Web、アプリ、DB をつないで、タップを処理する

ssh deployer@learner01
REPO_URI='http://172.16.10.22/ubuntu'
curl --fail --show-error "$REPO_URI/infra-study-archive-keyring.asc" -o /tmp/infra-study-archive-keyring.asc
GPG_HOME="$(mktemp -d)"
chmod 700 "$GPG_HOME"
EXPECTED_FINGERPRINT='089E07BDFFA26DB7C7203016297FAD1317CA1DC4'
ACTUAL_FINGERPRINT="$(gpg --homedir "$GPG_HOME" --show-keys --with-colons /tmp/infra-study-archive-keyring.asc | awk -F: '$1=="fpr" {print $10; exit}')"
test "$ACTUAL_FINGERPRINT" = "$EXPECTED_FINGERPRINT"
fingerprint_status=$?
rm -rf -- "$GPG_HOME"
test "$fingerprint_status" -eq 0
sudo install -d -m 0755 /etc/apt/keyrings /etc/apt/sources.list.d.part4
sudo install -o root -g root -m 0644 /tmp/infra-study-archive-keyring.asc /etc/apt/keyrings/infra-study-archive-keyring.asc
sudo tee /etc/apt/sources.list.d.part4/infra-study.sources >/dev/null <<EOF
Types: deb
URIs: $REPO_URI
Suites: noble
Components: part4
Architectures: amd64
Signed-By: /etc/apt/keyrings/infra-study-archive-keyring.asc
EOF
sudo chmod 0644 /etc/apt/sources.list.d.part4/infra-study.sources
APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
sudo env LC_ALL=C apt-get "${APT_ONLY_PART4[@]}" update 2>&1 | tee /tmp/apt-update-app01.log
grep -E '^(Get|Hit):' /tmp/apt-update-app01.log
sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" install -y python3-psycopg2

keyring: あり
--- 配置物 ---
-rw-r--r-- 1 root root  400  8月 24 23:02 /etc/systemd/system/tapapi.service

/etc/tapapi/:
合計 4
-rw-r----- 1 root tapapi 200  8月 24 23:02 tapapi.env

/opt/tapapi/:
合計 12
-rw-r--r-- 1 root root  373  8月 24 23:02 schema.sql
-rwxr-xr-x 1 root root 7320  8月 24 23:02 tapapi.py
--- 実行ユーザ ---
uid=996(tapapi) gid=986(tapapi) groups=986(tapapi)

python3 -c 'import psycopg2; print(psycopg2.__version__)'

import psycopg2: OK

TAPAPI_ARCHIVE=/tmp/tapapi-1.1.tar.gz
TAPAPI_SHA256=8a4e518211fc661f6fdcc0b2dd45be50eb1a199b36eaeb8db1b0a985a4eb2a9e
curl --fail --show-error --location \
  --output "$TAPAPI_ARCHIVE" \
  "http://172.16.10.22/assets/part4/tapapi-1.1.tar.gz"
printf '%s  %s\n' "$TAPAPI_SHA256" "$TAPAPI_ARCHIVE" | sha256sum --check -
test "$(stat -c %s "$TAPAPI_ARCHIVE")" -eq 2728
tar -tzf "$TAPAPI_ARCHIVE"

TAPAPI_TMP="$(mktemp -d)"
tar -xzf "$TAPAPI_ARCHIVE" -C "$TAPAPI_TMP"
id tapapi >/dev/null 2>&1 || \
  sudo useradd --system --home-dir /opt/tapapi --shell /usr/sbin/nologin tapapi
sudo install -d -o root -g root -m 0755 /opt/tapapi /etc/tapapi
sudo install -o root -g root -m 0755 "$TAPAPI_TMP/tapapi/tapapi.py" /opt/tapapi/tapapi.py
sudo install -o root -g root -m 0644 "$TAPAPI_TMP/tapapi/schema.sql" /opt/tapapi/schema.sql
sudo install -o root -g root -m 0644 "$TAPAPI_TMP/tapapi/tapapi.service" /etc/systemd/system/tapapi.service
sudo install -o root -g tapapi -m 0640 "$TAPAPI_TMP/tapapi/tapapi.env.example" /etc/tapapi/tapapi.env
rm -rf "$TAPAPI_TMP"

sudoedit /etc/tapapi/tapapi.env
sudo systemctl daemon-reload
sudo systemctl start tapapi.service
systemctl status tapapi.service --no-pager
sudo journalctl -u tapapi.service --no-pager -n 30

# Copy to /etc/tapapi/tapapi.env and replace the placeholders on each host.
TAPAPI_NODE=app01
PGHOST=172.16.10.24
PGPORT=5432
PGDATABASE=transit_lab
PGUSER=tap_app
PGPASSWORD=***
PGCONNECT_TIMEOUT=3
● tapapi.service - Part 4 transit-card tap API
     Loaded: loaded (/etc/systemd/system/tapapi.service; disabled; preset: enabled)
     Active: active (running) since Tue 2026-08-18 11:05:01 JST; 2s ago
   Main PID: 2160 (python3)
      Tasks: 1 (limit: 2255)
     Memory: 10.9M (peak: 11.2M)
        CPU: 64ms
     CGroup: /system.slice/tapapi.service

nc -vz "<db01の接続名>" "<PostgreSQLの待受port>"

Connection to <db01のアドレス> 5432 port [tcp/postgresql] succeeded!

curl --fail --show-error --include "http://localhost:8080/health"

{"status":"ok","db":"ok","node":"app01"}

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT usename, datname, application_name, client_addr, state
     FROM pg_stat_activity
    WHERE usename = 'tap_app';"

 usename | datname | application_name | client_addr | state
---------+---------+------------------+-------------+-------
(0 rows)

# app01 側: 要求を流し続ける
timeout 20 bash -c 'while :; do curl -sS -m5 "http://localhost:8080/health" > /dev/null; done'

# db01 側: 上と並行して、観測を繰り返す
for i in $(seq 1 300); do
  sudo -u postgres psql -d transit_lab -Atc \
    "SELECT usename, datname, application_name, client_addr, state
       FROM pg_stat_activity
      WHERE usename = 'tap_app';"
done | grep -m 5 tap_app

tap_app|transit_lab||<app01のアドレス>|idle in transaction
tap_app|transit_lab||<app01のアドレス>|idle
tap_app|transit_lab||<app01のアドレス>|idle in transaction
tap_app|transit_lab||<app01のアドレス>|idle
tap_app|transit_lab||<app01のアドレス>|idle

EVENT_ID="event-tap-first"
curl --fail --show-error --include \
  -H "X-Event-ID: ${EVENT_ID}" \
  -H 'Content-Type: application/json' \
  --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\",\"amount\":120}" \
  "http://localhost:8080/tap"

HTTP/1.0 200 OK
Server: tapapi
Date: Tue, 18 Aug 2026 02:05:22 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 91

{"ok":true,"card_id":"card-demo","balance":880,"event_id":"event-tap-first","node":"app01"}

EVENT_ID="event-tap-missing-amount"
curl --show-error --include \
  -H "X-Event-ID: ${EVENT_ID}" \
  -H 'Content-Type: application/json' \
  --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\"}" \
  "http://localhost:8080/tap"

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT event_id, card_id, amount FROM tap_events WHERE event_id = 'event-tap-first';"
sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT card_id, balance FROM cards WHERE card_id = 'card-demo';"

    event_id     |  card_id  | amount
-----------------+-----------+--------
 event-tap-first | card-demo |    120
(1 row)

  card_id  | balance
-----------+---------
 card-demo |     880
(1 row)

ssh deployer@front01
REPO_URI='http://172.16.10.22/ubuntu'
curl --fail --show-error "$REPO_URI/infra-study-archive-keyring.asc" -o /tmp/infra-study-archive-keyring.asc
GPG_HOME="$(mktemp -d)"
chmod 700 "$GPG_HOME"
EXPECTED_FINGERPRINT='089E07BDFFA26DB7C7203016297FAD1317CA1DC4'
ACTUAL_FINGERPRINT="$(gpg --homedir "$GPG_HOME" --show-keys --with-colons /tmp/infra-study-archive-keyring.asc | awk -F: '$1=="fpr" {print $10; exit}')"
test "$ACTUAL_FINGERPRINT" = "$EXPECTED_FINGERPRINT"
fingerprint_status=$?
rm -rf -- "$GPG_HOME"
test "$fingerprint_status" -eq 0
sudo install -d -m 0755 /etc/apt/keyrings /etc/apt/sources.list.d.part4
sudo install -o root -g root -m 0644 /tmp/infra-study-archive-keyring.asc /etc/apt/keyrings/infra-study-archive-keyring.asc
sudo tee /etc/apt/sources.list.d.part4/infra-study.sources >/dev/null <<EOF
Types: deb
URIs: $REPO_URI
Suites: noble
Components: part4
Architectures: amd64
Signed-By: /etc/apt/keyrings/infra-study-archive-keyring.asc
EOF
sudo chmod 0644 /etc/apt/sources.list.d.part4/infra-study.sources
APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
sudo apt-get "${APT_ONLY_PART4[@]}" update
sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" install -y nginx
systemctl status nginx --no-pager

Get:1 http://172.16.10.22/ubuntu noble InRelease [2699 B]
Get:2 http://172.16.10.22/ubuntu noble/part4 amd64 Packages [14.5 kB]
No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-08-18 02:05:59 UTC; 2s ago
       Docs: man:nginx(8)
    Process: 1499 ExecStartPre=/usr/sbin/nginx -t -q -g daemon on; master_process on; (code=exited, status=0/SUCCESS)

log_format tap_with_event
    '$remote_addr $request status=$status event_id=$http_x_event_id '
    'upstream=$upstream_addr upstream_status=$upstream_status';

upstream tap_app_backend {
    server learner01:8080;  # app01 の実体（このラボでの接続名）
}

server {
    listen <入口の待受port>;
    access_log /var/log/nginx/tap_access.log tap_with_event;

    location / {
        proxy_set_header X-Event-ID $http_x_event_id;
        proxy_set_header Host $host;
        proxy_pass http://tap_app_backend;
    }
}

sudoedit /etc/nginx/sites-available/part4-ch3
sudo ln -s /etc/nginx/sites-available/part4-ch3 /etc/nginx/sites-enabled/part4-ch3
sudo nginx -t
sudo systemctl reload nginx
systemctl status nginx --no-pager

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-08-18 02:05:59 UTC; 15s ago
       Docs: man:nginx(8)
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=1684,fd=5),("nginx",pid=1535,fd=5),("nginx",pid=1532,fd=5))
LISTEN 0      511          0.0.0.0:8081      0.0.0.0:*    users:(("nginx",pid=1684,fd=12),("nginx",pid=1532,fd=12))
LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=1684,fd=6),("nginx",pid=1535,fd=6),("nginx",pid=1532,fd=6))

EVENT_ID="event-tap-goal"
curl --fail --show-error --include \
  -H "X-Event-ID: ${EVENT_ID}" \
  -H 'Content-Type: application/json' \
  --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\",\"amount\":120}" \
  "http://<front01の接続名>:<入口の待受port>/tap"

HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Tue, 18 Aug 2026 02:06:27 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 90
Connection: keep-alive

{"ok":true,"card_id":"card-demo","balance":760,"event_id":"event-tap-goal","node":"app01"}

sudo grep -F 'event_id=event-tap-goal' /var/log/nginx/tap_access.log

172.16.10.22 POST /tap HTTP/1.1 status=200 event_id=event-tap-goal upstream=172.16.10.20:8080 upstream_status=200

sudo journalctl -u tapapi.service --no-pager \
  | grep -F 'event-tap-goal'

 8月 18 11:06:27 learner01 python3[2160]: {"event_id":"event-tap-goal","card_id":"card-demo","amount":120,"node":"app01","status":200,"result":"ok"}

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT event_id, card_id, amount, created_at
     FROM tap_events
    WHERE event_id = 'event-tap-goal';"
sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT card_id, balance FROM cards WHERE card_id = 'card-demo';"

    event_id    |  card_id  | amount
----------------+-----------+--------
 event-tap-goal | card-demo |    120
(1 row)

  card_id  | balance
-----------+---------
 card-demo |     760
(1 row)

sudo grep 'connection authorized: user=tap_app database=transit_lab' /var/log/postgresql/postgresql-16-main.log | tail -n 1

... connection authorized: user=tap_app database=transit_lab ...

sudo -u postgres psql -d transit_lab -Atc \
  "SELECT balance FROM cards WHERE card_id = 'card-demo';"

760

EVENT_ID="event-tap-goal"
curl --show-error --include \
  -H "X-Event-ID: ${EVENT_ID}" \
  -H 'Content-Type: application/json' \
  --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\",\"amount\":120}" \
  "http://<front01の接続名>:<入口の待受port>/tap"

HTTP/1.1 409 Conflict
Server: nginx/1.24.0 (Ubuntu)
Date: Tue, 18 Aug 2026 02:06:50 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 81
Connection: keep-alive

{"ok":false,"error":"duplicate_event","event_id":"event-tap-goal","node":"app01"}

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT event_id, count(*) FROM tap_events
    WHERE event_id = 'event-tap-goal' GROUP BY event_id;"
sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT card_id, balance FROM cards WHERE card_id = 'card-demo';"

    event_id    | count
----------------+-------
 event-tap-goal |     1
(1 row)

  card_id  | balance
-----------+---------
 card-demo |     760
(1 row)

sudo journalctl -u tapapi.service --no-pager \
  | grep -F 'POST /tap' | tail -n 2

 8月 18 11:06:27 learner01 python3[2160]: {"event_id":"event-tap-goal","card_id":"card-demo","amount":120,"node":"app01","status":200,"result":"ok"}
 8月 18 11:06:49 learner01 python3[2160]: {"event_id":"event-tap-goal","card_id":"card-demo","amount":120,"node":"app01","status":409,"result":"duplicate_event"}

sudo cp /tmp/ch3-app-env.before-failure /etc/tapapi/tapapi.env
sudo systemctl restart tapapi.service
systemctl status tapapi.service --no-pager

（2026-10-12 実測・抜粋）
● tapapi.service - Part 4 transit-card tap API
     Loaded: loaded (/etc/systemd/system/tapapi.service; disabled; ...)
     Active: active (running) since ...

EVENT_ID="event-tap-recovered"
curl --fail --show-error --include \
  -H "X-Event-ID: ${EVENT_ID}" \
  -H 'Content-Type: application/json' \
  --data "{\"card_id\":\"card-demo\",\"event_id\":\"${EVENT_ID}\",\"amount\":120}" \
  "http://<front01の接続名>:<入口の待受port>/tap"

{"ok":true,"card_id":"card-demo","balance":640,"event_id":"event-tap-recovered","node":"app01"}

sudo grep -F 'event_id=event-tap-recovered' /var/log/nginx/tap_access.log

--- ① Web 層（front01）: nginx access log ---
<workstation01のアドレス> POST /tap HTTP/1.1 status=200 event_id=event-tap-recovered upstream=<app01のアドレス>:8080 upstream_status=200

sudo journalctl -u tapapi.service --no-pager \
  | grep -F 'event-tap-recovered'

--- ② App 層（app01）: journal ---
 8月 24 23:06:50 learner01 python3[4575]: {"event_id":"event-tap-recovered","card_id":"card-demo","amount":120,"node":"app01","status":200,"result":"ok"}

sudo -u postgres psql -P pager=off -d transit_lab -c \
  "SELECT event_id FROM tap_events WHERE event_id = 'event-tap-recovered';"

--- ③ DB 層（db01）: tap_events ---
      event_id
---------------------
 event-tap-recovered
(1 row)

(
sudo systemctl disable --now tapapi.service
sudo rm /etc/systemd/system/tapapi.service
sudo systemctl daemon-reload
systemctl status tapapi.service --no-pager || true
systemctl is-enabled tapapi.service || true

sudo rm -rf /opt/tapapi
sudo rm -rf /etc/tapapi
sudo userdel tapapi
sudo groupdel tapapi 2>/dev/null || true
rm -f /tmp/tapapi-1.1.tar.gz
test ! -e /opt/tapapi
test ! -e /etc/tapapi
test ! -e /etc/systemd/system/tapapi.service
getent passwd tapapi || true
getent group tapapi || true

mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "$pkg" in
    python3-psycopg2|libpq5|libpq5:amd64) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }
APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"
dpkg-query -W -f='${binary:Package} ${Status}\n' python3-psycopg2 2>/dev/null | grep 'install ok installed' || echo 'App 用 package は導入済みとして残っていない'
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

sudo rm -f /tmp/apt-update-app01.log /tmp/ch3-app-env.before-failure /tmp/ch3-failure-since
test ! -e /tmp/apt-update-app01.log
test ! -e /tmp/ch3-app-env.before-failure
test ! -e /tmp/ch3-failure-since

(
sudo rm -f /etc/nginx/sites-enabled/part4-ch3
sudo rm -f /etc/nginx/sites-available/part4-ch3
mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "$pkg" in
    nginx|nginx-common) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }
APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

--- 削除対象が章専用ファイルであることを確認する ---
-rw-r--r-- 1 root root 468 Aug 24 14:03 /etc/nginx/sites-available/part4-ch3
lrwxrwxrwx 1 root root  36 Aug 24 14:03 /etc/nginx/sites-enabled/part4-ch3 -> /etc/nginx/sites-available/part4-ch3
有効化先の実体: /etc/nginx/sites-available/part4-ch3

--- 削除する ---
  nginx
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 1355 kB disk space will be freed.
Removing nginx (1.24.0-2ubuntu7.15) ...

--- 不在を確認する ---
sites-enabled/part4-ch3: 不在
sites-available/part4-ch3: 不在
nginx	
inactive

PG_CONFIG="$(sudo -u postgres psql -Atc 'SHOW config_file;')"
PG_HBA="$(sudo -u postgres psql -Atc 'SHOW hba_file;')"
sudoedit "$PG_CONFIG"
sudoedit "$PG_HBA"
sudo -u postgres psql -c 'SELECT pg_reload_conf();'
sudo -u postgres psql -Atc 'SHOW log_connections;'
sudo -u postgres dropdb transit_lab
sudo -u postgres psql -Atc \
  "SELECT datname FROM pg_database WHERE datname = 'transit_lab';"
sudo -u postgres dropuser tap_app
sudo -u postgres psql -Atc \
  "SELECT rolname FROM pg_roles WHERE rolname = 'tap_app';"

=== 復元前 ===
60:listen_addresses = '<db01のアドレス>'
65:log_connections = on
133:host transit_lab tap_app <app01のアドレス>/32 scram-sha-256

=== 復元後 ===
60:listen_addresses = 'localhost'
65:log_connections = off
transit_lab の行数: 0
off

=== 演習 DB を消して不在を確認 ===
(空)
(上が空なら DB は存在しない)
=== role を消して不在を確認 ===
(空)
(上が空なら role は存在しない)

0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
After this operation, 34.8 kB disk space will be freed.
Removing postgresql (16+257build1.1) ...
Removing postgresql-client (16+257build1.1) ...

systemctl is-active postgresql

active

(
mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "$pkg" in
    postgresql|postgresql-16|postgresql-client|postgresql-client-16|postgresql-client-common|postgresql-common|libcommon-sense-perl|libcommon-sense-perl:amd64|libjson-perl|libjson-xs-perl|libllvm17t64|libllvm17t64:amd64|libpq5|libpq5:amd64|libtypes-serialiser-perl|ssl-cert) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }

APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y postgresql postgresql-16 postgresql-client postgresql-client-16 postgresql-client-common postgresql-common

# 比較教材として予測だけを見る。実行はしない
sudo apt-get "${APT_ONLY_PART4[@]}" -s autoremove --purge

mapfile -t chapter_packages < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"

sudo userdel postgres 2>/dev/null || true
sudo groupdel postgres 2>/dev/null || true
sudo groupdel ssl-cert 2>/dev/null || true
sudo chown root:root /etc/ssl/private
sudo chmod 0700 /etc/ssl/private
getent passwd postgres || true
getent group postgres || true
getent group ssl-cert || true
stat -c '%a %u %g %n' /etc/ssl/private
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

  postgresql postgresql-client
0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
After this operation, 34.8 kB disk space will be freed.
Removing postgresql (16+257build1.1) ...
Removing postgresql-client (16+257build1.1) ...
--- systemctl is-active postgresql ---
active

The following packages were automatically installed and are no longer required:
  libcommon-sense-perl libjson-perl libjson-xs-perl libllvm17t64 libpq5
  libtypes-serialiser-perl ssl-cert
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  postgresql-16* postgresql-client-16* postgresql-client-common*
  postgresql-common*
0 upgraded, 0 newly installed, 4 to remove and 0 not upgraded.
After this operation, 50.5 MB disk space will be freed.
Removing postgresql-16 (16.14-0ubuntu0.24.04.1) ...
update-alternatives: warning: forcing reinstallation of alternative /usr/share/postgresql/16/man/man1/psql.1.gz because link group psql.1.gz is broken
Removing postgresql-client-16 (16.14-0ubuntu0.24.04.1) ...
Removing postgresql-common (257build1.1) ...
Removing 'diversion of /usr/bin/pg_config to /usr/bin/pg_config.libpq-dev by postgresql-common'
Removing postgresql-client-common (257build1.1) ...
Processing triggers for man-db (2.12.0-4build2) ...
Purging configuration files for postgresql-client-common (257build1.1) ...
Purging configuration files for postgresql-16 (16.14-0ubuntu0.24.04.1) ...
Dropping cluster main...
Purging configuration files for postgresql-common (257build1.1) ...

=== autoremove --purge ===
0 upgraded, 0 newly installed, 7 to remove and 0 not upgraded.
After this operation, 125 MB disk space will be freed.
Removing libjson-xs-perl (4.040-0ubuntu0.24.04.1) ...
Removing libtypes-serialiser-perl (1.01-1) ...
Removing libcommon-sense-perl:amd64 (3.75-3build3) ...
Removing libjson-perl (4.10000-1) ...
Removing libllvm17t64:amd64 (1:17.0.6-9ubuntu1) ...
Removing libpq5:amd64 (16.14-0ubuntu0.24.04.1) ...
Removing ssl-cert (1.1.2ubuntu1) ...
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for libc-bin (2.39-0ubuntu8.8) ...
Purging configuration files for ssl-cert (1.1.2ubuntu1) ...

(
mapfile -t package_diff < <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort | comm -13 /tmp/part4-packages-before.tsv -)
if ((${#package_diff[@]})); then
  printf '章開始時より増えた package: %s\n' "${package_diff[@]}" >&2
  exit 1
else
  echo '章開始時より増えた package は 0 件'
fi
systemctl is-active nginx postgresql || true
systemctl status tapapi.service --no-pager || true
getent passwd tapapi postgres || true
getent group tapapi postgres ssl-cert || true
stat -c '%a %u %g %n' /etc/ssl/private
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

sudo rm -rf /etc/apt/sources.list.d.part4
sudo rm -f /etc/apt/keyrings/infra-study-archive-keyring.asc
rm -f /tmp/infra-study-archive-keyring.asc /tmp/part4-packages-before.tsv
test ! -e /etc/apt/sources.list.d.part4
test ! -e /etc/apt/keyrings/infra-study-archive-keyring.asc
test ! -e /tmp/infra-study-archive-keyring.asc
test ! -e /tmp/part4-packages-before.tsv

# db01・app01・front01 の各 VM で実行する
sudo find /etc /var/lib /srv /opt /usr/local "$HOME" \
  -not -path '/var/lib/apt/*' \
  -not -path '/var/lib/dpkg/*' \
  -not -path '/var/lib/systemd/*' \
  -not -path '/var/log/*' \
  -not -path '/var/cache/*' \
  -not -name '.bash_history' \
  -not -path '/etc/passwd-' -not -path '/etc/group-' \
  -not -path '/etc/shadow-' -not -path '/etc/gshadow-' \
  -not -path '/var/lib/fwupd' -not -path '/var/lib/fwupd/*' \
  -not -path '/etc/fwupd' -not -path '/etc/fwupd/*' \
  -not -path '/var/lib/ucf' -not -path '/var/lib/ucf/*' \
  -not -path '/var/lib/landscape' -not -path '/var/lib/landscape/*' \
  -not -path '/etc/ld.so.cache' \
  -not -path '/var/lib/ubuntu-release-upgrader/release-upgrade-available' \
  -not -path '/var/lib/snapd/state.json' \
  -not -path '/var/lib/snapd/maintenance.json' \
  -not -path '/var/lib/logrotate/status' \
  -printf '%p\t%y\t%m\t%U\t%G\t%s\t%T@\n' 2>/dev/null \
  | LC_ALL=C sort \
  | sudo tee /tmp/part4-manifest-after.tsv >/dev/null
sudo diff -u /tmp/part4-manifest-before.tsv /tmp/part4-manifest-after.tsv > /var/tmp/part4-chapter-manifest.diff
diff_rc=$?
if [ "$diff_rc" -le 1 ]; then
  if awk 'BEGIN { FS = "\t"; c = "LC_ALL=C sort" }
      /^\+\+\+|^---|^@@/ { next }
      /^[+-]/ {
        if (NF != 7) { printf "manifest の列数が 7 ではありません: %s\n", $0 > "/dev/stderr"; bad = 1; exit 2 }
        t++; s = substr($1, 1, 1); p = substr($1, 2)
        k = $2 " " $3 " " $4 " " $5 " " ($2 == "d" ? "-" : $6)
        if (s == "-") { if (p in b) { dup = p; exit 2 } b[p] = k; bm[p] = $7; bt[p] = $2 }
        else          { if (p in a) { dup = p; exit 2 } a[p] = k; am[p] = $7 }
      }
      END {
        if (bad) exit 2
        if (dup != "") { printf "同じパスが重複しています: %s\n", dup > "/dev/stderr"; exit 2 }
        print "== 残留候補（0 件で合格）=="
        n = 0
        for (p in b) {
          if (!(p in a)) { print "消えた   " p | c; n++ }
          else if (a[p] != b[p]) { print "変わった " p "  (" b[p] " -> " a[p] ")" | c; n++ }
        }
        for (p in a) if (!(p in b)) { print "増えた   " p | c; n++ }
        fflush(); close(c)
        print "残留候補: " n " 件"
        print "== 更新日時だけ変わった通常ファイル（1 件ずつ理由を説明できること）=="
        m = 0; d = 0
        for (p in b) if ((p in a) && a[p] == b[p] && am[p] != bm[p]) { if (bt[p] == "d") d++; else { print p | c; m++ } }
        fflush(); close(c)
        print "更新日時だけ変わった通常ファイル: " m " 件 ／ ディレクトリ: " d " 件"
        print "差分行総数: " (t + 0)
      }' /var/tmp/part4-chapter-manifest.diff; then
    sudo rm -f /tmp/part4-manifest-before.tsv /tmp/part4-manifest-after.tsv
  else
    echo "差分の表示に失敗しました。構築前・章末の manifest と /var/tmp/part4-chapter-manifest.diff は残してあります。表示された理由を確認してください" >&2
  fi
else
  echo "差分を採れませんでした（diff の終了コード $diff_rc）。構築前 manifest /tmp/part4-manifest-before.tsv があるか確認してください" >&2
fi

sudo rm -f /var/tmp/part4-chapter-manifest.diff
test ! -e /var/tmp/part4-chapter-manifest.diff

（形の例です。M・K・T には実行したときの件数が入ります。更新日時だけ変わった通常ファイルの行と件数は、台・章によって変わります。合格の条件は「残留候補: 0 件」です）
== 残留候補（0 件で合格）==
残留候補: 0 件
== 更新日時だけ変わった通常ファイル（1 件ずつ理由を説明できること）==
（該当するパスが 1 行ずつ並びます）
更新日時だけ変わった通常ファイル: M 件 ／ ディレクトリ: K 件
差分行総数: T