mawkone
537e697dab
Documents the new apps.exec tool alongside apps.logs and adds a troubleshooting cookbook covering the common failure patterns we've seen in the wild: missing migrations, silent apps.update reroutes, 502s on compose domains, healthcheck timeouts, and how to use apps.exec as the platform's escape hatch for in-container inspection. Bumps MCP version to 2.2.0 in the changelog and bumps the vibn-frontend submodule to ship the apps.exec implementation. Also includes setup-vibn-logs-user.sh (the script that installs the locked-down SSH user on the Coolify host) which was already running in production but not yet committed. Made-with: Cursor
48 lines
1.5 KiB
Bash
48 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Run as sudo on coolify-server-mtl:
|
|
# bash /tmp/setup-vibn-logs-user.sh
|
|
#
|
|
# Creates a locked-down `vibn-logs` user that the vibn-frontend
|
|
# control plane can SSH to. Membership in the `docker` group lets
|
|
# it run `docker ps` / `docker logs` without sudo; no shell login,
|
|
# no password, single authorized key.
|
|
|
|
set -euo pipefail
|
|
|
|
USER=vibn-logs
|
|
PUBKEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINkn70ItA4LUZTZDIu8fC8QkuHAewk5VH9ogF+52UTT0 vibn-logs@vibn-frontend'
|
|
|
|
if id "$USER" &>/dev/null; then
|
|
echo "user $USER already exists"
|
|
else
|
|
useradd -m -s /bin/bash "$USER"
|
|
echo "created user $USER"
|
|
fi
|
|
|
|
usermod -aG docker "$USER"
|
|
passwd -l "$USER" >/dev/null
|
|
|
|
mkdir -p "/home/$USER/.ssh"
|
|
chmod 700 "/home/$USER/.ssh"
|
|
|
|
# Exactly one authorized key (force-restrict: no PTY, no agent forwarding,
|
|
# no X11 forwarding, no port forwarding). The control plane only needs
|
|
# to run docker commands.
|
|
AUTH_FILE="/home/$USER/.ssh/authorized_keys"
|
|
RESTRICTIONS='no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty'
|
|
echo "$RESTRICTIONS $PUBKEY" > "$AUTH_FILE"
|
|
chmod 600 "$AUTH_FILE"
|
|
chown -R "$USER:$USER" "/home/$USER/.ssh"
|
|
|
|
echo "✓ $USER ready"
|
|
echo " groups: $(id -nG "$USER")"
|
|
echo " authorized_keys:"
|
|
sed 's/^/ /' "$AUTH_FILE"
|
|
|
|
# Verify docker access
|
|
su - "$USER" -s /bin/bash -c 'docker ps --format "table {{.Names}}" | head -3' || {
|
|
echo "⚠ docker access test failed — user may not be able to run docker commands"
|
|
exit 1
|
|
}
|
|
echo "✓ docker access verified"
|