feat: expose signed platform health status

deploy/server/bootstrap-secrets.sh

@@ -37,10 +37,10 @@ umask 077
   printf 'CURSOR_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'SHARE_TOKEN_SIGNING_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'PROVIDER_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
+  printf 'PLATFORM_HEALTH_CALLBACK_SECRET=%s\n' "$(openssl rand -hex 32)"
   printf 'MOCK_PROVIDER_API_KEY=%s\n' "$(openssl rand -hex 24)"
   printf 'ALERT_WEBHOOK_SECRET=%s\n' "$(openssl rand -hex 32)"
 } > "$output_path"
 
 chmod 600 "$output_path"
 echo "created $output_path with mode 600"
-

deploy/server/compose.override.yaml

@@ -106,6 +106,7 @@ services:
       <<: *server-backend-environment
       HTTP_ADDR: 0.0.0.0:8081
       PROVIDER_CALLBACK_SECRET: ${PROVIDER_CALLBACK_SECRET}
+      PLATFORM_HEALTH_CALLBACK_SECRET: ${PLATFORM_HEALTH_CALLBACK_SECRET}
       RATE_LIMIT_RPS: "1000"
       RATE_LIMIT_BURST: "1500"
     restart: unless-stopped

deploy/server/health-monitor.sh

@@ -18,6 +18,8 @@ if [[ -f "$monitor_config" ]]; then
 fi
 alert_webhook_url=${ALERT_WEBHOOK_URL:-}
 alert_webhook_secret_file=${ALERT_WEBHOOK_SECRET_FILE:-/etc/data-terminal-cloud/monitor-webhook-secret}
+platform_health_report_url=${PLATFORM_HEALTH_REPORT_URL:-}
+platform_health_report_secret_file=${PLATFORM_HEALTH_REPORT_SECRET_FILE:-/etc/data-terminal-cloud/platform-health-callback-secret}
 if [[ -f "$offsite_config_file" ]]; then
   # shellcheck disable=SC1090
   source "$offsite_config_file"
@@ -232,14 +234,12 @@ PY
 chmod 0644 "$status_tmp"
 mv -f "$status_tmp" "$status_file"
 
-if [[ -n "$alert_webhook_url" && "$previous_status" != "$overall" ]]; then
-  if [[ ! -r "$alert_webhook_secret_file" ]]; then
-    record_check alert_delivery critical secret_missing
-    echo "Alert webhook is configured but its HMAC secret is unreadable" >&2
-    exit 5
-  fi
+post_signed_status() {
+  local target_url=$1
+  local secret_file=$2
+  local timestamp signature
   timestamp=$(date +%s)
-  signature=$(python3 - "$alert_webhook_secret_file" "$status_file" "$timestamp" <<'PY'
+  signature=$(python3 - "$secret_file" "$status_file" "$timestamp" <<'PY'
 import hashlib
 import hmac
 import sys
@@ -249,7 +249,7 @@ body = open(sys.argv[2], "rb").read()
 print(hmac.new(secret, sys.argv[3].encode() + b"." + body, hashlib.sha256).hexdigest())
 PY
 )
-  python3 - "$alert_webhook_url" "$curl_config" <<'PY'
+  python3 - "$target_url" "$curl_config" <<'PY'
 import sys
 
 url = sys.argv[1].replace("\\", "\\\\").replace('"', '\\"')
@@ -260,6 +260,23 @@ PY
     -H "X-Platform-Timestamp: $timestamp" \
     -H "X-Platform-Signature: sha256=$signature" \
     --data-binary "@$status_file" >/dev/null
+}
+
+if [[ -n "$platform_health_report_url" ]]; then
+  if [[ ! -r "$platform_health_report_secret_file" ]]; then
+    echo "Platform health reporting is configured but its HMAC secret is unreadable" >&2
+    exit 6
+  fi
+  post_signed_status "$platform_health_report_url" "$platform_health_report_secret_file"
+fi
+
+if [[ -n "$alert_webhook_url" && "$previous_status" != "$overall" ]]; then
+  if [[ ! -r "$alert_webhook_secret_file" ]]; then
+    record_check alert_delivery critical secret_missing
+    echo "Alert webhook is configured but its HMAC secret is unreadable" >&2
+    exit 5
+  fi
+  post_signed_status "$alert_webhook_url" "$alert_webhook_secret_file"
 fi
 
 printf 'platform_health status=%s critical=%s warning=%s status_file=%s\n' \

deploy/server/install-monitoring.sh

@@ -9,13 +9,31 @@ fi
 project_root=${PLATFORM_ROOT:-/opt/data-terminal-cloud/current}
 install -d -m 0700 /etc/data-terminal-cloud
 install -d -m 0750 /var/lib/data-terminal-cloud-monitor
+platform_env="$project_root/deploy/server/.env"
+if [[ -r "$platform_env" && ! -s /etc/data-terminal-cloud/platform-health-callback-secret ]]; then
+  platform_health_secret=$(sed -n 's/^PLATFORM_HEALTH_CALLBACK_SECRET=//p' "$platform_env" | head -n1)
+  if (( ${#platform_health_secret} >= 32 )); then
+    umask 077
+    printf '%s\n' "$platform_health_secret" >/etc/data-terminal-cloud/platform-health-callback-secret
+  fi
+fi
+if [[ -s /etc/data-terminal-cloud/platform-health-callback-secret ]]; then
+  chmod 0600 /etc/data-terminal-cloud/platform-health-callback-secret
+fi
 if [[ ! -s /etc/data-terminal-cloud/monitor-webhook-secret ]]; then
   umask 077
   openssl rand -base64 48 >/etc/data-terminal-cloud/monitor-webhook-secret
 fi
 chmod 0600 /etc/data-terminal-cloud/monitor-webhook-secret
 if [[ ! -e /etc/data-terminal-cloud/monitor.env ]]; then
-  cat >/etc/data-terminal-cloud/monitor.env <<'EOF'
+  public_origin=$(sed -n 's/^PUBLIC_ORIGIN=//p' "$platform_env" 2>/dev/null | head -n1)
+  report_url=
+  if [[ "$public_origin" == https://* && -s /etc/data-terminal-cloud/platform-health-callback-secret ]]; then
+    report_url="$public_origin/callbacks/v1/platform-health"
+  fi
+  cat >/etc/data-terminal-cloud/monitor.env <<EOF
+PLATFORM_HEALTH_REPORT_URL=$report_url
+PLATFORM_HEALTH_REPORT_SECRET_FILE=/etc/data-terminal-cloud/platform-health-callback-secret
 ALERT_WEBHOOK_URL=
 ALERT_WEBHOOK_SECRET_FILE=/etc/data-terminal-cloud/monitor-webhook-secret
 EOF