diff --git a/app.py b/app.py index 3238ed3..51b6941 100644 --- a/app.py +++ b/app.py @@ -1036,12 +1036,29 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)): return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns} +SPEEDTEST_REPO_FILES = ( + ".dockerignore", + "Dockerfile", + "compose.yaml", + "pyproject.toml", + "streamscope/__init__.py", + "streamscope/app.py", + "streamscope/db.py", + "streamscope/mtr.py", + "streamscope/scoring.py", + "streamscope/static/index.html", + "streamscope/static/assets/app.css", + "streamscope/static/assets/app.js", +) + + class SpeedtestDeployRequest(BaseModel): stats_password: str + session_secret: str async def _fetch_forgejo_text(repo: str, path: str) -> str: - if repo != "sascha/speedtest" or path != "compose.yaml": + if repo != "sascha/speedtest" or path not in SPEEDTEST_REPO_FILES: raise ValueError("unsupported Forgejo file") cfg = SERVICES.get("forgejo", {}) base_url = cfg.get("url") @@ -1055,57 +1072,93 @@ async def _fetch_forgejo_text(repo: str, path: str) -> str: return base64.b64decode(response.json()["content"]).decode() -def _deploy_speedtest_compose(compose: str, password: str) -> dict: +def _deploy_speedtest_compose(files: dict[str, str], password: str, session_secret: str) -> dict: + if set(files) != set(SPEEDTEST_REPO_FILES): + raise ValueError("speedtest source bundle is incomplete") + compose = files["compose.yaml"] + dockerfile = files["Dockerfile"] required = [ - "ghcr.io/librespeed/speedtest:latest", + "build: .", '127.0.0.1:8080:8080', - 'TELEMETRY: "true"', - '/app-config/speedtest/database:/database', - 'PASSWORD: "${STATS_PASSWORD:', + '/app-config/speedtest/data:/data', + 'ADMIN_PASSWORD: "${ADMIN_PASSWORD:', + 'SESSION_SECRET: "${SESSION_SECRET:', + "NET_RAW", ] if any(item not in compose for item in required): - raise ValueError("speedtest compose is missing a required security or persistence setting") - if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password): + raise ValueError("StreamScope compose is missing a required security or persistence setting") + if "python:" not in dockerfile or "mtr-tiny" not in dockerfile or "php" in dockerfile.lower(): + raise ValueError("StreamScope image must be Python-based, MTR-capable and PHP-free") + secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}" + if not re.fullmatch(secret_pattern, password): raise ValueError("stats password must be 24-128 safe characters") + if not re.fullmatch(secret_pattern, session_secret): + raise ValueError("session secret must be 24-128 safe characters") script = f"""from pathlib import Path -import os +import os, shutil stack = Path('/app-config/github/speedtest') -database = Path('/app-config/speedtest/database') +backup = Path('/app-config/deployment-backups/speedtest-rollback') +data = Path('/app-config/speedtest/data') +if backup.exists(): + shutil.rmtree(backup) +if stack.exists(): + backup.parent.mkdir(parents=True, exist_ok=True) + shutil.copytree(stack, backup) stack.mkdir(parents=True, exist_ok=True) -database.mkdir(parents=True, exist_ok=True) -compose = stack / 'compose.yaml' -if compose.exists(): - (stack / 'compose.yaml.bak').write_bytes(compose.read_bytes()) -compose.write_text({compose!r}) +data.mkdir(parents=True, exist_ok=True) +files = {files!r} +for relative, content in files.items(): + target = stack / relative + target.parent.mkdir(parents=True, exist_ok=True) + target.write_text(content) env = stack / '.env' -env.write_text('STATS_PASSWORD=' + {password!r} + '\\n') +env.write_text('ADMIN_PASSWORD=' + {password!r} + '\\nSESSION_SECRET=' + {session_secret!r} + '\\nSTATS_PASSWORD=' + {password!r} + '\\n') os.chmod(env, 0o600) """ rc, _out, err = _remote_python(script) if rc != 0: - raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}") - preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull" - rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300) + raise RuntimeError(f"StreamScope file deployment failed: {err[-300:]}") + rollback = "rm -rf /app-config/github/speedtest && cp -a /app-config/deployment-backups/speedtest-rollback /app-config/github/speedtest && cd /app-config/github/speedtest && docker compose up -d" + preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose build --pull" + rc, _out, err = _ssh(VPS_SSH, preflight, timeout=600) if rc != 0: - raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}") - deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d" - rc, out, err = _ssh(VPS_SSH, deploy, timeout=120) + _ssh(VPS_SSH, rollback, timeout=180) + raise RuntimeError(f"StreamScope build preflight failed: {err[-500:]}") + deploy = "cd /app-config/github/speedtest && docker compose up -d --remove-orphans" + rc, out, err = _ssh(VPS_SSH, deploy, timeout=180) if rc != 0: - raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}") - health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1" - rc, _out, err = _ssh(VPS_SSH, health, timeout=75) + _ssh(VPS_SSH, rollback, timeout=180) + raise RuntimeError(f"StreamScope deployment failed: {(err or out)[-500:]}") + health = "for i in $(seq 1 45); do curl -fsS --max-time 3 http://127.0.0.1:8080/api/health >/dev/null && exit 0; sleep 2; done; exit 1" + rc, _out, err = _ssh(VPS_SSH, health, timeout=105) if rc != 0: - raise RuntimeError(f"speedtest health check failed: {err[-300:]}") - return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False} + _ssh(VPS_SSH, rollback, timeout=180) + raise RuntimeError(f"StreamScope health check failed and rollback was attempted: {err[-300:]}") + return { + "status": "deployed", + "health": "ok", + "application": "streamscope", + "database": "/app-config/speedtest/data/streamscope.db", + "public_port": False, + "mtr": True, + } @app.post("/vps/speedtest/deploy") async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)): - if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password): + secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}" + if not re.fullmatch(secret_pattern, req.stats_password): raise HTTPException(400, "stats password must be 24-128 safe characters") - compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml") - result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password) - _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry") + if not re.fullmatch(secret_pattern, req.session_secret): + raise HTTPException(400, "session secret must be 24-128 safe characters") + contents = await asyncio.gather(*( + _fetch_forgejo_text("sascha/speedtest", path) for path in SPEEDTEST_REPO_FILES + )) + files = dict(zip(SPEEDTEST_REPO_FILES, contents)) + result = await asyncio.to_thread( + _deploy_speedtest_compose, files, req.stats_password, req.session_secret + ) + _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed StreamScope with private history and MTR") return result diff --git a/tests/test_app.py b/tests/test_app.py index 8865342..df4c85f 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -324,16 +324,16 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch): assert calls[1] == "reload" -def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypatch): +def test_speedtest_deploy_requires_strong_secrets_and_uses_full_git_app(monkeypatch): calls = [] async def fake_fetch(repo, path): calls.append(("fetch", repo, path)) - return "services:\n speedtest:\n image: ghcr.io/librespeed/speedtest:latest\n" + return f"content:{path}" - def fake_deploy(compose, password): - calls.append(("deploy", compose, password)) - return {"status": "deployed", "health": "ok"} + def fake_deploy(files, password, session_secret): + calls.append(("deploy", files, password, session_secret)) + return {"status": "deployed", "health": "ok", "application": "streamscope"} monkeypatch.setattr(app, "_fetch_forgejo_text", fake_fetch) monkeypatch.setattr(app, "_deploy_speedtest_compose", fake_deploy) @@ -341,18 +341,24 @@ def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypa weak = client.post( "/vps/speedtest/deploy", headers={"Authorization": "Bearer test-token"}, - json={"stats_password": "short"}, + json={"stats_password": "short", "session_secret": "long-session-secret-with-entropy"}, ) response = client.post( "/vps/speedtest/deploy", headers={"Authorization": "Bearer test-token"}, - json={"stats_password": "correct-horse-battery-staple"}, + json={ + "stats_password": "correct-horse-battery-staple", + "session_secret": "streamscope-session-secret-with-entropy", + }, ) assert weak.status_code == 400 assert response.status_code == 200 - assert response.json()["status"] == "deployed" - assert calls == [ - ("fetch", "sascha/speedtest", "compose.yaml"), - ("deploy", "services:\n speedtest:\n image: ghcr.io/librespeed/speedtest:latest\n", "correct-horse-battery-staple"), - ] + assert response.json()["application"] == "streamscope" + assert ("fetch", "sascha/speedtest", "compose.yaml") in calls + assert ("fetch", "sascha/speedtest", "streamscope/static/assets/app.js") in calls + deploy = calls[-1] + assert deploy[0] == "deploy" + assert deploy[1]["compose.yaml"] == "content:compose.yaml" + assert deploy[2] == "correct-horse-battery-staple" + assert deploy[3] == "streamscope-session-secret-with-entropy"