claude generated first pass

docs/TESTPLAN.md

@@ -0,0 +1,79 @@
+# Test plan
+
+Run the stages in order — each depends on the previous one.
+
+## 0. Host plumbing (on the VPS)
+
+```bash
+sysctl net.ipv4.ip_forward          # = 1
+wg show wg0                         # both peers: recent "latest handshake"
+ping -c3 172.31.255.2               # Trochalakis WG box
+ping -c3 172.31.255.3               # Oswald WG box
+ping -c3 <TROCH_DC1_IP>             # AHDC01 across the tunnel
+ping -c3 <OSWALD_DC_IP>             # AH-OSWLDC across the tunnel
+```
+
+## 1. Unbound (on the VPS)
+
+```bash
+docker compose ps unbound           # healthy
+# AD SRV record via conditional forward (the money query):
+dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
+dig @127.0.0.1 ahdc01.ad.atlashorizon.net +short
+dig @127.0.0.1 ah-oswldc.ad.oswaldtheotter.net +short
+dig @127.0.0.1 -x <TROCH_DC1_IP> +short          # reverse zone
+dig @127.0.0.1 google.com +short                  # public recursion
+```
+
+## 2. Duo Auth Proxy (on the VPS)
+
+```bash
+docker compose logs duo-authproxy   # connectivity tool output: LDAPS bind
+                                    # to both DCs OK, Duo API reachable
+# End-to-end RADIUS (expect a push to your phone, then Access-Accept):
+apt-get install -y freeradius-utils
+radtest '<aduser>' '<adpassword>' 127.0.0.1:1812 10 "$RADIUS_SECRET"
+# Negative: wrong password -> immediate Access-Reject, no push.
+```
+
+This stage proves the **LDAP bind** leg independently of OpenVPN.
+
+## 3. Full client connect (from outside, e.g. phone hotspot)
+
+1. Import a built `.ovpn`, connect with AD username + password → approve
+   the Duo push → connected.
+2. `ipconfig /all`: address in `172.31.8.0/24`, DNS `172.31.8.1`, suffix
+   `ad.atlashorizon.net`.
+3. DNS through the tunnel:
+   `nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.atlashorizon.net`
+4. Reachability, one host per site:
+   `ping ahdc01.ad.atlashorizon.net` and `ping ah-oswldc.ad.oswaldtheotter.net`
+5. AD actually works: `dir \\ad.atlashorizon.net\SYSVOL` then `klist`
+   (Kerberos tickets present, no NTLM fallback).
+6. Passcode-append fallback: reconnect using `password,<passcode>` from the
+   Duo app — must succeed with no push.
+
+## 4. Routing correctness
+
+- On AHDC01, Security log 4624/4768 for the test user shows the **real**
+  client IP (`172.31.8.x`), not a NAT address — confirms routed (no
+  masquerade) design.
+- From the client: `tracert <TROCH_DC1_IP>` → first hop `172.31.8.1`.
+- From a DC at each site: `tracert 172.31.8.x` → leaves via the **local**
+  WG box (no path through the other site = no asymmetric routing).
+- From a Trochalakis host: `tracert <oswald LAN IP>` still uses the direct
+  site-to-site tunnel (RackNerd never appears).
+
+## 5. Exposure check (from any outside box)
+
+```bash
+nmap -sU -p 53,1194,51820 <racknerd_public_ip>   # 53 must NOT respond
+nmap -sT -p 22,53,636,1812,7505 <racknerd_public_ip>  # only 22 open
+```
+
+## 6. Persistence
+
+```bash
+docker compose down && docker compose up -d --build   # survives cleanly
+reboot   # then: wg show, docker compose ps, re-run stage 3 quick connect
+```