106 lines
3.8 KiB
Bash
106 lines
3.8 KiB
Bash
#!/bin/bash
|
|
# fix-iap.sh — diagnostiserer og fikser IAP-problemer for et gitt subdomain
|
|
# Bruk: bash scripts/fix/fix-iap.sh opax.vauco.no
|
|
|
|
set -euo pipefail
|
|
|
|
DOMAIN=${1:-opax.vauco.no}
|
|
PROJECT=${PROJECTID:-propane-will-491900-m5}
|
|
LB_IP="34.98.77.173"
|
|
BACKEND="osvauco-agent-iap-backend"
|
|
PROXY="osvauco-agent-https-proxy"
|
|
URL_MAP="osvauco-agent-url-map"
|
|
IAM_MEMBER="domain:vauco.no"
|
|
IAM_ROLE="roles/iap.httpsResourceAccessor"
|
|
|
|
echo "====================================="
|
|
echo " IAP FIX — $DOMAIN"
|
|
echo "====================================="
|
|
|
|
# 1. DNS-sjekk
|
|
echo "\n[1/5] DNS-sjekk..."
|
|
RESOLVED=$(dig +short "$DOMAIN" | tail -1)
|
|
if [ "$RESOLVED" = "$LB_IP" ]; then
|
|
echo " ✅ DNS OK — peker på $LB_IP"
|
|
else
|
|
echo " ❌ DNS FEIL — peker på $RESOLVED (forventet $LB_IP)"
|
|
echo " → Endre A-record for $DOMAIN til $LB_IP hos DNS-registrar (Proisp)"
|
|
echo " → Kan ikke automatiseres — gjør dette manuelt"
|
|
fi
|
|
|
|
# 2. HTTP-respons-sjekk
|
|
echo "\n[2/5] HTTP-sjekk (curl -sI)..."
|
|
HTTP_CODE=$(curl -sI -o /dev/null -w "%{http_code}" --max-time 10 "https://$DOMAIN" || echo "000")
|
|
case $HTTP_CODE in
|
|
302) echo " ✅ 302 — IAP redirect til Google login. Fungerer!" ;;
|
|
200) echo " ✅ 200 — OK" ;;
|
|
403) echo " ⚠️ 403 — IAP er på, men du er ikke autorisert. Sjekker IAM..." ;;
|
|
404) echo " ❌ 404 — Feil backend eller URL-map" ;;
|
|
000) echo " ❌ Timeout/ingen respons — SSL eller routing-problem" ;;
|
|
*) echo " ❌ HTTP $HTTP_CODE — ukjent feil" ;;
|
|
esac
|
|
|
|
# 3. URL-map-sjekk
|
|
echo "\n[3/5] URL-map-sjekk..."
|
|
CURRENT_MAP=$(gcloud compute target-https-proxies describe "$PROXY" \
|
|
--project="$PROJECT" --format="value(urlMap)" 2>/dev/null | sed 's|.*/||')
|
|
if [ "$CURRENT_MAP" = "$URL_MAP" ]; then
|
|
echo " ✅ Proxy bruker korrekt URL-map: $URL_MAP"
|
|
else
|
|
echo " ❌ Proxy bruker feil URL-map: $CURRENT_MAP"
|
|
echo " → Fikser..."
|
|
gcloud compute target-https-proxies update "$PROXY" \
|
|
--url-map="$URL_MAP" --project="$PROJECT"
|
|
echo " ✅ Oppdatert til $URL_MAP"
|
|
fi
|
|
|
|
# 4. SSL-sertifikat-sjekk
|
|
echo "\n[4/5] SSL-sertifikat-sjekk..."
|
|
CERTS=$(gcloud compute target-https-proxies describe "$PROXY" \
|
|
--project="$PROJECT" --format="json(sslCertificates)" 2>/dev/null)
|
|
|
|
# Finn om det finnes et aktivt sertifikat for domenet
|
|
DOMAIN_CLEAN=$(echo "$DOMAIN" | tr '.' '-')
|
|
if echo "$CERTS" | grep -q "$DOMAIN_CLEAN\|$DOMAIN"; then
|
|
echo " ✅ SSL-sertifikat for $DOMAIN er koblet til proxy"
|
|
else
|
|
echo " ❌ Ingen SSL-sertifikat for $DOMAIN funnet"
|
|
CERT_NAME="${DOMAIN_CLEAN}-cert"
|
|
echo " → Oppretter sertifikat $CERT_NAME..."
|
|
gcloud compute ssl-certificates create "$CERT_NAME" \
|
|
--domains="$DOMAIN" --project="$PROJECT" 2>/dev/null || echo " (sertifikat eksisterer kanskje allerede)"
|
|
echo " → Kobler til proxy..."
|
|
EXISTING=$(gcloud compute target-https-proxies describe "$PROXY" \
|
|
--project="$PROJECT" --format="value(sslCertificates)" | tr ';' ',' | sed 's|.*/||g')
|
|
gcloud compute target-https-proxies update "$PROXY" \
|
|
--ssl-certificates="${EXISTING},${CERT_NAME}" --project="$PROJECT"
|
|
echo " ✅ Sertifikat lagt til. Venter på provisjonering (10-15 min)..."
|
|
fi
|
|
|
|
# 5. IAM-sjekk
|
|
echo "\n[5/5] IAM-sjekk..."
|
|
IAM_OK=$(gcloud iap web get-iam-policy \
|
|
--resource-type=backend-services \
|
|
--service="$BACKEND" \
|
|
--project="$PROJECT" \
|
|
--format=json 2>/dev/null | grep -c "$IAM_MEMBER" || echo "0")
|
|
|
|
if [ "$IAM_OK" -gt "0" ]; then
|
|
echo " ✅ IAM OK — $IAM_MEMBER har tilgang"
|
|
else
|
|
echo " ❌ IAM mangler for $IAM_MEMBER"
|
|
echo " → Legger til..."
|
|
gcloud iap web add-iam-policy-binding \
|
|
--resource-type=backend-services \
|
|
--service="$BACKEND" \
|
|
--member="$IAM_MEMBER" \
|
|
--role="$IAM_ROLE" \
|
|
--project="$PROJECT"
|
|
echo " ✅ IAM oppdatert"
|
|
fi
|
|
|
|
echo "\n====================================="
|
|
echo " FERDIG. Test: https://$DOMAIN"
|
|
echo " Forventet: 302 → Google login"
|
|
echo "====================================="
|