diff --git a/labs/lab1.md b/labs/lab1.md index bb4e226d9..eb319e50f 100644 --- a/labs/lab1.md +++ b/labs/lab1.md @@ -91,9 +91,20 @@ git config --global commit.gpgsign true git config --global tag.gpgsign true ``` -Tell the platform your SSH key is a **signing key**: -- GitHub: Settings → SSH and GPG keys → **New SSH key**, key type **Signing Key** -- GitLab: Profile → SSH Keys → tick "Usage type: Authentication & signing" +Now register the key on the platform. GitHub treats **Authentication** and **Signing** as *separate* roles for the same key, so you add it under both: + +- **Authentication Key** — lets you `clone` / `fetch` / `push` over SSH (`git@github.com:…`). If you cloned over HTTPS, or have never seen `ssh -T git@github.com` greet you by name, you don't have one configured yet — add it now or the `upstream` SSH remote will fail in Lab 2. +- **Signing Key** — gives your commits the **Verified** badge. + +- 🐙 GitHub: Settings → SSH and GPG keys → **New SSH key** → add the **same** `~/.ssh/id_ed25519.pub` **twice**, once with Key type **Authentication Key** and once with **Signing Key**. +- 🦊 GitLab: Profile → SSH Keys → a single key with **Usage type: Authentication & signing** covers both. + +Confirm authentication works before moving on: + +```bash +ssh -T git@github.com +# expect: Hi YOUR_USERNAME! You've successfully authenticated... +``` ### 1.4: Make a Signed Commit @@ -303,7 +314,8 @@ In `submissions/lab1.md`: ## Common Pitfalls - 🪤 **PR template doesn't auto-populate** — make sure the template is on `main` *before* opening the PR -- 🪤 **Commits show "Unverified"** — the SSH key must be added as a *Signing Key* on GitHub (not just an authentication key) +- 🪤 **Commits show "Unverified"** — the key must also be added as a **Signing Key** on GitHub; an Authentication Key alone won't verify commits (they're separate roles — see §1.3) +- 🪤 **`git@github.com: Permission denied (publickey)` on clone/fetch/push** — the *reverse* gap: your key is registered for signing but not as an **Authentication Key**. Add it as Authentication too (§1.3) and confirm with `ssh -T git@github.com`. Quick unblock for the *public* upstream: `git remote set-url upstream https://github.com/inno-devops-labs/DevOps-Intro.git` - 🪤 **`git push` rejected on `main`** — that's the bonus rule working as designed; push to `feature/lab1` instead - 🪤 **`gpg.format=ssh` ignored** — confirm Git ≥ 2.34: `git --version` - 🪤 **Pushed to the wrong branch** — `git switch feature/lab1` before `git push` diff --git a/labs/lab2.md b/labs/lab2.md index fca7b3f22..aae9acfb3 100644 --- a/labs/lab2.md +++ b/labs/lab2.md @@ -223,6 +223,7 @@ git bisect reset ## Common Pitfalls +- 🪤 **`git@github.com: Permission denied (publickey)` on `git fetch upstream`** — *not* a remote-config bug (the error is at the SSH layer, before Git reads the repo). Your key isn't registered for **authentication** on GitHub — and a **Signing Key** (Lab 1) does *not* count for auth, they're separate roles. Add the same `~/.ssh/id_ed25519.pub` as an **Authentication Key** (Lab 1 §1.3), verify with `ssh -T git@github.com`, then re-run. To unblock right now, the public upstream fetches over HTTPS with no key: `git remote set-url upstream https://github.com/inno-devops-labs/DevOps-Intro.git` - 🪤 **`reset --hard` without committing first** — your *uncommitted* edits really *are* gone (reflog only saves committed work). Always check `git status` first - 🪤 **`tag -v` says "no signature"** — you used `git tag NAME` instead of `git tag -a -s NAME -m "..."` - 🪤 **Rebase conflicts** — resolve, then `git rebase --continue`. Never `git rebase --skip` unless you know what you're skipping diff --git a/labs/lab3.md b/labs/lab3.md index 9f0970b20..87344cfb3 100644 --- a/labs/lab3.md +++ b/labs/lab3.md @@ -160,6 +160,23 @@ Tips: - GitLab: `parallel:matrix:` - Set `fail-fast: false` (GH) or equivalent so a single bad cell doesn't cancel the others — you want to *see* which combo broke +> ⚠️ **The matrix renames your checks — update branch protection (1.6) or your PR blocks forever.** A matrixed `test` job reports as `test (1.23)` and `test (1.24)`; the old required check named `test` will sit at *"Expected — Waiting for status to be reported"* indefinitely, even though every real check is green. Two fixes: +> +> 1. **Quick:** in the branch-protection rule, replace `vet`/`test` with the matrixed names (`vet (1.23)`, `vet (1.24)`, `test (1.23)`, `test (1.24)`). +> 2. **Robust (recommended):** add one aggregation job and require *only* it — then the matrix can change freely without touching protection settings: +> +> ```yaml +> ci-ok: +> if: always() +> needs: [vet, test, lint] +> runs-on: ubuntu-24.04 +> steps: +> - run: | +> test "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "false" +> ``` +> +> The `if: always()` matters — without it, a failed `needs` job *skips* `ci-ok`, and a skipped required check lets the PR through on some configurations. + ### 2.3: Skip docs-only changes Edit your trigger so the pipeline runs **only** when something in `app/` or your CI config itself changes. README edits should not burn 4 minutes of CI time. @@ -179,6 +196,8 @@ Capture wall-clock times from the CI UI for three scenarios: > 💡 To get a clean baseline, temporarily disable each optimization with a commit, take a screenshot of the run time, then restore. +> 🧪 **Expect the cache rows to be boring — that's the finding, not a failure.** QuickNotes has **zero third-party dependencies** (look at `app/go.mod` — no `require` block, no `go.sum`), so the module cache has nothing to store and total wall-clock barely moves with `cache: true` vs `cache: false`. Most of your 60–80 s is runner provisioning, checkout, and the Go toolchain download — none of which `setup-go`'s cache touches. Report what you measured and *explain why* (that's design question **f** in disguise). To see where caching *would* pay, compare the **per-step** durations (`setup-go`, `go test`) instead of job totals, and note which step a real dependency-heavy project would save on. + ### 2.5: Document In `submissions/lab3.md`: @@ -284,6 +303,8 @@ Answer in 4-6 sentences: - 🪤 **Forgot `working-directory` (or `cd app`) for Go commands** — Go modules live in `app/`, not the repo root; commands run from the root will fail with "no Go files" - 🪤 **`fail-fast: true` (the GH Actions default) in a matrix** — one fail cancels the others; you can't see *which* combo broke - 🪤 **Branch protection set on someone else's fork's `main`** — you can only protect *your* fork's `main`. The upstream course repo has its own protection +- 🪤 **PR stuck on "Expected — Waiting for status to be reported" after adding the matrix** — the matrix renamed `test` → `test (1.23)`/`test (1.24)`, but branch protection still requires the old `test` context, which will never report again. Update the required-check names or switch to the `ci-ok` aggregation job (see §2.2) +- 🪤 **"Caching didn't speed anything up"** — on a zero-dependency module that's the *correct* result, not a mistake (see §2.4); don't pad the timing table with numbers you didn't observe - 🪤 **`golangci-lint` version not pinned** — "latest" pulls a new release tomorrow that may flag your code with new rules. Pin `v2.5.0` exactly - 🪤 **GitLab CI: incorrect anchor syntax** (`<<: *name`) — GitLab is strict; use the in-platform CI Lint tool (`Project → CI/CD → Editor → Validate`) - 🪤 **Cache hits expire after 7 days of inactivity on GH** — that's expected; the cache key is what protects you against poisoning diff --git a/submissions/lab4-assets/curl-post.txt b/submissions/lab4-assets/curl-post.txt new file mode 100644 index 000000000..6adc7850f --- /dev/null +++ b/submissions/lab4-assets/curl-post.txt @@ -0,0 +1,23 @@ +Note: Unnecessary use of -X or --request, POST is already inferred. +* Trying 127.0.0.1:8080... + % Total % Received % Xferd Average Speed Time Time Time Current + Dload Upload Total Spent Left Speed + 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connected to localhost (127.0.0.1) port 8080 (#0) +> POST /notes HTTP/1.1 +> Host: localhost:8080 +> User-Agent: curl/7.82.0 +> Accept: */* +> Content-Type: application/json +> Content-Length: 39 +> +} [39 bytes data] +* Mark bundle as not supporting multiuse +< HTTP/1.1 201 Created +< Content-Type: application/json +< Date: Tue, 16 Jun 2026 16:46:12 GMT +< Content-Length: 92 +< +{ [92 bytes data] + 100 131 100 92 100 39 15219 6451 --:--:-- --:--:-- --:--:-- 26200 +* Connection #0 to host localhost left intact +{"id":6,"title":"trace me","body":"in flight","created_at":"2026-06-16T16:46:12.62574443Z"} diff --git a/submissions/lab4-assets/dig-example.txt b/submissions/lab4-assets/dig-example.txt new file mode 100644 index 000000000..ee09d40a4 --- /dev/null +++ b/submissions/lab4-assets/dig-example.txt @@ -0,0 +1,3 @@ +$ dig +short example.com @1.1.1.1 +104.20.23.154 +172.66.147.243 diff --git a/submissions/lab4-assets/go-run-processes.txt b/submissions/lab4-assets/go-run-processes.txt new file mode 100644 index 000000000..ba677b0ac --- /dev/null +++ b/submissions/lab4-assets/go-run-processes.txt @@ -0,0 +1 @@ +root 4460 298 12 19:48 pts/0 00:00:00 /snap/go/11200/bin/go run . diff --git a/submissions/lab4-assets/ip-route.txt b/submissions/lab4-assets/ip-route.txt new file mode 100644 index 000000000..4733c94c9 --- /dev/null +++ b/submissions/lab4-assets/ip-route.txt @@ -0,0 +1,3 @@ +$ ip route show +default via 172.19.128.1 dev eth0 proto kernel +172.19.128.0/20 dev eth0 proto kernel scope link src 172.19.130.184 diff --git a/submissions/lab4-assets/journalctl-quicknotes.txt b/submissions/lab4-assets/journalctl-quicknotes.txt new file mode 100644 index 000000000..b0601f6da --- /dev/null +++ b/submissions/lab4-assets/journalctl-quicknotes.txt @@ -0,0 +1,2 @@ +$ journalctl --user -u quicknotes -n 20 || true +-- No entries -- diff --git a/submissions/lab4-assets/lab4-trace.pcap b/submissions/lab4-assets/lab4-trace.pcap new file mode 100644 index 000000000..dfe48d8ee Binary files /dev/null and b/submissions/lab4-assets/lab4-trace.pcap differ diff --git a/submissions/lab4-assets/lab4-trace.txt b/submissions/lab4-assets/lab4-trace.txt new file mode 100644 index 000000000..fb3c477cd --- /dev/null +++ b/submissions/lab4-assets/lab4-trace.txt @@ -0,0 +1,43 @@ +19:46:12.625388 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags [S], seq 4277809752, win 65495, options [mss 65495,sackOK,TS val 2900709604 ecr 0,nop,wscale 7], length 0 +E..<.}@.@..<..............2X.........0......... +..P......... +19:46:12.625400 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags [S.], seq 2244450212, ack 4277809753, win 65483, options [mss 65495,sackOK,TS val 2900709604 ecr 2900709604,nop,wscale 7], length 0 +E..<..@.@.<...................2Y.....0......... +..P...P..... +19:46:12.625409 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags [.], ack 1, win 512, options [nop,nop,TS val 2900709604 ecr 2900709604], length 0 +E..4.~@.@..C..............2Y.........(..... +..P...P. +19:46:12.625606 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags [P.], seq 1:176, ack 1, win 512, options [nop,nop,TS val 2900709604 ecr 2900709604], length 175: HTTP: POST /notes HTTP/1.1 +E.....@.@.................2Y............... +..P...P.POST /notes HTTP/1.1 +Host: localhost:8080 +User-Agent: curl/7.82.0 +Accept: */* +Content-Type: application/json +Content-Length: 39 + +{"title":"trace me","body":"in flight"} +19:46:12.625632 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags [.], ack 176, win 511, options [nop,nop,TS val 2900709604 ecr 2900709604], length 0 +E..4..@.@.....................3......(..... +..P...P. +19:46:12.631249 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags [P.], seq 1:206, ack 176, win 512, options [nop,nop,TS val 2900709610 ecr 2900709604], length 205: HTTP: HTTP/1.1 201 Created +E.....@.@..K..................3............ +..P...P.HTTP/1.1 201 Created +Content-Type: application/json +Date: Tue, 16 Jun 2026 16:46:12 GMT +Content-Length: 92 + +{"id":6,"title":"trace me","body":"in flight","created_at":"2026-06-16T16:46:12.62574443Z"} + +19:46:12.631275 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags [.], ack 206, win 511, options [nop,nop,TS val 2900709610 ecr 2900709610], length 0 +E..4..@.@..A..............3....r.....(..... +..P...P. +19:46:12.631448 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags [F.], seq 176, ack 206, win 512, options [nop,nop,TS val 2900709610 ecr 2900709610], length 0 +E..4..@.@..@..............3....r.....(..... +..P...P. +19:46:12.631508 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags [F.], seq 206, ack 177, win 512, options [nop,nop,TS val 2900709610 ecr 2900709610], length 0 +E..4..@.@..................r..3 .....(..... +..P...P. +19:46:12.631522 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags [.], ack 207, win 512, options [nop,nop,TS val 2900709610 ecr 2900709610], length 0 +E..4..@.@..?..............3 ...s.....(..... +..P...P. diff --git a/submissions/lab4-assets/mtr-localhost.txt b/submissions/lab4-assets/mtr-localhost.txt new file mode 100644 index 000000000..aaa58223c --- /dev/null +++ b/submissions/lab4-assets/mtr-localhost.txt @@ -0,0 +1,4 @@ +$ mtr -rwc 5 localhost +Start: 2026-06-16T19:47:44+0300 +HOST: DESKTOP-I0DHHPT Loss% Snt Last Avg Best Wrst StDev + 1.|-- localhost 0.0% 5 0.0 0.0 0.0 0.0 0.0 diff --git a/submissions/lab4-assets/outsidein-1-process.txt b/submissions/lab4-assets/outsidein-1-process.txt new file mode 100644 index 000000000..98f94174d --- /dev/null +++ b/submissions/lab4-assets/outsidein-1-process.txt @@ -0,0 +1,2 @@ +$ ps -ef | grep quicknotes +root 4535 4460 0 19:48 pts/0 00:00:00 /root/.cache/go-build/01/01b36d0cffeef160fa8af2f501e7375bd20c7b28a5467c110d6e43fef651f8f2-d/quicknotes diff --git a/submissions/lab4-assets/outsidein-2-listening.txt b/submissions/lab4-assets/outsidein-2-listening.txt new file mode 100644 index 000000000..a9aee1a47 --- /dev/null +++ b/submissions/lab4-assets/outsidein-2-listening.txt @@ -0,0 +1,2 @@ +$ ss -tlnp | grep 8080 +LISTEN 0 4096 *:8080 *:* users:(("quicknotes",pid=4535,fd=3)) diff --git a/submissions/lab4-assets/outsidein-3-health.txt b/submissions/lab4-assets/outsidein-3-health.txt new file mode 100644 index 000000000..cc1792283 --- /dev/null +++ b/submissions/lab4-assets/outsidein-3-health.txt @@ -0,0 +1,2 @@ +$ curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080/health +200 diff --git a/submissions/lab4-assets/outsidein-4-firewall.txt b/submissions/lab4-assets/outsidein-4-firewall.txt new file mode 100644 index 000000000..002e4f750 --- /dev/null +++ b/submissions/lab4-assets/outsidein-4-firewall.txt @@ -0,0 +1 @@ +$ sudo iptables -L -n -v 2>/dev/null || sudo nft list ruleset 2>/dev/null || true diff --git a/submissions/lab4-assets/outsidein-5-dns.txt b/submissions/lab4-assets/outsidein-5-dns.txt new file mode 100644 index 000000000..cab07dd95 --- /dev/null +++ b/submissions/lab4-assets/outsidein-5-dns.txt @@ -0,0 +1,2 @@ +$ dig +short localhost +127.0.0.1 diff --git a/submissions/lab4-assets/qn-broken.log b/submissions/lab4-assets/qn-broken.log new file mode 100644 index 000000000..91905670b --- /dev/null +++ b/submissions/lab4-assets/qn-broken.log @@ -0,0 +1,3 @@ +2026/06/16 19:48:28 quicknotes listening on :8080 (notes loaded: 6) +2026/06/16 19:48:28 listen: listen tcp :8080: bind: address already in use +exit status 1 diff --git a/submissions/lab4-assets/repair-health.txt b/submissions/lab4-assets/repair-health.txt new file mode 100644 index 000000000..394f3fdb8 --- /dev/null +++ b/submissions/lab4-assets/repair-health.txt @@ -0,0 +1 @@ +{"notes":6,"status":"ok"} diff --git a/submissions/lab4-assets/repair-listening.txt b/submissions/lab4-assets/repair-listening.txt new file mode 100644 index 000000000..635c6d9f7 --- /dev/null +++ b/submissions/lab4-assets/repair-listening.txt @@ -0,0 +1 @@ +LISTEN 0 4096 *:8080 *:* users:(("quicknotes",pid=4886,fd=3)) diff --git a/submissions/lab4-assets/repair-server.log b/submissions/lab4-assets/repair-server.log new file mode 100644 index 000000000..41178da2b --- /dev/null +++ b/submissions/lab4-assets/repair-server.log @@ -0,0 +1,2 @@ +2026/06/16 20:02:09 quicknotes listening on :8080 (notes loaded: 6) +2026/06/16 20:02:33 shutting down diff --git a/submissions/lab4-assets/ss-8080.txt b/submissions/lab4-assets/ss-8080.txt new file mode 100644 index 000000000..d7c5cb3ae --- /dev/null +++ b/submissions/lab4-assets/ss-8080.txt @@ -0,0 +1,2 @@ +$ ss -tlnp | grep :8080 +LISTEN 0 4096 *:8080 *:* users:(("quicknotes",pid=4337,fd=3)) diff --git a/submissions/lab4.md b/submissions/lab4.md new file mode 100644 index 000000000..be24d6751 --- /dev/null +++ b/submissions/lab4.md @@ -0,0 +1,858 @@ +\# Lab 4 Submission + + + +\## Task 1: Trace a Request End-to-End + + + +\### QuickNotes request + + + +I started QuickNotes locally on port `8080` and captured one request to `POST /notes` using `tcpdump` on the loopback interface. + + + +The request was sent with: + + + +```bash + +curl -v -X POST http://localhost:8080/notes \\ + + -H 'Content-Type: application/json' \\ + + -d '{"title":"trace me","body":"in flight"}' + +``` + + + +The application responded successfully: + + + +```text + +POST /notes HTTP/1.1 + +HTTP/1.1 201 Created + +{"id":6,"title":"trace me","body":"in flight","created\_at":"2026-06-16T16:46:12.62574443Z"} + +``` + + + +This confirms that the request reached QuickNotes, QuickNotes created the note, and the server returned a valid JSON response with status `201 Created`. + + + +\--- + + + +\## Annotated Packet Capture + + + +The full decoded capture is included in: + + + +```text + +submissions/lab4-assets/lab4-trace.txt + +``` + + + +\### TCP three-way handshake + + + +The TCP connection starts with the standard three-way handshake: + + + +```text + +19:46:12.625388 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags \[S], seq 4277809752, win 65495, options \[mss 65495,sackOK,TS val 2900709604 ecr 0,nop,wscale 7], length 0 + +19:46:12.625400 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags \[S.], seq 2244450212, ack 4277809753, win 65483, options \[mss 65495,sackOK,TS val 2900709604 ecr 2900709604,nop,wscale 7], length 0 + +19:46:12.625409 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags \[.], ack 1, win 512, options \[nop,nop,TS val 2900709604 ecr 2900709604], length 0 + +``` + + + +Annotation: + + + +\* `SYN`: the client starts a TCP connection to `127.0.0.1:8080`. + +\* `SYN/ACK`: the QuickNotes server accepts and acknowledges the connection. + +\* `ACK`: the client confirms the connection is established. + +\* After this point, HTTP data can be sent over the TCP connection. + + + +\### HTTP request + + + +The HTTP request line and body appear in the capture: + + + +```text + +19:46:12.625606 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags \[P.], seq 1:176, ack 1, win 512, options \[nop,nop,TS val 2900709604 ecr 2900709604], length 175: HTTP: POST /notes HTTP/1.1 + + + +POST /notes HTTP/1.1 + +Host: localhost:8080 + +User-Agent: curl/7.82.0 + +Accept: \*/\* + +Content-Type: application/json + +Content-Length: 39 + + + +{"title":"trace me","body":"in flight"} + +``` + + + +Annotation: + + + +This is the application-layer request. The client sends a `POST` request to `/notes` with a JSON body. The body contains the title and body of the note that should be created. + + + +\### HTTP response + + + +The server response appears in the capture: + + + +```text + +19:46:12.631249 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags \[P.], seq 1:206, ack 176, win 512, options \[nop,nop,TS val 2900709610 ecr 2900709604], length 205: HTTP: HTTP/1.1 201 Created + + + +HTTP/1.1 201 Created + +Content-Type: application/json + +Date: Tue, 16 Jun 2026 16:46:12 GMT + +Content-Length: 92 + + + +{"id":6,"title":"trace me","body":"in flight","created\_at":"2026-06-16T16:46:12.62574443Z"} + +``` + + + +Annotation: + + + +QuickNotes returned `201 Created`, which means the note was successfully created. The response body contains the generated note ID, original title/body, and creation timestamp. + + + +\### Connection close + + + +The capture ends with the TCP connection being closed: + + + +```text + +19:46:12.631448 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags \[F.], seq 176, ack 206, win 512, options \[nop,nop,TS val 2900709610 ecr 2900709610], length 0 + +19:46:12.631508 IP 127.0.0.1.8080 > 127.0.0.1.39140: Flags \[F.], seq 206, ack 177, win 512, options \[nop,nop,TS val 2900709610 ecr 2900709610], length 0 + +19:46:12.631522 IP 127.0.0.1.39140 > 127.0.0.1.8080: Flags \[.], ack 207, win 512, options \[nop,nop,TS val 2900709610 ecr 2900709610], length 0 + +``` + + + +Annotation: + + + +The client sends `FIN`, the server responds with `FIN`, and the client sends the final `ACK`. This is the normal TCP connection teardown after the HTTP exchange completed. + + + +\--- + + + +\## Five Debugging Commands + + + +\### 1. Listening socket + + + +Command: + + + +```bash + +ss -tlnp | grep :8080 + +``` + + + +Output: + + + +```text + +$ ss -tlnp | grep :8080 + +LISTEN 0 4096 \*:8080 \*:\* users:(("quicknotes",pid=4337,fd=3)) + +``` + + + +Decision: + + + +This confirms that QuickNotes is listening on TCP port `8080`. If this command returned no output, then nothing would be bound to the expected port. + + + +\--- + + + +\### 2. Host routes + + + +Command: + + + +```bash + +ip route show + +``` + + + +Output: + + + +```text + +$ ip route show + +default via 172.19.128.1 dev eth0 proto kernel + +172.19.128.0/20 dev eth0 proto kernel scope link src 172.19.130.184 + +``` + + + +Decision: + + + +This shows the host routing table inside WSL. The default route goes through `eth0`, while the QuickNotes request to `localhost` stays on loopback and does not need the external route. + + + +\--- + + + +\### 3. Reachability to localhost + + + +Command: + + + +```bash + +mtr -rwc 5 localhost + +``` + + + +Output: + + + +```text + +$ mtr -rwc 5 localhost + +Start: 2026-06-16T19:47:44+0300 + +HOST: DESKTOP-I0DHHPT Loss% Snt Last Avg Best Wrst StDev + + 1.|-- localhost 0.0% 5 0.0 0.0 0.0 0.0 0.0 + +``` + + + +Decision: + + + +This confirms that `localhost` is reachable with no packet loss. Since this is loopback traffic, the path is one hop and does not depend on the external network. + + + +\--- + + + +\### 4. DNS check + + + +Command: + + + +```bash + +dig +short example.com @1.1.1.1 + +``` + + + +Output: + + + +```text + +$ dig +short example.com @1.1.1.1 + +104.20.23.154 + +172.66.147.243 + +``` + + + +Decision: + + + +This verifies that DNS resolution works through the resolver `1.1.1.1`. It is not directly required for `localhost`, but it confirms that DNS tools and outbound name resolution are working. + + + +\--- + + + +\### 5. User service logs + + + +Command: + + + +```bash + +journalctl --user -u quicknotes -n 20 || true + +``` + + + +Output: + + + +```text + +$ journalctl --user -u quicknotes -n 20 || true + +\-- No entries -- + +``` + + + +Decision: + + + +This checks whether QuickNotes has user-level systemd logs. In my run, QuickNotes was started manually with `go run .`, so a missing `quicknotes` user service log is expected and not itself a failure. + + + +\--- + + + +\## If QuickNotes Returned 502 + + + +If QuickNotes returned `502 Bad Gateway`, I would first check the component in front of QuickNotes, such as a reverse proxy, because `502` usually means the proxy could not successfully talk to the upstream service. I would verify whether QuickNotes is running with `ps`, whether it is listening on the expected port with `ss -tlnp`, and whether it is reachable directly with `curl http://localhost:8080/health`. If the direct health check works, I would inspect the proxy configuration and proxy logs. If the direct health check fails, I would debug the QuickNotes process, port binding, firewall rules, and application logs. + + + +\--- + + + +\# Task 2: Outside-In Debugging on a Broken Deploy + + + +\## Broken Instance Reproduction + + + +I reproduced the broken deployment by starting one QuickNotes process on `:8080`, then trying to start a second QuickNotes process on the same address. + + + +Commands: + + + +```bash + +cd app + +ADDR=:8080 go run . \& + +PID1=$! + +sleep 1 + + + +ADDR=:8080 go run . 2>\&1 | tee ../submissions/lab4-assets/qn-broken.log \& + +PID2=$! + +sleep 2 + + + +ps -ef | grep "go run" | grep -v grep + +``` + + + +Captured error: + + + +```text + +2026/06/16 19:48:27 quicknotes listening on :8080 (notes loaded: 6) + +2026/06/16 19:48:28 quicknotes listening on :8080 (notes loaded: 6) + +2026/06/16 19:48:28 listen: listen tcp :8080: bind: address already in use + +exit status 1 + +``` + + + +Root cause: + + + +```text + +listen tcp :8080: bind: address already in use + +``` + + + +The second QuickNotes instance failed because the first instance was already bound to TCP port `8080`. + + + +\--- + + + +\## Outside-In Debugging Chain + + + +\### 1. Is a process running? + + + +Command: + + + +```bash + +ps -ef | grep quicknotes + +``` + + + +Output: + + + +```text + +$ ps -ef | grep quicknotes + +root 4535 4460 0 19:48 pts/0 00:00:00 /root/.cache/go-build/01/01b36d0cffeef160fa8af2f501e7375bd20c7b28a5467c110d6e43fef651f8f2-d/quicknotes + +``` + + + +Decision: + + + +This confirms that a QuickNotes process exists. Since the process is running, the next step is to check whether it is bound to the expected port. + + + +\--- + + + +\### 2. Is anything listening on port 8080? + + + +Command: + + + +```bash + +ss -tlnp | grep 8080 + +``` + + + +Output: + + + +```text + +$ ss -tlnp | grep 8080 + +LISTEN 0 4096 \*:8080 \*:\* users:(("quicknotes",pid=4535,fd=3)) + +``` + + + +Decision: + + + +This confirms that a process named `quicknotes` is listening on port `8080`. This explains why the second instance could not bind to the same port. + + + +\--- + + + +\### 3. Is the service reachable from the host? + + + +Command: + + + +```bash + +curl -s -o /dev/null -w "%{http\_code}\\n" http://localhost:8080/health + +``` + + + +Output: + + + +```text + +$ curl -s -o /dev/null -w "%{http\_code}\\n" http://localhost:8080/health + +200 + +``` + + + +Decision: + + + +This confirms that something is serving HTTP traffic on `localhost:8080`. The existing instance is healthy, but the new instance failed to start because the port was already occupied. + + + +\--- + + + +\### 4. Is a firewall blocking traffic? + + + +Command: + + + +```bash + +sudo iptables -L -n -v 2>/dev/null || sudo nft list ruleset 2>/dev/null || true + +``` + + + +Output: + + + +```text + +$ sudo iptables -L -n -v 2>/dev/null || sudo nft list ruleset 2>/dev/null || true + +``` + + + +Decision: + + + +This produced no blocking rule output. Since the service is reachable and returns HTTP `200`, the firewall is not the cause of the failure. + + + +\--- + + + +\### 5. Does DNS resolve localhost? + + + +Command: + + + +```bash + +dig +short localhost + +``` + + + +Output: + + + +```text + +$ dig +short localhost + +127.0.0.1 + +``` + + + +Decision: + + + +This confirms that `localhost` resolves to `127.0.0.1`. DNS or host resolution is not the cause of the issue. + + + +\--- + + + +\## Repair and Re-Verification + + + +I killed the conflicting QuickNotes process and restarted QuickNotes on port `8080`. + + + +Commands: + + + +```bash + +pkill -f "go run ." || true + +pkill -f quicknotes || true + +sleep 1 + + + +cd app + +ADDR=:8080 go run . \& + +PID\_FIXED=$! + +sleep 1 + + + +curl -s http://localhost:8080/health + +``` + + + +Output: + + + +```text + +{"notes":6,"status":"ok"} + +``` + + + +After removing the conflicting process, QuickNotes was able to bind to port `8080` and respond to the health check. + + + +\--- + + + +\## Mini-Postmortem + + + +The failure was caused by a port conflict: one QuickNotes instance was already listening on `:8080`, so a second instance could not bind to the same address. This is a systemic deployment problem, not an individual mistake, because deployment scripts and service managers should prevent duplicate instances from silently competing for the same port. Better tooling would include systemd unit management, pre-flight port checks, health checks, and clearer startup failure logging. A deployment pipeline should also verify that the new process actually became healthy before treating the deployment as successful. This would turn the failure from a manual debugging exercise into an automatically detected startup error. + + + +\--- + + + +\## Files Included + + + +```text + +submissions/lab4.md + +submissions/lab4-assets/lab4-trace.pcap + +submissions/lab4-assets/lab4-trace.txt + +submissions/lab4-assets/curl-post.txt + +submissions/lab4-assets/ss-8080.txt + +submissions/lab4-assets/ip-route.txt + +submissions/lab4-assets/mtr-localhost.txt + +submissions/lab4-assets/dig-example.txt + +submissions/lab4-assets/journalctl-quicknotes.txt + +submissions/lab4-assets/qn-broken.log + +submissions/lab4-assets/go-run-processes.txt + +submissions/lab4-assets/outsidein-1-process.txt + +submissions/lab4-assets/outsidein-2-listening.txt + +submissions/lab4-assets/outsidein-3-health.txt + +submissions/lab4-assets/outsidein-4-firewall.txt + +submissions/lab4-assets/outsidein-5-dns.txt + +submissions/lab4-assets/repair-health.txt + +``` + + +