Compare commits
No commits in common. "main" and "feature/streamscope-deploy" have entirely different histories.
main
...
feature/st
3 changed files with 5 additions and 217 deletions
117
app.py
117
app.py
|
|
@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse
|
|||
from contextlib import asynccontextmanager
|
||||
|
||||
log = logging.getLogger("butler")
|
||||
VERSION = "2.3.5"
|
||||
VERSION = "2.3.2"
|
||||
|
||||
API_DIR = os.environ.get("API_KEY_DIR", "/data/api")
|
||||
VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache")
|
||||
|
|
@ -278,7 +278,6 @@ async def root():
|
|||
"status": "GET /status - health of all backends",
|
||||
"overview": "GET /overview?details=false - deterministic homelab verdict for small models",
|
||||
"audit": "GET /audit - recent API calls",
|
||||
"sysctl_audit": "GET /system/sysctl/{host} - read-only live and persistent network tuning",
|
||||
},
|
||||
"vault_items": len(_vault_cache),
|
||||
}
|
||||
|
|
@ -1050,7 +1049,6 @@ SPEEDTEST_REPO_FILES = (
|
|||
"streamscope/static/index.html",
|
||||
"streamscope/static/assets/app.css",
|
||||
"streamscope/static/assets/app.js",
|
||||
"streamscope/static/assets/longterm-metrics.js",
|
||||
)
|
||||
|
||||
|
||||
|
|
@ -1126,7 +1124,7 @@ os.chmod(env, 0o600)
|
|||
if rc != 0:
|
||||
_ssh(VPS_SSH, rollback, timeout=180)
|
||||
raise RuntimeError(f"StreamScope build preflight failed: {err[-500:]}")
|
||||
deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d --remove-orphans"
|
||||
deploy = "cd /app-config/github/speedtest && docker compose up -d --remove-orphans"
|
||||
rc, out, err = _ssh(VPS_SSH, deploy, timeout=180)
|
||||
if rc != 0:
|
||||
_ssh(VPS_SSH, rollback, timeout=180)
|
||||
|
|
@ -1187,76 +1185,6 @@ def _ssh(host, cmd, timeout=600):
|
|||
except _sp.TimeoutExpired:
|
||||
return 124, "", f"SSH command timed out after {timeout} seconds"
|
||||
|
||||
|
||||
SYSCTL_AUDIT_KEYS = (
|
||||
"net.core.default_qdisc",
|
||||
"net.core.rmem_default",
|
||||
"net.core.rmem_max",
|
||||
"net.core.wmem_default",
|
||||
"net.core.wmem_max",
|
||||
"net.core.netdev_max_backlog",
|
||||
"net.core.somaxconn",
|
||||
"net.ipv4.ip_forward",
|
||||
"net.ipv4.tcp_congestion_control",
|
||||
"net.ipv4.tcp_fastopen",
|
||||
"net.ipv4.tcp_mtu_probing",
|
||||
"net.ipv4.tcp_no_metrics_save",
|
||||
"net.ipv4.tcp_rmem",
|
||||
"net.ipv4.tcp_slow_start_after_idle",
|
||||
"net.ipv4.tcp_window_scaling",
|
||||
"net.ipv4.tcp_wmem",
|
||||
)
|
||||
|
||||
|
||||
def _sysctl_audit_command() -> str:
|
||||
script = f'''import glob, json
|
||||
from pathlib import Path
|
||||
keys = {SYSCTL_AUDIT_KEYS!r}
|
||||
live, errors = {{}}, {{}}
|
||||
for key in keys:
|
||||
try:
|
||||
live[key] = Path("/proc/sys/" + key.replace(".", "/")).read_text().strip()
|
||||
except OSError as exc:
|
||||
errors[key] = str(exc)[:160]
|
||||
persistent = {{}}
|
||||
for path in ["/etc/sysctl.conf", *sorted(glob.glob("/etc/sysctl.d/*.conf"))]:
|
||||
try:
|
||||
with open(path, encoding="utf-8", errors="replace") as handle:
|
||||
for raw in handle:
|
||||
line = raw.split("#", 1)[0].strip()
|
||||
if "=" not in line:
|
||||
continue
|
||||
key, value = (part.strip() for part in line.split("=", 1))
|
||||
if key in keys:
|
||||
persistent.setdefault(key, []).append({{"file": path, "value": value}})
|
||||
except (FileNotFoundError, PermissionError):
|
||||
pass
|
||||
print(json.dumps({{"live": live, "persistent": persistent, "errors": errors}}))
|
||||
'''
|
||||
encoded = base64.b64encode(script.encode()).decode()
|
||||
return f'python3 -c "import base64;exec(base64.b64decode(\'{encoded}\'))"'
|
||||
|
||||
|
||||
@app.get("/system/sysctl/{host}")
|
||||
async def system_sysctl_audit(host: str, _=Depends(_verify)):
|
||||
if not re.fullmatch(r"[a-z0-9][a-z0-9-]{0,62}", host):
|
||||
raise HTTPException(400, "Invalid host name")
|
||||
if host == "vps":
|
||||
target = VPS_SSH
|
||||
else:
|
||||
inventory = await asyncio.to_thread(_find_inventory_host, host)
|
||||
if not inventory:
|
||||
raise HTTPException(404, f"Host {host} not found")
|
||||
target = f'{inventory["user"]}@{inventory["ip"]}'
|
||||
rc, out, err = await asyncio.to_thread(_ssh, target, _sysctl_audit_command(), 30)
|
||||
if rc != 0:
|
||||
raise HTTPException(502, (err or out).strip()[-500:] or "sysctl audit failed")
|
||||
try:
|
||||
result = json.loads(out)
|
||||
except json.JSONDecodeError as exc:
|
||||
raise HTTPException(502, "sysctl audit returned invalid JSON") from exc
|
||||
return {"host": host, **result}
|
||||
|
||||
def _pve_auth():
|
||||
pv = _parse_kv("proxmox")
|
||||
return f"PVEAPIToken={pv.get('tokenid','')}={pv.get('secret','')}"
|
||||
|
|
@ -1567,47 +1495,10 @@ print("updated" if updated else "added")'''
|
|||
async def ansible_run(request: Request, _=Depends(_verify)):
|
||||
body = await request.json()
|
||||
hostname = body.get("limit", body.get("hostname", ""))
|
||||
template_id = body.get("template_id", 10)
|
||||
if not hostname:
|
||||
return JSONResponse({"error": "limit/hostname required"}, status_code=400)
|
||||
action = body.get("action", "setup")
|
||||
if action not in {"setup", "tune", "pvetune"}:
|
||||
return JSONResponse({"error": "action must be setup, tune or pvetune"}, status_code=400)
|
||||
if not re.fullmatch(r"[a-zA-Z0-9_.:-]+", hostname):
|
||||
return JSONResponse({"error": "invalid hostname/limit"}, status_code=400)
|
||||
if action in {"tune", "pvetune"}:
|
||||
approved_files = (
|
||||
"roles/sysctl/defaults/main.yml",
|
||||
"roles/sysctl/tasks/main.yml",
|
||||
"group_vars/vps/sysctl.yml",
|
||||
"sysctl-proxmox.yaml",
|
||||
"roles/sysctl_proxmox/tasks/main.yml",
|
||||
)
|
||||
file_sync = " && ".join(
|
||||
f"git show origin/master:{path} > {path}" for path in approved_files
|
||||
)
|
||||
command = (
|
||||
"cd /app-config/ansible && "
|
||||
"git fetch origin master && "
|
||||
f"{file_sync} && "
|
||||
f"bash pfannkuchen.sh {action} {hostname}"
|
||||
)
|
||||
else:
|
||||
command = (
|
||||
"cd /app-config/ansible && "
|
||||
"git pull --ff-only origin master && "
|
||||
f"bash pfannkuchen.sh {action} {hostname}"
|
||||
)
|
||||
rc, out, err = _ssh(AUTOMATION1, command, timeout=600)
|
||||
_audit("/ansible/run", "POST", 200 if rc == 0 else 502, f"{action} {hostname}")
|
||||
if action != "setup":
|
||||
return {
|
||||
"status": "ok" if rc == 0 else "error",
|
||||
"action": action,
|
||||
"hostname": hostname,
|
||||
"rc": rc,
|
||||
"output": out[-4000:],
|
||||
"error": err[-1000:] if rc != 0 else "",
|
||||
}
|
||||
rc, out, err = _ssh(AUTOMATION1, f"cd /app-config/ansible && bash pfannkuchen.sh setup {hostname}", timeout=600)
|
||||
|
||||
# After successful ansible run: sync Hawser token to Dockhand
|
||||
if rc == 0:
|
||||
|
|
|
|||
|
|
@ -42,32 +42,7 @@ def test_health_exposes_current_version():
|
|||
with TestClient(app.app) as client:
|
||||
response = client.get("/health")
|
||||
assert response.status_code == 200
|
||||
assert response.json()["version"] == app.VERSION == "2.3.5"
|
||||
|
||||
|
||||
def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
|
||||
payload = {
|
||||
"live": {"net.ipv4.tcp_congestion_control": "bbr"},
|
||||
"persistent": {"net.ipv4.tcp_congestion_control": [{"file": "/etc/sysctl.d/99-net-tuning.conf", "value": "bbr"}]},
|
||||
"errors": {},
|
||||
}
|
||||
calls = []
|
||||
monkeypatch.setattr(app, "_find_inventory_host", lambda name: {"name": name, "user": "root", "ip": "10.5.85.16"})
|
||||
monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, __import__("json").dumps(payload), "")))
|
||||
with TestClient(app.app) as client:
|
||||
response = client.get("/system/sysctl/node6", headers={"Authorization": "Bearer test-token"})
|
||||
assert response.status_code == 200
|
||||
assert response.json()["live"]["net.ipv4.tcp_congestion_control"] == "bbr"
|
||||
assert calls[0][0] == "root@10.5.85.16"
|
||||
assert "base64.b64decode" in calls[0][1]
|
||||
|
||||
|
||||
def test_sysctl_audit_rejects_unknown_host_without_ssh(monkeypatch):
|
||||
monkeypatch.setattr(app, "_find_inventory_host", lambda _name: None)
|
||||
monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
|
||||
with TestClient(app.app) as client:
|
||||
response = client.get("/system/sysctl/not-there", headers={"Authorization": "Bearer test-token"})
|
||||
assert response.status_code == 404
|
||||
assert response.json()["version"] == app.VERSION == "2.3.2"
|
||||
|
||||
|
||||
def test_invalid_log_target_is_rejected_before_ssh():
|
||||
|
|
@ -108,46 +83,6 @@ def test_inventory_upsert_uses_base64_script(monkeypatch):
|
|||
assert "\\nname =" not in calls[0][1]
|
||||
|
||||
|
||||
def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypatch):
|
||||
calls = []
|
||||
|
||||
def fake_ssh(host, command, timeout=600):
|
||||
calls.append((host, command, timeout))
|
||||
return 0, "changed=1 failed=0", ""
|
||||
|
||||
monkeypatch.setattr(app, "_ssh", fake_ssh)
|
||||
with TestClient(app.app) as client:
|
||||
response = client.post(
|
||||
"/ansible/run",
|
||||
headers={"Authorization": "Bearer test-token"},
|
||||
json={"hostname": "emby-sascha", "action": "tune"},
|
||||
)
|
||||
assert response.status_code == 200
|
||||
assert response.json()["action"] == "tune"
|
||||
assert "git fetch origin master" in calls[0][1]
|
||||
assert "git show origin/master:roles/sysctl/tasks/main.yml" in calls[0][1]
|
||||
assert "git pull --ff-only" not in calls[0][1]
|
||||
assert "bash pfannkuchen.sh tune emby-sascha" in calls[0][1]
|
||||
assert len(calls) == 1
|
||||
|
||||
|
||||
def test_ansible_run_rejects_unknown_action_and_shell_metacharacters(monkeypatch):
|
||||
monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
|
||||
with TestClient(app.app) as client:
|
||||
bad_action = client.post(
|
||||
"/ansible/run",
|
||||
headers={"Authorization": "Bearer test-token"},
|
||||
json={"hostname": "emby-sascha", "action": "shell"},
|
||||
)
|
||||
bad_host = client.post(
|
||||
"/ansible/run",
|
||||
headers={"Authorization": "Bearer test-token"},
|
||||
json={"hostname": "emby-sascha;id", "action": "tune"},
|
||||
)
|
||||
assert bad_action.status_code == 400
|
||||
assert bad_host.status_code == 400
|
||||
|
||||
|
||||
def test_docker_inspect_returns_sanitized_summary(monkeypatch):
|
||||
raw = [{
|
||||
"Name": "/fileflows",
|
||||
|
|
|
|||
|
|
@ -1,38 +0,0 @@
|
|||
import app
|
||||
|
||||
|
||||
def test_streamscope_deploy_replaces_legacy_container_before_compose(monkeypatch):
|
||||
assert "streamscope/static/assets/longterm-metrics.js" in app.SPEEDTEST_REPO_FILES
|
||||
files = {path: "placeholder" for path in app.SPEEDTEST_REPO_FILES}
|
||||
files["compose.yaml"] = """services:
|
||||
streamscope:
|
||||
build: .
|
||||
ports:
|
||||
- '127.0.0.1:8080:8080'
|
||||
environment:
|
||||
ADMIN_PASSWORD: "${ADMIN_PASSWORD:?required}"
|
||||
SESSION_SECRET: "${SESSION_SECRET:?required}"
|
||||
volumes:
|
||||
- /app-config/speedtest/data:/data
|
||||
cap_add:
|
||||
- NET_RAW
|
||||
"""
|
||||
files["Dockerfile"] = "FROM python:3.13-slim\nRUN apt-get install -y mtr-tiny\n"
|
||||
commands = []
|
||||
|
||||
monkeypatch.setattr(app, "_remote_python", lambda script: (0, "", ""))
|
||||
|
||||
def fake_ssh(host, command, timeout=600):
|
||||
commands.append(command)
|
||||
return 0, "ok", ""
|
||||
|
||||
monkeypatch.setattr(app, "_ssh", fake_ssh)
|
||||
result = app._deploy_speedtest_compose(
|
||||
files,
|
||||
"correct-horse-battery-staple",
|
||||
"streamscope-session-secret-with-entropy",
|
||||
)
|
||||
|
||||
deploy = next(command for command in commands if "compose up -d --remove-orphans" in command)
|
||||
assert "docker rm -f speedtest" in deploy
|
||||
assert result["application"] == "streamscope"
|
||||
Loading…
Add table
Add a link
Reference in a new issue