آموزش لینوکس پیشرفته؛ مدیریت، امنیت و عیب‌یابی سرور

FIXTURE_BASE=$(mktemp -d "$HOME/linux2-fixtures.XXXXXX") || exit 1
export FIXTURE_BASE
python3 - <<'PY_FIXTURES'
import os
from pathlib import Path
root = Path(os.environ["FIXTURE_BASE"])
files = {
  "incident-lab/README.txt": "Linux 2 final project: offline incident recovery\nRequirements: Python 3, Bash, GNU coreutils. No network or elevated privileges.\nCopy this directory to a fresh mktemp directory under your own HOME as shown in lesson 16.\nInitial healthcheck must exit 78; the backup configuration must pass with exit 0.\nThe healthcheck computes base + workers * per-worker peak against a fictional limit.\nIt does not run a server, allocate workload memory, read cgroups, or validate production health.\nUse only the copied fixture. Preserve evidence before changing live/service.conf.\n",
  "incident-lab/backup/SHA256SUMS": "9cab169b2f203d02835283e68d08617d72acb0a4db04e9e2a3d4f6c340629df7  service.conf\n",
  "incident-lab/backup/service.conf": "[service]\nport=8080\nworkers=2\nmode=training\n",
  "incident-lab/events.log": "2026-10-29T09:55:00Z training-web status=healthy workers=2 requests_failed=0 oom_kill_total=0\n2026-10-29T10:00:00Z deploy change=workers old=2 new=8 actor=training-operator\n2026-10-29T10:02:00Z training-web status=degraded requests_failed=12 oom_kill_total=2\n2026-10-29T10:03:00Z resource memory_limit_mib=256 host_free_mib=4096\n# Synthetic fixture. No actual kernel or service event is represented.\n",
  "incident-lab/healthcheck.py": "#!/usr/bin/env python3\n\"\"\"Offline capacity model; does not inspect or change the host system.\"\"\"\nimport configparser\nimport pathlib\nimport sys\n\ndef read_config(path):\n    parser = configparser.ConfigParser(interpolation=None)\n    with pathlib.Path(path).open(encoding=\"utf-8\") as stream:\n        parser.read_file(stream)\n    return parser\n\ndef main():\n    if len(sys.argv) != 3:\n        print(\"usage: healthcheck.py CONFIG INVENTORY\", file=sys.stderr)\n        return 64\n    try:\n        conf = read_config(sys.argv[1])\n        host = read_config(sys.argv[2])\n        workers = conf.getint(\"service\", \"workers\")\n        port = conf.getint(\"service\", \"port\")\n        budget = host.getint(\"host\", \"memory_limit_mib\")\n        base = host.getint(\"host\", \"base_mib\")\n        peak = host.getint(\"host\", \"worker_peak_mib\")\n        if not 1 <= workers <= 16 or not 1024 <= port <= 65535:\n            raise ValueError(\"workers or port outside training range\")\n        if min(budget, base, peak) <= 0:\n            raise ValueError(\"capacity inputs must be positive\")\n    except (OSError, ValueError, configparser.Error) as exc:\n        print(\"invalid fixture: \" + str(exc), file=sys.stderr)\n        return 65\n    required = base + workers * peak\n    print(f\"SIMULATION required_mib={required} budget_mib={budget}\")\n    if required > budget:\n        print(\"capacity model: FAIL\", file=sys.stderr)\n        return 78\n    print(\"capacity model: PASS (not a live service health test)\")\n    return 0\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n",
  "incident-lab/inventory.txt": "[host]\ndistribution=Debian 12 (fictional host)\nservice=training-web\nmemory_limit_mib=256\nbase_mib=96\nworker_peak_mib=48\nrpo_minutes=5\nrto_minutes=15\n",
  "incident-lab/live/service.conf": "[service]\nport=8080\nworkers=8\nmode=training\n",
  "incident-lab/runbook.txt": "OFFLINE INCIDENT RECOVERY RUNBOOK\nAll fixture data is synthetic. Do not write to system configuration.\n\nScope and impact:\nRPO / RTO (scenario targets):\nEvidence paths and timestamps:\nTimeline:\nHypothesis:\nEvidence that would disprove the hypothesis:\nSmallest proposed change:\nCandidate validation command and expected exit status:\nPublish command:\nVerification and remaining limitations:\nRollback trigger:\nRollback command and expected state:\nRecovery retry:\nFollow-up guard / monitoring / restore drill:\n"
}
for name, content in files.items():
    target = root / name
    target.parent.mkdir(parents=True, exist_ok=True)
    target.write_text(content, encoding="utf-8")
print("Fixture files ready:", len(files))
PY_FIXTURES
test "$?" -eq 0 || exit 1
cd "$FIXTURE_BASE" || exit 1
printf "FIXTURE_ROOT=%s\n" "$FIXTURE_BASE"

umask 077
test -f incident-lab/healthcheck.py || exit 1
LAB16=$(mktemp -d "$HOME/linux2-incident.XXXXXX") || exit 1
export LAB16
cp -R -- incident-lab/. "$LAB16/"
mkdir -- "$LAB16/evidence"
cp -- "$LAB16/live/service.conf" "$LAB16/evidence/service.conf.before"
cp -- "$LAB16/events.log" "$LAB16/evidence/events.before.log"
cat "$LAB16/inventory.txt"
cat "$LAB16/events.log"
diff -u -- "$LAB16/backup/service.conf" "$LAB16/live/service.conf"
python3 "$LAB16/healthcheck.py" "$LAB16/live/service.conf" "$LAB16/inventory.txt"

(cd "$LAB16/backup" && sha256sum -c SHA256SUMS) || exit 1
(
  candidate=$(mktemp "$LAB16/live/.candidate.XXXXXX") || exit 1
  trap 'rm -f -- "$candidate"' EXIT
  trap 'exit 130' INT
  trap 'exit 143' TERM
  cp -- "$LAB16/backup/service.conf" "$candidate" || exit 1
  python3 "$LAB16/healthcheck.py" "$candidate" "$LAB16/inventory.txt" || exit 1
  mv -fT -- "$candidate" "$LAB16/live/service.conf" || exit 1
) || exit 1
python3 "$LAB16/healthcheck.py" "$LAB16/live/service.conf" "$LAB16/inventory.txt"
sha256sum -- "$LAB16/live/service.conf" > "$LAB16/evidence/after.sha256"

(
  undo=$(mktemp "$LAB16/live/.rollback.XXXXXX") || exit 1
  trap 'rm -f -- "$undo"' EXIT
  trap 'exit 130' INT
  trap 'exit 143' TERM
  cp -- "$LAB16/evidence/service.conf.before" "$undo" || exit 1
  mv -fT -- "$undo" "$LAB16/live/service.conf" || exit 1
) || exit 1
if python3 "$LAB16/healthcheck.py" "$LAB16/live/service.conf" "$LAB16/inventory.txt"; then
  printf 'unexpected success\n'; exit 1
else
  test "$?" -eq 78 || exit 1
fi