.fields.get("remote_ip", "") |
| 38 | + |
| 39 | + @property |
| 40 | + def total(self) -> str: |
| 41 | + return self.fields.get("total", "") |
| 42 | + |
| 43 | + @property |
| 44 | + def ok(self) -> bool: |
| 45 | + return self.exit_code == 0 and self.http_code not in {"", "000"} |
| 46 | + |
| 47 | + |
| 48 | +def _required_env(name: str) -> str: |
| 49 | + value = os.getenv(name, "").strip() |
| 50 | + if not value: |
| 51 | + raise SystemExit(f"ERROR: {name} is required") |
| 52 | + return value |
| 53 | + |
| 54 | + |
| 55 | +def _probe_script(urls: Iterable[str], *, connect_timeout: str, max_time: str) -> str: |
| 56 | + url_args = " ".join(shlex.quote(url) for url in urls) |
| 57 | + return ( |
| 58 | + f"for url in {url_args}; do " |
| 59 | + "out=$(curl -I -sS -o /dev/null " |
| 60 | + f"-w 'http=%{{http_code}} remote_ip=%{{remote_ip}} connect=%{{time_connect}} " |
| 61 | + f"tls=%{{time_appconnect}} total=%{{time_total}}' " |
| 62 | + f"--connect-timeout {shlex.quote(connect_timeout)} " |
| 63 | + f'-m {shlex.quote(max_time)} "$url" 2>&1); ' |
| 64 | + "status=$?; " |
| 65 | + 'printf \'RESULT\t%s\t%s\t%s\n\' "$url" "$status" "$out"; ' |
| 66 | + "done" |
| 67 | + ) |
| 68 | + |
| 69 | + |
| 70 | +def _run_command(cmd: List[str], label: str) -> str: |
| 71 | + try: |
| 72 | + result = subprocess.run(cmd, check=True, capture_output=True, text=True) |
| 73 | + except FileNotFoundError as exc: |
| 74 | + raise SystemExit(f"ERROR: missing required command for {label}: {exc.filename}") from exc |
| 75 | + except subprocess.CalledProcessError as exc: |
| 76 | + stderr = exc.stderr.strip() |
| 77 | + stdout = exc.stdout.strip() |
| 78 | + detail = stderr or stdout or f"exit status {exc.returncode}" |
| 79 | + raise SystemExit(f"ERROR: {label} failed: {detail}") from exc |
| 80 | + return result.stdout |
| 81 | + |
| 82 | + |
| 83 | +def _parse_results(output: str) -> Dict[str, ProbeResult]: |
| 84 | + results: Dict[str, ProbeResult] = {} |
| 85 | + for line in output.splitlines(): |
| 86 | + if not line.startswith(RESULT_PREFIX): |
| 87 | + continue |
| 88 | + _, url, exit_code, details = line.split("\t", 3) |
| 89 | + results[url] = ProbeResult(url=url, exit_code=int(exit_code), details=details) |
| 90 | + return results |
| 91 | + |
| 92 | + |
| 93 | +def _print_section( |
| 94 | + title: str, urls: List[str], results: Dict[str, ProbeResult], self_url: str |
| 95 | +) -> None: |
| 96 | + print(f"{title}:") |
| 97 | + for url in urls: |
| 98 | + result = results.get(url) |
| 99 | + if result is None: |
| 100 | + print(f" FAIL {url} (no result)") |
| 101 | + continue |
| 102 | + label = "self" if url == self_url else "ext " |
| 103 | + if result.ok: |
| 104 | + print( |
| 105 | + f" OK [{label}] {url} " |
| 106 | + f"http={result.http_code} ip={result.remote_ip or '-'} total={result.total or '-'}" |
| 107 | + ) |
| 108 | + else: |
| 109 | + print( |
| 110 | + f" FAIL [{label}] {url} exit={result.exit_code} " |
| 111 | + f"http={result.http_code or '000'} detail={result.details}" |
| 112 | + ) |
| 113 | + |
| 114 | + |
| 115 | +def main() -> int: |
| 116 | + if shutil.which("ssh") is None: |
| 117 | + raise SystemExit("ERROR: ssh is required") |
| 118 | + if shutil.which("kamal") is None: |
| 119 | + raise SystemExit("ERROR: kamal is required") |
| 120 | + |
| 121 | + kamal_dest = _required_env("KAMAL_DEST") |
| 122 | + kamal_host = _required_env("KAMAL_HOST") |
| 123 | + kamal_ssh_user = _required_env("KAMAL_SSH_USER") |
| 124 | + kamal_app_role = os.getenv("KAMAL_APP_ROLE", "web").strip() or "web" |
| 125 | + connect_timeout = os.getenv("KAMAL_NETWORK_CONNECT_TIMEOUT", "5").strip() or "5" |
| 126 | + max_time = os.getenv("KAMAL_NETWORK_MAX_TIME", "12").strip() or "12" |
| 127 | + |
| 128 | + self_url = os.getenv("KAMAL_NETWORK_SELF_URL", "").strip() or f"https://{kamal_host}" |
| 129 | + external_urls = shlex.split(os.getenv("KAMAL_NETWORK_EXTERNAL_URLS", "").strip()) |
| 130 | + if not external_urls: |
| 131 | + external_urls = list(DEFAULT_EXTERNAL_URLS) |
| 132 | + |
| 133 | + urls = list(dict.fromkeys([*external_urls, self_url])) |
| 134 | + probe_script = _probe_script(urls, connect_timeout=connect_timeout, max_time=max_time) |
| 135 | + |
| 136 | + host_output = _run_command( |
| 137 | + ["ssh", f"{kamal_ssh_user}@{kamal_host}", f"bash -lc {shlex.quote(probe_script)}"], |
| 138 | + "host probe", |
| 139 | + ) |
| 140 | + container_output = _run_command( |
| 141 | + [ |
| 142 | + "kamal", |
| 143 | + "app", |
| 144 | + "exec", |
| 145 | + "-d", |
| 146 | + kamal_dest, |
| 147 | + "--roles", |
| 148 | + kamal_app_role, |
| 149 | + "--reuse", |
| 150 | + f"bash -lc {shlex.quote(probe_script)}", |
| 151 | + ], |
| 152 | + "container probe", |
| 153 | + ) |
| 154 | + |
| 155 | + host_results = _parse_results(host_output) |
| 156 | + container_results = _parse_results(container_output) |
| 157 | + |
| 158 | + print( |
| 159 | + f"Network sanity report for {kamal_dest} " |
| 160 | + f"(host={kamal_host}, role={kamal_app_role}, self_url={self_url})" |
| 161 | + ) |
| 162 | + print("") |
| 163 | + _print_section("Host shell", urls, host_results, self_url) |
| 164 | + print("") |
| 165 | + _print_section("Container", urls, container_results, self_url) |
| 166 | + print("") |
| 167 | + |
| 168 | + failures: List[str] = [] |
| 169 | + for url in urls: |
| 170 | + host_result = host_results.get(url) |
| 171 | + container_result = container_results.get(url) |
| 172 | + if host_result is None or not host_result.ok: |
| 173 | + failures.append(f"host failed: {url}") |
| 174 | + if container_result is None or not container_result.ok: |
| 175 | + failures.append(f"container failed: {url}") |
| 176 | + |
| 177 | + host_self_ok = host_results.get(self_url).ok if self_url in host_results else False |
| 178 | + container_self_ok = ( |
| 179 | + container_results.get(self_url).ok if self_url in container_results else False |
| 180 | + ) |
| 181 | + external_container_failures = [ |
| 182 | + url for url in external_urls if not container_results.get(url, ProbeResult(url, 1, "")).ok |
| 183 | + ] |
| 184 | + |
| 185 | + if not failures: |
| 186 | + print( |
| 187 | + "PASS: host shell and container can reach the expected external URLs " |
| 188 | + "and self public hostname." |
| 189 | + ) |
| 190 | + return 0 |
| 191 | + |
| 192 | + if host_self_ok and not container_self_ok and not external_container_failures: |
| 193 | + print( |
| 194 | + "FAIL: host shell can reach the self public hostname, but the container cannot. " |
| 195 | + "This points to a container-to-self-FQDN / hairpin / firewall-path issue." |
| 196 | + ) |
| 197 | + else: |
| 198 | + print("FAIL: one or more host/container connectivity probes failed.") |
| 199 | + |
| 200 | + for failure in failures: |
| 201 | + print(f" - {failure}") |
| 202 | + return 1 |
| 203 | + |
| 204 | + |
| 205 | +if __name__ == "__main__": |
| 206 | + sys.exit(main()) |
0 commit comments