diff --git a/app.py b/app.py index 1496ad1..080259c 100644 --- a/app.py +++ b/app.py @@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse from contextlib import asynccontextmanager log = logging.getLogger("butler") -VERSION = "2.3.3" +VERSION = "2.3.2" API_DIR = os.environ.get("API_KEY_DIR", "/data/api") VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache") @@ -278,7 +278,6 @@ async def root(): "status": "GET /status - health of all backends", "overview": "GET /overview?details=false - deterministic homelab verdict for small models", "audit": "GET /audit - recent API calls", - "sysctl_audit": "GET /system/sysctl/{host} - read-only live and persistent network tuning", }, "vault_items": len(_vault_cache), } @@ -1050,7 +1049,6 @@ SPEEDTEST_REPO_FILES = ( "streamscope/static/index.html", "streamscope/static/assets/app.css", "streamscope/static/assets/app.js", - "streamscope/static/assets/longterm-metrics.js", ) @@ -1187,76 +1185,6 @@ def _ssh(host, cmd, timeout=600): except _sp.TimeoutExpired: return 124, "", f"SSH command timed out after {timeout} seconds" - -SYSCTL_AUDIT_KEYS = ( - "net.core.default_qdisc", - "net.core.rmem_default", - "net.core.rmem_max", - "net.core.wmem_default", - "net.core.wmem_max", - "net.core.netdev_max_backlog", - "net.core.somaxconn", - "net.ipv4.ip_forward", - "net.ipv4.tcp_congestion_control", - "net.ipv4.tcp_fastopen", - "net.ipv4.tcp_mtu_probing", - "net.ipv4.tcp_no_metrics_save", - "net.ipv4.tcp_rmem", - "net.ipv4.tcp_slow_start_after_idle", - "net.ipv4.tcp_window_scaling", - "net.ipv4.tcp_wmem", -) - - -def _sysctl_audit_command() -> str: - script = f'''import glob, json, subprocess -keys = {SYSCTL_AUDIT_KEYS!r} -live, errors = {{}}, {{}} -for key in keys: - result = subprocess.run(["sysctl", "-n", key], capture_output=True, text=True) - if result.returncode == 0: - live[key] = result.stdout.strip() - else: - errors[key] = result.stderr.strip()[:160] -persistent = {{}} -for path in ["/etc/sysctl.conf", *sorted(glob.glob("/etc/sysctl.d/*.conf"))]: - try: - with open(path, encoding="utf-8", errors="replace") as handle: - for raw in handle: - line = raw.split("#", 1)[0].strip() - if "=" not in line: - continue - key, value = (part.strip() for part in line.split("=", 1)) - if key in keys: - persistent.setdefault(key, []).append({{"file": path, "value": value}}) - except (FileNotFoundError, PermissionError): - pass -print(json.dumps({{"live": live, "persistent": persistent, "errors": errors}})) -''' - encoded = base64.b64encode(script.encode()).decode() - return f'python3 -c "import base64;exec(base64.b64decode(\'{encoded}\'))"' - - -@app.get("/system/sysctl/{host}") -async def system_sysctl_audit(host: str, _=Depends(_verify)): - if not re.fullmatch(r"[a-z0-9][a-z0-9-]{0,62}", host): - raise HTTPException(400, "Invalid host name") - if host == "vps": - target = VPS_SSH - else: - inventory = await asyncio.to_thread(_find_inventory_host, host) - if not inventory: - raise HTTPException(404, f"Host {host} not found") - target = f'{inventory["user"]}@{inventory["ip"]}' - rc, out, err = await asyncio.to_thread(_ssh, target, _sysctl_audit_command(), 30) - if rc != 0: - raise HTTPException(502, (err or out).strip()[:300] or "sysctl audit failed") - try: - result = json.loads(out) - except json.JSONDecodeError as exc: - raise HTTPException(502, "sysctl audit returned invalid JSON") from exc - return {"host": host, **result} - def _pve_auth(): pv = _parse_kv("proxmox") return f"PVEAPIToken={pv.get('tokenid','')}={pv.get('secret','')}" diff --git a/tests/test_app.py b/tests/test_app.py index ba473b0..df4c85f 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -42,32 +42,7 @@ def test_health_exposes_current_version(): with TestClient(app.app) as client: response = client.get("/health") assert response.status_code == 200 - assert response.json()["version"] == app.VERSION == "2.3.3" - - -def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch): - payload = { - "live": {"net.ipv4.tcp_congestion_control": "bbr"}, - "persistent": {"net.ipv4.tcp_congestion_control": [{"file": "/etc/sysctl.d/99-net-tuning.conf", "value": "bbr"}]}, - "errors": {}, - } - calls = [] - monkeypatch.setattr(app, "_find_inventory_host", lambda name: {"name": name, "user": "root", "ip": "10.5.85.16"}) - monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, __import__("json").dumps(payload), ""))) - with TestClient(app.app) as client: - response = client.get("/system/sysctl/node6", headers={"Authorization": "Bearer test-token"}) - assert response.status_code == 200 - assert response.json()["live"]["net.ipv4.tcp_congestion_control"] == "bbr" - assert calls[0][0] == "root@10.5.85.16" - assert "base64.b64decode" in calls[0][1] - - -def test_sysctl_audit_rejects_unknown_host_without_ssh(monkeypatch): - monkeypatch.setattr(app, "_find_inventory_host", lambda _name: None) - monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH"))) - with TestClient(app.app) as client: - response = client.get("/system/sysctl/not-there", headers={"Authorization": "Bearer test-token"}) - assert response.status_code == 404 + assert response.json()["version"] == app.VERSION == "2.3.2" def test_invalid_log_target_is_rejected_before_ssh(): diff --git a/tests/test_streamscope_deploy.py b/tests/test_streamscope_deploy.py index f8ca0a8..65bd7b0 100644 --- a/tests/test_streamscope_deploy.py +++ b/tests/test_streamscope_deploy.py @@ -2,7 +2,6 @@ import app def test_streamscope_deploy_replaces_legacy_container_before_compose(monkeypatch): - assert "streamscope/static/assets/longterm-metrics.js" in app.SPEEDTEST_REPO_FILES files = {path: "placeholder" for path in app.SPEEDTEST_REPO_FILES} files["compose.yaml"] = """services: streamscope: