diff --git a/app.py b/app.py index 51b6941..3238ed3 100644 --- a/app.py +++ b/app.py @@ -1036,29 +1036,12 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)): return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns} -SPEEDTEST_REPO_FILES = ( - ".dockerignore", - "Dockerfile", - "compose.yaml", - "pyproject.toml", - "streamscope/__init__.py", - "streamscope/app.py", - "streamscope/db.py", - "streamscope/mtr.py", - "streamscope/scoring.py", - "streamscope/static/index.html", - "streamscope/static/assets/app.css", - "streamscope/static/assets/app.js", -) - - class SpeedtestDeployRequest(BaseModel): stats_password: str - session_secret: str async def _fetch_forgejo_text(repo: str, path: str) -> str: - if repo != "sascha/speedtest" or path not in SPEEDTEST_REPO_FILES: + if repo != "sascha/speedtest" or path != "compose.yaml": raise ValueError("unsupported Forgejo file") cfg = SERVICES.get("forgejo", {}) base_url = cfg.get("url") @@ -1072,93 +1055,57 @@ async def _fetch_forgejo_text(repo: str, path: str) -> str: return base64.b64decode(response.json()["content"]).decode() -def _deploy_speedtest_compose(files: dict[str, str], password: str, session_secret: str) -> dict: - if set(files) != set(SPEEDTEST_REPO_FILES): - raise ValueError("speedtest source bundle is incomplete") - compose = files["compose.yaml"] - dockerfile = files["Dockerfile"] +def _deploy_speedtest_compose(compose: str, password: str) -> dict: required = [ - "build: .", + "ghcr.io/librespeed/speedtest:latest", '127.0.0.1:8080:8080', - '/app-config/speedtest/data:/data', - 'ADMIN_PASSWORD: "${ADMIN_PASSWORD:', - 'SESSION_SECRET: "${SESSION_SECRET:', - "NET_RAW", + 'TELEMETRY: "true"', + '/app-config/speedtest/database:/database', + 'PASSWORD: "${STATS_PASSWORD:', ] if any(item not in compose for item in required): - raise ValueError("StreamScope compose is missing a required security or persistence setting") - if "python:" not in dockerfile or "mtr-tiny" not in dockerfile or "php" in dockerfile.lower(): - raise ValueError("StreamScope image must be Python-based, MTR-capable and PHP-free") - secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}" - if not re.fullmatch(secret_pattern, password): + raise ValueError("speedtest compose is missing a required security or persistence setting") + if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password): raise ValueError("stats password must be 24-128 safe characters") - if not re.fullmatch(secret_pattern, session_secret): - raise ValueError("session secret must be 24-128 safe characters") script = f"""from pathlib import Path -import os, shutil +import os stack = Path('/app-config/github/speedtest') -backup = Path('/app-config/deployment-backups/speedtest-rollback') -data = Path('/app-config/speedtest/data') -if backup.exists(): - shutil.rmtree(backup) -if stack.exists(): - backup.parent.mkdir(parents=True, exist_ok=True) - shutil.copytree(stack, backup) +database = Path('/app-config/speedtest/database') stack.mkdir(parents=True, exist_ok=True) -data.mkdir(parents=True, exist_ok=True) -files = {files!r} -for relative, content in files.items(): - target = stack / relative - target.parent.mkdir(parents=True, exist_ok=True) - target.write_text(content) +database.mkdir(parents=True, exist_ok=True) +compose = stack / 'compose.yaml' +if compose.exists(): + (stack / 'compose.yaml.bak').write_bytes(compose.read_bytes()) +compose.write_text({compose!r}) env = stack / '.env' -env.write_text('ADMIN_PASSWORD=' + {password!r} + '\\nSESSION_SECRET=' + {session_secret!r} + '\\nSTATS_PASSWORD=' + {password!r} + '\\n') +env.write_text('STATS_PASSWORD=' + {password!r} + '\\n') os.chmod(env, 0o600) """ rc, _out, err = _remote_python(script) if rc != 0: - raise RuntimeError(f"StreamScope file deployment failed: {err[-300:]}") - rollback = "rm -rf /app-config/github/speedtest && cp -a /app-config/deployment-backups/speedtest-rollback /app-config/github/speedtest && cd /app-config/github/speedtest && docker compose up -d" - preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose build --pull" - rc, _out, err = _ssh(VPS_SSH, preflight, timeout=600) + raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}") + preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull" + rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300) if rc != 0: - _ssh(VPS_SSH, rollback, timeout=180) - raise RuntimeError(f"StreamScope build preflight failed: {err[-500:]}") - deploy = "cd /app-config/github/speedtest && docker compose up -d --remove-orphans" - rc, out, err = _ssh(VPS_SSH, deploy, timeout=180) + raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}") + deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d" + rc, out, err = _ssh(VPS_SSH, deploy, timeout=120) if rc != 0: - _ssh(VPS_SSH, rollback, timeout=180) - raise RuntimeError(f"StreamScope deployment failed: {(err or out)[-500:]}") - health = "for i in $(seq 1 45); do curl -fsS --max-time 3 http://127.0.0.1:8080/api/health >/dev/null && exit 0; sleep 2; done; exit 1" - rc, _out, err = _ssh(VPS_SSH, health, timeout=105) + raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}") + health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1" + rc, _out, err = _ssh(VPS_SSH, health, timeout=75) if rc != 0: - _ssh(VPS_SSH, rollback, timeout=180) - raise RuntimeError(f"StreamScope health check failed and rollback was attempted: {err[-300:]}") - return { - "status": "deployed", - "health": "ok", - "application": "streamscope", - "database": "/app-config/speedtest/data/streamscope.db", - "public_port": False, - "mtr": True, - } + raise RuntimeError(f"speedtest health check failed: {err[-300:]}") + return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False} @app.post("/vps/speedtest/deploy") async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)): - secret_pattern = r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}" - if not re.fullmatch(secret_pattern, req.stats_password): + if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password): raise HTTPException(400, "stats password must be 24-128 safe characters") - if not re.fullmatch(secret_pattern, req.session_secret): - raise HTTPException(400, "session secret must be 24-128 safe characters") - contents = await asyncio.gather(*( - _fetch_forgejo_text("sascha/speedtest", path) for path in SPEEDTEST_REPO_FILES - )) - files = dict(zip(SPEEDTEST_REPO_FILES, contents)) - result = await asyncio.to_thread( - _deploy_speedtest_compose, files, req.stats_password, req.session_secret - ) - _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed StreamScope with private history and MTR") + compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml") + result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password) + _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry") return result diff --git a/tests/test_app.py b/tests/test_app.py index df4c85f..8865342 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -324,16 +324,16 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch): assert calls[1] == "reload" -def test_speedtest_deploy_requires_strong_secrets_and_uses_full_git_app(monkeypatch): +def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypatch): calls = [] async def fake_fetch(repo, path): calls.append(("fetch", repo, path)) - return f"content:{path}" + return "services:\n speedtest:\n image: ghcr.io/librespeed/speedtest:latest\n" - def fake_deploy(files, password, session_secret): - calls.append(("deploy", files, password, session_secret)) - return {"status": "deployed", "health": "ok", "application": "streamscope"} + def fake_deploy(compose, password): + calls.append(("deploy", compose, password)) + return {"status": "deployed", "health": "ok"} monkeypatch.setattr(app, "_fetch_forgejo_text", fake_fetch) monkeypatch.setattr(app, "_deploy_speedtest_compose", fake_deploy) @@ -341,24 +341,18 @@ def test_speedtest_deploy_requires_strong_secrets_and_uses_full_git_app(monkeypa weak = client.post( "/vps/speedtest/deploy", headers={"Authorization": "Bearer test-token"}, - json={"stats_password": "short", "session_secret": "long-session-secret-with-entropy"}, + json={"stats_password": "short"}, ) response = client.post( "/vps/speedtest/deploy", headers={"Authorization": "Bearer test-token"}, - json={ - "stats_password": "correct-horse-battery-staple", - "session_secret": "streamscope-session-secret-with-entropy", - }, + json={"stats_password": "correct-horse-battery-staple"}, ) assert weak.status_code == 400 assert response.status_code == 200 - assert response.json()["application"] == "streamscope" - assert ("fetch", "sascha/speedtest", "compose.yaml") in calls - assert ("fetch", "sascha/speedtest", "streamscope/static/assets/app.js") in calls - deploy = calls[-1] - assert deploy[0] == "deploy" - assert deploy[1]["compose.yaml"] == "content:compose.yaml" - assert deploy[2] == "correct-horse-battery-staple" - assert deploy[3] == "streamscope-session-secret-with-entropy" + assert response.json()["status"] == "deployed" + assert calls == [ + ("fetch", "sascha/speedtest", "compose.yaml"), + ("deploy", "services:\n speedtest:\n image: ghcr.io/librespeed/speedtest:latest\n", "correct-horse-battery-staple"), + ]