TLS とファイアウォールで、公開範囲を絞る

sudo ss -lntp

（2026-09-02 実測）　実アドレスは対象 port の特定に要る範囲だけ示します。
--- front01 ---
LISTEN 0  511  0.0.0.0:8080  nginx     ← 入口（章専用設定）
LISTEN 0  511  0.0.0.0:80    nginx     ← 既定サイト
LISTEN 0 4096  0.0.0.0:22    sshd
--- app01 / app02 ---
LISTEN 0    5  0.0.0.0:8080  python3   ← App service
LISTEN 0 4096  0.0.0.0:22    sshd
--- db01 ---
LISTEN 0  200  172.16.10.24:5432  postgres   ← VLAN10 のアドレスだけで待つ
LISTEN 0 4096  0.0.0.0:22         sshd

probe_tcp() {
  TARGET="$1"
  PORT="$2"
  LABEL="$3"
  TARGET_IP="$(getent ahostsv4 "$TARGET" | awk 'NR == 1 { print $1 }')"
  if [ -z "$TARGET_IP" ]; then
    printf '%s\t%s\tRESOLVE_DENY\n' "$(hostname)" "${LABEL}"
  elif timeout 3 bash -c ": </dev/tcp/${TARGET_IP}/${PORT}" 2>/dev/null; then
    printf '%s\t%s\tALLOW\n' "$(hostname)" "${LABEL}"
  else
    printf '%s\t%s\tDENY\n' "$(hostname)" "${LABEL}"
  fi
}

PHASE=before
{
  probe_tcp "<front01の接続名>" "<HTTPの待受port>" "front-http"
  probe_tcp "<front01の接続名>" "<HTTPSの待受port>" "front-https"
  probe_tcp "<app01の接続名>" "<Appの待受port>" "app01-service"
  probe_tcp "<app02の接続名>" "<Appの待受port>" "app02-service"
  probe_tcp "<db01の接続名>" "<DBの待受port>" "db-service"
} | tee "/tmp/ch5-reach-${PHASE}-$(hostname).tsv"

# workstation01 で 5 台ぶんを 1 つの表にまとめる
PHASE=before
OUT="/tmp/ch5-reachability-${PHASE}.tsv"
cat "/tmp/ch5-reach-${PHASE}-$(hostname).tsv" > "$OUT"
for H in front01 172.16.10.20 172.16.10.21 db01; do
  ssh deployer@"$H" "cat /tmp/ch5-reach-${PHASE}-\$(hostname).tsv" >> "$OUT"
done
sort -o "$OUT" "$OUT"
cat "$OUT"

workstation01	front-http	ALLOW
workstation01	front-https	DENY
workstation01	app01-service	ALLOW
workstation01	app02-service	ALLOW
workstation01	db-service	ALLOW
front01	front-http	ALLOW
front01	front-https	DENY
front01	app01-service	ALLOW
front01	app02-service	ALLOW
front01	db-service	ALLOW
learner01	front-http	ALLOW
learner01	front-https	DENY
learner01	app01-service	ALLOW
learner01	app02-service	ALLOW
learner01	db-service	ALLOW
learner02	front-http	ALLOW
learner02	front-https	DENY
learner02	app01-service	ALLOW
learner02	app02-service	ALLOW
learner02	db-service	ALLOW
db01	front-http	ALLOW
db01	front-https	DENY
db01	app01-service	ALLOW
db01	app02-service	ALLOW
db01	db-service	DENY

mkdir -p "$HOME/ch5-tls"
chmod 700 "$HOME/ch5-tls"
cd "$HOME/ch5-tls"

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out lab-ca.key
chmod 600 lab-ca.key
openssl req -x509 -new -sha256 \
  -key lab-ca.key \
  -days 7 \
  -subj "/CN=<演習用CA名>" \
  -out lab-ca.crt

ssh deployer@front01
sudo install -d -m 700 /etc/nginx/tls
sudo openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
  -out /etc/nginx/tls/front01.key
sudo chmod 600 /etc/nginx/tls/front01.key
sudo openssl req -new -sha256 \
  -key /etc/nginx/tls/front01.key \
  -subj "/CN=<front01のTLS接続名>" \
  -out /tmp/front01.csr

（2026-09-02 実測）　秘密鍵の内容は表示しません。
/etc/nginx/tls/front01.key owner=root group=root mode=600 size=1708
/tmp/front01.csr           owner=root group=root mode=644 size=887

Certificate request self-signature verify OK
subject=CN = front01

scp deployer@<front01の接続名>:/tmp/front01.csr "$HOME/ch5-tls/front01.csr"
openssl req -in "$HOME/ch5-tls/front01.csr" -noout -subject -verify

Certificate request self-signature verify OK
subject=CN = front01

cd "$HOME/ch5-tls"
cat > front01.ext <<'EOF'
subjectAltName=DNS:<front01のTLS接続名>
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
EOF

openssl x509 -req -sha256 \
  -in front01.csr \
  -CA lab-ca.crt \
  -CAkey lab-ca.key \
  -CAcreateserial \
  -days 7 \
  -extfile front01.ext \
  -out front01.crt

cd "$HOME/ch5-tls"
openssl x509 -in front01.crt -noout \
  -subject -issuer -dates -ext subjectAltName
openssl verify -CAfile lab-ca.crt front01.crt

subject=CN = infra-study-lab-ca
notBefore=Sep  1 13:11:21 2026 GMT
notAfter=Sep  8 13:11:21 2026 GMT

Certificate request self-signature verify OK
subject=CN = front01
subject=CN = front01
issuer=CN = infra-study-lab-ca
notBefore=Sep  1 13:11:55 2026 GMT
notAfter=Sep  8 13:11:55 2026 GMT
X509v3 Subject Alternative Name:
    DNS:front01
front01.crt: OK

# workstation01 から certificate を渡す（certificate は公開してよい情報）
scp "$HOME/ch5-tls/front01.crt" deployer@<front01の接続名>:/tmp/front01.crt

ssh deployer@front01
sudo install -m 644 /tmp/front01.crt /etc/nginx/tls/front01.crt
sudo stat /etc/nginx/tls/front01.crt /etc/nginx/tls/front01.key

（2026-09-02 実測）
/etc/nginx/tls/front01.crt owner=root group=root mode=644 size=1172
/etc/nginx/tls/front01.key owner=root group=root mode=600 size=1708

sudo openssl x509 -noout -modulus -in /etc/nginx/tls/front01.crt | openssl sha256
sudo openssl rsa  -noout -modulus -in /etc/nginx/tls/front01.key | openssl sha256

（2026-09-02 実測）　modulus そのものは表示せず、ハッシュだけを比べます。
crt: SHA2-256(stdin)= bf02321de9e2d48a92a0a530179903c45c13ee9992644e6b92965daac1c1cf8c
key: SHA2-256(stdin)= bf02321de9e2d48a92a0a530179903c45c13ee9992644e6b92965daac1c1cf8c

server {
    listen <HTTPの待受port>;
    server_name <front01のTLS接続名>;
    return 301 https://$host:<HTTPSの待受port>$request_uri;
}

server {
    listen <HTTPSの待受port> ssl;
    server_name <front01のTLS接続名>;

    ssl_certificate     /etc/nginx/tls/front01.crt;
    ssl_certificate_key /etc/nginx/tls/front01.key;

    location / {
        proxy_set_header X-Event-ID $http_x_event_id;
        proxy_set_header Host $host;
        proxy_pass http://tap_app_backend;
    }
}

sudoedit "<nginxの章専用設定ファイル>"
sudo nginx -t
sudo systemctl reload nginx
systemctl status nginx --no-pager
sudo ss -lntp | grep nginx
openssl s_client \
  -connect "<front01の接続名>:<HTTPSの待受port>" \
  -servername "<front01のTLS接続名>" \
  -showcerts </dev/null

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
LISTEN 0      511          0.0.0.0:8443      0.0.0.0:*    users:(("nginx",...))

（2026-09-02 実測）
=== nginx -t ===
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

=== reload 後の待受 ===
LISTEN 0      511          0.0.0.0:8443      0.0.0.0:*    users:(("nginx",...))
LISTEN 0      511          0.0.0.0:8080      0.0.0.0:*    users:(("nginx",...))
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",...))

=== 提示された certificate ===
subject=CN = front01
issuer=CN = infra-study-lab-ca

curl --show-error --verbose \
  "https://<front01のTLS接続名>:<HTTPSの待受port>/health"
printf 'curl_exit=%s\n' "$?"

（2026-10-12 実測・抜粋。--verbose の経過行〔* > < で始まる行〕は省略）
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. ...
curl_exit=60

openssl s_client \
  -connect "<front01の接続名>:<HTTPSの待受port>" \
  -servername "<front01のTLS接続名>" \
  -showcerts </dev/null

（2026-09-02 実測）
=== 信頼前（演習用 CA を渡さない）===
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it.
http=000
curl_exit=60

=== 提示された chain と検証結果 ===
depth=0 CN = front01
subject=CN = front01
issuer=CN = infra-study-lab-ca
Verification error: unable to verify the first certificate

curl --fail --show-error --verbose \
  --cacert "$HOME/ch5-tls/lab-ca.crt" \
  "https://<front01のTLS接続名>:<HTTPSの待受port>/health"

（2026-09-02 実測）
{"status":"ok","db":"ok","node":"app02"}
http=200

Verify return code: 0 (ok)

# 対象 VM 内で初期状態を記録する
sudo ufw status verbose
ip -br addr show

（2026-09-02 実測）　実アドレスは VLAN10 側だけを示します。
--- front01 ---
Status: inactive
eth0             UP             <管理LANのアドレス>
ens19.10@ens19   UP             172.16.10.23/24
--- app01 ---
Status: inactive
ens18            UP             <管理LANのアドレス>
ens20.10@ens20   UP             172.16.10.20/24
--- app02 ---
Status: inactive
ens18            UP             <管理LANのアドレス>
ens20.10@ens20   UP             172.16.10.21/24
--- db01 ---
Status: inactive
eth0             UP             <管理LANのアドレス>
ens19.10@ens19   UP             172.16.10.24/24

for HOST in front01 172.16.10.20 172.16.10.21 db01; do
  ssh -o BatchMode=yes -o ConnectTimeout=5 "deployer@${HOST}" \
    'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
done

（2026-09-02 実測）
management-ok host=front01   time=2026-09-02T01:43:34+00:00
management-ok host=learner01 time=2026-09-02T10:43:35+09:00
management-ok host=learner02 time=2026-09-02T10:43:35+09:00
management-ok host=db01      time=2026-09-02T01:43:35+00:00

# 対象 VM 内で 1 ルールだけ登録してから有効化する
sudo ufw allow from <workstation01の接続元> to any port <管理接続のport> proto tcp
sudo ufw --force enable
sudo ufw status verbose

# 直後に workstation01 の別ターミナルから確認する
ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@<対象VMの接続名> \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'

（2026-09-02 実測）　4 台とも同じ形。以下は 1 台目（front01）。
Rules updated
Firewall is active and enabled on system startup
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    172.16.10.22

--- 直後の新しい SSH 接続 ---
management-ok host=front01 time=2026-09-02T01:43:58+00:00

sudo ufw allow from <workstation01の接続元> to any port <HTTPSの待受port> proto tcp
sudo ufw status numbered

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@front01 \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
curl --fail --show-error --max-time 10 \
  --cacert "$HOME/ch5-tls/lab-ca.crt" \
  -o /dev/null -w 'http=%{http_code}\n' \
  "https://<front01のTLS接続名>:<HTTPSの待受port>/health"

（2026-09-02 実測）
=== ルール ===
[ 1] 22/tcp                     ALLOW IN    172.16.10.22
[ 2] 8443/tcp                   ALLOW IN    172.16.10.22

=== 直後の管理接続 ===
management-ok host=front01 time=2026-09-02T01:45:12+00:00

=== 直後の HTTPS 応答 ===
curl: (28) Operation timed out after 10002 milliseconds with 0 bytes received
http=000

sudo ufw allow from <front01の接続元> to any port <Appの待受port> proto tcp
sudo ufw status numbered

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@<app01の接続名> \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
ssh deployer@front01 'timeout 3 bash -c ": </dev/tcp/<app01の接続名>/<Appの待受port>"'

（2026-09-02 実測）
=== ルール ===
[ 1] 22/tcp                     ALLOW IN    172.16.10.22
[ 2] 8080/tcp                   ALLOW IN    172.16.10.23

=== 直後の管理接続 ===
management-ok host=learner01 time=2026-09-02T10:45:22+09:00

=== front01 から App service への probe ===
app01-probe ALLOW

sudo ufw allow from <front01の接続元> to any port <Appの待受port> proto tcp
sudo ufw status numbered

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@<app02の接続名> \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
ssh deployer@front01 'timeout 3 bash -c ": </dev/tcp/<app02の接続名>/<Appの待受port>"'

（2026-09-02 実測）
=== ルール ===
[ 1] 22/tcp                     ALLOW IN    172.16.10.22
[ 2] 8080/tcp                   ALLOW IN    172.16.10.23

=== 直後の管理接続 ===
management-ok host=learner02 time=2026-09-02T10:45:24+09:00

=== front01 から App service への probe ===
app02-probe ALLOW

sudo ufw allow from <app01の接続元> to any port <DBの待受port> proto tcp
sudo ufw status numbered

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@db01 \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
ssh deployer@<app01の接続名> 'timeout 3 bash -c ": </dev/tcp/<db01の接続名>/<DBの待受port>"'

（2026-09-02 実測）
=== ルール ===
[ 1] 22/tcp                     ALLOW IN    172.16.10.22
[ 2] 5432/tcp                   ALLOW IN    172.16.10.20

=== 直後の管理接続 ===
management-ok host=db01 time=2026-09-02T01:45:24+00:00

=== app01 から DB service への probe ===
app01->db ALLOW

sudo ufw allow from <app02の接続元> to any port <DBの待受port> proto tcp
sudo ufw status numbered

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@db01 \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
ssh deployer@<app02の接続名> 'timeout 3 bash -c ": </dev/tcp/<db01の接続名>/<DBの待受port>"'

（2026-09-02 実測）
=== ルール ===
[ 1] 22/tcp                     ALLOW IN    172.16.10.22
[ 2] 5432/tcp                   ALLOW IN    172.16.10.20
[ 3] 5432/tcp                   ALLOW IN    172.16.10.21

=== 直後の管理接続 ===
management-ok host=db01 time=2026-09-02T01:45:24+00:00

=== app02 から DB service への probe ===
app02->db ALLOW

{"status":"ok","db":"ok","node":"app02"}
http=200

sudo ufw status verbose
sudo ufw status numbered

sudo ufw --force delete <想定にない許可の番号>

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@<対象VMの接続名> \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'

（2026-09-02 実測）　4 台とも `Default: deny (incoming), allow (outgoing)`。
--- front01 ---
[ 1] 22/tcp    ALLOW IN  172.16.10.22
[ 2] 8443/tcp  ALLOW IN  172.16.10.22
--- app01 ---
[ 1] 22/tcp    ALLOW IN  172.16.10.22
[ 2] 8080/tcp  ALLOW IN  172.16.10.23
--- app02 ---
[ 1] 22/tcp    ALLOW IN  172.16.10.22
[ 2] 8080/tcp  ALLOW IN  172.16.10.23
--- db01 ---
[ 1] 22/tcp    ALLOW IN  172.16.10.22
[ 2] 5432/tcp  ALLOW IN  172.16.10.20
[ 3] 5432/tcp  ALLOW IN  172.16.10.21

# front01 で、同じ秘密鍵から SAN の違う CSR を作る
ssh deployer@front01
sudo openssl req -new -sha256 \
  -key /etc/nginx/tls/front01.key \
  -subj "/CN=<接続に使わない名前>" \
  -out /tmp/wrong-name.csr

# workstation01 で CSR を受け取り、演習用 CA で署名する
scp deployer@<front01の接続名>:/tmp/wrong-name.csr "$HOME/ch5-tls/wrong-name.csr"
cd "$HOME/ch5-tls"

cat > wrong-name.ext <<'EOF'
subjectAltName=DNS:<接続に使わない名前>
keyUsage=digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
EOF

openssl x509 -req -sha256 \
  -in wrong-name.csr \
  -CA lab-ca.crt \
  -CAkey lab-ca.key \
  -CAcreateserial \
  -days 7 \
  -extfile wrong-name.ext \
  -out wrong-name.crt

scp wrong-name.crt deployer@<front01の接続名>:/tmp/wrong-name.crt

sudo cp /etc/nginx/tls/front01.crt /tmp/ch5-front01.crt.good
sudo install -m 644 /tmp/wrong-name.crt /etc/nginx/tls/front01.crt
sudo nginx -t
sudo systemctl reload nginx

curl --show-error --verbose \
  --cacert "$HOME/ch5-tls/lab-ca.crt" \
  "https://<front01のTLS接続名>:<HTTPSの待受port>/health"
printf 'name_mismatch_exit=%s\n' "$?"

（2026-09-02 実測）
=== 差し替えた certificate ===
subject=CN = not-front01
X509v3 Subject Alternative Name:
    DNS:not-front01

=== 正しい接続名のまま接続 ===
*  subject: CN=not-front01
*  subjectAltName does not match front01
*  SSL: no alternative certificate subject name matches target host name 'front01'
curl: (60) SSL: no alternative certificate subject name matches target host name 'front01'
name_mismatch_exit=60

Verification error: hostname mismatch
Verify return code: 62 (hostname mismatch)

sudo cp /tmp/ch5-front01.crt.good /etc/nginx/tls/front01.crt
sudo chmod 644 /etc/nginx/tls/front01.crt
sudo nginx -t
sudo systemctl reload nginx

curl --fail --show-error \
  --cacert "$HOME/ch5-tls/lab-ca.crt" \
  "https://<front01のTLS接続名>:<HTTPSの待受port>/health"

（2026-09-02 実測）
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

{"status":"ok","db":"ok","node":"app01"}
http=200

Verify return code: 0 (ok)

# app01 で、外す 1 件の番号を確認してから削除する
sudo ufw status numbered
sudo ufw --force delete <front01からのApp service許可の番号>
sudo ufw status verbose

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@<app01の接続名> \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
ssh deployer@front01 \
  'timeout 3 bash -c ": </dev/tcp/<app01の接続名>/<Appの待受port>"'
printf 'service_probe_exit=%s\n' "$?"

（2026-09-02 実測）
=== 削除前後の番号 ===
[ 1] 22/tcp    ALLOW IN  172.16.10.22
[ 2] 8080/tcp  ALLOW IN  172.16.10.23     ← これを削除
（削除後）
[ 1] 22/tcp    ALLOW IN  172.16.10.22

=== 直後の管理接続（生きている）===
management-ok host=learner01 time=2026-09-02T10:50:20+09:00

=== front01 からの service probe ===
app01-probe DENY
app02-probe ALLOW     ← 変えていない方は通る

=== 入口経由を 3 回 ===
{"status":"ok","db":"ok","node":"app02"}  http=200
curl: (28) Operation timed out after 10002 milliseconds with 0 bytes received
http=000
{"status":"ok","db":"ok","node":"app02"}  http=200

# app01 で、外したのと同じ 1 件を戻す
sudo ufw allow from <front01の接続元> to any port <Appの待受port> proto tcp
sudo ufw status verbose

ssh -o BatchMode=yes -o ConnectTimeout=5 deployer@<app01の接続名> \
  'printf "management-ok host=%s time=%s\n" "$(hostname)" "$(date --iso-8601=seconds)"'
ssh deployer@front01 'timeout 3 bash -c ": </dev/tcp/<app01の接続名>/<Appの待受port>"'
curl --fail --show-error \
  --cacert "$HOME/ch5-tls/lab-ca.crt" \
  "https://<front01のTLS接続名>:<HTTPSの待受port>/health"

（2026-09-02 実測）
=== 戻したルール ===
[ 1] 22/tcp    ALLOW IN  172.16.10.22
[ 2] 8080/tcp  ALLOW IN  172.16.10.23

=== 直後の管理接続 ===
management-ok host=learner01 time=2026-09-02T10:50:57+09:00

=== front01 からの service probe ===
app01-probe ALLOW

=== 入口経由を 6 回（両方へ戻ったことを示す）===
{"status":"ok","db":"ok","node":"app01"}  http=200
{"status":"ok","db":"ok","node":"app02"}  http=200
{"status":"ok","db":"ok","node":"app01"}  http=200
{"status":"ok","db":"ok","node":"app02"}  http=200
{"status":"ok","db":"ok","node":"app01"}  http=200
{"status":"ok","db":"ok","node":"app02"}  http=200

hostname
test -s /tmp/part4-package-before.tsv
sudo ufw status verbose
sudo ufw status numbered
# 以下 3 行は db01 だけ
PG_CONF="$(sudo -u postgres psql -Atc 'SHOW config_file;')"
PG_HBA="$(sudo -u postgres psql -Atc 'SHOW hba_file;')"
PG_CONF_DIR="$(dirname "$PG_CONF")"

hostname
sudo systemctl disable --now tapapi.service
systemctl is-active tapapi.service || true

hostname
sudo rm -f "<nginxの有効化先>"
sudo rm -f "<nginxの章専用設定ファイル>"
sudo nginx -t
sudo systemctl reload nginx
sudo rm -f /var/log/nginx/tap_access.log /var/log/nginx/tap_access.log.*

(
sudo -u postgres dropdb --if-exists transit_lab
sudo -u postgres dropuser --if-exists tap_app
sudo rm -f "$PG_CONF_DIR/conf.d/part4.conf"
sudo sed -i -e '\|^host transit_lab tap_app 172\.16\.10\.20/32 scram-sha-256$|d' -e '\|^host transit_lab tap_app 172\.16\.10\.21/32 scram-sha-256$|d' "$PG_HBA"
sudo systemctl restart postgresql
test "$(sudo grep -cE '^host transit_lab tap_app (172\.16\.10\.20|172\.16\.10\.21)/32 scram-sha-256$' "$PG_HBA" || true)" -eq 0
test "$(sudo -u postgres psql -Atc "SELECT count(*) FROM pg_database WHERE datname='transit_lab';")" -eq 0
test "$(sudo -u postgres psql -Atc "SELECT count(*) FROM pg_roles WHERE rolname='tap_app';")" -eq 0
# 基準状態の db01 に PostgreSQL は無い。ここに出る cluster は本章が作ったもの。
# 見覚えのない cluster が出たら、消さずに止めて演習環境の担当へ知らせる。
pg_lsclusters --no-header
pg_lsclusters --no-header | awk '{print $1, $2}' | while read -r version cluster; do sudo pg_dropcluster --stop "$version" "$cluster"; done

mapfile -t chapter_packages < <(comm -13 <(cut -f1 /tmp/part4-package-before.tsv | LC_ALL=C sort) <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort))
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "${pkg%:amd64}" in
    postgresql|postgresql-16|postgresql-client|postgresql-client-16|postgresql-client-common|postgresql-common|libcommon-sense-perl|libjson-perl|libjson-xs-perl|libllvm17t64|libpq5|libtypes-serialiser-perl|ssl-cert) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }

APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"

sudo userdel postgres 2>/dev/null || true
sudo groupdel postgres 2>/dev/null || true
sudo groupdel ssl-cert 2>/dev/null || true
sudo chown root:root /etc/ssl/private
sudo chmod 0700 /etc/ssl/private
getent passwd postgres || true
getent group postgres || true
getent group ssl-cert || true
stat -c '%a %u %g %n' /etc/ssl/private
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

hostname
sudo ufw --force disable
# ufw reset は元の規則を *.rules.<日時> へ「名前を変えて移す」ので、更新日時は元のまま。
# 日時では選べないため、reset の前に在った退避の一覧を控え、増えた分だけを消す
mapfile -t UFW_OLD < <(ls /etc/ufw/*.rules.[0-9]*_[0-9]* 2>/dev/null)
sudo ufw --force reset
for f in /etc/ufw/*.rules.[0-9]*_[0-9]*; do
  [ -e "$f" ] || continue
  printf '%s\n' "${UFW_OLD[@]}" | grep -qxF -- "$f" || sudo rm -f -- "$f"
done
printf 'ufw の退避: 開始前 %s 件 / 現在 %s 件（同数なら今回の分は消えた）\n' "${#UFW_OLD[@]}" "$(ls /etc/ufw/*.rules.[0-9]*_[0-9]* 2>/dev/null | wc -l)"
sudo ufw status verbose
sudo ufw status numbered

(
# app01 / app02
hostname
sudo rm -f /etc/systemd/system/tapapi.service
sudo systemctl daemon-reload
sudo rm -rf /opt/tapapi /etc/tapapi
sudo userdel tapapi 2>/dev/null || true
getent group tapapi >/dev/null && sudo groupdel tapapi || true

mapfile -t chapter_packages < <(comm -13 <(cut -f1 /tmp/part4-package-before.tsv | LC_ALL=C sort) <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort))
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "${pkg%:amd64}" in
    python3-psycopg2|libpq5) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }
APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"

)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

(
# front01（nginx が参照しなくなった後）
APT_ONLY_PART4=(
  -o Dir::Etc::sourcelist=/dev/null
  -o Dir::Etc::sourceparts=/etc/apt/sources.list.d.part4
  -o APT::Get::List-Cleanup=0
)
mapfile -t chapter_packages < <(comm -13 <(cut -f1 /tmp/part4-package-before.tsv | LC_ALL=C sort) <(dpkg-query -W -f='${binary:Package}\n' | LC_ALL=C sort))
unexpected=()
for pkg in "${chapter_packages[@]}"; do
  case "${pkg%:amd64}" in
    nginx|nginx-common) ;;
    *) unexpected+=("$pkg") ;;
  esac
done
((${#unexpected[@]} == 0)) || { printf '想定外の package: %s\n' "${unexpected[@]}" >&2; exit 1; }
((${#chapter_packages[@]} == 0)) || sudo DEBIAN_FRONTEND=noninteractive apt-get "${APT_ONLY_PART4[@]}" purge -y "${chapter_packages[@]}"

sudo rm -rf /etc/nginx/tls
sudo rm -f /tmp/front01.csr /tmp/front01.crt /tmp/wrong-name.csr /tmp/wrong-name.crt /tmp/ch5-front01.crt.good
)
rc=$?
((rc == 0)) || echo 'SSH 接続は維持したまま処理を中止しました' >&2

sudo rm -rf /etc/apt/sources.list.d.part4
sudo rm -f /etc/apt/keyrings/infra-study-archive-keyring.asc
rm -f /tmp/infra-study-archive-keyring.asc /tmp/tapapi-1.1.tar.gz /tmp/ch5-reach-before-*.tsv /tmp/ch5-reach-after-*.tsv
test ! -e /etc/apt/sources.list.d.part4
test ! -e /etc/apt/keyrings/infra-study-archive-keyring.asc
test ! -e /tmp/infra-study-archive-keyring.asc
[ -z "${TAPAPI_TMP:-}" ] || rm -rf -- "$TAPAPI_TMP"

# workstation01
rm -f /tmp/ch5-reachability-before.tsv /tmp/ch5-reachability-after.tsv
rm -rf "$HOME/ch5-tls"

dpkg-query -W -f='${binary:Package}\t${Version}\n' | sort > /tmp/part4-package-after.tsv
diff -u /tmp/part4-package-before.tsv /tmp/part4-package-after.tsv
systemctl status tapapi.service --no-pager || true
systemctl status nginx --no-pager || true
systemctl status postgresql --no-pager || true
sudo ss -lntp | grep -E ':(5432|8080|8443)([[:space:]]|$)' || true
test ! -e /opt/tapapi; test ! -e /etc/tapapi; test ! -e /etc/systemd/system/tapapi.service
test ! -e "<nginxの章専用設定ファイル>"; test ! -e "<nginxの有効化先>"
test ! -e /etc/apt/sources.list.d.part4; test ! -e /etc/apt/keyrings/infra-study-archive-keyring.asc
getent passwd tapapi || true; getent group tapapi || true
getent passwd postgres || true; getent group postgres || true; getent group ssl-cert || true
stat -c '%a %u %g %n' /etc/ssl/private 2>/dev/null || true
sudo ufw status numbered
test "$(ls /etc/ufw/*.rules.20* 2>/dev/null | wc -l)" -eq 0
test ! -e /etc/nginx/tls/front01.key; test ! -e /etc/nginx/tls/front01.crt
test ! -e "$HOME/ch5-tls"

sudo find /etc /var/lib /srv /opt /usr/local "$HOME" \
  -not -path '/var/lib/apt/*' \
  -not -path '/var/lib/dpkg/*' \
  -not -path '/var/lib/systemd/*' \
  -not -path '/var/log/*' \
  -not -path '/var/cache/*' \
  -not -name '.bash_history' \
  -not -path '/etc/passwd-' -not -path '/etc/group-' \
  -not -path '/etc/shadow-' -not -path '/etc/gshadow-' \
  -not -path '/var/lib/fwupd' -not -path '/var/lib/fwupd/*' \
  -not -path '/etc/fwupd' -not -path '/etc/fwupd/*' \
  -not -path '/var/lib/ucf' -not -path '/var/lib/ucf/*' \
  -not -path '/var/lib/landscape' -not -path '/var/lib/landscape/*' \
  -not -path '/etc/ld.so.cache' \
  -not -path '/var/lib/ubuntu-release-upgrader/release-upgrade-available' \
  -not -path '/var/lib/snapd/state.json' \
  -not -path '/var/lib/snapd/maintenance.json' \
  -not -path '/var/lib/logrotate/status' \
  -printf '%p\t%y\t%m\t%U\t%G\t%s\t%T@\n' 2>/dev/null \
  | LC_ALL=C sort \
  | sudo tee /tmp/part4-manifest-after.tsv >/dev/null
sudo diff -u /tmp/part4-manifest-before.tsv /tmp/part4-manifest-after.tsv > /var/tmp/part4-chapter-manifest.diff
diff_rc=$?
if [ "$diff_rc" -le 1 ]; then
  if ! awk 'BEGIN { FS = "\t"; c = "LC_ALL=C sort" }
      /^\+\+\+|^---|^@@/ { next }
      /^[+-]/ {
        if (NF != 7) { printf "manifest の列数が 7 ではありません: %s\n", $0 > "/dev/stderr"; bad = 1; exit 2 }
        t++; s = substr($1, 1, 1); p = substr($1, 2)
        k = $2 " " $3 " " $4 " " $5 " " ($2 == "d" ? "-" : $6)
        if (s == "-") { if (p in b) { dup = p; exit 2 } b[p] = k; bm[p] = $7; bt[p] = $2 }
        else          { if (p in a) { dup = p; exit 2 } a[p] = k; am[p] = $7 }
      }
      END {
        if (bad) exit 2
        if (dup != "") { printf "同じパスが重複しています: %s\n", dup > "/dev/stderr"; exit 2 }
        print "== 残留候補（0 件で合格）=="
        n = 0
        for (p in b) {
          if (!(p in a)) { print "消えた   " p | c; n++ }
          else if (a[p] != b[p]) { print "変わった " p "  (" b[p] " -> " a[p] ")" | c; n++ }
        }
        for (p in a) if (!(p in b)) { print "増えた   " p | c; n++ }
        fflush(); close(c)
        print "残留候補: " n " 件"
        print "== 更新日時だけ変わった通常ファイル（1 件ずつ理由を説明できること）=="
        m = 0; d = 0
        for (p in b) if ((p in a) && a[p] == b[p] && am[p] != bm[p]) { if (bt[p] == "d") d++; else { print p | c; m++ } }
        fflush(); close(c)
        print "更新日時だけ変わった通常ファイル: " m " 件 ／ ディレクトリ: " d " 件"
        print "差分行総数: " (t + 0)
      }' /var/tmp/part4-chapter-manifest.diff; then
    echo "差分の表示に失敗しました。構築前・章末の manifest と /var/tmp/part4-chapter-manifest.diff は残してあります。表示された理由を確認してください" >&2
  fi
else
  echo "差分を採れませんでした（diff の終了コード $diff_rc）。構築前 manifest /tmp/part4-manifest-before.tsv があるか確認してください" >&2
fi

（形の例です。M・K・T には実行したときの件数が入ります。更新日時だけ変わった通常ファイルの行と件数は、台・章によって変わります。合格の条件は「残留候補: 0 件」です）
== 残留候補（0 件で合格）==
残留候補: 0 件
== 更新日時だけ変わった通常ファイル（1 件ずつ理由を説明できること）==
（該当するパスが 1 行ずつ並びます）
更新日時だけ変わった通常ファイル: M 件 ／ ディレクトリ: K 件
差分行総数: T

rm -f /tmp/part4-package-before.tsv /tmp/part4-package-after.tsv
sudo rm -f /tmp/part4-manifest-before.tsv /tmp/part4-manifest-after.tsv /var/tmp/part4-chapter-manifest.diff
test ! -e /var/tmp/part4-chapter-manifest.diff