app.py

@@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from contextlib import asynccontextmanager
 
 log = logging.getLogger("butler")
-VERSION = "2.3.5"
+VERSION = "2.3.3"
 
 API_DIR = os.environ.get("API_KEY_DIR", "/data/api")
 VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache")
@@ -1209,15 +1209,15 @@ SYSCTL_AUDIT_KEYS = (
 
 
 def _sysctl_audit_command() -> str:
-    script = f'''import glob, json
+    script = f'''import glob, json, subprocess
-from pathlib import Path
 keys = {SYSCTL_AUDIT_KEYS!r}
 live, errors = {{}}, {{}}
 for key in keys:
-    try:
+    result = subprocess.run(["sysctl", "-n", key], capture_output=True, text=True)
-        live[key] = Path("/proc/sys/" + key.replace(".", "/")).read_text().strip()
+    if result.returncode == 0:
-    except OSError as exc:
+        live[key] = result.stdout.strip()
-        errors[key] = str(exc)[:160]
+    else:
+        errors[key] = result.stderr.strip()[:160]
 persistent = {{}}
 for path in ["/etc/sysctl.conf", *sorted(glob.glob("/etc/sysctl.d/*.conf"))]:
     try:
@@ -1250,7 +1250,7 @@ async def system_sysctl_audit(host: str, _=Depends(_verify)):
         target = f'{inventory["user"]}@{inventory["ip"]}'
     rc, out, err = await asyncio.to_thread(_ssh, target, _sysctl_audit_command(), 30)
     if rc != 0:
-        raise HTTPException(502, (err or out).strip()[-500:] or "sysctl audit failed")
+        raise HTTPException(502, (err or out).strip()[:300] or "sysctl audit failed")
     try:
         result = json.loads(out)
     except json.JSONDecodeError as exc:
@@ -1567,47 +1567,10 @@ print("updated" if updated else "added")'''
 async def ansible_run(request: Request, _=Depends(_verify)):
     body = await request.json()
     hostname = body.get("limit", body.get("hostname", ""))
+    template_id = body.get("template_id", 10)
     if not hostname:
         return JSONResponse({"error": "limit/hostname required"}, status_code=400)
-    action = body.get("action", "setup")
+    rc, out, err = _ssh(AUTOMATION1, f"cd /app-config/ansible && bash pfannkuchen.sh setup {hostname}", timeout=600)
-    if action not in {"setup", "tune", "pvetune"}:
-        return JSONResponse({"error": "action must be setup, tune or pvetune"}, status_code=400)
-    if not re.fullmatch(r"[a-zA-Z0-9_.:-]+", hostname):
-        return JSONResponse({"error": "invalid hostname/limit"}, status_code=400)
-    if action in {"tune", "pvetune"}:
-        approved_files = (
-            "roles/sysctl/defaults/main.yml",
-            "roles/sysctl/tasks/main.yml",
-            "group_vars/vps/sysctl.yml",
-            "sysctl-proxmox.yaml",
-            "roles/sysctl_proxmox/tasks/main.yml",
-        )
-        file_sync = " && ".join(
-            f"git show origin/master:{path} > {path}" for path in approved_files
-        )
-        command = (
-            "cd /app-config/ansible && "
-            "git fetch origin master && "
-            f"{file_sync} && "
-            f"bash pfannkuchen.sh {action} {hostname}"
-        )
-    else:
-        command = (
-            "cd /app-config/ansible && "
-            "git pull --ff-only origin master && "
-            f"bash pfannkuchen.sh {action} {hostname}"
-        )
-    rc, out, err = _ssh(AUTOMATION1, command, timeout=600)
-    _audit("/ansible/run", "POST", 200 if rc == 0 else 502, f"{action} {hostname}")
-    if action != "setup":
-        return {
-            "status": "ok" if rc == 0 else "error",
-            "action": action,
-            "hostname": hostname,
-            "rc": rc,
-            "output": out[-4000:],
-            "error": err[-1000:] if rc != 0 else "",
-        }
     
     # After successful ansible run: sync Hawser token to Dockhand
     if rc == 0:

tests/test_app.py

@@ -42,7 +42,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.5"
+    assert response.json()["version"] == app.VERSION == "2.3.3"
 
 
 def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
@@ -108,46 +108,6 @@ def test_inventory_upsert_uses_base64_script(monkeypatch):
     assert "\\nname =" not in calls[0][1]
 
 
-def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypatch):
-    calls = []
-
-    def fake_ssh(host, command, timeout=600):
-        calls.append((host, command, timeout))
-        return 0, "changed=1 failed=0", ""
-
-    monkeypatch.setattr(app, "_ssh", fake_ssh)
-    with TestClient(app.app) as client:
-        response = client.post(
-            "/ansible/run",
-            headers={"Authorization": "Bearer test-token"},
-            json={"hostname": "emby-sascha", "action": "tune"},
-        )
-    assert response.status_code == 200
-    assert response.json()["action"] == "tune"
-    assert "git fetch origin master" in calls[0][1]
-    assert "git show origin/master:roles/sysctl/tasks/main.yml" in calls[0][1]
-    assert "git pull --ff-only" not in calls[0][1]
-    assert "bash pfannkuchen.sh tune emby-sascha" in calls[0][1]
-    assert len(calls) == 1
-
-
-def test_ansible_run_rejects_unknown_action_and_shell_metacharacters(monkeypatch):
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
-    with TestClient(app.app) as client:
-        bad_action = client.post(
-            "/ansible/run",
-            headers={"Authorization": "Bearer test-token"},
-            json={"hostname": "emby-sascha", "action": "shell"},
-        )
-        bad_host = client.post(
-            "/ansible/run",
-            headers={"Authorization": "Bearer test-token"},
-            json={"hostname": "emby-sascha;id", "action": "tune"},
-        )
-    assert bad_action.status_code == 400
-    assert bad_host.status_code == 400
-
-
 def test_docker_inspect_returns_sanitized_summary(monkeypatch):
     raw = [{
         "Name": "/fileflows",