feat(ops): add quick-fix scripts for common GCP/TUI issues

scripts/fix/README.md

@@ -0,0 +1,21 @@
+# Quick-Fix Scripts
+
+Einliner-scripts for å fikse vanlige problemer raskt, uten å måtte debugge i TUI.
+
+## Scripts
+
+| Script | Hva det fikser |
+|---|---|
+| `fix-iap.sh` | IAP 403/404 — sjekker og fikser DNS, URL-map, SSL-cert, IAM |
+| `fix-tui.sh` | Gemini CLI TUI henger/svarer ikke — restart og re-auth |
+| `fix-cloudrun.sh` | Cloud Run service er nede eller 502 |
+| `fix-dns.sh` | Subdomain peker feil (CNAME vs A-record) |
+
+## Bruk
+
+```bash
+bash scripts/fix/fix-iap.sh opax.vauco.no
+bash scripts/fix/fix-tui.sh
+bash scripts/fix/fix-cloudrun.sh osvauco-agent
+bash scripts/fix/fix-dns.sh opax.vauco.no
+```

scripts/fix/fix-cloudrun.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# fix-cloudrun.sh — sjekker og restarter Cloud Run-tjeneste
+# Bruk: bash scripts/fix/fix-cloudrun.sh osvauco-agent
+
+set -uo pipefail
+
+SERVICE=${1:-osvauco-agent}
+PROJECT=${PROJECTID:-propane-will-491900-m5}
+REGION=${REGION:-us-central1}
+
+echo "====================================="
+echo " CLOUD RUN FIX — $SERVICE"
+echo "====================================="
+
+# 1. Status
+echo "\n[1/3] Henter status..."
+STATUS=$(gcloud run services describe "$SERVICE" \
+  --project="$PROJECT" --region="$REGION" \
+  --format="value(status.conditions[0].type,status.conditions[0].status)" 2>/dev/null || echo "FEIL")
+echo "  Status: $STATUS"
+
+# 2. Siste revisjon og URL
+echo "\n[2/3] Siste revisjon og URL..."
+gcloud run services describe "$SERVICE" \
+  --project="$PROJECT" --region="$REGION" \
+  --format="table(status.latestReadyRevisionName,status.url)" 2>/dev/null || echo "  Klarte ikke hente"
+
+# 3. Health-sjekk
+echo "\n[3/3] Health-sjekk..."
+SVC_URL=$(gcloud run services describe "$SERVICE" \
+  --project="$PROJECT" --region="$REGION" \
+  --format="value(status.url)" 2>/dev/null || echo "")
+
+if [ -n "$SVC_URL" ]; then
+  TOKEN=$(gcloud auth print-identity-token 2>/dev/null)
+  HTTP=$(curl -sI -o /dev/null -w "%{http_code}" \
+    -H "Authorization: Bearer $TOKEN" \
+    --max-time 10 "${SVC_URL}/health" || echo "000")
+  echo "  /health → HTTP $HTTP"
+  if [ "$HTTP" = "200" ]; then
+    echo "  ✅ Cloud Run OK"
+  else
+    echo "  ❌ Ikke OK — sjekk logs:"
+    echo "  gcloud run services logs read $SERVICE --project=$PROJECT --region=$REGION --limit=50"
+  fi
+else
+  echo "  ❌ Klarte ikke hente service URL"
+fi
+
+echo "\n====================================="
+echo " Logs: gcloud run services logs read $SERVICE --project=$PROJECT --region=$REGION --limit=50"
+echo "====================================="

scripts/fix/fix-dns.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# fix-dns.sh — sjekker om subdomain peker riktig (A-record til LB, ikke CNAME til ghs)
+# Bruk: bash scripts/fix/fix-dns.sh opax.vauco.no
+
+set -uo pipefail
+
+DOMAIN=${1:-opax.vauco.no}
+LB_IP="34.98.77.173"
+BAD_CNAME="ghs.googlehosted.com"
+
+echo "====================================="
+echo " DNS FIX CHECK — $DOMAIN"
+echo "====================================="
+
+RESOLVED=$(dig +short "$DOMAIN" | tail -1)
+CNAME=$(dig +short CNAME "$DOMAIN" 2>/dev/null || echo "")
+
+echo "\nNåværende DNS:"
+echo "  CNAME : ${CNAME:-ingen}"
+echo "  Resolves to: ${RESOLVED:-ingen}"
+
+if echo "$CNAME" | grep -q "$BAD_CNAME"; then
+  echo "\n  ❌ PROBLEM: $DOMAIN bruker CNAME til $BAD_CNAME"
+  echo "     Dette er Cloud Run Domain Mapping — ikke Load Balancer!"
+  echo "     IAP fungerer IKKE med denne konfigurasjonen."
+  echo ""
+  echo "  → FIX (manuelt hos Proisp):"
+  echo "     1. Slett CNAME: $DOMAIN → $BAD_CNAME"
+  echo "     2. Legg til A-record: $DOMAIN → $LB_IP"
+  echo "     3. TTL: 300"
+  echo ""
+  echo "  → Fremtidig automatisering: flytt vauco.no til Google Cloud DNS"
+  echo "     gcloud dns managed-zones create vauco-no --dns-name=vauco.no. --project=propane-will-491900-m5"
+elif [ "$RESOLVED" = "$LB_IP" ]; then
+  echo "\n  ✅ DNS OK — $DOMAIN peker på Load Balancer ($LB_IP)"
+else
+  echo "\n  ⚠️  $DOMAIN peker på $RESOLVED (ukjent)"
+  echo "  Forventet: $LB_IP"
+fi
+
+echo "\n====================================="

scripts/fix/fix-iap.sh

@@ -0,0 +1,105 @@
+#!/bin/bash
+# fix-iap.sh — diagnostiserer og fikser IAP-problemer for et gitt subdomain
+# Bruk: bash scripts/fix/fix-iap.sh opax.vauco.no
+
+set -euo pipefail
+
+DOMAIN=${1:-opax.vauco.no}
+PROJECT=${PROJECTID:-propane-will-491900-m5}
+LB_IP="34.98.77.173"
+BACKEND="osvauco-agent-iap-backend"
+PROXY="osvauco-agent-https-proxy"
+URL_MAP="osvauco-agent-url-map"
+IAM_MEMBER="domain:vauco.no"
+IAM_ROLE="roles/iap.httpsResourceAccessor"
+
+echo "====================================="
+echo " IAP FIX — $DOMAIN"
+echo "====================================="
+
+# 1. DNS-sjekk
+echo "\n[1/5] DNS-sjekk..."
+RESOLVED=$(dig +short "$DOMAIN" | tail -1)
+if [ "$RESOLVED" = "$LB_IP" ]; then
+  echo "  ✅ DNS OK — peker på $LB_IP"
+else
+  echo "  ❌ DNS FEIL — peker på $RESOLVED (forventet $LB_IP)"
+  echo "  → Endre A-record for $DOMAIN til $LB_IP hos DNS-registrar (Proisp)"
+  echo "  → Kan ikke automatiseres — gjør dette manuelt"
+fi
+
+# 2. HTTP-respons-sjekk
+echo "\n[2/5] HTTP-sjekk (curl -sI)..."
+HTTP_CODE=$(curl -sI -o /dev/null -w "%{http_code}" --max-time 10 "https://$DOMAIN" || echo "000")
+case $HTTP_CODE in
+  302) echo "  ✅ 302 — IAP redirect til Google login. Fungerer!" ;;
+  200) echo "  ✅ 200 — OK" ;;
+  403) echo "  ⚠️  403 — IAP er på, men du er ikke autorisert. Sjekker IAM..." ;;
+  404) echo "  ❌ 404 — Feil backend eller URL-map" ;;
+  000) echo "  ❌ Timeout/ingen respons — SSL eller routing-problem" ;;
+  *)   echo "  ❌ HTTP $HTTP_CODE — ukjent feil" ;;
+esac
+
+# 3. URL-map-sjekk
+echo "\n[3/5] URL-map-sjekk..."
+CURRENT_MAP=$(gcloud compute target-https-proxies describe "$PROXY" \
+  --project="$PROJECT" --format="value(urlMap)" 2>/dev/null | sed 's|.*/||')
+if [ "$CURRENT_MAP" = "$URL_MAP" ]; then
+  echo "  ✅ Proxy bruker korrekt URL-map: $URL_MAP"
+else
+  echo "  ❌ Proxy bruker feil URL-map: $CURRENT_MAP"
+  echo "  → Fikser..."
+  gcloud compute target-https-proxies update "$PROXY" \
+    --url-map="$URL_MAP" --project="$PROJECT"
+  echo "  ✅ Oppdatert til $URL_MAP"
+fi
+
+# 4. SSL-sertifikat-sjekk
+echo "\n[4/5] SSL-sertifikat-sjekk..."
+CERTS=$(gcloud compute target-https-proxies describe "$PROXY" \
+  --project="$PROJECT" --format="json(sslCertificates)" 2>/dev/null)
+
+# Finn om det finnes et aktivt sertifikat for domenet
+DOMAIN_CLEAN=$(echo "$DOMAIN" | tr '.' '-')
+if echo "$CERTS" | grep -q "$DOMAIN_CLEAN\|$DOMAIN"; then
+  echo "  ✅ SSL-sertifikat for $DOMAIN er koblet til proxy"
+else
+  echo "  ❌ Ingen SSL-sertifikat for $DOMAIN funnet"
+  CERT_NAME="${DOMAIN_CLEAN}-cert"
+  echo "  → Oppretter sertifikat $CERT_NAME..."
+  gcloud compute ssl-certificates create "$CERT_NAME" \
+    --domains="$DOMAIN" --project="$PROJECT" 2>/dev/null || echo "  (sertifikat eksisterer kanskje allerede)"
+  echo "  → Kobler til proxy..."
+  EXISTING=$(gcloud compute target-https-proxies describe "$PROXY" \
+    --project="$PROJECT" --format="value(sslCertificates)" | tr ';' ',' | sed 's|.*/||g')
+  gcloud compute target-https-proxies update "$PROXY" \
+    --ssl-certificates="${EXISTING},${CERT_NAME}" --project="$PROJECT"
+  echo "  ✅ Sertifikat lagt til. Venter på provisjonering (10-15 min)..."
+fi
+
+# 5. IAM-sjekk
+echo "\n[5/5] IAM-sjekk..."
+IAM_OK=$(gcloud iap web get-iam-policy \
+  --resource-type=backend-services \
+  --service="$BACKEND" \
+  --project="$PROJECT" \
+  --format=json 2>/dev/null | grep -c "$IAM_MEMBER" || echo "0")
+
+if [ "$IAM_OK" -gt "0" ]; then
+  echo "  ✅ IAM OK — $IAM_MEMBER har tilgang"
+else
+  echo "  ❌ IAM mangler for $IAM_MEMBER"
+  echo "  → Legger til..."
+  gcloud iap web add-iam-policy-binding \
+    --resource-type=backend-services \
+    --service="$BACKEND" \
+    --member="$IAM_MEMBER" \
+    --role="$IAM_ROLE" \
+    --project="$PROJECT"
+  echo "  ✅ IAM oppdatert"
+fi
+
+echo "\n====================================="
+echo " FERDIG. Test: https://$DOMAIN"
+echo " Forventet: 302 → Google login"
+echo "====================================="

scripts/fix/fix-tui.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# fix-tui.sh — fikser Gemini CLI TUI som henger, ikke svarer, eller feiler auth
+# Bruk: bash scripts/fix/fix-tui.sh
+
+set -uo pipefail
+
+echo "====================================="
+echo " TUI FIX — Gemini CLI"
+echo "====================================="
+
+# 1. Sjekk om gemini-prosess henger
+echo "\n[1/4] Sjekker kjørende gemini-prosesser..."
+GEMINI_PIDS=$(pgrep -f "gemini" 2>/dev/null || echo "")
+if [ -n "$GEMINI_PIDS" ]; then
+  echo "  ⚠️  Fant hengende prosess(er): $GEMINI_PIDS"
+  echo "  → Dreper dem..."
+  kill $GEMINI_PIDS 2>/dev/null || true
+  sleep 1
+  echo "  ✅ Prosesser drept"
+else
+  echo "  ✅ Ingen hengende gemini-prosesser"
+fi
+
+# 2. Re-auth gcloud
+echo "\n[2/4] Verifiserer gcloud auth..."
+ACCOUNT=$(gcloud auth list --filter=status:ACTIVE --format="value(account)" 2>/dev/null | head -1)
+if [ -n "$ACCOUNT" ]; then
+  echo "  ✅ Innlogget som: $ACCOUNT"
+else
+  echo "  ❌ Ikke autentisert!"
+  echo "  → Kjører re-auth..."
+  gcloud auth login
+fi
+
+# 3. Sjekk Vertex AI token
+echo "\n[3/4] Sjekker Vertex AI identity token..."
+TOKEN=$(gcloud auth print-identity-token 2>/dev/null | head -c 20)
+if [ -n "$TOKEN" ]; then
+  echo "  ✅ Identity token OK"
+else
+  echo "  ❌ Klarte ikke hente token"
+  echo "  → Kjør: gcloud auth application-default login"
+fi
+
+# 4. Test Gemini API
+echo "\n[4/4] Tester Gemini CLI..."
+if command -v gemini &>/dev/null; then
+  echo "  ✅ gemini er installert: $(gemini --version 2>/dev/null || echo 'ukjent versjon')"
+  echo "  → Start ny sesjon med: opax (eller bash opax.sh)"
+else
+  echo "  ❌ gemini ikke funnet i PATH"
+  echo "  → Installer: npm install -g @google/gemini-cli"
+fi
+
+echo "\n====================================="
+echo " FERDIG. Start TUI på nytt med: opax"
+echo "====================================="