diff --git a/app.py b/app.py index 70fd72a..d3abe66 100644 --- a/app.py +++ b/app.py @@ -1164,6 +1164,110 @@ async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)): return result +BW_MANAGER_REPO_FILES = ( + ".env.example", ".gitignore", "README.md", "compose.yaml", + "src/.dockerignore", "src/Dockerfile", "src/app.py", + "src/remote_policy.py", "src/requirements.txt", + "src/templates/base.html", "src/templates/history.html", + "src/templates/index.html", "src/templates/users.html", +) + + +async def _fetch_bw_manager_text(path: str) -> str: + if path not in BW_MANAGER_REPO_FILES: + raise ValueError("unsupported BW Manager file") + cfg = SERVICES.get("forgejo", {}) + base_url, token = cfg.get("url"), _get_key(cfg) + if not base_url or not token: + raise RuntimeError("Forgejo service configuration is unavailable") + url = f"{base_url}/api/v1/repos/sascha/bw-manager/contents/{path}" + async with httpx.AsyncClient(timeout=30) as client: + response = await client.get( + url, params={"ref": "main"}, + headers={"Authorization": f"token {token}"}, + ) + response.raise_for_status() + return base64.b64decode(response.json()["content"]).decode() + + +def _deploy_bw_manager_compose(files: dict[str, str]) -> dict: + if set(files) != set(BW_MANAGER_REPO_FILES): + raise ValueError("BW Manager source bundle is incomplete") + if "build: ./src" not in files["compose.yaml"]: + raise ValueError("BW Manager compose contract is invalid") + if "build_gated_targets" not in files["src/app.py"]: + raise ValueError("BW Manager candidate lacks the user/network AND gate") + rc, working_dir, err = _ssh( + VPS_SSH, + "docker inspect -f '{{ index .Config.Labels \"com.docker.compose.project.working_dir\" }}' bw-manager", + timeout=30, + ) + working_dir = working_dir.strip() + if rc != 0 or not re.fullmatch(r"/app-config/[A-Za-z0-9_./-]+", working_dir): + raise RuntimeError(f"cannot determine safe BW Manager working directory: {(err or working_dir)[-300:]}") + timestamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ") + candidate = f"/app-config/deployment-candidates/bw-manager-{timestamp}" + backup = f"/app-config/deployment-backups/bw-manager-{timestamp}" + image = "bw-manager-bw-manager" + rollback_image = f"{image}:rollback-{timestamp}" + script = f"""from pathlib import Path +import shutil +candidate = Path({candidate!r}) +if candidate.exists(): shutil.rmtree(candidate) +candidate.mkdir(parents=True) +for relative, content in {files!r}.items(): + target = candidate / relative + target.parent.mkdir(parents=True, exist_ok=True) + target.write_text(content) +live_env = Path({working_dir!r}) / '.env' +if live_env.exists(): shutil.copy2(live_env, candidate / '.env') +""" + rc, _out, err = _remote_python(script) + if rc != 0: + raise RuntimeError(f"BW Manager candidate staging failed: {err[-300:]}") + rc, _out, err = _ssh(VPS_SSH, f"cd {candidate} && docker compose config -q && docker compose build --pull", timeout=600) + if rc != 0: + raise RuntimeError(f"BW Manager candidate build failed: {err[-500:]}") + deploy_script = f"""from pathlib import Path +import shutil +live, backup, candidate = Path({working_dir!r}), Path({backup!r}), Path({candidate!r}) +backup.parent.mkdir(parents=True, exist_ok=True) +if backup.exists(): shutil.rmtree(backup) +shutil.copytree(live, backup) +for relative in {BW_MANAGER_REPO_FILES!r}: + source, target = candidate / relative, live / relative + target.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, target) +""" + rc, _out, err = _remote_python(deploy_script) + if rc != 0: + raise RuntimeError(f"BW Manager live file switch failed: {err[-300:]}") + _ssh(VPS_SSH, f"docker image tag {image} {rollback_image}", timeout=60) + rollback = ( + f"rm -rf {working_dir} && cp -a {backup} {working_dir} && " + f"docker image tag {rollback_image} {image} && cd {working_dir} && " + "docker compose up -d --no-build" + ) + rc, out, err = _ssh(VPS_SSH, f"cd {working_dir} && docker compose up -d --build --remove-orphans", timeout=600) + if rc != 0: + _ssh(VPS_SSH, rollback, timeout=180) + raise RuntimeError(f"BW Manager deployment failed: {(err or out)[-500:]}") + health = "for i in $(seq 1 45); do curl -fsS --max-time 3 http://127.0.0.1:8870/api/status >/dev/null && exit 0; sleep 2; done; exit 1" + rc, _out, err = _ssh(VPS_SSH, health, timeout=105) + if rc != 0: + _ssh(VPS_SSH, rollback, timeout=180) + raise RuntimeError(f"BW Manager health failed; rollback attempted: {err[-300:]}") + return {"status": "deployed", "health": "ok", "working_dir": working_dir, "backup": backup} + + +@app.post("/vps/bw-manager/deploy") +async def vps_bw_manager_deploy(_=Depends(_verify)): + contents = await asyncio.gather(*(_fetch_bw_manager_text(path) for path in BW_MANAGER_REPO_FILES)) + result = await asyncio.to_thread(_deploy_bw_manager_compose, dict(zip(BW_MANAGER_REPO_FILES, contents))) + _audit("/vps/bw-manager/deploy", "POST", 200, "Git-managed BW Manager deployment") + return result + + # --- VM Lifecycle Endpoints --- import subprocess as _sp diff --git a/tests/test_bw_manager_deploy.py b/tests/test_bw_manager_deploy.py new file mode 100644 index 0000000..cf5a339 --- /dev/null +++ b/tests/test_bw_manager_deploy.py @@ -0,0 +1,32 @@ +import importlib.util +from pathlib import Path + +import pytest +from fastapi.testclient import TestClient + + +ROOT = Path(__file__).resolve().parents[1] + + +def load_app(monkeypatch): + monkeypatch.setenv("BUTLER_TOKEN", "test-token") + spec = importlib.util.spec_from_file_location("butler_bw_test", ROOT / "app.py") + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +def test_bw_manager_deploy_rejects_bundle_without_and_gate(monkeypatch): + app = load_app(monkeypatch) + files = {path: "placeholder" for path in app.BW_MANAGER_REPO_FILES} + files["compose.yaml"] = "services:\n bw-manager:\n build: ./src\n" + files["src/app.py"] = "def old_policy(): pass\n" + + with pytest.raises(ValueError, match="AND gate"): + app._deploy_bw_manager_compose(files) + + +def test_bw_manager_deploy_endpoint_requires_auth(monkeypatch): + app = load_app(monkeypatch) + response = TestClient(app.app).post("/vps/bw-manager/deploy") + assert response.status_code in (401, 403) \ No newline at end of file