code wiki / _hdl_build / nx_edge_recon_stage.nx
nx_edge_recon_stage.nx
buildroot/runtime/_hdl_build/nx_edge_recon_stage.nx
about
nx_edge_recon_stage.nx -- READ-ONLY stage step for a public :443 EDGE-CUTOVER recon over the sovereign SSH
path. Sibling of nx_video_diag_stage.nx: reads the decrypted secret from /tmp/nxsecret.out (produced by
nx_machine_key + _offc/nx_vault.elf open), copies it to /tmp/nxpw, and writes a STRICTLY READ-ONLY recon
payload to /tmp/nxcmd. Then nx_ssh_cmd consumes both. The payload is echo/for/grep/ss/netstat/ls/openssl
(read)/cat/sort/head ONLY -- no kill/start/mv/deploy/cron/write/sudo. NOTHING on the NAS or router is
mutated. Purpose: inventory the nginx :443 edge + all sovereign listeners + cert SANs + route tables so a
reversible cutover can be DESIGNED (not executed). license_tier: ORIGINAL
dependencies 1 imports · 0 importers
imports: nx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 10 | const DIAG_CMD: *u8 = "echo ===NGINX_ALL_SERVERS===; for f in /usr/local/etc/nginx/sites-enabled/* /etc/nginx/sites-enabled/* /usr/local/etc/nginx/nginx.conf; do echo \"--FILE $f--\"; grep -nE 'listen|server_name|ssl_certificate|proxy_pass|root |location ' \"$f\" 2>/dev/null; done; echo ===LISTEN_PORTS===; (ss -tlnp 2>/dev/null||netstat -tlnp 2>/dev/null)|grep -E ':443 |:8443|:7443|:8445|:8446|:80 |:9443|:8453'; echo ===DSM_NGINX===; grep -rlE 'synology|DSM|webman|5000|5001' /usr/local/etc/nginx/ 2>/dev/null | head; echo ===CERTS_SITESELF===; ls -l /volume1/homes/elderwesto/nishihost/certs/ 2>/dev/null; echo ===SITESELF_CERT_SAN===; openssl x509 -inform DER -in /volume1/homes/elderwesto/nishihost/certs/le_fullchain.der -noout -text 2>/dev/null | grep -iE 'subject:|dns:|not after'; echo ===MULTISAN_CERT_SAN===; openssl x509 -inform DER -in /volume1/homes/elderwesto/nishihost/certs/multi_san_cert.der -noout -text 2>/dev/null | grep -iE 'subject:|dns:|not after'; echo ===CERTS_NGINX===; grep -rhoE 'ssl_certificate[_key]* .*;' /usr/local/etc/nginx/sites-enabled/ 2>/dev/null | sort -u; echo ===SITES_CONF===; cat /volume1/homes/elderwesto/nishihost/sites.conf 2>/dev/null; echo ===PROXY_ROUTES===; cat /volume1/homes/elderwesto/nishihost/proxy_routes.conf 2>/dev/null; echo ===CERTS_GEN===; cat /volume1/homes/elderwesto/nishihost/certs_generated.conf 2>/dev/null; echo ===SITES_GEN===; cat /volume1/homes/elderwesto/nishihost/sites_generated.conf 2>/dev/null; echo ===END===\n" |
functions
| 12 | func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } |
| 13 | func pw(s: *u8) -> i64 { sys_write(1,s,slen(s)); return 0 } |
| 14 | func pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } |
| 16 | func main() -> i64 |