f26ed51938
Option A per triage's normalization on #95: derive, never mint. The derivation is pinned — sha256("rig-machine-id:<machine-id>"), first 32 hex as 8-4-4-4-12 — and the prefix is the contract that keeps the id uncorrelatable with other tools' derivations, per machine-id(5)'s own guidance not to expose the raw value. Missing, empty and 'uninitialized' machine-id files degrade loudly to an 'unavailable (reason)' line: hashing nothing would hand every such machine the same identity, the worst possible failure for an identity field. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
268 lines
13 KiB
Bash
Executable file
268 lines
13 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# rig platform — what is this machine? Calculated at run time, stored nowhere.
|
|
#
|
|
# Read-only in the strongest sense rig has: it reads /proc, uname,
|
|
# /etc/os-release, /etc/machine-id, df and systemd-detect-virt, and writes
|
|
# NOTHING, ever. That
|
|
# is the design, not an implementation detail — specs change without rig doing
|
|
# anything (RAM added, root disk resized, unattended-upgrades patching the
|
|
# kernel), so a stored spec is stale the moment the machine changes, and
|
|
# refreshing one on every run would collide with bootstrap's convergence
|
|
# contract ("safe to re-run; a second run changes nothing").
|
|
#
|
|
# The corollary is worth having deliberately: this runs on a machine rig has
|
|
# never converged, and needs no root. It answers "what should I converge this
|
|
# into?", not only "what did I converge this into?".
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")" && pwd)"
|
|
# shellcheck source=SCRIPTDIR/lib/users-config.sh
|
|
. "$HERE/lib/users-config.sh" # read_role_marker — one reader of /etc/rig/role
|
|
|
|
die() { printf 'rig-platform: ERROR: %s\n' "$1" >&2; exit "${2:-1}"; }
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
usage: rig platform
|
|
|
|
Describes the machine you are on: hostname, a stable machine ID, OS, kernel,
|
|
CPU, memory, disk and virtualization, then rig's own provenance (which rig,
|
|
when, and the role marker bootstrap wrote).
|
|
|
|
ID names the machine where HOSTNAME names the slot: it is derived from
|
|
/etc/machine-id (a namespaced sha256, never the raw value, which machine-id(5)
|
|
asks tools not to expose). Two machines reporting the same ID were cloned
|
|
from one image — actionable information, not a coincidence: no identity that
|
|
lives in the filesystem survives the filesystem being copied.
|
|
|
|
Computed at run time from /proc, uname, /etc/os-release, /etc/machine-id, df
|
|
and systemd-detect-virt. Writes nothing, needs no root, makes no network call
|
|
— so it also works on a pristine Debian box rig has never bootstrapped, where
|
|
the provenance block reads 'not bootstrapped'.
|
|
EOF
|
|
}
|
|
|
|
# --- args ------------------------------------------------------------------
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
-h|--help) usage; exit 0 ;;
|
|
*) die "unknown flag: $1" 2 ;;
|
|
esac
|
|
done
|
|
|
|
# One aligned column for every line, so the output diffs cleanly across a
|
|
# fleet and reads as one table rather than a log.
|
|
field() { printf '%-10s %s\n' "$1" "$2"; }
|
|
|
|
# --- hostname ---------------------------------------------------------------
|
|
# uname -n is the coreutils fallback: `hostname` lives in its own package and a
|
|
# minimal image may not carry it, and this command's whole point is running
|
|
# before anything has been installed.
|
|
HOSTNAME_V="$(hostname 2>/dev/null || uname -n)"
|
|
|
|
# --- identity (#95) -----------------------------------------------------------
|
|
# HOSTNAME names the slot; ID names the machine. rig itself sets the hostname
|
|
# during bootstrap and reuses it across rebuilds ('hetzner-cp-1' is a role, not
|
|
# hardware), so nothing above answers "is this the same machine I converged in
|
|
# June, or its replacement?". /etc/machine-id does — but machine-id(5) asks
|
|
# that the raw value not be exposed (it is a stable correlator across every
|
|
# tool that leaks it), and its documented remedy is an application-specific
|
|
# derivation. So: THE PINNED DERIVATION, fixed by #95 so two implementations
|
|
# can never disagree —
|
|
#
|
|
# printf 'rig-machine-id:%s' "$(cat /etc/machine-id)" | sha256sum
|
|
# → first 32 hex chars, rendered 8-4-4-4-12
|
|
#
|
|
# The 'rig-machine-id:' prefix is the contract, not decoration: it is what
|
|
# keeps this id uncorrelatable with any other tool's derivation of the same
|
|
# machine-id. sha256sum is coreutils, which this command is restricted to.
|
|
# Derived, computed here, stored nowhere — #64's thesis — so it exists before
|
|
# bootstrap and needs no write path.
|
|
#
|
|
# What this deliberately does NOT fix: a host cloned from a golden image
|
|
# carries the clone's /etc/machine-id, so two machines reporting the same ID
|
|
# means a cloned image. That is surfaced (help text, README) rather than
|
|
# defended against — no identity that lives in the filesystem survives the
|
|
# filesystem being copied.
|
|
#
|
|
# RIG_MACHINE_ID overrides the path so the harness can drive the present,
|
|
# absent, empty and uninitialized cases against fixtures (repo precedent:
|
|
# RIG_MANIFEST / RIG_ROLE_MARKER below).
|
|
MID_FILE="${RIG_MACHINE_ID:-/etc/machine-id}"
|
|
ID_V=""
|
|
if [ ! -r "$MID_FILE" ]; then
|
|
# Never an empty string: an ID field that renders blank looks like a bug,
|
|
# and a missing file is a fact worth naming.
|
|
ID_V="unavailable (no $MID_FILE)"
|
|
else
|
|
# $(...) strips the trailing newline — that is part of the pinned derivation
|
|
# above, not an accident of shell.
|
|
MID="$(cat "$MID_FILE")"
|
|
if [ -z "$MID" ]; then
|
|
# NEVER a hash of nothing: hashing the empty string would hand every such
|
|
# machine the SAME id — the worst possible failure for an identity field.
|
|
# Images do ship the file empty (that is first-boot semantics per
|
|
# machine-id(5)), so this path is real, not defensive.
|
|
ID_V="unavailable ($MID_FILE is empty)"
|
|
elif [ "$MID" = "uninitialized" ]; then
|
|
# machine-id(5)'s other not-yet-set sentinel — same collision failure as
|
|
# empty if hashed, so same loud degradation.
|
|
ID_V="unavailable ($MID_FILE is uninitialized)"
|
|
else
|
|
MID_HASH="$(printf 'rig-machine-id:%s' "$MID" | sha256sum)"
|
|
MID_HASH="${MID_HASH%% *}"
|
|
ID_V="${MID_HASH:0:8}-${MID_HASH:8:4}-${MID_HASH:12:4}-${MID_HASH:16:4}-${MID_HASH:20:12}"
|
|
fi
|
|
fi
|
|
|
|
# --- OS ---------------------------------------------------------------------
|
|
# THE os-release TRAP: /etc/os-release defines VERSION, NAME and ID, so
|
|
# sourcing it in the MAIN shell silently clobbers same-named script variables.
|
|
# Every site in this tree sources it in a SUBSHELL instead (bootstrap.sh:305,
|
|
# bootstrap-tenant.sh:126, runner-install.sh:88, db.sh:52,
|
|
# coolify-backup-install.sh:88), and test/cli.sh greps commands/ to keep it
|
|
# that way. Follow the form verbatim.
|
|
if [ -r /etc/os-release ]; then
|
|
OS="$(. /etc/os-release && printf '%s %s' "${NAME:-}" "${VERSION:-${VERSION_ID:-}}")"
|
|
else
|
|
OS=""
|
|
fi
|
|
|
|
# --- kernel -----------------------------------------------------------------
|
|
KERNEL="$(uname -r) ($(uname -m))"
|
|
|
|
# --- CPU --------------------------------------------------------------------
|
|
# 'model name' is x86's spelling; arm64 /proc/cpuinfo has no such field, so an
|
|
# unnamed CPU still reports its core count rather than nothing at all.
|
|
CPU_MODEL="$(awk -F': ' '/^model name/ {print $2; exit}' /proc/cpuinfo 2>/dev/null || true)"
|
|
CORES="$(nproc 2>/dev/null || true)"
|
|
|
|
# --- memory -----------------------------------------------------------------
|
|
# /proc/meminfo is in kB. MemAvailable is the kernel's own estimate of what a
|
|
# new workload could claim (MemFree undercounts badly, reclaimable cache being
|
|
# most of a busy box's RAM); it predates every kernel rig targets, but degrade
|
|
# rather than print a wrong number if it is missing.
|
|
mem_kb() { awk -v k="$1" '$1 == k":" {print $2; exit}' /proc/meminfo 2>/dev/null || true; }
|
|
MEM_TOTAL_KB="$(mem_kb MemTotal)"
|
|
MEM_AVAIL_KB="$(mem_kb MemAvailable)"
|
|
human_kb() { # kB -> IEC, matching df's units below
|
|
[ -n "${1:-}" ] || { printf 'unknown'; return 0; }
|
|
numfmt --to=iec-i "$(( $1 * 1024 ))" 2>/dev/null || printf '%s kB' "$1"
|
|
}
|
|
|
|
# --- disk -------------------------------------------------------------------
|
|
# -P is the one-line-per-filesystem guarantee (a long device name otherwise
|
|
# wraps and breaks field positions); -B1 gives bytes, so numfmt renders the
|
|
# same IEC units as memory above instead of df's own bare 'G'.
|
|
DISK_TOTAL="" DISK_FREE=""
|
|
if DF="$(df -PB1 / 2>/dev/null)"; then
|
|
DISK_TOTAL="$(printf '%s\n' "$DF" | awk 'NR==2 {print $2}')"
|
|
DISK_FREE="$(printf '%s\n' "$DF" | awk 'NR==2 {print $4}')"
|
|
fi
|
|
human_b() { # bytes -> IEC; falls back like human_kb rather than to 'unknown'
|
|
[ -n "${1:-}" ] || { printf 'unknown'; return 0; }
|
|
numfmt --to=iec-i "$1" 2>/dev/null || printf '%s B' "$1"
|
|
}
|
|
|
|
# --- virtualization ---------------------------------------------------------
|
|
# THE set -e TRAP: systemd-detect-virt exits NON-ZERO on bare metal while
|
|
# printing 'none'. That is a normal, correct answer — without the `|| true` a
|
|
# bare-metal machine would turn this whole command into a failed run. The
|
|
# substitution also swallows the binary being absent entirely (a non-systemd
|
|
# box), which lands as 'unknown'.
|
|
VIRT="$(systemd-detect-virt 2>/dev/null || true)"
|
|
|
|
printf '%s\n' "PLATFORM"
|
|
field HOSTNAME "$HOSTNAME_V"
|
|
field ID "$ID_V"
|
|
field OS "${OS:-unknown}"
|
|
field KERNEL "$KERNEL"
|
|
field CPU "${CPU_MODEL:-unknown}${CORES:+ ($CORES cores)}"
|
|
field MEMORY "$(human_kb "$MEM_TOTAL_KB") total, $(human_kb "$MEM_AVAIL_KB") available"
|
|
field DISK "$(human_b "$DISK_TOTAL") total, $(human_b "$DISK_FREE") free on /"
|
|
field VIRT "${VIRT:-unknown}"
|
|
echo
|
|
|
|
# --- provenance: READ, never written ----------------------------------------
|
|
# The complementary half of the answer — which rig, and when — is decided
|
|
# rather than observed, so unlike everything above it IS stored. rig writes it
|
|
# during bootstrap; this command only ever reads it.
|
|
#
|
|
# /etc/rig/manifest is #61 and is NOT implemented yet, so on every machine in
|
|
# existence today this block reads 'not bootstrapped'. That degradation is the
|
|
# point: the two features are independent and neither blocks the other. The
|
|
# parse is the flat key=value shape the manifest is specified to use — the
|
|
# same jq-free shape /etc/rig/users and /etc/rig/role already use, parseable
|
|
# with `read` on a box that has no YAML parser.
|
|
#
|
|
# RIG_MANIFEST / RIG_ROLE_MARKER override the paths so the harness can drive
|
|
# both the present and the absent case against fixtures, non-root, without a
|
|
# real marker on the machine running the tests (repo precedent: the
|
|
# RIG_ROLE_MARKER gate in bin/rig, install.sh and users-close-root.sh).
|
|
MANIFEST="${RIG_MANIFEST:-/etc/rig/manifest}"
|
|
MARKER="${RIG_ROLE_MARKER:-/etc/rig/role}"
|
|
|
|
manifest_field() { # $1 = key — empty when absent, unreadable or unset
|
|
local k v
|
|
[ -r "$MANIFEST" ] || return 0
|
|
# `|| [ -n "$k" ]` so a manifest whose last line lacks a trailing newline
|
|
# still yields that line: read returns 1 at EOF even having filled k/v.
|
|
# Same guard parse_users_file uses (lib/users-config.sh:47) — #61's writer
|
|
# should not have to know whether this reader tolerates a missing \n.
|
|
while IFS='=' read -r k v || [ -n "$k" ]; do
|
|
[ "$k" = "$1" ] || continue
|
|
printf '%s\n' "$v"
|
|
return 0
|
|
done < "$MANIFEST"
|
|
return 0
|
|
}
|
|
|
|
printf '%s\n' "PROVENANCE"
|
|
# Keys are #61's documented schema verbatim — schema/bootstrapped_by/
|
|
# bootstrapped_at/converged_by/converged_at — NOT invented ones. #61 keeps
|
|
# birth and latest deliberately separate ("is this machine converged by a rig
|
|
# that predates the fix?"), so both are reported and neither is inferred from
|
|
# the other: CONVERGED answers currency, BOOTSTRAPPED answers provenance.
|
|
# Every field degrades independently, so a partial manifest from a future
|
|
# schema still renders what it does carry.
|
|
if [ -r "$MANIFEST" ]; then
|
|
M_SCHEMA="$(manifest_field schema)"
|
|
B_BY="$(manifest_field bootstrapped_by)"; B_AT="$(manifest_field bootstrapped_at)"
|
|
C_BY="$(manifest_field converged_by)"; C_AT="$(manifest_field converged_at)"
|
|
# A manifest with no schema= line is pre-#61; say so rather than render blanks.
|
|
if [ -z "$M_SCHEMA$B_BY$B_AT$C_BY$C_AT" ]; then
|
|
field RIG "manifest present but carries no recognised fields ($MANIFEST)"
|
|
else
|
|
# 'not recorded' rather than 'unknown', and it does NOT describe a fresh
|
|
# box: #61's writer records both pairs equally at bootstrap, so no writer
|
|
# produces a manifest missing converged_* — its absence means the file is
|
|
# partial or hand-edited. Deliberately not backfilled from bootstrapped_*,
|
|
# because inferring a convergence that never happened is worse than saying
|
|
# the record is not there. README and the fixtures pin exactly this.
|
|
field CONVERGED "${C_BY:-not recorded}${C_AT:+, $C_AT}"
|
|
field BOOTSTRAP "${B_BY:-not recorded}${B_AT:+, $B_AT}"
|
|
[ -n "$M_SCHEMA" ] && [ "$M_SCHEMA" != "1" ] && \
|
|
field NOTE "manifest schema=$M_SCHEMA is newer than this rig reads (expects 1)"
|
|
fi
|
|
else
|
|
field RIG "not bootstrapped (no $MANIFEST)"
|
|
fi
|
|
|
|
# The role marker is bootstrap's own line — 'role=dev-server
|
|
# root-door=closed host=yes join=authkey' — printed as the role plus its
|
|
# traits. The example tracks the CURRENT vocabulary (#76's -server/-box role
|
|
# suffixes, #77's root-door trait); this command renders whatever fields the
|
|
# marker carries, so a pre-rename box still prints its own class= line as-is.
|
|
MARKER_LINE="$(read_role_marker "$MARKER")"
|
|
if [ -n "$MARKER_LINE" ]; then
|
|
ROLE_NAME="" ROLE_TRAITS=""
|
|
for kv in $MARKER_LINE; do
|
|
case "$kv" in
|
|
role=*) ROLE_NAME="${kv#role=}" ;;
|
|
*) ROLE_TRAITS="${ROLE_TRAITS:+$ROLE_TRAITS }$kv" ;;
|
|
esac
|
|
done
|
|
field ROLE "${ROLE_NAME:-unknown}${ROLE_TRAITS:+ ($ROLE_TRAITS)}"
|
|
else
|
|
field ROLE "not bootstrapped (no $MARKER)"
|
|
fi
|