diff --git a/app.py b/app.py index 7f6ba54..a931ba0 100644 --- a/app.py +++ b/app.py @@ -1458,159 +1458,6 @@ async def restore_iso_builder(dry_run: bool = Query(True), _=Depends(_verify)): return result -CADDY_HOST = "root@46.225.230.72" -CADDYFILE_PATH = "/app-config/caddy/Caddyfile" -HETZNER_DNS_API = "https://api.hetzner.cloud/v1" - - -def _validate_managed_hostname(hostname: str) -> str: - hostname = hostname.strip().lower().rstrip(".") - if not re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+", hostname): - raise HTTPException(400, "Invalid hostname") - if not hostname.endswith(".sascha-lutz.de"): - raise HTTPException(400, "Hostname is outside the managed zone") - return hostname - - -def _caddy_site_remove_command(hostname: str, dry_run: bool) -> str: - script = '''import datetime, hashlib, json, os, re, subprocess, sys -path = %r -hostname = %r -dry_run = %r - -def digest(data): - return hashlib.sha256(data.encode()).hexdigest() - -def run(args): - p = subprocess.run(args, text=True, capture_output=True, timeout=30) - return {"rc": p.returncode, "stdout": p.stdout.strip()[-2000:], "stderr": p.stderr.strip()[-2000:]} - -text = open(path, encoding="utf-8").read() -pattern = re.compile(r"(?m)^[ \\t]*" + re.escape(hostname) + r"[ \\t]*\\{") -match = pattern.search(text) -result = {"hostname": hostname, "dry_run": dry_run, "found": bool(match), "before_sha256": digest(text)} -if not match: - print(json.dumps(result)); raise SystemExit(0) -start = match.start(); depth = 0; end = None -for idx in range(match.end() - 1, len(text)): - if text[idx] == "{": depth += 1 - elif text[idx] == "}": - depth -= 1 - if depth == 0: - end = idx + 1 - while end < len(text) and text[end] in " \\t": end += 1 - while end < len(text) and text[end] == "\\n": end += 1 - break -if end is None: - result["error"] = "Unbalanced Caddy site block"; print(json.dumps(result)); raise SystemExit(2) -result["line_start"] = text.count("\\n", 0, start) + 1 -result["line_end"] = text.count("\\n", 0, end) + 1 -if dry_run: - print(json.dumps(result)); raise SystemExit(0) -new = text[:start] + text[end:] -backup = path + ".pre-outline-removal-" + datetime.datetime.now().strftime("%%Y%%m%%d-%%H%%M%%S") -open(backup, "w", encoding="utf-8").write(text) -with open(path, "w", encoding="utf-8") as f: - f.write(new); f.flush(); os.fsync(f.fileno()) -result["backup"] = backup -result["after_sha256"] = digest(new) -validation = run(["docker", "exec", "caddy", "caddy", "validate", "--config", "/etc/caddy/Caddyfile"]) -result["validation"] = validation -if validation["rc"] != 0: - with open(path, "w", encoding="utf-8") as f: - f.write(text); f.flush(); os.fsync(f.fileno()) - result["rolled_back"] = True; print(json.dumps(result)); raise SystemExit(3) -host_sha = run(["sha256sum", path]) -container_sha = run(["docker", "exec", "caddy", "sha256sum", "/etc/caddy/Caddyfile"]) -result["host_container_hash_match"] = bool(host_sha["stdout"] and container_sha["stdout"] and host_sha["stdout"].split()[0] == container_sha["stdout"].split()[0]) -if not result["host_container_hash_match"]: - with open(path, "w", encoding="utf-8") as f: - f.write(text); f.flush(); os.fsync(f.fileno()) - result["rolled_back"] = True; print(json.dumps(result)); raise SystemExit(4) -reload = run(["docker", "exec", "caddy", "caddy", "reload", "--config", "/etc/caddy/Caddyfile"]) -result["reload"] = reload -if reload["rc"] != 0: - with open(path, "w", encoding="utf-8") as f: - f.write(text); f.flush(); os.fsync(f.fileno()) - run(["docker", "exec", "caddy", "caddy", "reload", "--config", "/etc/caddy/Caddyfile"]) - result["rolled_back"] = True; print(json.dumps(result)); raise SystemExit(5) -container_text = run(["docker", "exec", "caddy", "sh", "-c", "cat /etc/caddy/Caddyfile"]) -result["hostname_absent"] = hostname not in container_text["stdout"] -print(json.dumps(result)) -''' % (CADDYFILE_PATH, hostname, dry_run) - encoded = base64.b64encode(script.encode()).decode() - return f"python3 -c \"import base64;exec(base64.b64decode('{encoded}'))\"" - - -@app.delete("/caddy/site/{hostname}") -async def caddy_site_remove(hostname: str, _=Depends(_verify), dry_run: bool = Query(True)): - hostname = _validate_managed_hostname(hostname) - rc, out, err = _ssh(CADDY_HOST, _caddy_site_remove_command(hostname, dry_run), timeout=90) - try: - result = json.loads(out) - except Exception: - raise HTTPException(502, (err or out or "Caddy removal returned no JSON")[-1000:]) - if rc != 0: - raise HTTPException(502, result) - _audit(f"/caddy/site/{hostname}", "DELETE", 200, f"dry_run={dry_run}") - return result - - -async def _hetzner_zone_and_rrsets(zone_name: str): - token = _read("HETZNER_DNS_TOKEN") - if not token: - raise HTTPException(503, "HETZNER_DNS_TOKEN unavailable in Butler vault cache") - headers = {"Authorization": f"Bearer {token}"} - async with httpx.AsyncClient(timeout=30) as client: - zones_response = await client.get(f"{HETZNER_DNS_API}/zones", headers=headers, params={"name": zone_name}) - if zones_response.status_code != 200: - raise HTTPException(502, f"Hetzner zones lookup failed: HTTP {zones_response.status_code}") - zones = zones_response.json().get("zones", []) - zone = next((item for item in zones if item.get("name") == zone_name), None) - if not zone: - raise HTTPException(404, "DNS zone not found") - rr_response = await client.get(f"{HETZNER_DNS_API}/zones/{zone['id']}/rrsets", headers=headers) - if rr_response.status_code != 200: - raise HTTPException(502, f"Hetzner RRSet lookup failed: HTTP {rr_response.status_code}") - return zone, rr_response.json().get("rrsets", []), headers - - -@app.get("/dns/rrset/{zone_name}/{record_name}") -async def dns_rrset_get(zone_name: str, record_name: str, _=Depends(_verify)): - zone_name = zone_name.strip().lower().rstrip(".") - hostname = _validate_managed_hostname(f"{record_name}.{zone_name}") - record_name = hostname[: -(len(zone_name) + 1)] - zone, rrsets, _headers = await _hetzner_zone_and_rrsets(zone_name) - selected = [r for r in rrsets if r.get("name") == record_name and r.get("type") in {"A", "AAAA", "CNAME"}] - return {"zone": zone_name, "zone_id": zone.get("id"), "name": record_name, "rrsets": selected} - - -@app.delete("/dns/rrset/{zone_name}/{record_name}") -async def dns_rrset_delete(zone_name: str, record_name: str, _=Depends(_verify), dry_run: bool = Query(True)): - zone_name = zone_name.strip().lower().rstrip(".") - hostname = _validate_managed_hostname(f"{record_name}.{zone_name}") - record_name = hostname[: -(len(zone_name) + 1)] - zone, rrsets, headers = await _hetzner_zone_and_rrsets(zone_name) - selected = [r for r in rrsets if r.get("name") == record_name and r.get("type") in {"A", "AAAA", "CNAME"}] - result = {"zone": zone_name, "zone_id": zone.get("id"), "name": record_name, "dry_run": dry_run, "rrsets": selected, "deleted": []} - if dry_run or not selected: - return result - async with httpx.AsyncClient(timeout=30) as client: - for rrset in selected: - url = f"{HETZNER_DNS_API}/zones/{zone['id']}/rrsets/{record_name}/{rrset['type']}" - response = await client.delete(url, headers=headers) - if response.status_code not in {200, 204}: - raise HTTPException(502, f"Hetzner RRSet delete failed for {rrset['type']}: HTTP {response.status_code}") - result["deleted"].append(rrset["type"]) - verify_response = await client.get(f"{HETZNER_DNS_API}/zones/{zone['id']}/rrsets", headers=headers) - remaining = verify_response.json().get("rrsets", []) if verify_response.status_code == 200 else selected - result["remaining"] = [r for r in remaining if r.get("name") == record_name and r.get("type") in {"A", "AAAA", "CNAME"}] - if result["remaining"]: - raise HTTPException(502, "RRSet read-back still contains deleted record") - _audit(f"/dns/rrset/{zone_name}/{record_name}", "DELETE", 200, "deleted=" + ",".join(result["deleted"])) - return result - - def _pve_auth(): pv = _parse_kv("proxmox") return f"PVEAPIToken={pv.get('tokenid','')}={pv.get('secret','')}" diff --git a/tests/test_app.py b/tests/test_app.py index a3ea996..b5db980 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -240,43 +240,6 @@ def test_iso_builder_restore_defaults_to_dry_run_and_has_no_free_target(monkeypa assert "/app-config/ansible" in decoded -def test_caddy_site_remove_defaults_to_dry_run(monkeypatch): - payload = {"hostname": "wiki.sascha-lutz.de", "dry_run": True, "found": True, "line_start": 10, "line_end": 13} - calls = [] - monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, __import__("json").dumps(payload), ""))) - with TestClient(app.app) as client: - response = client.delete("/caddy/site/wiki.sascha-lutz.de", headers={"Authorization": "Bearer test-token"}) - assert response.status_code == 200 - assert response.json()["dry_run"] is True - assert calls[0][0] == app.CADDY_HOST - assert calls[0][2] == 90 - - -def test_caddy_site_remove_rejects_unmanaged_hostname_before_ssh(monkeypatch): - monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH"))) - with TestClient(app.app) as client: - response = client.delete("/caddy/site/example.com", headers={"Authorization": "Bearer test-token"}) - assert response.status_code == 400 - - -def test_dns_rrset_dry_run_returns_only_selected_records(monkeypatch): - async def fake_lookup(zone): - assert zone == "sascha-lutz.de" - return {"id": 96805, "name": zone}, [ - {"name": "wiki", "type": "A", "records": [{"value": "46.225.230.72"}]}, - {"name": "wiki", "type": "AAAA", "records": [{"value": "::1"}]}, - {"name": "git", "type": "A", "records": [{"value": "46.225.230.72"}]}, - ], {"Authorization": "Bearer hidden"} - monkeypatch.setattr(app, "_hetzner_zone_and_rrsets", fake_lookup) - with TestClient(app.app) as client: - response = client.delete("/dns/rrset/sascha-lutz.de/wiki", headers={"Authorization": "Bearer test-token"}) - assert response.status_code == 200 - body = response.json() - assert body["dry_run"] is True - assert [item["type"] for item in body["rrsets"]] == ["A", "AAAA"] - assert body["deleted"] == [] - - def test_invalid_log_target_is_rejected_before_ssh(): with TestClient(app.app) as client: response = client.get(