Projects Monitor Access to OCI

Grants Projects Monitor — a separate dashboard project that surfaces aggregated status across several of the operator’s projects, hosted externally on Osasco (Nuvem Hospedagem shared hosting), not part of this repo — narrow, read-only access to pull a health snapshot from each vinhedo host on demand. See ADR-0001 for why this is a bespoke shell mechanism rather than a standard monitoring agent.

Files

File	Runs on	Purpose
deploy-projects-monitor.sh	laptop	Orchestrates provisioning and verification across hosts
setup-projects-monitor.sh	remote host, as root	Creates the service account, installs the collector, grants sudo, locks down SSH
monitor-report	remote host, via forced command	Emits one JSON health snapshot per invocation
projects_monitor / projects_monitor.pub	—	The SSH keypair used for the forced-command login

Deploying

./deploy-projects-monitor.sh                # all four vinhedo hosts
./deploy-projects-monitor.sh vinhedo2        # a single host
VERIFY_ONLY=1 ./deploy-projects-monitor.sh   # skip provisioning, just check access

For each target host, the deploy script checks SSH reachability, copies setup-projects-monitor.sh, monitor-report, and the public key to a remote temp directory, and runs the setup script remotely via sudo. It then verifies access by SSHing in as projects_monitor (using the local private key) and confirming a valid JSON snapshot comes back.

What setup-projects-monitor.sh does on each host

• Creates (or updates) a projects_monitor service account. The shell is kept as /bin/bash, not nologin — sshd’s forced-command execution needs a real shell to run the command in.
• Installs monitor-report to /usr/local/bin/monitor-report.
• On first run only, auto-detects installed services (nginx, fail2ban, wg-quick@wg0, unattended-upgrades, docker, mariadb, plus any local units matching the operator’s other projects) and writes them to /etc/projects-monitor/services.conf.
• Grants exactly two passwordless, read-only sudo commands: wg show all dump and cat /etc/wireguard/configs/clients.txt.
• Installs the collector’s public key into ~projects_monitor/.ssh/authorized_keys with a forced command (command="/usr/local/bin/monitor-report") and no agent/port forwarding, no PTY.
• Writes an sshd Match User projects_monitor block enforcing the forced command and disabling forwarding, validates the config with sshd -t, then restarts ssh.

Both scripts are idempotent — safe to re-run for updates or key rotation.

monitor-report output

A single JSON document, hand-rolled via awk/printf (no JSON library), containing:

• schema_version, hostname, timestamp, uptime, load averages, CPU count
• Memory/swap (KB), root disk usage
• reboot_required flag and pending package list
• Per-service systemctl is-active status (from MONITOR_SERVICES in services.conf) and any failed systemd units
• If wg is installed: a WireGuard peer dump (via the sudo grant) and named clients from /etc/wireguard/configs/clients.txt