feat: add infrastructure health check and management automation scripts

scripts/update_rancher_cert.py

@@ -0,0 +1,56 @@
+import paramiko
+import sys
+import base64
+
+sys.stdout.reconfigure(encoding='utf-8')
+
+key_path = r"C:\Users\Snarf\.ssh\id_ed25519_snarfnet"
+
+# 1. Read cert and key from 140.44.4.71
+c_npm = paramiko.SSHClient()
+c_npm.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c_npm.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
+
+stdin, stdout, stderr = c_npm.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app) cat /etc/letsencrypt/live/npm-8/fullchain.pem")
+fullchain = stdout.read()
+
+stdin, stdout, stderr = c_npm.exec_command("docker exec $(docker ps -q -f name=nginx-proxy-manager_app) cat /etc/letsencrypt/live/npm-8/privkey.pem")
+privkey = stdout.read()
+c_npm.close()
+
+if not fullchain or not privkey:
+    print("Error reading cert or key from NPM!")
+    sys.exit(1)
+
+print(f"Read fullchain ({len(fullchain)} bytes) and privkey ({len(privkey)} bytes) successfully.")
+
+# 2. Connect to 140.44.4.11 (Aerodrome master) and update secret
+c_aero = paramiko.SSHClient()
+c_aero.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c_aero.connect("140.44.4.11", username="root", key_filename=key_path, timeout=10)
+
+b64_fullchain = base64.b64encode(fullchain).decode('ascii')
+b64_privkey = base64.b64encode(privkey).decode('ascii')
+
+cmd_write = f"""
+echo '{b64_fullchain}' | base64 -d > /tmp/aerodrome_fullchain.pem
+echo '{b64_privkey}' | base64 -d > /tmp/aerodrome_privkey.pem
+k3s kubectl -n cattle-system create secret tls tls-rancher-ingress \
+  --cert=/tmp/aerodrome_fullchain.pem \
+  --key=/tmp/aerodrome_privkey.pem \
+  --dry-run=client -o yaml | k3s kubectl apply -f -
+rm -f /tmp/aerodrome_fullchain.pem /tmp/aerodrome_privkey.pem
+"""
+
+stdin, stdout, stderr = c_aero.exec_command(cmd_write)
+print("kubectl apply result:")
+print(stdout.read().decode('utf-8'))
+err = stderr.read().decode('utf-8')
+if err: print("kubectl stderr:", err)
+
+# Verify updated secret
+stdin, stdout, stderr = c_aero.exec_command("k3s kubectl -n cattle-system get secret tls-rancher-ingress -o jsonpath='{.data.tls\\.crt}' | base64 -d | openssl x509 -noout -subject -dates -issuer")
+print("\nNew secret details:")
+print(stdout.read().decode('utf-8'))
+
+c_aero.close()