vpn-verify

name	vpn-verify
description	Post-deployment verification checklist for VPN. Use AUTOMATICALLY after any deployment action (deploy, rebuild, restart) and BEFORE claiming deployment is complete or successful. Evidence before assertions.

VPN Deployment Verification

Mandatory verification checklist after ANY deployment or change to VPN infrastructure. No completion claims without fresh evidence.

When to Use

AUTOMATICALLY (do not wait for user to ask):

• After running ssh_exec.py deploy quick-rebuild.sh
• After running any deploy-*.sh script
• After ssh_exec.py restart
• Before saying "done", "deployed", "VPN is ready", or any success claim

On request:

• User asks "is it working?", "did it deploy correctly?"
• User asks to verify/check the VPN

The Iron Law

NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE

If you haven't run ssh_exec.py status in THIS message, you cannot claim deployment succeeded.

"Should be working" is not verification. Run the command.

Verification Checklist

Execute ALL checks. Report results as pass/fail with evidence.

Check 1: Xray Process Running

Command: python ssh_exec.py status

Output	Result
Shows "xray" with "running" status	PASS
Shows "stopped", "failed", or no xray info	FAIL -> python ssh_exec.py restart, then re-check
SSH connection error	FAIL -> run vpn-troubleshoot

Check 2: VLESS URIs Generated

What to verify: Deployment script output contained at least one line starting with vless://

Condition	Result
1+ VLESS URIs captured from deploy output	PASS
No URIs in output	FAIL -> check deploy logs, may need to re-run

Check 3: Server IP Matches Config

What to verify: The IP address in the VLESS URI matches VPN_HOST in .env

How: Read .env, extract VPN_HOST, compare with the IP in captured VLESS URIs.

Condition	Result
IPs match	PASS
IPs differ	FAIL -> .env may be outdated or URI is from old deployment

Check 4: SSH Port Changed

Command: Check VPN_SSH_PORT in .env OR run python ssh_exec.py exec "grep -E '^Port ' /etc/ssh/sshd_config"

Condition	Result
SSH port is NOT 22 (typically 49152)	PASS
SSH port is still 22	WARN -> "TSPU can block port 22 to foreign IPs. Consider changing."

Check 5: Firewall Active

Command: python ssh_exec.py exec "ufw status | head -1"

Output	Result
"Status: active"	PASS
"Status: inactive" or command not found	FAIL -> python ssh_exec.py exec "ufw --force enable"

Check 6: Inbound Ports Listening

Command: python ssh_exec.py exec "ss -tnlp | grep xray"

Output	Result
Shows ports 443, 8443, 2053 (at least one)	PASS
No xray ports listening	FAIL -> restart xray, check config

Report Format

After all checks, present a summary:

Результаты проверки деплоя:
  1. Xray процесс:     [PASS/FAIL]
  2. VLESS URI:         [PASS/FAIL]
  3. IP совпадает:      [PASS/FAIL]
  4. SSH порт:          [PASS/WARN]
  5. Firewall:          [PASS/FAIL]
  6. Порты слушают:     [PASS/FAIL]

If ALL pass: provide user with VLESS URIs and client setup instructions. If ANY fail: diagnose the failure, do NOT claim success.

Red Flags — STOP Immediately

You are about to violate this rule if you catch yourself:

• Writing "deployed successfully" without running ssh_exec.py status first
• Saying "VPN is ready" based on script exit code alone
• Assuming firewall is active because the script enables it
• Presenting URIs without verifying xray is actually running
• Using words like "should work", "probably deployed", "looks good"

After Verification Passes

Tell user (in Russian):

1. Present the VLESS URIs clearly
2. Remind: "Import URI into your VPN client"
3. Remind: "Enable TUN mode" (critical)
4. Remind: "Test by opening 2ip.ru — should show VPS country for non-Russian sites"
5. Point to platform-specific setup guide (client-configs/v2rayn-setup.md for Windows)