proxmox/scripts/verify

Verification Scripts

Scripts for ingress, NPMplus, DNS, and source-of-truth verification.

Dependencies

Required tools (install before running):

Tool	Purpose	Install
bash	Shell (4.0+)	Default on most systems
curl	API calls, HTTP	apt install curl
jq	JSON parsing	apt install jq
dig	DNS resolution	apt install dnsutils
openssl	SSL certificate inspection	apt install openssl
ssh	Remote execution	apt install openssh-client
ss	Port checking	apt install iproute2
systemctl	Service status	System (systemd)
sqlite3	Database backup	apt install sqlite3

Optional (recommended for automation): sshpass, rsync, screen, tmux, htop, shellcheck, parallel. See docs/11-references/APT_PACKAGES_CHECKLIST.md § Automation / jump host.
One-line install (Debian/Ubuntu): sudo apt install -y sshpass rsync dnsutils iproute2 screen tmux htop shellcheck parallel

Tool	Purpose
wscat or websocat	WebSocket testing (manual verification)

Scripts

• backup-npmplus.sh - Full NPMplus backup (database, API exports, certificates)
• check-contracts-on-chain-138.sh - Check that Chain 138 deployed contracts have bytecode on-chain (cast code for 31 addresses; requires cast and RPC access). Use [RPC_URL] or env RPC_URL_138; --dry-run lists addresses only (no RPC calls); SKIP_EXIT=1 to exit 0 when RPC unreachable.
• check-public-report-api.sh - Verify token-aggregation report + networks JSON (not Blockscout). Probes /api/v1/networks first, then /token-aggregation/api/v1/networks, and uses the working prefix for all checks. Use SKIP_EXIT=1 for diagnostic-only mode. Set SKIP_BRIDGE_ROUTES=0 / SKIP_BRIDGE_PREFLIGHT=0 for bridge assertions.
• check-token-aggregation-chain138-api.sh - Hits tokens, pools, quote, bridge/routes, bridge/status, bridge/preflight, and networks on both /api/v1/* and /token-aggregation/api/v1/*. BASE_URL=https://explorer.d-bis.org (default) or http://192.168.11.140.
• check-gru-transport-preflight.sh - Operator-focused GRU runtime preflight. Calls /api/v1/bridge/preflight, prints blocked pairs with eligibilityBlockers / runtimeMissingRequirements, and fails unless all active pairs are runtime-ready or ALLOW_BLOCKED=1 is set.
• check-cstar-v2-transport-stack.sh - Predeploy Forge verifier for the c* V2 bridge stack. Runs the base V2 token suite, legacy reserve-verifier compatibility suite, V2 reserve/verifier full L1/L2 round-trip suite, and the core CWMultiTokenBridge round-trip suite.
• run-repo-green-test-path.sh - Local deterministic green-path aggregate behind root pnpm test. Runs config validation, then the focused smom-dbis-138 contract and service CI targets.
• xdc-zero-chain138-preflight.sh - eth_chainId HTTP checks for XDC_PARENTNET_URL/PARENTNET_URL and RPC_URL_138; optional ETHEREUM_MAINNET_RPC, BSC_RPC_URL. See CHAIN138_XDC_ZERO_BRIDGE_RUNBOOK.
• ../xdc-zero/merge-endpointconfig-chain138.sh - Merge chain138 into XDC-Zero endpointconfig.json (optional xdcparentnet.registers append). Set XDC_ZERO_ENDPOINT_DIR; use --dry-run. See config/xdc-zero/README.md.
• check-completion-status.sh - One-command summary of repo-completable checks, public report API health, and pointers to operator/external remaining work.
• reconcile-env-canonical.sh - Emit recommended .env lines for Chain 138 (canonical source of truth); use to reconcile smom-dbis-138/.env with CONTRACT_ADDRESSES_REFERENCE. Usage: ./scripts/verify/reconcile-env-canonical.sh [--print]
• check-deployer-balance-blockscout-vs-rpc.sh - Compare deployer native balance from Blockscout API vs RPC (to verify index matches current chain); see EXPLORER_AND_BLOCKSCAN_REFERENCE
• sync-blockscout-address-labels-from-registry.sh - Plan or sync Blockscout address labels from address-registry-entry JSON (config/dbis-institutional/schemas/address-registry-entry.schema.json: blockscout.label, status: active). Supports --mode=http, --mode=db, and --mode=auto; on the self-hosted Chain 138 explorer, db is the right live mode because /api/v1/* is token-aggregation, not a native Blockscout label-write API. DB mode writes primary labels into Blockscout public.address_names through CT 5000. See config/dbis-institutional/README.md and OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md.
• check-dependencies.sh - Verify required tools (bash, curl, jq, openssl, ssh)
• export-cloudflare-dns-records.sh - Export Cloudflare DNS records
• export-npmplus-config.sh - Export NPMplus proxy hosts and certificates via API
• generate-source-of-truth.sh - Combine verification outputs into canonical JSON
• run-full-verification.sh - Run full verification suite
• verify-backend-vms.sh - Verify backend VMs (status, IPs, nginx configs)
• verify-end-to-end-routing.sh - E2E routing verification
• verify-udm-pro-port-forwarding.sh - UDM Pro port forwarding checks
• verify-websocket.sh - WebSocket connectivity test (requires websocat or wscat)

Task runners (no LAN vs from LAN)

• From anywhere (no LAN/creds): ../run-completable-tasks-from-anywhere.sh — runs config validation, on-chain contract check, run-all-validation --skip-genesis, public report API diagnostics, and reconcile-env-canonical.
• Completion snapshot: check-completion-status.sh — summarizes what is complete locally and what still depends on operator or external execution.
• Full LAN execution order: ../run-full-operator-completion-from-lan.sh — starts with the token-aggregation /api/v1 repair, then Wave 0, verification, E2E, and optional operator-only deployment steps. Use --dry-run first.
• From LAN (NPM_PASSWORD, optional PRIVATE_KEY): ../run-operator-tasks-from-lan.sh — runs W0-1 (NPMplus RPC fix), W0-3 (NPMplus backup), O-1 (Blockscout verification); use --dry-run to print commands only. See ALL_TASKS_DETAILED_STEPS.

Environment

Set variables in .env or export before running. See project root .env.example and docs/04-configuration/VERIFICATION_GAPS_AND_TODOS.md.