Snarf/SnarfCode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add various infrastructure and service diagnostic scripts

Browse Source
This commit is contained in:
Snarf
2026-11-06 09:02:19 -05:00
parent 00f22f33af
commit 1b8c862b10
59 changed files with 1499 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

208
scripts/update_npm_dns_entries.py Normal file
View File

@@ -0,0 +1,208 @@
import paramiko
import sys
sys.stdout.reconfigure(encoding='utf-8')
key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
c = paramiko.SSHClient()
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
print("1. Creating safe backups of database and config files...")
backup_cmd = """
cp /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite.bak.dns
cp -r /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host /var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host_bak_dns
"""
stdin, stdout, stderr = c.exec_command(backup_cmd)
stdout.channel.recv_exit_status()
print("Backups created successfully.")
print("2. Updating database.sqlite...")
py_script = """
import sqlite3, json, datetime
conn = sqlite3.connect("/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite")
cur = conn.cursor()
now = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
updates = [
(3, json.dumps(["pihole.snarfnet.net"]), "140.44.4.34", 443, "https"),
(43, json.dumps(["pihole2.snarfnet.net"]), "140.44.4.62", 443, "https"),
(51, json.dumps(["pihole3.snarfnet.net"]), "140.44.4.62", 443, "https"),
(52, json.dumps(["dns1.snarfnet.net"]), "140.44.4.34", 443, "https"),
(53, json.dumps(["dns2.snarfnet.net"]), "140.44.4.62", 443, "https"),
]
for pid, dnames, host, port, scheme in updates:
cur.execute('''UPDATE proxy_host
SET domain_names = ?, forward_host = ?, forward_port = ?, forward_scheme = ?,
certificate_id = 1, ssl_forced = 1, allow_websocket_upgrade = 1, http2_support = 1,
hsts_enabled = 1, hsts_subdomains = 1, advanced_config = "", modified_on = ?
WHERE id = ?''', (dnames, host, port, scheme, now, pid))
print(f"Updated proxy host {pid} -> {host}:{port} ({scheme})")
cur.execute("SELECT id FROM proxy_host WHERE id = 54")
if not cur.fetchone():
cur.execute('''INSERT INTO proxy_host (
id, created_on, modified_on, owner_user_id, is_deleted,
domain_names, forward_host, forward_port, access_list_id,
certificate_id, ssl_forced, caching_enabled, block_exploits,
advanced_config, meta, allow_websocket_upgrade, http2_support,
forward_scheme, enabled, locations, hsts_enabled, hsts_subdomains,
trust_forwarded_proto
) VALUES (
54, ?, ?, 1, 0,
?, "140.44.4.34", 443, 0,
1, 1, 0, 1,
"", "{\\"nginx_online\\":true,\\"nginx_err\\":null}", 1, 1,
"https", 1, "[]", 1, 1,
0
)''', (now, now, json.dumps(["technitium.snarfnet.net"])))
print("Inserted proxy host 54: technitium.snarfnet.net -> 140.44.4.34:443")
else:
cur.execute('''UPDATE proxy_host
SET domain_names = ?, forward_host = "140.44.4.34", forward_port = 443, forward_scheme = "https",
certificate_id = 1, ssl_forced = 1, allow_websocket_upgrade = 1, http2_support = 1,
hsts_enabled = 1, hsts_subdomains = 1, modified_on = ?
WHERE id = 54''', (json.dumps(["technitium.snarfnet.net"]), now))
print("Updated proxy host 54: technitium.snarfnet.net")
cur.execute("SELECT id FROM proxy_host WHERE id = 55")
if not cur.fetchone():
cur.execute('''INSERT INTO proxy_host (
id, created_on, modified_on, owner_user_id, is_deleted,
domain_names, forward_host, forward_port, access_list_id,
certificate_id, ssl_forced, caching_enabled, block_exploits,
advanced_config, meta, allow_websocket_upgrade, http2_support,
forward_scheme, enabled, locations, hsts_enabled, hsts_subdomains,
trust_forwarded_proto
) VALUES (
55, ?, ?, 1, 0,
?, "140.44.4.34", 443, 0,
1, 1, 0, 1,
"", "{\\"nginx_online\\":true,\\"nginx_err\\":null}", 1, 1,
"https", 1, "[]", 1, 1,
0
)''', (now, now, json.dumps(["pihole1.snarfnet.net"])))
print("Inserted proxy host 55: pihole1.snarfnet.net -> 140.44.4.34:443")
else:
cur.execute('''UPDATE proxy_host
SET domain_names = ?, forward_host = "140.44.4.34", forward_port = 443, forward_scheme = "https",
certificate_id = 1, ssl_forced = 1, allow_websocket_upgrade = 1, http2_support = 1,
hsts_enabled = 1, hsts_subdomains = 1, modified_on = ?
WHERE id = 55''', (json.dumps(["pihole1.snarfnet.net"]), now))
print("Updated proxy host 55: pihole1.snarfnet.net")
conn.commit()
conn.close()
"""
stdin, stdout, stderr = c.exec_command(f"python3 -c '{py_script}'")
print(stdout.read().decode('utf-8'))
err = stderr.read().decode('utf-8')
if err: print("DB Update Err:", err)
print("3. Generating Nginx configuration files in proxy_host/...")
conf_template = """# ------------------------------------------------------------
# {domains}
# ------------------------------------------------------------
map $scheme $hsts_header {{
https "max-age=63072000;includeSubDomains; preload";
}}
server {{
set $forward_scheme {scheme};
set $server "{host}";
set $port {port};
listen 80;
listen [::]:80;
listen 443 ssl;
listen [::]:443 ssl;
server_name {domains};
http2 on;
# Let's Encrypt SSL
include conf.d/include/letsencrypt-acme-challenge.conf;
include conf.d/include/ssl-cache.conf;
include conf.d/include/ssl-ciphers.conf;
ssl_certificate /etc/letsencrypt/live/npm-1/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/npm-1/privkey.pem;
# Asset Caching
include conf.d/include/assets.conf;
# Block Exploits
include conf.d/include/block-exploits.conf;
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
add_header Strict-Transport-Security $hsts_header always;
# Force SSL
set $trust_forwarded_proto "F";
include conf.d/include/force-ssl.conf;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
access_log /data/logs/proxy-host-{pid}_access.log proxy;
error_log /data/logs/proxy-host-{pid}_error.log warn;
location / {{
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
add_header Strict-Transport-Security $hsts_header always;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;
# Proxy!
include conf.d/include/proxy.conf;
}}
# Custom
include /data/nginx/custom/server_proxy[.]conf;
}}
"""
configs = [
(3, "pihole.snarfnet.net", "140.44.4.34", 443, "https"),
(43, "pihole2.snarfnet.net", "140.44.4.62", 443, "https"),
(51, "pihole3.snarfnet.net", "140.44.4.62", 443, "https"),
(52, "dns1.snarfnet.net", "140.44.4.34", 443, "https"),
(53, "dns2.snarfnet.net", "140.44.4.62", 443, "https"),
(54, "technitium.snarfnet.net", "140.44.4.34", 443, "https"),
(55, "pihole1.snarfnet.net", "140.44.4.34", 443, "https"),
]
for pid, dom, host, port, scheme in configs:
cfg = conf_template.format(pid=pid, domains=dom, host=host, port=port, scheme=scheme)
remote_path = f"/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/nginx/proxy_host/{pid}.conf"
cmd_write = f"cat << 'EOF' > {remote_path}\n{cfg}\nEOF\n"
stdin, stdout, stderr = c.exec_command(cmd_write)
stdout.channel.recv_exit_status()
print(f"Wrote {remote_path} ({dom} -> {host}:{port})")
print("\n4. Testing Nginx configuration syntax inside container...")
test_cmd = "docker exec $(docker ps -q -f name=nginx-proxy-manager_app | head -n1) nginx -t"
stdin, stdout, stderr = c.exec_command(test_cmd)
test_out = stdout.read().decode('utf-8')
test_err = stderr.read().decode('utf-8')
print("nginx -t stdout:", test_out)
print("nginx -t stderr:", test_err)
if "successful" in test_err or "successful" in test_out:
print("\n5. Reloading Nginx across Swarm service...")
reload_cmd = "docker service update --force nginx-proxy-manager_app"
stdin, stdout, stderr = c.exec_command(reload_cmd)
print(stdout.read().decode('utf-8'))
print("NPM service reloaded successfully!")
else:
print("\nWARNING: Nginx test failed! Please check configuration.")
c.close()