awoooi/scripts/reboot-recovery/signoz-188-upstream-bridge.sh

#!/usr/bin/env bash
# Controlled SignOz bridge for the post-reboot 188 public gateway drift.
# It runs as the 188 ollama user, listens only on 127.0.0.1:3301, and proxies
# to the live SignOz UI on 110. It never edits Nginx, reads secrets, or reloads
# host services.

set -euo pipefail

TARGET_HOST="${TARGET_HOST:-ollama@192.168.0.188}"
REMOTE_SCRIPT="${REMOTE_SCRIPT:-/home/ollama/bin/awoooi-signoz-upstream-bridge.sh}"
LISTEN_HOST="${LISTEN_HOST:-127.0.0.1}"
LISTEN_PORT="${LISTEN_PORT:-3301}"
UPSTREAM_HOST="${UPSTREAM_HOST:-192.168.0.110}"
UPSTREAM_PORT="${UPSTREAM_PORT:-8080}"
SSH_CONNECT_TIMEOUT="${SSH_CONNECT_TIMEOUT:-6}"
SSH_STRICT_HOST_KEY_CHECKING="${SSH_STRICT_HOST_KEY_CHECKING:-accept-new}"
SSH_OPTS=(
  -o BatchMode=yes
  -o ConnectTimeout="$SSH_CONNECT_TIMEOUT"
  -o ConnectionAttempts=1
  -o ServerAliveInterval=5
  -o ServerAliveCountMax=1
  -o StrictHostKeyChecking="$SSH_STRICT_HOST_KEY_CHECKING"
)

usage() {
  cat <<'USAGE'
Usage: signoz-188-upstream-bridge.sh [--check|--apply|--status|--rollback]

Restores signoz.wooo.work without Nginx reload by starting a user-level
127.0.0.1:3301 -> 192.168.0.110:8080 socat bridge on host 188.

Modes:
  --check      Read-only prerequisite check.
  --apply      Install/update the user bridge script, crontab @reboot entry, and start it.
  --status     Read remote bridge status.
  --rollback   Stop the bridge and remove its crontab block.

This script does not use sudo, Docker, Nginx reload, host reboot, DB writes, or secrets.
USAGE
}

mode="${1:---check}"
case "$mode" in
  --check|--apply|--status|--rollback)
    ;;
  -h|--help)
    usage
    exit 0
    ;;
  *)
    usage >&2
    exit 64
    ;;
esac

ssh_remote() {
  ssh "${SSH_OPTS[@]}" "$TARGET_HOST" "$@"
}

remote_script_payload() {
  cat <<'REMOTE'
#!/usr/bin/env bash
set -euo pipefail

LISTEN_HOST="${LISTEN_HOST:-127.0.0.1}"
LISTEN_PORT="${LISTEN_PORT:-3301}"
UPSTREAM_HOST="${UPSTREAM_HOST:-192.168.0.110}"
UPSTREAM_PORT="${UPSTREAM_PORT:-8080}"
RUN_DIR="${RUN_DIR:-/home/ollama/run}"
LOG_DIR="${LOG_DIR:-/home/ollama/log}"
PID_FILE="${PID_FILE:-$RUN_DIR/awoooi-signoz-upstream-bridge.pid}"
LOG_FILE="${LOG_FILE:-$LOG_DIR/awoooi-signoz-upstream-bridge.log}"

is_running() {
  [ -s "$PID_FILE" ] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null
}

status() {
  local running=0 listen_code upstream_code
  if is_running; then
    running=1
  fi
  listen_code="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 6 "http://${LISTEN_HOST}:${LISTEN_PORT}/" 2>/dev/null || true)"
  upstream_code="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 6 "http://${UPSTREAM_HOST}:${UPSTREAM_PORT}/" 2>/dev/null || true)"
  printf 'SIGNOZ_BRIDGE_STATUS running=%s listen=%s:%s listen_code=%s upstream=%s:%s upstream_code=%s pid=%s\n' \
    "$running" "$LISTEN_HOST" "$LISTEN_PORT" "${listen_code:-000}" "$UPSTREAM_HOST" "$UPSTREAM_PORT" "${upstream_code:-000}" "$(cat "$PID_FILE" 2>/dev/null || true)"
  [ "$running" -eq 1 ] && [ "${listen_code:-000}" = "200" ] && [ "${upstream_code:-000}" = "200" ]
}

start() {
  command -v socat >/dev/null
  mkdir -p "$RUN_DIR" "$LOG_DIR"
  if is_running; then
    status
    return 0
  fi
  if ss -ltn 2>/dev/null | awk '{print $4}' | grep -Eq "(^|:)${LISTEN_PORT}$"; then
    echo "SIGNOZ_BRIDGE_BLOCKED port_busy=${LISTEN_PORT}" >&2
    return 2
  fi
  nohup socat "TCP-LISTEN:${LISTEN_PORT},bind=${LISTEN_HOST},reuseaddr,fork" "TCP:${UPSTREAM_HOST}:${UPSTREAM_PORT}" >>"$LOG_FILE" 2>&1 &
  echo "$!" >"$PID_FILE"
  sleep 1
  status
}

stop() {
  if is_running; then
    kill "$(cat "$PID_FILE")"
  fi
  rm -f "$PID_FILE"
  echo "SIGNOZ_BRIDGE_STOPPED"
}

case "${1:-status}" in
  start) start ;;
  stop) stop ;;
  status) status ;;
  *) exit 64 ;;
esac
REMOTE
}

remote_env_prefix="LISTEN_HOST=$LISTEN_HOST LISTEN_PORT=$LISTEN_PORT UPSTREAM_HOST=$UPSTREAM_HOST UPSTREAM_PORT=$UPSTREAM_PORT"

case "$mode" in
  --check)
    ssh_remote "command -v socat; ss -ltn 2>/dev/null | grep -E ':${LISTEN_PORT}\\b' || true; curl -sS -o /dev/null -w 'SIGNOZ_UPSTREAM_CODE=%{http_code}\n' --max-time 6 http://${UPSTREAM_HOST}:${UPSTREAM_PORT}/"
    ;;
  --apply)
    tmp_payload="$(mktemp)"
    remote_script_payload >"$tmp_payload"
    ssh_remote "mkdir -p /home/ollama/bin /home/ollama/run /home/ollama/log"
    scp "${SSH_OPTS[@]}" "$tmp_payload" "$TARGET_HOST:$REMOTE_SCRIPT.tmp"
    rm -f "$tmp_payload"
    ssh_remote "chmod 0755 '$REMOTE_SCRIPT.tmp' && mv '$REMOTE_SCRIPT.tmp' '$REMOTE_SCRIPT'"
    ssh_remote "(crontab -l 2>/dev/null | sed '/# AWOOOI SignOz upstream bridge start/,/# AWOOOI SignOz upstream bridge end/d'; printf '%s\n' '# AWOOOI SignOz upstream bridge start' '@reboot $remote_env_prefix $REMOTE_SCRIPT start >/tmp/awoooi-signoz-upstream-bridge.cron.log 2>&1' '# AWOOOI SignOz upstream bridge end') | crontab -"
    ssh_remote "$remote_env_prefix '$REMOTE_SCRIPT' start"
    ;;
  --status)
    ssh_remote "$remote_env_prefix '$REMOTE_SCRIPT' status"
    ;;
  --rollback)
    ssh_remote "if [ -x '$REMOTE_SCRIPT' ]; then $remote_env_prefix '$REMOTE_SCRIPT' stop; fi; crontab -l 2>/dev/null | sed '/# AWOOOI SignOz upstream bridge start/,/# AWOOOI SignOz upstream bridge end/d' | crontab -"
    ;;
esac