sascha/homelab-butler
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request 'StreamScope vollständig über Butler deployen' (#10) from feature/streamscope-deploy into main

Browse source
This commit is contained in:
sascha 2026-08-08 18:23:27 +02:00
commit fafffe56c4
2 changed files with 102 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

115
app.py
View file

@ -1036,12 +1036,29 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)):
return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns}
SPEEDTEST_REPO_FILES = (
".dockerignore",
"Dockerfile",
"compose.yaml",
"pyproject.toml",
"streamscope/__init__.py",
"streamscope/app.py",
"streamscope/db.py",
"streamscope/mtr.py",
"streamscope/scoring.py",
"streamscope/static/index.html",
"streamscope/static/assets/app.css",
"streamscope/static/assets/app.js",
)
class SpeedtestDeployRequest(BaseModel):
stats_password: str
session_secret: str
async def _fetch_forgejo_text(repo: str, path: str) -> str:
if repo != "sascha/speedtest" or path != "compose.yaml":
if repo != "sascha/speedtest" or path not in SPEEDTEST_REPO_FILES:
raise ValueError("unsupported Forgejo file")
cfg = SERVICES.get("forgejo", {})
base_url = cfg.get("url")
@ -1055,57 +1072,93 @@ async def _fetch_forgejo_text(repo: str, path: str) -> str:
return base64.b64decode(response.json()["content"]).decode()
def _deploy_speedtest_compose(compose: str, password: str) -> dict:
def _deploy_speedtest_compose(files: dict[str, str], password: str, session_secret: str) -> dict:
if set(files) != set(SPEEDTEST_REPO_FILES):
raise ValueError("speedtest source bundle is incomplete")
compose = files["compose.yaml"]
dockerfile = files["Dockerfile"]
required = [
"ghcr.io/librespeed/speedtest:latest",
"build: .",
'127.0.0.1:8080:8080',
'TELEMETRY: "true"',
'/app-config/speedtest/database:/database',
'PASSWORD: "${STATS_PASSWORD:',
'/app-config/speedtest/data:/data',
'ADMIN_PASSWORD: "${ADMIN_PASSWORD:',
'SESSION_SECRET: "${SESSION_SECRET:',
"NET_RAW",
]
if any(item not in compose for item in required):
raise ValueError("speedtest compose is missing a required security or persistence setting")
if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password):
raise ValueError("StreamScope compose is missing a required security or persistence setting")
if "python:" not in dockerfile or "mtr-tiny" not in dockerfile or "php" in dockerfile.lower():
raise ValueError("StreamScope image must be Python-based, MTR-capable and PHP-free")
secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}"
if not re.fullmatch(secret_pattern, password):
raise ValueError("stats password must be 24-128 safe characters")
if not re.fullmatch(secret_pattern, session_secret):
raise ValueError("session secret must be 24-128 safe characters")
script = f"""from pathlib import Path
import os
import os, shutil
stack = Path('/app-config/github/speedtest')
database = Path('/app-config/speedtest/database')
backup = Path('/app-config/deployment-backups/speedtest-rollback')
data = Path('/app-config/speedtest/data')
if backup.exists():
shutil.rmtree(backup)
if stack.exists():
backup.parent.mkdir(parents=True, exist_ok=True)
shutil.copytree(stack, backup)
stack.mkdir(parents=True, exist_ok=True)
database.mkdir(parents=True, exist_ok=True)
compose = stack / 'compose.yaml'
if compose.exists():
(stack / 'compose.yaml.bak').write_bytes(compose.read_bytes())
compose.write_text({compose!r})
data.mkdir(parents=True, exist_ok=True)
files = {files!r}
for relative, content in files.items():
target = stack / relative
target.parent.mkdir(parents=True, exist_ok=True)
target.write_text(content)
env = stack / '.env'
env.write_text('STATS_PASSWORD=' + {password!r} + '\\n')
env.write_text('ADMIN_PASSWORD=' + {password!r} + '\\nSESSION_SECRET=' + {session_secret!r} + '\\nSTATS_PASSWORD=' + {password!r} + '\\n')
os.chmod(env, 0o600)
"""
rc, _out, err = _remote_python(script)
if rc != 0:
raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}")
preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull"
rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300)
raise RuntimeError(f"StreamScope file deployment failed: {err[-300:]}")
rollback = "rm -rf /app-config/github/speedtest && cp -a /app-config/deployment-backups/speedtest-rollback /app-config/github/speedtest && cd /app-config/github/speedtest && docker compose up -d"
preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose build --pull"
rc, _out, err = _ssh(VPS_SSH, preflight, timeout=600)
if rc != 0:
raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}")
deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d"
rc, out, err = _ssh(VPS_SSH, deploy, timeout=120)
_ssh(VPS_SSH, rollback, timeout=180)
raise RuntimeError(f"StreamScope build preflight failed: {err[-500:]}")
deploy = "cd /app-config/github/speedtest && docker compose up -d --remove-orphans"
rc, out, err = _ssh(VPS_SSH, deploy, timeout=180)
if rc != 0:
raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}")
health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1"
rc, _out, err = _ssh(VPS_SSH, health, timeout=75)
_ssh(VPS_SSH, rollback, timeout=180)
raise RuntimeError(f"StreamScope deployment failed: {(err or out)[-500:]}")
health = "for i in $(seq 1 45); do curl -fsS --max-time 3 http://127.0.0.1:8080/api/health >/dev/null && exit 0; sleep 2; done; exit 1"
rc, _out, err = _ssh(VPS_SSH, health, timeout=105)
if rc != 0:
raise RuntimeError(f"speedtest health check failed: {err[-300:]}")
return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False}
_ssh(VPS_SSH, rollback, timeout=180)
raise RuntimeError(f"StreamScope health check failed and rollback was attempted: {err[-300:]}")
return {
"status": "deployed",
"health": "ok",
"application": "streamscope",
"database": "/app-config/speedtest/data/streamscope.db",
"public_port": False,
"mtr": True,
}
@app.post("/vps/speedtest/deploy")
async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)):
if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password):
secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}"
if not re.fullmatch(secret_pattern, req.stats_password):
raise HTTPException(400, "stats password must be 24-128 safe characters")
compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml")
result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password)
_audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry")
if not re.fullmatch(secret_pattern, req.session_secret):
raise HTTPException(400, "session secret must be 24-128 safe characters")
contents = await asyncio.gather(*(
_fetch_forgejo_text("sascha/speedtest", path) for path in SPEEDTEST_REPO_FILES
))
files = dict(zip(SPEEDTEST_REPO_FILES, contents))
result = await asyncio.to_thread(
_deploy_speedtest_compose, files, req.stats_password, req.session_secret
)
_audit("/vps/speedtest/deploy", "POST", 200, "Git-managed StreamScope with private history and MTR")
return result

30
tests/test_app.py
View file

@ -324,16 +324,16 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
assert calls[1] == "reload"
def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypatch):
def test_speedtest_deploy_requires_strong_secrets_and_uses_full_git_app(monkeypatch):
calls = []
async def fake_fetch(repo, path):
calls.append(("fetch", repo, path))
return "services:\n speedtest:\n image: ghcr.io/librespeed/speedtest:latest\n"
return f"content:{path}"
def fake_deploy(compose, password):
calls.append(("deploy", compose, password))
return {"status": "deployed", "health": "ok"}
def fake_deploy(files, password, session_secret):
calls.append(("deploy", files, password, session_secret))
return {"status": "deployed", "health": "ok", "application": "streamscope"}
monkeypatch.setattr(app, "_fetch_forgejo_text", fake_fetch)
monkeypatch.setattr(app, "_deploy_speedtest_compose", fake_deploy)
@ -341,18 +341,24 @@ def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypa
weak = client.post(
"/vps/speedtest/deploy",
headers={"Authorization": "Bearer test-token"},
json={"stats_password": "short"},
json={"stats_password": "short", "session_secret": "long-session-secret-with-entropy"},
)
response = client.post(
"/vps/speedtest/deploy",
headers={"Authorization": "Bearer test-token"},
json={"stats_password": "correct-horse-battery-staple"},
json={
"stats_password": "correct-horse-battery-staple",
"session_secret": "streamscope-session-secret-with-entropy",
},
)
assert weak.status_code == 400
assert response.status_code == 200
assert response.json()["status"] == "deployed"
assert calls == [
("fetch", "sascha/speedtest", "compose.yaml"),
("deploy", "services:\n speedtest:\n image: ghcr.io/librespeed/speedtest:latest\n", "correct-horse-battery-staple"),
]
assert response.json()["application"] == "streamscope"
assert ("fetch", "sascha/speedtest", "compose.yaml") in calls
assert ("fetch", "sascha/speedtest", "streamscope/static/assets/app.js") in calls
deploy = calls[-1]
assert deploy[0] == "deploy"
assert deploy[1]["compose.yaml"] == "content:compose.yaml"
assert deploy[2] == "correct-horse-battery-staple"
assert deploy[3] == "streamscope-session-secret-with-entropy"