#!/usr/bin/env bash set -Eeuo pipefail set +x umask 077 readonly LABEL=Q160_REDIS_ROLE_READONLY readonly VIP=10.2.203.117 readonly ROLE_ROOT=/opt/zhct-deploy/roles/redis readonly Q131_EVIDENCE_SHA256=c4a0ef639ece14dfbe383465a9f3b5bbd4ecbb8e5e66d129830178b43adf9283 readonly Q132_STATE=FAIL_OWNER_REPAIR_PENDING_READONLY_DIAGNOSIS readonly SCRIPT_PATH="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/$(basename -- "${BASH_SOURCE[0]}")" AUDIT_ROOT=/var/backups/zhct-q160/redis die() { printf 'Q160_REDIS_ERROR=%s\n' "$*" >&2 return 1 } finish() { local rc=$? trap - EXIT printf 'Q160_REDIS_ROLLBACK_STATE=NO_SYSTEM_CHANGE_TO_ROLL_BACK\n' printf 'Q160_REDIS_HA=NOT_ASSERTED\n' printf 'Q160_GLOBAL_PASS=NOT_ASSERTED_BY_REDIS_ROLE\n' printf 'END|%s|RC=%s|AUDIT_LOG=%s\n' "$LABEL" "$rc" "${AUDIT_LOG:-NOT_CREATED}" exit "$rc" } trap finish EXIT static_validate() { bash -n "$SCRIPT_PATH" grep -Fq "$Q131_EVIDENCE_SHA256" "$SCRIPT_PATH" grep -Fq "$Q132_STATE" "$SCRIPT_PATH" if grep -En 'systemctl[[:space:]]+(enable|disable|start|stop|restart)|redis-cli[^\n]*(SET|DEL|FLUSH|REPLICAOF|SLAVEOF|FAILOVER)|ip[[:space:]]+addr[[:space:]]+(add|del)' "$SCRIPT_PATH" | grep -v 'grep -En'; then die 'forbidden system mutation command found' fi if grep -En 'sha256sum[^\n]*(redis5\.password|redis7\.password)|cat[[:space:]]+[^\n]*(redis5\.password|redis7\.password)' "$SCRIPT_PATH" | grep -v 'grep -En'; then die 'forbidden secret output or digest command found' fi printf '%s\n' \ 'Q160_REDIS_LOCAL_STATIC_VALIDATE=PASS' \ 'REMOTE_SYSTEM_MUTATION=ZERO_REQUIRED' \ 'SECRET_VALUES=NOT_OUTPUT_NOT_HASHED' \ 'Q132_REPAIR_ACTIVATION=PROHIBITED' } printf 'BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')" if [[ "${1:-}" == --static-validate ]]; then static_validate exit 0 fi [[ $# -eq 0 ]] || die 'no arguments are accepted for remote readonly run' [[ $(id -u) -eq 0 ]] || die 'root is required' actual_host=$(hostname -s) case "$actual_host" in sqjcredis01) node=redis01 target_ip=10.2.203.112 expected_redis_enabled=enabled expected_redis_active=active expected_secret_state=PRESENT expected_placeholder=ABSENT node_judgment=PASS_Q131_STATE_PRESERVED ;; sqjcredis02) node=redis02 target_ip=10.2.203.113 expected_redis_enabled=disabled expected_redis_active=inactive expected_secret_state=ABSENT expected_placeholder=PRESENT node_judgment=PASS_Q132_BLOCKED_STATE_OBSERVED ;; *) die "unsupported hostname: $actual_host" ;; esac ip -o -4 addr show scope global | awk '{split($4,a,"/"); print a[1]}' | grep -Fxq "$target_ip" || die 'target IP mismatch' printf 'Q160_REDIS_TARGET_IDENTITY=PASS|node=%s|host=%s|ip=%s\n' "$node" "$actual_host" "$target_ip" RUN_ID="q160-redis-${node}-$(date -u +%Y%m%dT%H%M%SZ)" AUDIT_DIR="${AUDIT_ROOT}/${RUN_ID}" AUDIT_LOG="${AUDIT_DIR}/operator.log" install -d -o root -g root -m 0700 "$AUDIT_DIR" exec > >(tee -a "$AUDIT_LOG") 2>&1 printf 'AUDIT_BEGIN|%s|%s\n' "$LABEL" "$(date '+%Y-%m-%dT%H:%M:%S%z')" printf 'Q160_RUN_ID=%s\nQ160_NODE=%s\nQ160_TARGET_HOST=%s\nQ160_TARGET_IP=%s\n' \ "$RUN_ID" "$node" "$actual_host" "$target_ip" printf 'Q160_DEP_Q143=PASS_CONTROLLER_ASSERTED_20260805T1745\n' printf 'Q160_Q131_EVIDENCE_SHA256=%s\n' "$Q131_EVIDENCE_SHA256" printf 'Q160_Q132_CURRENT_STATE=%s\n' "$Q132_STATE" printf '%s\n' '=== UNIQUE IDENTITY ===' [[ -r /etc/zhct/node.env ]] || die 'node.env is missing' grep -Fxq 'ROLE=redis' /etc/zhct/node.env || die 'node role mismatch' grep -Fxq "NODE_KEY=$node" /etc/zhct/node.env || die 'node key mismatch' grep -Fxq "NODE_IP=$target_ip" /etc/zhct/node.env || die 'node IP mismatch' grep -Fxq "NODE_NAME=$actual_host" /etc/zhct/node.env || die 'node name mismatch' grep -E '^(ROLE|NODE_KEY|NODE_IP|NODE_NAME|APPLIED_AT)=' /etc/zhct/node.env [[ -f /etc/machine-id && ! -L /etc/machine-id ]] stat -c 'MACHINE_ID|%F|%A|%a|%U:%G|%s|%n' /etc/machine-id [[ $(wc -c /dev/null || true) active=$(systemctl is-active "$unit" 2>/dev/null || true) printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" "$enabled" "$active" [[ "$enabled" == "$expected_redis_enabled" && "$active" == "$expected_redis_active" ]] || die "$unit state mismatch" done for unit in sentinel5.service sentinel7.service orchestrator.service; do enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true) active=$(systemctl is-active "$unit" 2>/dev/null || true) printf 'UNIT|%s|enabled=%s|active=%s\n' "$unit" "$enabled" "$active" [[ "$enabled" == disabled && "$active" == inactive ]] || die "$unit must remain disabled/inactive" done keepalived_active=$(systemctl is-active keepalived.service 2>/dev/null || true) printf 'UNIT|keepalived.service|active=%s\n' "$keepalived_active" [[ "$keepalived_active" != active ]] || die 'keepalived must not be active before Q-251' ps -eo pid=,user=,comm=,args= | awk '$3 ~ /^(redis-server|redis-sentinel|orchestrator)$/ {print "ROLE_PROCESS|" $0}' listeners=$(ss -lntupH | awk '$5 ~ /:(6379|6387|26379|26387|3000|10008)$/ {print}') if [[ -n "$listeners" ]]; then printf '%s\n' "$listeners" | sed 's/^/TARGET_LISTENER|/'; else printf 'TARGET_LISTENERS=NONE\n'; fi if [[ "$node" == redis01 ]]; then ss -lntH | awk '{print $4}' | grep -Fxq "$target_ip:6379" || die 'Redis5 listener absent on Redis01' ss -lntH | awk '{print $4}' | grep -Fxq "$target_ip:6387" || die 'Redis7 listener absent on Redis01' for port in 26379 26387 3000 10008; do ! ss -lntH | awk '{print $4}' | grep -Eq ":${port}$" || die "forbidden listener present: $port" done IFS= read -r redis5_auth