From 07d3e019e28e9a0b509a202c5dc19ef8335919eb Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 5 Sep 2026 13:13:18 +0200 Subject: [PATCH 1/2] feat: optimize Sascha Emby edge (app.py) --- app.py | 101 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 100 insertions(+), 1 deletion(-) diff --git a/app.py b/app.py index b93e8d6..d5a06ef 100644 --- a/app.py +++ b/app.py @@ -12,7 +12,7 @@ from contextlib import asynccontextmanager from contextvars import ContextVar log = logging.getLogger("butler") -VERSION = "2.4.0" +VERSION = "2.4.1" API_DIR = os.environ.get("API_KEY_DIR", "/data/api") VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache") @@ -2264,6 +2264,11 @@ class SaschaMediaTunnelRequest(BaseModel): confirmation: str | None = None +class SaschaMediaEdgeOptimizeRequest(BaseModel): + dry_run: bool = True + confirmation: str | None = None + + def _sascha_media_edge_audit_command() -> str: script = '''import json, re, subprocess +from pathlib import Path @@ -2355,6 +2360,100 @@ async def sascha_media_edge_audit(_=Depends(_verify)): return result +def _sascha_media_edge_optimize_command() -> str: + script = '''import hashlib, json, os, re, shutil, subprocess, time ++from pathlib import Path ++path = Path("/app-config/caddy/Caddyfile") ++text = path.read_text(encoding="utf-8") ++old_pattern = re.compile(r"(?m)^(\\s*import\\s+emby_config\\s+tv\\.sascha-lutz\\.de\\s+)10\\.6\\.1\\.103:8096(\\s*)$") ++new_pattern = re.compile(r"(?m)^\\s*import\\s+emby_config\\s+tv\\.sascha-lutz\\.de\\s+10\\.11\\.13\\.3:8096\\s*$") ++old_count = len(old_pattern.findall(text)); new_count = len(new_pattern.findall(text)) ++if old_count == 1: ++ text = old_pattern.sub(r"\\g<1>10.11.13.3:8096\\g<2>", text) ++elif not (old_count == 0 and new_count == 1): ++ raise RuntimeError("expected exactly one tv.sascha-lutz.de upstream") ++lines = text.splitlines(keepends=True) ++first = next((i for i, line in enumerate(lines) if line.strip() and not line.lstrip().startswith("#")), None) ++if first is None or lines[first].strip() != "{": ++ lines[0:0] = ["{\\n", " servers {\\n", " protocols h1 h2\\n", " }\\n", "}\\n", "\\n"] ++else: ++ depth = 0; global_end = None; servers_start = None; servers_end = None ++ for i in range(first, len(lines)): ++ stripped = lines[i].strip(); before = depth ++ if before == 1 and re.match(r"^servers(?:\\s+\\S+)?\\s*\\{$", stripped): servers_start = i ++ depth += lines[i].count("{") - lines[i].count("}") ++ if servers_start is not None and i > servers_start and depth == 1 and servers_end is None: servers_end = i ++ if i > first and depth == 0: global_end = i; break ++ if global_end is None: raise RuntimeError("unbalanced Caddy global options block") ++ if servers_start is None: ++ lines[global_end:global_end] = [" servers {\\n", " protocols h1 h2\\n", " }\\n"] ++ else: ++ if servers_end is None: raise RuntimeError("unbalanced Caddy servers block") ++ protocol_lines = [i for i in range(servers_start + 1, servers_end) if re.match(r"^\\s*protocols\\s+", lines[i])] ++ if len(protocol_lines) > 1: raise RuntimeError("multiple Caddy protocol directives") ++ if protocol_lines: lines[protocol_lines[0]] = re.sub(r"protocols\\s+.*", "protocols h1 h2", lines[protocol_lines[0]]) ++ else: lines.insert(servers_start + 1, " protocols h1 h2\\n") ++text = "".join(lines) ++if re.search(r"(?im)^\\s*header(?:_down)?\\s+Alt-Svc", text): raise RuntimeError("manual Alt-Svc directive requires review") ++stamp = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime()) ++backup = path.with_name("Caddyfile.pre-sascha-media-" + stamp) ++candidate = path.with_name("Caddyfile.sascha-media-candidate") ++shutil.copy2(path, backup); candidate.write_text(text, encoding="utf-8"); os.chmod(candidate, path.stat().st_mode) ++def run(args, timeout=30): ++ proc = subprocess.run(args, text=True, capture_output=True, timeout=timeout) ++ if proc.returncode != 0: raise RuntimeError((proc.stderr or proc.stdout).strip()[-500:] or "command failed") ++ return proc.stdout.strip() ++try: ++ run(["docker", "cp", str(candidate), "caddy:/tmp/Caddyfile.sascha-media-candidate"]) ++ run(["docker", "exec", "caddy", "caddy", "validate", "--config", "/tmp/Caddyfile.sascha-media-candidate"]) ++ with path.open("w", encoding="utf-8") as handle: ++ handle.write(text); handle.flush(); os.fsync(handle.fileno()) ++ host_hash = hashlib.sha256(path.read_bytes()).hexdigest() ++ container_hash = run(["docker", "exec", "caddy", "sha256sum", "/etc/caddy/Caddyfile"]).split()[0] ++ if host_hash != container_hash: raise RuntimeError("host/container Caddyfile hash mismatch") ++ run(["docker", "exec", "caddy", "caddy", "validate", "--config", "/etc/caddy/Caddyfile"]) ++ run(["docker", "exec", "caddy", "caddy", "reload", "--config", "/etc/caddy/Caddyfile"]) ++ adapted = json.loads(run(["docker", "exec", "caddy", "caddy", "adapt", "--config", "/etc/caddy/Caddyfile"])) ++ protocols = [] ++ for server in adapted.get("apps", {}).get("http", {}).get("servers", {}).values(): protocols.extend(server.get("protocols", [])) ++ if sorted(set(protocols)) != ["h1", "h2"]: raise RuntimeError("Caddy did not load h1+h2-only protocols") ++ if not run(["curl", "-fsS", "--max-time", "15", "http://10.11.13.3:8096/System/Ping"]): raise RuntimeError("Emby direct-path ping was empty") ++except Exception: ++ with path.open("w", encoding="utf-8") as handle: ++ handle.write(backup.read_text(encoding="utf-8")); handle.flush(); os.fsync(handle.fileno()) ++ subprocess.run(["docker", "exec", "caddy", "caddy", "reload", "--config", "/etc/caddy/Caddyfile"], text=True, capture_output=True, timeout=30) ++ raise ++finally: ++ candidate.unlink(missing_ok=True) ++ subprocess.run(["docker", "exec", "caddy", "rm", "-f", "/tmp/Caddyfile.sascha-media-candidate"], text=True, capture_output=True) ++print(json.dumps({"status": "optimized", "upstream": "10.11.13.3:8096", "protocols": ["h1", "h2"], "backup": str(backup), "sha256": host_hash})) ++'''.replace("\n+", "\n") + encoded = base64.b64encode(script.encode()).decode() + return f'sudo -n python3 -c "import base64;exec(base64.b64decode(\'{encoded}\'))"' + + +def _optimize_sascha_media_edge() -> dict: + return _ssh_json(_media_host_target(SASCHA_MEDIA_VPS_HOST), _sascha_media_edge_optimize_command(), 90) + + +@app.post("/media/edge/sascha/optimize") +async def optimize_sascha_media_edge(req: SaschaMediaEdgeOptimizeRequest, _=Depends(_verify)): + """Switch only tv.sascha-lutz.de to wg-media and disable HTTP/3 on its dedicated Hetzner edge.""" + plan = {"status": "would_optimize", "hostname": "tv.sascha-lutz.de", "upstream": "10.11.13.3:8096", "protocols": ["h1", "h2"], "zero_downtime_reload": True} + if req.dry_run: + _audit("/media/edge/sascha/optimize", "POST", 200, "dry_run=True", True) + return plan + if req.confirmation != "OPTIMIZE_TV_SASCHA_LUTZ_DE": + raise HTTPException(400, "confirmation must be OPTIMIZE_TV_SASCHA_LUTZ_DE") + try: + result = await asyncio.to_thread(_optimize_sascha_media_edge) + except Exception as exc: + _audit("/media/edge/sascha/optimize", "POST", 502, "optimization failed; Caddy rollback attempted") + raise HTTPException(502, str(exc)[-500:]) from exc + _audit("/media/edge/sascha/optimize", "POST", 200, "direct upstream and h1+h2 enabled") + return result + + def _media_tunnel_key_command() -> str: script = '''import json, os, subprocess +from pathlib import Path From 3c3bc0fcda6de493c067090a3d420c188aa54dff Mon Sep 17 00:00:00 2001 From: sascha Date: Sat, 5 Sep 2026 13:13:19 +0200 Subject: [PATCH 2/2] feat: optimize Sascha Emby edge (tests/test_app.py) --- tests/test_app.py | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/tests/test_app.py b/tests/test_app.py index a98a293..3178eb8 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -43,7 +43,7 @@ def test_health_exposes_current_version(): with TestClient(app.app) as client: response = client.get("/health") assert response.status_code == 200 - assert response.json()["version"] == app.VERSION == "2.4.0" + assert response.json()["version"] == app.VERSION == "2.4.1" def test_media_handoff_proxies_strict_category_contract(monkeypatch): @@ -1370,3 +1370,31 @@ def test_sascha_media_path_benchmark_returns_both_fixed_routes(monkeypatch): assert response.status_code == 200 assert response.json()["direction"] == "emby-sascha_to_hetzner" assert set(response.json()["results"]) == {"legacy_node6", "direct_wg_media"} + + +def test_sascha_media_edge_optimize_is_dry_run_by_default(monkeypatch): + monkeypatch.setattr(app, "_optimize_sascha_media_edge", lambda: (_ for _ in ()).throw(AssertionError("dry-run must not mutate"))) + with TestClient(app.app) as client: + response = client.post("/media/edge/sascha/optimize", headers={"Authorization": "Bearer test-token"}, json={}) + assert response.status_code == 200 + assert response.json()["protocols"] == ["h1", "h2"] + assert response.json()["upstream"] == "10.11.13.3:8096" + + +def test_sascha_media_edge_optimize_requires_confirmation(monkeypatch): + monkeypatch.setattr(app, "_optimize_sascha_media_edge", lambda: (_ for _ in ()).throw(AssertionError("must not mutate"))) + with TestClient(app.app) as client: + response = client.post("/media/edge/sascha/optimize", headers={"Authorization": "Bearer test-token"}, json={"dry_run": False}) + assert response.status_code == 400 + + +def test_sascha_media_edge_optimize_applies_fixed_safe_result(monkeypatch): + monkeypatch.setattr(app, "_optimize_sascha_media_edge", lambda: {"status": "optimized", "upstream": "10.11.13.3:8096", "protocols": ["h1", "h2"], "backup": "/app-config/caddy/backup", "sha256": "a" * 64}) + with TestClient(app.app) as client: + response = client.post( + "/media/edge/sascha/optimize", + headers={"Authorization": "Bearer test-token"}, + json={"dry_run": False, "confirmation": "OPTIMIZE_TV_SASCHA_LUTZ_DE"}, + ) + assert response.status_code == 200 + assert response.json()["status"] == "optimized"