Add local production infra lab

2026-07-06 12:00:27 +09:00
parent ec261bcbc5
commit fc736aabf1
16 changed files with 623 additions and 23 deletions
@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN local production-like infra lab.
+#
+# Usage:
+#   infra-lab.sh start|stop|status|verify|env
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+COMPOSE="$PROJECT_ROOT/infra/local-prod/docker-compose.yml"
+CMD="${1:-status}"
+
+compose() {
+  docker compose -f "$COMPOSE" "$@"
+}
+
+need_docker() {
+  command -v docker >/dev/null 2>&1 || { echo "INFRA_LAB_DOCKER_MISSING" >&2; exit 1; }
+  docker compose version >/dev/null 2>&1 || { echo "INFRA_LAB_COMPOSE_MISSING" >&2; exit 1; }
+}
+
+hash_file() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
+  else shasum -a 256 "$1" | awk '{print $1}'; fi
+}
+
+wait_url() {
+  local url="$1"
+  for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24; do
+    curl -fsS -m 3 "$url" >/dev/null 2>&1 && return 0
+    sleep 2
+  done
+  echo "INFRA_LAB_WAIT_TIMEOUT url=$url" >&2
+  return 1
+}
+
+case "$CMD" in
+  start)
+    need_docker
+    compose up -d --build
+    wait_url "http://127.0.0.1:18200/v1/sys/health" || exit 1
+    wait_url "http://127.0.0.1:18081/healthz" || exit 1
+    wait_url "http://127.0.0.1:19090/minio/health/live" || exit 1
+    wait_url "http://127.0.0.1:19092/healthz" || exit 1
+    wait_url "http://127.0.0.1:19093/healthz" || exit 1
+    wait_url "http://127.0.0.1:18080/healthz" || exit 1
+    echo "INFRA_LAB_STARTED compose=$COMPOSE"
+    ;;
+
+  stop)
+    need_docker
+    compose down
+    echo "INFRA_LAB_STOPPED"
+    ;;
+
+  status)
+    need_docker
+    compose ps
+    ;;
+
+  env)
+    cat <<'EOF'
+export VAULT_ADDR=http://127.0.0.1:18200
+export VAULT_TOKEN=root
+export CASAN_IDP_JWKS_URL=http://127.0.0.1:18081/.well-known/jwks.json
+export CASAN_ALERT_WEBHOOK=http://127.0.0.1:19092/alert
+export CASAN_PROVIDER_USAGE_API=http://127.0.0.1:19093/usage
+export CASAN_DASHBOARD_URL=http://127.0.0.1:18080
+export CASAN_DASHBOARD_AUTH=casan:casan
+export CASAN_MINIO_ENDPOINT=http://127.0.0.1:19090
+export CASAN_MINIO_BUCKET=casan-worm
+EOF
+    ;;
+
+  verify)
+    need_docker
+    PASS=0; FAIL=0
+    pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+    fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+    wait_url "http://127.0.0.1:18200/v1/sys/health" && pass "Vault dev reachable" || fail "Vault dev unreachable"
+    VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" enable-transit >/dev/null 2>&1
+    WORK="$(mktemp -d)"
+    trap 'rm -rf "$WORK"' EXIT
+    printf 'infra-lab-head\n' > "$WORK/head.txt"
+    if VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" sign "$WORK/head.txt" "$WORK/head.sig" casan-infra-lab >/dev/null 2>&1 \
+      && VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" verify "$WORK/head.txt" "$WORK/head.sig" casan-infra-lab >/dev/null 2>&1; then
+      pass "Vault Transit signs and verifies"
+    else
+      fail "Vault Transit sign/verify failed"
+    fi
+
+    printf 'deploy to production and run database migration\n' > "$WORK/approval.txt"
+    INPUT_SHA="$(hash_file "$WORK/approval.txt")"
+    TOKEN="$(curl -fsS -m 5 -H 'Content-Type: application/json' \
+      -d "{\"sub\":\"oidc-ops\",\"role\":\"ops\",\"action\":\"deploy\",\"actor\":\"alice\",\"input_sha256\":\"$INPUT_SHA\",\"ttl_s\":300}" \
+      http://127.0.0.1:18081/token | python3 -c 'import json,sys; print(json.load(sys.stdin)["access_token"])')" || TOKEN=""
+    if [[ -n "$TOKEN" ]] && CASAN_APPROVAL_JWT="$TOKEN" CASAN_IDP_JWKS_URL="http://127.0.0.1:18081/.well-known/jwks.json" \
+      bash "$SCRIPT_DIR/approval-verify.sh" deploy alice "$WORK/approval.txt" oidc-ops - >/dev/null 2>&1; then
+      pass "Mock OIDC IdP issues JWKS-verifiable approval JWT"
+    else
+      fail "Mock OIDC approval verification failed"
+    fi
+
+    if compose run --rm minio-mc -c 'set -eu; obj="verify-$(date +%s)-$$.txt"; mc alias set local http://minio:9000 casanadmin casanadmin123 >/dev/null; printf verify >/tmp/verify.txt; mc cp /tmp/verify.txt "local/casan-worm/$obj" >/dev/null; out="$(mc retention info "local/casan-worm/$obj")"; case "$out" in *COMPLIANCE*|*Mode*) exit 0;; *) echo "$out" >&2; exit 1;; esac' >/dev/null 2>&1; then
+      pass "MinIO WORM/Object Lock bucket accepts retained object"
+    else
+      fail "MinIO WORM verification failed"
+    fi
+
+    ALERT_FILE="$WORK/alert.json"
+    printf '{"body":{"alert.type":"execution-failed","step.name":"infra-lab"},"resource":{"service.name":"casan"}}\n' > "$ALERT_FILE"
+    if CASAN_AGENTOPS_DIR="$WORK/agentops" CASAN_ALERT_WEBHOOK=http://127.0.0.1:19092/alert bash "$SCRIPT_DIR/alert-dispatch.sh" "$ALERT_FILE" >/dev/null 2>&1 \
+      && curl -fsS http://127.0.0.1:19092/events | grep -q "infra-lab"; then
+      pass "Alert webhook receives live dispatch"
+    else
+      fail "Alert webhook verification failed"
+    fi
+
+    if bash "$SCRIPT_DIR/provider-usage-fetch.sh" http://127.0.0.1:19093/usage "$WORK/provider.jsonl" >/dev/null 2>&1 \
+      && grep -q "provider_api" "$WORK/provider.jsonl"; then
+      pass "Billing API mock imports provider telemetry"
+    else
+      fail "Billing API mock verification failed"
+    fi
+
+    if curl -fsS http://127.0.0.1:18080/healthz | grep -q '"status"' \
+      && curl -fsS -u casan:casan http://127.0.0.1:18080/ | grep -q "AgentOps Dashboard"; then
+      pass "Dashboard served behind nginx basic auth"
+    else
+      fail "Dashboard/nginx verification failed"
+    fi
+
+    echo "INFRA_LAB_VERIFY_SUMMARY PASS=$PASS FAIL=$FAIL"
+    [[ "$FAIL" -eq 0 ]] || exit 1
+    ;;
+
+  *)
+    echo "Usage: infra-lab.sh start|stop|status|verify|env" >&2
+    exit 64
+    ;;
+esac