Merge pull request 'feat: read-only sysctl audit ergänzen' (#12) from feat/read-only-sysctl-audit into main

app.py

@@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from contextlib import asynccontextmanager
 
 log = logging.getLogger("butler")
-VERSION = "2.3.2"
+VERSION = "2.3.3"
 
 API_DIR = os.environ.get("API_KEY_DIR", "/data/api")
 VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache")
@@ -278,6 +278,7 @@ async def root():
             "status": "GET /status - health of all backends",
             "overview": "GET /overview?details=false - deterministic homelab verdict for small models",
             "audit": "GET /audit - recent API calls",
+            "sysctl_audit": "GET /system/sysctl/{host} - read-only live and persistent network tuning",
         },
         "vault_items": len(_vault_cache),
     }
@@ -1049,6 +1050,7 @@ SPEEDTEST_REPO_FILES = (
     "streamscope/static/index.html",
     "streamscope/static/assets/app.css",
     "streamscope/static/assets/app.js",
+    "streamscope/static/assets/longterm-metrics.js",
 )
 
 
@@ -1185,6 +1187,76 @@ def _ssh(host, cmd, timeout=600):
     except _sp.TimeoutExpired:
         return 124, "", f"SSH command timed out after {timeout} seconds"
 
+
+SYSCTL_AUDIT_KEYS = (
+    "net.core.default_qdisc",
+    "net.core.rmem_default",
+    "net.core.rmem_max",
+    "net.core.wmem_default",
+    "net.core.wmem_max",
+    "net.core.netdev_max_backlog",
+    "net.core.somaxconn",
+    "net.ipv4.ip_forward",
+    "net.ipv4.tcp_congestion_control",
+    "net.ipv4.tcp_fastopen",
+    "net.ipv4.tcp_mtu_probing",
+    "net.ipv4.tcp_no_metrics_save",
+    "net.ipv4.tcp_rmem",
+    "net.ipv4.tcp_slow_start_after_idle",
+    "net.ipv4.tcp_window_scaling",
+    "net.ipv4.tcp_wmem",
+)
+
+
+def _sysctl_audit_command() -> str:
+    script = f'''import glob, json, subprocess
+keys = {SYSCTL_AUDIT_KEYS!r}
+live, errors = {{}}, {{}}
+for key in keys:
+    result = subprocess.run(["sysctl", "-n", key], capture_output=True, text=True)
+    if result.returncode == 0:
+        live[key] = result.stdout.strip()
+    else:
+        errors[key] = result.stderr.strip()[:160]
+persistent = {{}}
+for path in ["/etc/sysctl.conf", *sorted(glob.glob("/etc/sysctl.d/*.conf"))]:
+    try:
+        with open(path, encoding="utf-8", errors="replace") as handle:
+            for raw in handle:
+                line = raw.split("#", 1)[0].strip()
+                if "=" not in line:
+                    continue
+                key, value = (part.strip() for part in line.split("=", 1))
+                if key in keys:
+                    persistent.setdefault(key, []).append({{"file": path, "value": value}})
+    except (FileNotFoundError, PermissionError):
+        pass
+print(json.dumps({{"live": live, "persistent": persistent, "errors": errors}}))
+'''
+    encoded = base64.b64encode(script.encode()).decode()
+    return f'python3 -c "import base64;exec(base64.b64decode(\'{encoded}\'))"'
+
+
+@app.get("/system/sysctl/{host}")
+async def system_sysctl_audit(host: str, _=Depends(_verify)):
+    if not re.fullmatch(r"[a-z0-9][a-z0-9-]{0,62}", host):
+        raise HTTPException(400, "Invalid host name")
+    if host == "vps":
+        target = VPS_SSH
+    else:
+        inventory = await asyncio.to_thread(_find_inventory_host, host)
+        if not inventory:
+            raise HTTPException(404, f"Host {host} not found")
+        target = f'{inventory["user"]}@{inventory["ip"]}'
+    rc, out, err = await asyncio.to_thread(_ssh, target, _sysctl_audit_command(), 30)
+    if rc != 0:
+        raise HTTPException(502, (err or out).strip()[:300] or "sysctl audit failed")
+    try:
+        result = json.loads(out)
+    except json.JSONDecodeError as exc:
+        raise HTTPException(502, "sysctl audit returned invalid JSON") from exc
+    return {"host": host, **result}
+
 def _pve_auth():
     pv = _parse_kv("proxmox")
     return f"PVEAPIToken={pv.get('tokenid','')}={pv.get('secret','')}"

tests/test_app.py

@@ -42,7 +42,32 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.2"
+    assert response.json()["version"] == app.VERSION == "2.3.3"
+
+
+def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
+    payload = {
+        "live": {"net.ipv4.tcp_congestion_control": "bbr"},
+        "persistent": {"net.ipv4.tcp_congestion_control": [{"file": "/etc/sysctl.d/99-net-tuning.conf", "value": "bbr"}]},
+        "errors": {},
+    }
+    calls = []
+    monkeypatch.setattr(app, "_find_inventory_host", lambda name: {"name": name, "user": "root", "ip": "10.5.85.16"})
+    monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, __import__("json").dumps(payload), "")))
+    with TestClient(app.app) as client:
+        response = client.get("/system/sysctl/node6", headers={"Authorization": "Bearer test-token"})
+    assert response.status_code == 200
+    assert response.json()["live"]["net.ipv4.tcp_congestion_control"] == "bbr"
+    assert calls[0][0] == "root@10.5.85.16"
+    assert "base64.b64decode" in calls[0][1]
+
+
+def test_sysctl_audit_rejects_unknown_host_without_ssh(monkeypatch):
+    monkeypatch.setattr(app, "_find_inventory_host", lambda _name: None)
+    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
+    with TestClient(app.app) as client:
+        response = client.get("/system/sysctl/not-there", headers={"Authorization": "Bearer test-token"})
+    assert response.status_code == 404
 
 
 def test_invalid_log_target_is_rejected_before_ssh():

tests/test_streamscope_deploy.py

@@ -2,6 +2,7 @@ import app
 
 
 def test_streamscope_deploy_replaces_legacy_container_before_compose(monkeypatch):
+    assert "streamscope/static/assets/longterm-metrics.js" in app.SPEEDTEST_REPO_FILES
     files = {path: "placeholder" for path in app.SPEEDTEST_REPO_FILES}
     files["compose.yaml"] = """services:
   streamscope: