From 358106287b28bffa8505b67fe623f77a3fbceae3 Mon Sep 17 00:00:00 2001
From: batsumaru <>
Date: Wed, 1 Jul 2026 16:25:42 +0900
Subject: Auto-discover jails and add WireGuard peer info to status page

Replace the per-jail check scripts with checks/jails.sh, which lists
running jails via jls and resolves each one's IPv4 (falling back to
jexec+ifconfig for VNET jails, which don't set the ip4.addr jail
parameter). New jails now show up without adding a script; the
trade-off is a stopped jail just disappears rather than showing down,
since jls only lists what's running.

checks/wireguard.sh now also reports each configured peer's allowed-IP
and time since last handshake, parsed from `wg show wg0 dump`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 statuspage/checks/jails.sh | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100755 statuspage/checks/jails.sh

(limited to 'statuspage/checks/jails.sh')

diff --git a/statuspage/checks/jails.sh b/statuspage/checks/jails.sh
new file mode 100755
index 0000000..71024cc
--- /dev/null
+++ b/statuspage/checks/jails.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+# checks/jails.sh
+# Discovers every currently running jail via jls - no separate script or
+# hardcoded name/IP needed per jail. Roll a new jail and it shows up on
+# the next render with no changes here.
+#
+# Trade-off: since jls only lists running jails, a jail that's supposed
+# to exist but isn't running just doesn't appear on the page - it won't
+# show as "down". If you need to detect an unexpectedly-stopped jail,
+# that needs an explicit expected-jails list (not implemented here).
+set -eu
+
+DIR=$(dirname "$0")
+. "$DIR/../lib/common.sh"
+
+# jail_ip4 NAME
+# Prints the jail's IPv4 address, or nothing if none could be found.
+jail_ip4() {
+    ip=$(jls -j "$1" -n ip4.addr 2>/dev/null | sed -n 's/.*ip4\.addr=\([^ ]*\).*/\1/p')
+    case "$ip" in
+        ""|-|0.0.0.0) ;;
+        *) printf '%s' "$ip"; return ;;
+    esac
+    # VNET jails run their own network stack, so ip4.addr (a classic-jail
+    # restriction parameter) is usually unset. Ask the jail directly for
+    # the first non-loopback address it sees instead.
+    jexec "$1" ifconfig -f inet:cidr 2>/dev/null \
+        | awk '/inet /{split($2,a,"/"); if (a[1] !~ /^127\./) {print a[1]; exit}}'
+}
+
+jls -n name 2>/dev/null | sed -n 's/.*name=\([^ ]*\).*/\1/p' | while IFS= read -r name; do
+    [ -n "$name" ] || continue
+
+    ip=$(jail_ip4 "$name")
+    json_line "jails" "$name jail" "$ip" "ok"
+
+    if [ -n "$ip" ]; then
+        http_status=$(port_check "$ip" 80)
+        json_line "jails" "  -> http :80" "" "$http_status"
+    fi
+done
-- 
cgit v1.3