app.py

@@ -1036,79 +1036,6 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)):
     return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns}
 
 
-class SpeedtestDeployRequest(BaseModel):
-    stats_password: str
-
-
-async def _fetch_forgejo_text(repo: str, path: str) -> str:
-    if repo != "sascha/speedtest" or path != "compose.yaml":
-        raise ValueError("unsupported Forgejo file")
-    cfg = SERVICES.get("forgejo", {})
-    base_url = cfg.get("url")
-    token = _get_key(cfg)
-    if not base_url or not token:
-        raise RuntimeError("Forgejo service configuration is unavailable")
-    url = f"{base_url}/api/v1/repos/{repo}/contents/{path}"
-    async with httpx.AsyncClient(timeout=30) as client:
-        response = await client.get(url, params={"ref": "main"}, headers={"Authorization": f"token {token}"})
-        response.raise_for_status()
-    return base64.b64decode(response.json()["content"]).decode()
-
-
-def _deploy_speedtest_compose(compose: str, password: str) -> dict:
-    required = [
-        "ghcr.io/librespeed/speedtest:latest",
-        '127.0.0.1:8080:8080',
-        'TELEMETRY: "true"',
-        '/app-config/speedtest/database:/database',
-        'PASSWORD: "${STATS_PASSWORD:',
-    ]
-    if any(item not in compose for item in required):
-        raise ValueError("speedtest compose is missing a required security or persistence setting")
-    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password):
-        raise ValueError("stats password must be 24-128 safe characters")
-    script = f"""from pathlib import Path
-import os
-stack = Path('/app-config/github/speedtest')
-database = Path('/app-config/speedtest/database')
-stack.mkdir(parents=True, exist_ok=True)
-database.mkdir(parents=True, exist_ok=True)
-compose = stack / 'compose.yaml'
-if compose.exists():
-    (stack / 'compose.yaml.bak').write_bytes(compose.read_bytes())
-compose.write_text({compose!r})
-env = stack / '.env'
-env.write_text('STATS_PASSWORD=' + {password!r} + '\\n')
-os.chmod(env, 0o600)
-"""
-    rc, _out, err = _remote_python(script)
-    if rc != 0:
-        raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}")
-    preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull"
-    rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300)
-    if rc != 0:
-        raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}")
-    deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d"
-    rc, out, err = _ssh(VPS_SSH, deploy, timeout=120)
-    if rc != 0:
-        raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}")
-    health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1"
-    rc, _out, err = _ssh(VPS_SSH, health, timeout=75)
-    if rc != 0:
-        raise RuntimeError(f"speedtest health check failed: {err[-300:]}")
-    return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False}
-
-
-@app.post("/vps/speedtest/deploy")
-async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)):
-    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password):
-        raise HTTPException(400, "stats password must be 24-128 safe characters")
-    compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml")
-    result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password)
-    _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry")
-    return result
-
-
 # --- VM Lifecycle Endpoints ---
 import subprocess as _sp
 

tests/test_app.py

@@ -322,37 +322,3 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
     assert calls[0][0] == "sascha@10.4.1.116"
     assert calls[0][1] == "sudo bash /data/stacks/homelab-butler/vault-sync.sh"
     assert calls[1] == "reload"
-
-
-def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypatch):
-    calls = []
-
-    async def fake_fetch(repo, path):
-        calls.append(("fetch", repo, path))
-        return "services:\n  speedtest:\n    image: ghcr.io/librespeed/speedtest:latest\n"
-
-    def fake_deploy(compose, password):
-        calls.append(("deploy", compose, password))
-        return {"status": "deployed", "health": "ok"}
-
-    monkeypatch.setattr(app, "_fetch_forgejo_text", fake_fetch)
-    monkeypatch.setattr(app, "_deploy_speedtest_compose", fake_deploy)
-    with TestClient(app.app) as client:
-        weak = client.post(
-            "/vps/speedtest/deploy",
-            headers={"Authorization": "Bearer test-token"},
-            json={"stats_password": "short"},
-        )
-        response = client.post(
-            "/vps/speedtest/deploy",
-            headers={"Authorization": "Bearer test-token"},
-            json={"stats_password": "correct-horse-battery-staple"},
-        )
-
-    assert weak.status_code == 400
-    assert response.status_code == 200
-    assert response.json()["status"] == "deployed"
-    assert calls == [
-        ("fetch", "sascha/speedtest", "compose.yaml"),
-        ("deploy", "services:\n  speedtest:\n    image: ghcr.io/librespeed/speedtest:latest\n", "correct-horse-battery-staple"),
-    ]