8ffeea6731
- 28 more of the operator's own public images (42 -> 67), alts from his captions - remove group-feier, group-outdoor, group-posiert (wedding guests visible) - studio section now offers Studio Neumuenster and Mobiles Studio - deploy: --force-recreate on release and rollback, plus in-container content probe - verify: DESFOTO_BASE dry-run, redirect, asset and privacy checks - tests: 57 OK (3 new content guards, 2 deploy/verify regression guards)
194 lines
7.7 KiB
Bash
Executable File
194 lines
7.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Post-release verification for desfoto.de.
|
|
#
|
|
# .ocauto/verify <release-sha>
|
|
#
|
|
# Proves that (a) the live desfoto.de serves the released build and assets,
|
|
# (b) the security posture matches the promises on /datenschutz/, and
|
|
# (c) the neighbouring sites (dennyschulz.de, dennyapp.de) are untouched.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
root="$(pwd)"
|
|
release_sha="${1:-unknown}"
|
|
remote="${DESFOTO_REMOTE:-prod-main}"
|
|
# DESFOTO_BASE lets the hook be dry-run against a local container
|
|
# (DESFOTO_BASE=http://127.0.0.1:18430 .ocauto/verify unknown); the
|
|
# domain-specific sections (deployed tree, canonical host, neighbours, TLS)
|
|
# only run against the real production origin.
|
|
base="${DESFOTO_BASE:-https://desfoto.de}"
|
|
live=0
|
|
if [ "$base" = "https://desfoto.de" ]; then live=1; fi
|
|
|
|
failures=0
|
|
pass() { printf ' ok %s\n' "$1"; }
|
|
fail() { printf ' FAIL %s\n' "$1" >&2; failures=$((failures + 1)); }
|
|
|
|
check_status() {
|
|
local url="$1" want="$2" got
|
|
got="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 30 "$url" || echo 000)"
|
|
if [ "$got" = "$want" ]; then pass "$url -> $got"; else fail "$url -> $got (want $want)"; fi
|
|
}
|
|
|
|
check_contains() {
|
|
local url="$1" needle="$2" body
|
|
body="$(curl -sS --max-time 30 "$url" || true)"
|
|
if printf '%s' "$body" | grep -qF -- "$needle"; then
|
|
pass "$url contains '$needle'"
|
|
else
|
|
fail "$url does not contain '$needle'"
|
|
fi
|
|
}
|
|
|
|
check_header() {
|
|
local url="$1" header="$2" headers
|
|
headers="$(curl -sSI --max-time 30 "$url" || true)"
|
|
if printf '%s' "$headers" | grep -qi "^$header:"; then
|
|
pass "$url sends $header"
|
|
else
|
|
fail "$url is missing the $header header"
|
|
fi
|
|
}
|
|
|
|
check_redirect() {
|
|
local url="$1" want="$2" got target
|
|
got="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 30 "$url" || echo 000)"
|
|
target="$(curl -sS -o /dev/null -w '%{redirect_url}' --max-time 30 "$url" || true)"
|
|
if [ "$got" = "301" ] && [ "$target" = "$want" ]; then
|
|
pass "$url -> 301 $want"
|
|
else
|
|
fail "$url -> $got ${target:-<no Location>} (want 301 $want)"
|
|
fi
|
|
}
|
|
|
|
check_not_contains() {
|
|
local url="$1" needle="$2" body
|
|
body="$(curl -sS --max-time 30 "$url" || true)"
|
|
if printf '%s' "$body" | grep -qF -- "$needle"; then
|
|
fail "$url still contains '$needle'"
|
|
else
|
|
pass "$url no longer contains '$needle'"
|
|
fi
|
|
}
|
|
|
|
printf '\n== release identity\n'
|
|
if [ "$live" = 1 ] && [ "$release_sha" != "unknown" ] && git -C "$root" rev-parse --verify --quiet "$release_sha" >/dev/null; then
|
|
local_hash="$(cd "$root/site" && find . -type f ! -name sitemap.xml ! -path './.well-known/*' -print0 |
|
|
sort -z | xargs -0 sha256sum | sha256sum | cut -d' ' -f1)"
|
|
remote_hash="$(ssh "$remote" "sudo sh -c 'cd /home/denny/stacks/desfoto/site && find . -type f ! -name sitemap.xml ! -path ./.well-known/\* -print0 | sort -z | xargs -0 sha256sum | sha256sum'" | cut -d' ' -f1)"
|
|
if [ "$local_hash" = "$remote_hash" ]; then
|
|
pass "deployed site tree matches the release ($local_hash)"
|
|
else
|
|
fail "deployed site tree differs from the release ($local_hash != $remote_hash)"
|
|
fi
|
|
remote_release="$(ssh "$remote" 'sudo cat /home/denny/stacks/desfoto/RELEASE' | tr -d '\r\n')"
|
|
if [ "$remote_release" = "$release_sha" ]; then
|
|
pass "release marker is $release_sha"
|
|
else
|
|
fail "release marker is '$remote_release' (want $release_sha)"
|
|
fi
|
|
fi
|
|
|
|
printf '\n== routes\n'
|
|
for route in / /shootings/ /businessfotografie/ /portrait-und-model/ /familien-und-paare/ \
|
|
/minishootings/ /video/ /social-media/ /projekte/ /ueber/ /kontakt/ /impressum/ /datenschutz/; do
|
|
check_status "$base$route" 200
|
|
done
|
|
|
|
# The retired photo URL must keep working: it is the umbrella page now.
|
|
check_redirect "$base/fotografie" "$base/shootings/"
|
|
check_redirect "$base/fotografie/" "$base/shootings/"
|
|
check_redirect "$base/fotografie.html" "$base/shootings/"
|
|
|
|
printf '\n== canonical host and redirects\n'
|
|
if [ "$live" = 1 ]; then
|
|
www_status="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 30 https://www.desfoto.de/ || echo 000)"
|
|
www_target="$(curl -sS -o /dev/null -w '%{redirect_url}' --max-time 30 https://www.desfoto.de/ || true)"
|
|
if [ "$www_status" = "301" ] && [ "$www_target" = "https://desfoto.de/" ]; then
|
|
pass "www.desfoto.de -> https://desfoto.de/ (301)"
|
|
else
|
|
fail "www.desfoto.de -> $www_status $www_target"
|
|
fi
|
|
http_target="$(curl -sS -o /dev/null -w '%{redirect_url}' --max-time 30 http://desfoto.de/ || true)"
|
|
case "$http_target" in
|
|
https://desfoto.de/*) pass "http://desfoto.de/ -> $http_target" ;;
|
|
*) fail "http://desfoto.de/ redirects to '$http_target'" ;;
|
|
esac
|
|
fi
|
|
|
|
printf '\n== content\n'
|
|
check_contains "$base/" 'href="/shootings/"'
|
|
check_contains "$base/" 'href="/video/"'
|
|
check_contains "$base/" "Mobiles Studio"
|
|
check_contains "$base/" "Studio Neumünster"
|
|
check_not_contains "$base/" 'href="/fotografie/'
|
|
check_contains "$base/shootings/" "Autarke Blitzanlage"
|
|
check_contains "$base/shootings/" "Minishootings"
|
|
check_contains "$base/impressum/" "§ 5 DDG"
|
|
check_contains "$base/impressum/" "DE462149560"
|
|
check_contains "$base/datenschutz/" "keine Zugriffsprotokolle"
|
|
check_contains "$base/datenschutz/" "youtube-nocookie.com"
|
|
check_contains "$base/video/" "NWWFTf7l8g0"
|
|
check_contains "$base/" "https://www.dennyschulz.de/"
|
|
check_contains "$base/" "https://dennyapp.de/"
|
|
check_contains "$base/sitemap.xml" "<loc>https://desfoto.de/shootings/</loc>"
|
|
check_not_contains "$base/sitemap.xml" "<loc>https://desfoto.de/fotografie/</loc>"
|
|
|
|
printf '\n== error handling and metadata\n'
|
|
check_status "$base/diese-seite-gibt-es-nicht/" 404
|
|
check_contains "$base/diese-seite-gibt-es-nicht/" "Diese Seite gibt es nicht"
|
|
check_status "$base/.well-known/security.txt" 200
|
|
check_status "$base/robots.txt" 200
|
|
|
|
printf '\n== assets\n'
|
|
check_status "$base/assets/img/logo-160.png" 200
|
|
check_status "$base/assets/img/favicon-32.png" 200
|
|
check_status "$base/assets/img/og-shootings.jpg" 200
|
|
check_status "$base/assets/site.css" 200
|
|
check_status "$base/assets/fonts/fraunces-latin.woff2" 200
|
|
# The portfolio expansion ships the operator's own public work...
|
|
check_status "$base/assets/img/music-dreadlocks-1200.webp" 200
|
|
check_status "$base/assets/img/business-hotel-window-1200.webp" 200
|
|
check_status "$base/assets/img/couple-park-1200.webp" 200
|
|
check_status "$base/assets/img/editorial-leap-1200.webp" 200
|
|
# ...and the wedding pictures showing the guests stay removed.
|
|
check_status "$base/assets/img/group-feier-1200.webp" 404
|
|
check_status "$base/assets/img/group-outdoor-1200.webp" 404
|
|
check_status "$base/assets/img/group-posiert-1200.webp" 404
|
|
check_contains "$base/projekte/" "music-dreadlocks-1200.webp"
|
|
check_contains "$base/familien-und-paare/" "couple-park-1200.webp"
|
|
|
|
printf '\n== privacy promises and headers\n'
|
|
check_header "$base/" "Strict-Transport-Security"
|
|
check_header "$base/" "Content-Security-Policy"
|
|
check_header "$base/" "X-Content-Type-Options"
|
|
check_header "$base/" "Referrer-Policy"
|
|
if curl -sSI --max-time 30 "$base/" | grep -qi '^set-cookie:'; then
|
|
fail "a cookie is set on the homepage"
|
|
else
|
|
pass "no Set-Cookie on the homepage"
|
|
fi
|
|
|
|
printf '\n== neighbouring sites untouched\n'
|
|
if [ "$live" = 1 ]; then
|
|
check_status "https://www.dennyschulz.de/" 200
|
|
check_contains "https://www.dennyschulz.de/impressum" "Denny Schulz"
|
|
check_status "https://dennyapp.de/" 200
|
|
fi
|
|
|
|
printf '\n== TLS\n'
|
|
if [ "$live" = 1 ] && command -v openssl >/dev/null 2>&1; then
|
|
if echo | openssl s_client -servername desfoto.de -connect desfoto.de:443 2>/dev/null |
|
|
openssl x509 -noout -checkend 604800 -subject 2>/dev/null; then
|
|
pass "certificate for desfoto.de is valid for at least 7 more days"
|
|
else
|
|
fail "certificate for desfoto.de is missing or expires within 7 days"
|
|
fi
|
|
fi
|
|
|
|
if [ "$failures" -ne 0 ]; then
|
|
printf '\nVERIFY FAIL (%d problem(s)) release=%s\n' "$failures" "$release_sha" >&2
|
|
exit 1
|
|
fi
|
|
printf '\nVERIFY PASS release=%s\n' "$release_sha"
|