racknerd/docs/TESTPLAN.md

Test plan

Run the stages in order — each depends on the previous one.

0. Host plumbing (on the VPS)

sysctl net.ipv4.ip_forward          # = 1
wg show wg0                         # both peers: recent "latest handshake"
ping -c3 172.31.255.2               # Trochalakis WG box
ping -c3 172.31.255.3               # Oswald WG box
ping -c3 <TROCH_DC1_IP>             # AHDC01 across the tunnel
ping -c3 <OSWALD_DC_IP>             # AH-OSWLDC across the tunnel

1. Unbound (on the VPS)

docker compose ps unbound           # healthy
# AD SRV record via conditional forward (the money query):
dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
dig @127.0.0.1 ahdc01.ad.atlashorizon.net +short
dig @127.0.0.1 ah-oswldc.ad.oswaldtheotter.net +short
dig @127.0.0.1 -x <TROCH_DC1_IP> +short          # reverse zone
dig @127.0.0.1 google.com +short                  # public recursion

2. Duo Auth Proxy (on the VPS)

docker compose logs duo-authproxy   # connectivity tool output: LDAPS bind
                                    # to both DCs OK, Duo API reachable
# End-to-end RADIUS (expect a push to your phone, then Access-Accept):
apt-get install -y freeradius-utils
radtest '<aduser>' '<adpassword>' 127.0.0.1:1812 10 "$RADIUS_SECRET"
# Negative: wrong password -> immediate Access-Reject, no push.

This stage proves the LDAP bind leg independently of OpenVPN.

3. Full client connect (from outside, e.g. phone hotspot)

1. Import a built .ovpn, connect with AD username + password → approve the Duo push → connected.
2. ipconfig /all: address in 172.31.8.0/24, DNS 172.31.8.1, suffix ad.atlashorizon.net.
3. DNS through the tunnel: nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.atlashorizon.net
4. Reachability, one host per site: ping ahdc01.ad.atlashorizon.net and ping ah-oswldc.ad.oswaldtheotter.net
5. AD actually works: dir \\ad.atlashorizon.net\SYSVOL then klist (Kerberos tickets present, no NTLM fallback).
6. Passcode-append fallback: reconnect using password,<passcode> from the Duo app — must succeed with no push.

4. Routing correctness

• On AHDC01, Security log 4624/4768 for the test user shows the real client IP (172.31.8.x), not a NAT address — confirms routed (no masquerade) design.
• From the client: tracert <TROCH_DC1_IP> → first hop 172.31.8.1.
• From a DC at each site: tracert 172.31.8.x → leaves via the local WG box (no path through the other site = no asymmetric routing).
• From a Trochalakis host: tracert <oswald LAN IP> still uses the direct site-to-site tunnel (RackNerd never appears).

5. Exposure check (from any outside box)

nmap -sU -p 53,1194,51820 <racknerd_public_ip>   # 53 must NOT respond
nmap -sT -p 22,53,636,1812,7505 <racknerd_public_ip>  # only 22 open

6. Persistence

docker compose down && docker compose up -d --build   # survives cleanly
reboot   # then: wg show, docker compose ps, re-run stage 3 quick connect