# Test plan

Run the stages in order — each depends on the previous one.

## 0. Host plumbing (on the VPS)

```bash
sysctl net.ipv4.ip_forward          # = 1
wg show wg0                         # both peers: recent "latest handshake"
ping -c3 172.31.255.2               # Trochalakis WG box
ping -c3 172.31.255.3               # Oswald WG box
ping -c3 <TROCH_DC1_IP>             # AHDC01 across the tunnel
ping -c3 <OSWALD_DC_IP>             # AH-OSWLDC across the tunnel
```

## 1. Unbound (on the VPS)

```bash
docker compose ps unbound           # healthy
# AD SRV record via conditional forward (the money query):
dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
dig @127.0.0.1 ahdc01.ad.atlashorizon.net +short
dig @127.0.0.1 ah-oswldc.ad.oswaldtheotter.net +short
dig @127.0.0.1 -x <TROCH_DC1_IP> +short          # reverse zone
dig @127.0.0.1 google.com +short                  # public recursion
```

## 2. Duo Auth Proxy (on the VPS)

```bash
docker compose logs duo-authproxy   # connectivity tool output: LDAPS bind
                                    # to both DCs OK, Duo API reachable
# End-to-end RADIUS (expect a push to your phone, then Access-Accept):
apt-get install -y freeradius-utils
radtest '<aduser>' '<adpassword>' 127.0.0.1:1812 10 "$RADIUS_SECRET"
# Negative: wrong password -> immediate Access-Reject, no push.
```

This stage proves the **LDAP bind** leg independently of OpenVPN.

## 3. Full client connect (from outside, e.g. phone hotspot)

1. Import a built `.ovpn`, connect with AD username + password → approve
   the Duo push → connected.
2. `ipconfig /all`: address in `172.31.8.0/24`, DNS `172.31.8.1`, suffix
   `ad.atlashorizon.net`.
3. DNS through the tunnel:
   `nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.atlashorizon.net`
4. Reachability, one host per site:
   `ping ahdc01.ad.atlashorizon.net` and `ping ah-oswldc.ad.oswaldtheotter.net`
5. AD actually works: `dir \\ad.atlashorizon.net\SYSVOL` then `klist`
   (Kerberos tickets present, no NTLM fallback).
6. Passcode-append fallback: reconnect using `password,<passcode>` from the
   Duo app — must succeed with no push.

## 4. Routing correctness

- On AHDC01, Security log 4624/4768 for the test user shows the **real**
  client IP (`172.31.8.x`), not a NAT address — confirms routed (no
  masquerade) design.
- From the client: `tracert <TROCH_DC1_IP>` → first hop `172.31.8.1`.
- From a DC at each site: `tracert 172.31.8.x` → leaves via the **local**
  WG box (no path through the other site = no asymmetric routing).
- From a Trochalakis host: `tracert <oswald LAN IP>` still uses the direct
  site-to-site tunnel (RackNerd never appears).

## 5. Exposure check (from any outside box)

```bash
nmap -sU -p 53,1194,51820 <racknerd_public_ip>   # 53 must NOT respond
nmap -sT -p 22,53,636,1812,7505 <racknerd_public_ip>  # only 22 open
```

## 6. Persistence

```bash
docker compose down && docker compose up -d --build   # survives cleanly
reboot   # then: wg show, docker compose ps, re-run stage 3 quick connect
```