feat: deploy StreamScope source bundle with MTR and rollback

app.py

@@ -1036,12 +1036,29 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)):
     return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns}
 
 
+SPEEDTEST_REPO_FILES = (
+    ".dockerignore",
+    "Dockerfile",
+    "compose.yaml",
+    "pyproject.toml",
+    "streamscope/__init__.py",
+    "streamscope/app.py",
+    "streamscope/db.py",
+    "streamscope/mtr.py",
+    "streamscope/scoring.py",
+    "streamscope/static/index.html",
+    "streamscope/static/assets/app.css",
+    "streamscope/static/assets/app.js",
+)
+
+
 class SpeedtestDeployRequest(BaseModel):
     stats_password: str
+    session_secret: str
 
 
 async def _fetch_forgejo_text(repo: str, path: str) -> str:
-    if repo != "sascha/speedtest" or path != "compose.yaml":
+    if repo != "sascha/speedtest" or path not in SPEEDTEST_REPO_FILES:
         raise ValueError("unsupported Forgejo file")
     cfg = SERVICES.get("forgejo", {})
     base_url = cfg.get("url")
@@ -1055,57 +1072,93 @@ async def _fetch_forgejo_text(repo: str, path: str) -> str:
     return base64.b64decode(response.json()["content"]).decode()
 
 
-def _deploy_speedtest_compose(compose: str, password: str) -> dict:
+def _deploy_speedtest_compose(files: dict[str, str], password: str, session_secret: str) -> dict:
+    if set(files) != set(SPEEDTEST_REPO_FILES):
+        raise ValueError("speedtest source bundle is incomplete")
+    compose = files["compose.yaml"]
+    dockerfile = files["Dockerfile"]
     required = [
-        "ghcr.io/librespeed/speedtest:latest",
+        "build: .",
         '127.0.0.1:8080:8080',
-        'TELEMETRY: "true"',
+        '/app-config/speedtest/data:/data',
-        '/app-config/speedtest/database:/database',
+        'ADMIN_PASSWORD: "${ADMIN_PASSWORD:',
-        'PASSWORD: "${STATS_PASSWORD:',
+        'SESSION_SECRET: "${SESSION_SECRET:',
+        "NET_RAW",
     ]
     if any(item not in compose for item in required):
-        raise ValueError("speedtest compose is missing a required security or persistence setting")
+        raise ValueError("StreamScope compose is missing a required security or persistence setting")
-    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password):
+    if "python:" not in dockerfile or "mtr-tiny" not in dockerfile or "php" in dockerfile.lower():
+        raise ValueError("StreamScope image must be Python-based, MTR-capable and PHP-free")
+    secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}"
+    if not re.fullmatch(secret_pattern, password):
         raise ValueError("stats password must be 24-128 safe characters")
+    if not re.fullmatch(secret_pattern, session_secret):
+        raise ValueError("session secret must be 24-128 safe characters")
     script = f"""from pathlib import Path
-import os
+import os, shutil
 stack = Path('/app-config/github/speedtest')
-database = Path('/app-config/speedtest/database')
+backup = Path('/app-config/deployment-backups/speedtest-rollback')
+data = Path('/app-config/speedtest/data')
+if backup.exists():
+    shutil.rmtree(backup)
+if stack.exists():
+    backup.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copytree(stack, backup)
 stack.mkdir(parents=True, exist_ok=True)
-database.mkdir(parents=True, exist_ok=True)
+data.mkdir(parents=True, exist_ok=True)
-compose = stack / 'compose.yaml'
+files = {files!r}
-if compose.exists():
+for relative, content in files.items():
-    (stack / 'compose.yaml.bak').write_bytes(compose.read_bytes())
+    target = stack / relative
-compose.write_text({compose!r})
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(content)
 env = stack / '.env'
-env.write_text('STATS_PASSWORD=' + {password!r} + '\\n')
+env.write_text('ADMIN_PASSWORD=' + {password!r} + '\\nSESSION_SECRET=' + {session_secret!r} + '\\nSTATS_PASSWORD=' + {password!r} + '\\n')
 os.chmod(env, 0o600)
 """
     rc, _out, err = _remote_python(script)
     if rc != 0:
-        raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}")
+        raise RuntimeError(f"StreamScope file deployment failed: {err[-300:]}")
-    preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull"
+    rollback = "rm -rf /app-config/github/speedtest && cp -a /app-config/deployment-backups/speedtest-rollback /app-config/github/speedtest && cd /app-config/github/speedtest && docker compose up -d"
-    rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300)
+    preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose build --pull"
+    rc, _out, err = _ssh(VPS_SSH, preflight, timeout=600)
     if rc != 0:
-        raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}")
+        _ssh(VPS_SSH, rollback, timeout=180)
-    deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d"
+        raise RuntimeError(f"StreamScope build preflight failed: {err[-500:]}")
-    rc, out, err = _ssh(VPS_SSH, deploy, timeout=120)
+    deploy = "cd /app-config/github/speedtest && docker compose up -d --remove-orphans"
+    rc, out, err = _ssh(VPS_SSH, deploy, timeout=180)
     if rc != 0:
-        raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}")
+        _ssh(VPS_SSH, rollback, timeout=180)
-    health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1"
+        raise RuntimeError(f"StreamScope deployment failed: {(err or out)[-500:]}")
-    rc, _out, err = _ssh(VPS_SSH, health, timeout=75)
+    health = "for i in $(seq 1 45); do curl -fsS --max-time 3 http://127.0.0.1:8080/api/health >/dev/null && exit 0; sleep 2; done; exit 1"
+    rc, _out, err = _ssh(VPS_SSH, health, timeout=105)
     if rc != 0:
-        raise RuntimeError(f"speedtest health check failed: {err[-300:]}")
+        _ssh(VPS_SSH, rollback, timeout=180)
-    return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False}
+        raise RuntimeError(f"StreamScope health check failed and rollback was attempted: {err[-300:]}")
+    return {
+        "status": "deployed",
+        "health": "ok",
+        "application": "streamscope",
+        "database": "/app-config/speedtest/data/streamscope.db",
+        "public_port": False,
+        "mtr": True,
+    }
 
 
 @app.post("/vps/speedtest/deploy")
 async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)):
-    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password):
+    secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}"
+    if not re.fullmatch(secret_pattern, req.stats_password):
         raise HTTPException(400, "stats password must be 24-128 safe characters")
-    compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml")
+    if not re.fullmatch(secret_pattern, req.session_secret):
-    result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password)
+        raise HTTPException(400, "session secret must be 24-128 safe characters")
-    _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry")
+    contents = await asyncio.gather(*(
+        _fetch_forgejo_text("sascha/speedtest", path) for path in SPEEDTEST_REPO_FILES
+    ))
+    files = dict(zip(SPEEDTEST_REPO_FILES, contents))
+    result = await asyncio.to_thread(
+        _deploy_speedtest_compose, files, req.stats_password, req.session_secret
+    )
+    _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed StreamScope with private history and MTR")
     return result