code wiki / _hdl_build / nx_edge_recon_stage.nx
`nx_edge_recon_stage.nx` source

1// nx_edge_recon_stage.nx -- READ-ONLY stage step for a public :443 EDGE-CUTOVER recon over the sovereign SSH
2// path. Sibling of nx_video_diag_stage.nx: reads the decrypted secret from /tmp/nxsecret.out (produced by
3// nx_machine_key + _offc/nx_vault.elf open), copies it to /tmp/nxpw, and writes a STRICTLY READ-ONLY recon
4// payload to /tmp/nxcmd. Then nx_ssh_cmd consumes both. The payload is echo/for/grep/ss/netstat/ls/openssl
5// (read)/cat/sort/head ONLY -- no kill/start/mv/deploy/cron/write/sudo. NOTHING on the NAS or router is
6// mutated. Purpose: inventory the nginx :443 edge + all sovereign listeners + cert SANs + route tables so a
7// reversible cutover can be DESIGNED (not executed). license_tier: ORIGINAL
8import "nx_syscalls.nx"
9
10const DIAG_CMD: *u8 = "echo ===NGINX_ALL_SERVERS===; for f in /usr/local/etc/nginx/sites-enabled/* /etc/nginx/sites-enabled/* /usr/local/etc/nginx/nginx.conf; do echo \"--FILE $f--\"; grep -nE 'listen|server_name|ssl_certificate|proxy_pass|root |location ' \"$f\" 2>/dev/null; done; echo ===LISTEN_PORTS===; (ss -tlnp 2>/dev/null||netstat -tlnp 2>/dev/null)|grep -E ':443 |:8443|:7443|:8445|:8446|:80 |:9443|:8453'; echo ===DSM_NGINX===; grep -rlE 'synology|DSM|webman|5000|5001' /usr/local/etc/nginx/ 2>/dev/null | head; echo ===CERTS_SITESELF===; ls -l /volume1/homes/elderwesto/nishihost/certs/ 2>/dev/null; echo ===SITESELF_CERT_SAN===; openssl x509 -inform DER -in /volume1/homes/elderwesto/nishihost/certs/le_fullchain.der -noout -text 2>/dev/null | grep -iE 'subject:|dns:|not after'; echo ===MULTISAN_CERT_SAN===; openssl x509 -inform DER -in /volume1/homes/elderwesto/nishihost/certs/multi_san_cert.der -noout -text 2>/dev/null | grep -iE 'subject:|dns:|not after'; echo ===CERTS_NGINX===; grep -rhoE 'ssl_certificate[_key]* .*;' /usr/local/etc/nginx/sites-enabled/ 2>/dev/null | sort -u; echo ===SITES_CONF===; cat /volume1/homes/elderwesto/nishihost/sites.conf 2>/dev/null; echo ===PROXY_ROUTES===; cat /volume1/homes/elderwesto/nishihost/proxy_routes.conf 2>/dev/null; echo ===CERTS_GEN===; cat /volume1/homes/elderwesto/nishihost/certs_generated.conf 2>/dev/null; echo ===SITES_GEN===; cat /volume1/homes/elderwesto/nishihost/sites_generated.conf 2>/dev/null; echo ===END===\n"
11
12func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
13func pw(s: *u8) -> i64 { sys_write(1,s,slen(s)); return 0 }
14func pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 }
15
16func main() -> i64 {
17    let box: *i64 = sys_mmap(16) as *i64
18    let sec: *u8 = sys_read_file("/tmp/nxsecret.out" as *u8, box)
19    if (sec as i64)==0 { pw("EDGE-RECON-STAGE: no /tmp/nxsecret.out -- run nx_machine_key + _offc/nx_vault.elf open first\n"); sys_exit(1); return 1 }
20    let pf: i64 = sys_openat_wr("/tmp/nxpw" as *u8, 0x180)
21    if pf<0 { pw("EDGE-RECON-STAGE: cannot write /tmp/nxpw\n"); sys_exit(1); return 1 }
22    sys_write(pf, sec, box[0]); sys_close(pf)
23    let cf: i64 = sys_openat_wr("/tmp/nxcmd" as *u8, 0x180)
24    if cf<0 { pw("EDGE-RECON-STAGE: cannot write /tmp/nxcmd\n"); sys_exit(1); return 1 }
25    sys_write(cf, DIAG_CMD, slen(DIAG_CMD)); sys_close(cf)
26    pw("EDGE-RECON-STAGE: credential -> /tmp/nxpw ("); pn(box[0]); pw(" bytes) + READ-ONLY edge recon staged -> /tmp/nxcmd. Run nx_ssh_cmd.\n")
27    sys_exit(0); return 0
28}
nx_edge_recon_stage.nx source

`nx_edge_recon_stage.nx` source
