From 8daf83198321c340d6b08f6b3fd80845e558c42f Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:03:56 +0200 Subject: [PATCH 1/8] feat(control): add stream-control/app.py --- stream-control/app.py | 123 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 stream-control/app.py diff --git a/stream-control/app.py b/stream-control/app.py new file mode 100644 index 0000000..5dc1203 --- /dev/null +++ b/stream-control/app.py @@ -0,0 +1,123 @@ +"""Network profile control surface; backend access is restricted to a forced SSH command.""" +from __future__ import annotations +import json, os, secrets, subprocess, time +from flask import Flask, flash, jsonify, redirect, render_template, request, session, url_for + +app = Flask(__name__) +app.secret_key = os.environ["SESSION_SECRET"] +app.config.update(SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE="Strict", SESSION_COOKIE_SECURE=True) + +PROFILES = { + "strict": {"label": "Strikt", "ch": 0.5, "vpn": 0.5, "color": "#ff667d"}, + "standard": {"label": "Standard", "ch": 1.0, "vpn": 1.0, "color": "#a88dff"}, + "relaxed": {"label": "Entspannt", "ch": 5.0, "vpn": 5.0, "color": "#32d6a3"}, + "open": {"label": "Off-Peak", "ch": 10.0, "vpn": 10.0, "color": "#26c6da"}, +} +_CACHE = {"at": 0.0, "data": None} + +def rpc(command: str, timeout: int = 25): + p = subprocess.run( + ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=8", "edge-maint", command], + capture_output=True, text=True, timeout=timeout, + ) + raw = p.stdout.strip() + try: + data = json.loads(raw) if raw else {} + except json.JSONDecodeError: + data = {"ok": False, "error": (p.stderr or raw or "invalid response")[:300]} + if p.returncode and data.get("ok") is not False: + data = {"ok": False, "error": (p.stderr or raw or f"rpc exit {p.returncode}")[:300]} + return data + +def get_state(force=False): + now = time.monotonic() + if not force and _CACHE["data"] is not None and now - _CACHE["at"] < 3: + return _CACHE["data"] + try: + data = rpc("state") + except Exception as exc: + data = {"ok": False, "error": str(exc)[:300], "limits": {}, "tc": {}, "services": {}, "policy": {}, "ipsets": {}} + _CACHE.update(at=now, data=data) + return data + +def csrf_token(): + token = session.get("csrf") + if not token: + token = session["csrf"] = secrets.token_urlsafe(32) + return token + +app.jinja_env.globals["csrf_token"] = csrf_token + +@app.before_request +def protect_post(): + if request.method == "POST" and not secrets.compare_digest(request.form.get("csrf", ""), session.get("csrf", "invalid")): + return "invalid request token", 400 + +@app.get("/") +def dashboard(): + state = get_state() + return render_template("dashboard.html", state=state, profiles=PROFILES) + +@app.post("/profile/") +def apply_profile(name): + profile = PROFILES.get(name) + if not profile: + flash("Unbekanntes Profil", "error") + return redirect(url_for("dashboard")) + result = rpc(f"set-limits {profile['ch']} {profile['vpn']}") + _CACHE["data"] = None + flash(f"Profil {profile['label']} aktiviert" if result.get("ok") else f"Fehler: {result.get('error','unbekannt')}", "success" if result.get("ok") else "error") + return redirect(url_for("dashboard")) + +@app.post("/limits") +def custom_limits(): + try: + ch = float(request.form["ch"]); vpn = float(request.form["vpn"]) + if not 0.1 <= ch <= 100 or not 0.1 <= vpn <= 100: + raise ValueError + except (KeyError, ValueError): + flash("Limits müssen zwischen 0,1 und 100 Mbit liegen", "error") + return redirect(url_for("dashboard")) + result = rpc(f"set-limits {ch:g} {vpn:g}") + _CACHE["data"] = None + flash("Benutzerdefinierte Limits gesetzt" if result.get("ok") else f"Fehler: {result.get('error','unbekannt')}", "success" if result.get("ok") else "error") + return redirect(url_for("dashboard")) + +@app.post("/policy") +def policy(): + mode = request.form.get("mode", "") + try: + min_sessions = int(request.form.get("min_sessions", "2")) + block_minutes = int(request.form.get("block_minutes", "10")) + if mode not in {"off", "monitor", "block"} or not 2 <= min_sessions <= 8 or not 1 <= block_minutes <= 1440: + raise ValueError + except ValueError: + flash("Ungültige Policy-Werte", "error") + return redirect(url_for("dashboard")) + result = rpc(f"set-policy {mode} {min_sessions} {block_minutes}") + _CACHE["data"] = None + flash("Session-Policy aktualisiert" if result.get("ok") else f"Fehler: {result.get('error','unbekannt')}", "success" if result.get("ok") else "error") + return redirect(url_for("dashboard")) + +@app.post("/maintenance/") +def maintenance(action): + mapping = { + "refresh": "limiter refresh", "start": "limiter start", "stop": "limiter stop", + "worker": "restart worker", "admin": "restart admin", + } + command = mapping.get(action) + if not command: + return "unknown action", 404 + result = rpc(command) + _CACHE["data"] = None + flash(f"Aktion {action} gestartet" if result.get("ok") else f"Fehler: {result.get('error','unbekannt')}", "success" if result.get("ok") else "error") + return redirect(url_for("dashboard")) + +@app.get("/api/status") +def api_status(): + return jsonify(get_state()) + +@app.get("/health") +def health(): + state = get_state() + return jsonify({"ok": bool(state.get("ok")), "backend": "reachable" if state else "unreachable"}), 200 if state.get("ok") else 503 From c62a3ca8b319830269df9131ddc1d53bca76aa40 Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:03:57 +0200 Subject: [PATCH 2/8] feat(control): add stream-control/templates/base.html --- stream-control/templates/base.html | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 stream-control/templates/base.html diff --git a/stream-control/templates/base.html b/stream-control/templates/base.html new file mode 100644 index 0000000..fd38237 --- /dev/null +++ b/stream-control/templates/base.html @@ -0,0 +1,22 @@ + + + + + StreamScope Control + + + + + +
◈StreamScope
+
+

REMOTE CONTROL

TV & Session Policy

{{ 'OVH ONLINE' if state.get('ok') else 'OVH OFFLINE' }}
+ {% with messages=get_flashed_messages(with_categories=true) %}{% for category,message in messages %}
{{ '✓' if category=='success' else '!' }}

{{ message }}

{% endfor %}{% endwith %} + {% block content %}{% endblock %} +
+ From 67f713347c7c462f4f48282a93ba47743de4e0a9 Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:03:57 +0200 Subject: [PATCH 3/8] feat(control): add stream-control/templates/dashboard.html --- stream-control/templates/dashboard.html | 58 +++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 stream-control/templates/dashboard.html diff --git a/stream-control/templates/dashboard.html b/stream-control/templates/dashboard.html new file mode 100644 index 0000000..63a5f5a --- /dev/null +++ b/stream-control/templates/dashboard.html @@ -0,0 +1,58 @@ +{% extends 'base.html' %}{% block content %} +{% set limits=state.get('limits',{}) %}{% set tc=state.get('tc',{}) %}{% set policy=state.get('policy',{}) %} +
+
REGION-PROFIL{{ limits.get('ch','—') }} Mbittc: {{ tc.get('ch','—') }} Mbit
+
CLOUD-PROFIL{{ limits.get('vpn','—') }} Mbittc: {{ tc.get('vpn','—') }} Mbit
+
SESSIONS{{ state.get('active_sessions','—') }}{{ state.get('active_blocks',0) }} aktive Sperren
+
POLICY{{ ('AUS' if not policy.get('enabled') else policy.get('mode','—')|upper) }}ab {{ policy.get('min_sessions','—') }} Streams
+
+ +

SCHNELLWAHL

Traffic-Profile

Wirkt sofort auf die aktiven tc-Klassen am OVH
+
+ {% for key,p in profiles.items() %} +
+

{{ p.label }}

{{ p.ch }} / {{ p.vpn }} MbitRegion / Cloud +
+ {% endfor %} +
+
+ +
+

MANUELL

Bandbreiten

+
+ + + + +
+
+

SESSION POLICY

Mehrfachnutzung

+
+ + + + + +
+
+
+ +
+

RUNTIME

Dienste & Regeln

+
+ {% for name,status in state.get('services',{}).items() %}{% endfor %} + + + +
{{ name }}{{ status }}
Markierungsregeln{{ state.get('mark_rules','—') }}
Region-Netze{{ state.get('ipsets',{}).get('geo-a-v4',0)+state.get('ipsets',{}).get('geo-a-v6',0) }}
Cloud-Netze{{ state.get('ipsets',{}).get('cloud-v4',0)+state.get('ipsets',{}).get('cloud-v6',0) }}
+
+ {% for action,label,cls in [('refresh','Netzlisten aktualisieren','ghost'),('worker','Worker neu starten','ghost'),('admin','Admin neu starten','ghost')] %}
{% endfor %} +
+
+

EREIGNISSE

Letzte Policy-Aktionen

+
{% for e in state.get('recent_events',[]) %}
{{ e.kind }}
{{ e.user_name or 'System' }}{{ e.detail }}
{% else %}

Keine Ereignisse vorhanden.

{% endfor %}
+
+
+ +{% if state.get('error') %}
!

{{ state.error }}

{% endif %} +{% endblock %} From 9aceb1076d7bcc5842f7043c67f37395f9432cdc Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:03:58 +0200 Subject: [PATCH 4/8] feat(control): add stream-control/static/admin.css --- stream-control/static/admin.css | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 stream-control/static/admin.css diff --git a/stream-control/static/admin.css b/stream-control/static/admin.css new file mode 100644 index 0000000..dc36270 --- /dev/null +++ b/stream-control/static/admin.css @@ -0,0 +1,5 @@ +:root{--bg:#0d1728;--bg2:#0a1321;--sidebar:#09121f;--panel:#172338;--panel2:#1b2940;--border:#293953;--text:#f4f6fb;--muted:#95a4bb;--dim:#65758e;--violet:#7857f6;--violet2:#a88dff;--cyan:#26c6da;--green:#32d6a3;--yellow:#f1c84b;--red:#ff667d;--shadow:0 16px 42px rgba(0,0,0,.2);--sidebar-w:248px}html[data-theme=light]{--bg:#eef2f8;--bg2:#e6ebf4;--sidebar:#fff;--panel:#fff;--panel2:#f7f9fc;--border:#d7deea;--text:#172033;--muted:#617087;--dim:#8390a4;--shadow:0 12px 30px rgba(36,52,76,.1)}*{box-sizing:border-box}html,body{margin:0;min-height:100%;background:radial-gradient(circle at 80% 0,rgba(105,82,242,.12),transparent 34%),var(--bg);color:var(--text);font-family:Inter,ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;font-feature-settings:"cv01","ss03"}body{padding-left:var(--sidebar-w)}a{color:inherit;text-decoration:none}button,input,select{font:inherit}.sidebar{position:fixed;inset:0 auto 0 0;width:var(--sidebar-w);padding:28px 16px 24px;background:var(--sidebar);border-right:1px solid var(--border);display:flex;flex-direction:column;z-index:20}.brand{display:flex;align-items:center;gap:11px;font-size:21px;font-weight:750;letter-spacing:-.6px;padding:0 10px}.brand>span:last-child>span{color:#bcaeff;font-weight:500}.brand-mark{display:grid;place-items:center;width:39px;height:39px;border-radius:50%;background:linear-gradient(145deg,#8767ff,#5b3edc);box-shadow:0 0 25px rgba(120,87,246,.36);font-size:25px}.nav-label,.eyebrow{font-size:10px;letter-spacing:1.8px;color:#9183ef;font-weight:800}.nav-label{margin:34px 12px 12px}.sidebar nav{display:grid;gap:5px}.nav-item{display:flex;align-items:center;gap:13px;padding:11px 14px;border-radius:9px;color:var(--muted);font-size:14px;border-left:3px solid transparent}.nav-item i{font-style:normal;color:#a9b5c8;width:17px;text-align:center}.nav-item:hover{background:rgba(120,87,246,.08);color:var(--text)}.nav-item.active{background:linear-gradient(90deg,rgba(120,87,246,.2),rgba(120,87,246,.08));border-left-color:var(--violet);color:var(--text)}.nav-item.active i{color:var(--violet2)}.sidebar-foot{margin-top:auto;display:flex;align-items:center;gap:10px;padding:13px;border:1px solid var(--border);border-radius:10px;background:var(--panel)}.sidebar-foot div{display:flex;flex-direction:column}.sidebar-foot strong{font-size:13px}.sidebar-foot small{color:var(--muted);font-size:10px;margin-top:2px}.online-dot,.status-pill b{width:9px;height:9px;background:var(--green);border-radius:50%;box-shadow:0 0 11px var(--green)}.mobile-head{display:none}main{width:min(1530px,100%);margin:0 auto;padding:28px 34px 70px}.topbar{display:flex;align-items:center;justify-content:space-between;padding-bottom:22px;margin-bottom:28px;border-bottom:1px solid var(--border)}.topbar h1{margin:5px 0 0;font-size:25px;line-height:1.1;letter-spacing:-.5px}.top-actions,.action-row{display:flex;align-items:center;gap:9px}.status-pill,.badge{display:inline-flex;align-items:center;gap:7px;border:1px solid var(--border);border-radius:999px;background:var(--panel);padding:7px 10px;font-size:10px;font-weight:800;letter-spacing:.7px;color:var(--muted)}.icon-btn,.ghost,.primary,.success,.danger{border:1px solid var(--border);border-radius:7px;padding:8px 12px;background:rgba(255,255,255,.025);color:var(--text);cursor:pointer;font-weight:650;font-size:12px}.icon-btn{width:35px;height:35px;padding:0}.ghost:hover{border-color:var(--violet);background:rgba(120,87,246,.1)}.primary{background:linear-gradient(135deg,var(--violet),#633be8);border-color:#8e72ff;box-shadow:0 7px 20px rgba(100,66,230,.22)}.primary:disabled{opacity:.5}.success{background:rgba(50,214,163,.12);color:var(--green);border-color:rgba(50,214,163,.3)}.danger{background:rgba(255,102,125,.1);color:var(--red);border-color:rgba(255,102,125,.3)}.alert,.notice{padding:14px 16px;border:1px solid var(--border);border-radius:9px;background:var(--panel);margin:0 0 18px}.alert.success{border-color:rgba(50,214,163,.35);color:var(--green)}.alert.error,.notice.warn{border-color:rgba(255,102,125,.4);color:var(--red)}.kpi-grid{display:grid;grid-template-columns:repeat(4,1fr);gap:14px;margin-bottom:14px}.kpi,.panel,.profile{background:linear-gradient(145deg,rgba(255,255,255,.035),rgba(255,255,255,.012)),var(--panel);border:1px solid var(--border);border-radius:13px;box-shadow:var(--shadow)}.kpi{padding:18px 19px;display:flex;flex-direction:column;min-height:122px;position:relative;overflow:hidden}.kpi:after{content:"";position:absolute;right:-25px;bottom:-30px;width:90px;height:90px;border-radius:50%;background:rgba(120,87,246,.1)}.kpi>span{font-size:10px;letter-spacing:1.3px;color:var(--muted);font-weight:750}.kpi>strong{font-size:31px;letter-spacing:-1.2px;margin:12px 0 2px}.kpi em,.limit-card em{font-style:normal;font-size:12px;color:var(--muted);font-weight:600}.kpi small,.limit-card small{color:var(--dim);font-size:11px}.grid{display:grid;gap:14px;margin-bottom:14px}.grid.two{grid-template-columns:repeat(2,minmax(0,1fr))}.grid.three{grid-template-columns:repeat(3,minmax(0,1fr))}.span-2{grid-column:span 2}.panel{padding:18px;min-width:0}.panel-head{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:16px}.panel-head h2{margin:4px 0 0;font-size:17px;letter-spacing:-.25px}.legend{display:flex;gap:12px;font-size:10px;font-weight:700}.legend span:before{content:"";display:inline-block;width:7px;height:7px;border-radius:50%;margin-right:5px}.legend .ch:before{background:var(--cyan)}.legend .vpn:before{background:var(--violet)}.legend .default:before{background:var(--green)}.chart{width:100%;height:250px;overflow:visible}.chart .gridline{stroke:var(--border);stroke-width:1;vector-effect:non-scaling-stroke}.line{fill:none;stroke-width:2.5;vector-effect:non-scaling-stroke}.line.ch{stroke:var(--cyan)}.line.vpn{stroke:var(--violet)}.line.default{stroke:var(--green)}.chart-foot{display:flex;justify-content:space-between;color:var(--dim);font-size:10px}.chart-foot strong{color:var(--text)}.world-map{position:relative;min-height:250px;display:grid;place-items:center;background:radial-gradient(circle at 50% 50%,rgba(120,87,246,.07),transparent 65%);overflow:hidden;border-radius:10px}.world-map img{width:100%;height:auto;opacity:.42}.map-dot{position:absolute;width:11px;height:11px;border-radius:50%;background:var(--green);border:2px solid var(--panel);box-shadow:0 0 0 5px rgba(50,214,163,.13);transform:translate(-50%,-50%)}.map-dot:hover:after{content:attr(data-label);position:absolute;bottom:15px;left:50%;transform:translateX(-50%);white-space:nowrap;background:#050a12;color:#fff;padding:5px 7px;border-radius:5px;font-size:10px}.map-legend{display:flex;gap:7px;flex-wrap:wrap;margin-top:10px}.map-legend span{font-size:10px;color:var(--muted)}.rank-list{display:grid}.rank-row{display:grid;grid-template-columns:27px minmax(0,1fr) auto;align-items:center;gap:10px;padding:10px 0;border-bottom:1px solid var(--border)}.rank-row:last-child{border:0}.rank-row>b{display:grid;place-items:center;width:25px;height:25px;background:var(--panel2);border-radius:6px;color:var(--violet2);font-size:11px}.rank-row div{min-width:0;display:flex;flex-direction:column}.rank-row strong,.rank-row small{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.rank-row strong{font:500 11px ui-monospace,monospace}.rank-row small{color:var(--dim);font-size:9px;margin-top:3px}.rank-row>span{font-size:11px;font-weight:750}.session-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:9px}.session-grid.wide{grid-template-columns:1fr}.session-card{display:flex;align-items:center;gap:11px;padding:12px;border:1px solid var(--border);background:var(--panel2);border-radius:9px;min-width:0}.session-icon{display:grid;place-items:center;width:35px;height:35px;flex:0 0 35px;border-radius:8px;background:rgba(120,87,246,.14);color:var(--violet2);font-size:12px}.session-main{display:flex;flex-direction:column;min-width:0;flex:1}.session-main strong,.session-main span,.session-main small{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.session-main strong{font-size:12px}.session-main span{font-size:11px;color:var(--muted);margin:3px 0}.session-main small,.session-meta small{font-size:9px;color:var(--dim)}.playing{font-size:8px;color:var(--green);font-weight:800}.session-meta{text-align:right;display:flex;flex-direction:column;font-size:10px}.empty{padding:28px;text-align:center;color:var(--dim)}.table-wrap{overflow:auto;border:1px solid var(--border);border-radius:9px}table{width:100%;border-collapse:collapse;font-size:12px}th{text-align:left;color:var(--dim);font-size:9px;letter-spacing:1px;padding:11px 12px;background:var(--bg2)}td{padding:11px 12px;border-top:1px solid var(--border);vertical-align:middle}td strong,td small{display:block}td small{margin-top:3px;color:var(--dim)}.mono{font-family:ui-monospace,monospace}.search,input,select{border:1px solid var(--border);background:var(--bg2);color:var(--text);padding:8px 10px;border-radius:7px;outline:none}.search{width:min(280px,100%)}input:focus,select:focus{border-color:var(--violet)}.badge.active{color:var(--green);border-color:rgba(50,214,163,.3)}.badge.danger{color:var(--red);border-color:rgba(255,102,125,.3)}.profile-grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:12px;margin-bottom:14px}.profile{padding:15px;position:relative;overflow:hidden}.profile:before{content:"";position:absolute;inset:0 auto 0 0;width:3px;background:var(--profile)}.profile.selected{border-color:var(--profile)}.profile>div{display:flex;align-items:center;gap:8px}.profile-dot{width:9px;height:9px;border-radius:50%;background:var(--profile);box-shadow:0 0 12px var(--profile)}.profile div small{margin-left:auto;color:var(--profile);font-size:8px;font-weight:800}.profile p{font-size:11px;color:var(--muted)}.profile button{width:100%}.limit-card>strong{display:block;font-size:28px;margin:12px 0 3px}.limit-card form{display:flex;gap:7px;margin-top:18px}.limit-card input{min-width:0;width:100%}.user-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}.user-card{display:grid;grid-template-columns:39px 1fr;gap:11px;padding:13px;border:1px solid var(--border);border-radius:9px;background:var(--panel2)}.avatar{display:grid;place-items:center;width:39px;height:39px;border-radius:50%;background:linear-gradient(135deg,var(--violet),#2fa6d5);font-weight:800}.user-info{display:flex;flex-direction:column}.user-info small{color:var(--dim);font-size:9px;margin-top:3px}.user-card form{grid-column:1/-1;display:flex;align-items:end;gap:7px}.user-card label{position:relative;flex:1;font-size:9px;color:var(--dim)}.user-card label input{width:100%;margin-top:4px}.user-card label span{position:absolute;right:8px;bottom:9px}.notice{display:flex;align-items:center;justify-content:space-between}.notice strong{color:var(--green)}.notice.warn strong{color:var(--red)}.notice p{margin:4px 0 0;color:var(--muted);font-size:11px}.inline{display:flex;gap:6px}.event-list>div,.schedule-list>div{display:flex;gap:11px;align-items:center;padding:11px 0;border-bottom:1px solid var(--border)}.event-list>div>div,.schedule-list>div>div{display:flex;flex-direction:column;flex:1}.event-list p{margin:3px 0;color:var(--muted);font-size:11px}.event-list time{font-size:9px;color:var(--dim)}.event-icon,.schedule-icon{display:grid;place-items:center;width:28px;height:28px;border-radius:50%;background:rgba(120,87,246,.12);color:var(--violet2)}.form-panel label,.profile-list label{font-size:10px;color:var(--muted);display:flex;flex-direction:column;gap:5px;position:relative}.form-grid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin-bottom:15px}.form-grid .full{grid-column:1/-1}.form-grid label small{position:absolute;right:8px;bottom:9px;font-size:8px;color:var(--dim)}.switch input{display:none}.switch span{display:block;width:42px;height:23px;border-radius:15px;background:var(--bg2);border:1px solid var(--border);position:relative}.switch span:after{content:"";position:absolute;width:17px;height:17px;left:2px;top:2px;background:var(--dim);border-radius:50%;transition:.2s}.switch input:checked+span:after{left:21px;background:var(--green)}.profile-list{display:grid;gap:8px}.profile-list form{display:grid;grid-template-columns:1.4fr repeat(3,.7fr) 35px auto;gap:7px;align-items:end;padding:10px;border:1px solid var(--border);border-radius:8px}.profile-list input{width:100%;min-width:0}.profile-list input[type=color]{height:34px;padding:2px}.form-grid fieldset{border:0;padding:0;margin:0}.form-grid legend{font-size:10px;color:var(--muted);margin-bottom:6px}.day{display:inline-block!important}.day input{display:none}.day span{display:inline-grid;place-items:center;width:35px;height:30px;border:1px solid var(--border);border-radius:6px;background:var(--bg2)}.day input:checked+span{color:#fff;border-color:var(--violet);background:rgba(120,87,246,.3)}details{margin-top:15px}summary{cursor:pointer;color:var(--muted);font-size:11px}pre{white-space:pre-wrap;overflow:auto;color:#91e9c9;background:var(--bg2);padding:12px;border-radius:8px;font-size:10px}.toast{position:fixed;right:20px;bottom:20px;opacity:0;pointer-events:none;padding:10px 14px;background:#050a12;border:1px solid var(--border);border-radius:7px;transition:.2s}.toast.show{opacity:1}.mobile-head{height:62px} +@media(max-width:1100px){.kpi-grid,.profile-grid{grid-template-columns:repeat(2,1fr)}.user-grid{grid-template-columns:repeat(2,1fr)}.grid.three{grid-template-columns:1fr}.span-2{grid-column:auto}.grid.two{grid-template-columns:1fr}.profile-list form{grid-template-columns:repeat(3,1fr)}}@media(max-width:760px){body{padding-left:0;padding-top:62px}.sidebar{transform:translateX(-100%);transition:.2s}.sidebar.open{transform:none}.mobile-head{display:flex;position:fixed;inset:0 0 auto;z-index:19;align-items:center;justify-content:space-between;padding:10px 15px;background:var(--sidebar);border-bottom:1px solid var(--border)}.mobile-head .brand{font-size:17px;padding:0}.mobile-head .brand-mark{width:33px;height:33px}.mobile-head button{background:transparent;color:var(--text);border:0;font-size:22px}main{padding:19px 14px 80px}.topbar{align-items:flex-start}.topbar h1{font-size:21px}.top-actions .ghost,.status-pill{display:none}.kpi-grid{grid-template-columns:repeat(2,1fr);gap:8px}.kpi{min-height:105px;padding:14px}.kpi>strong{font-size:23px}.session-grid,.user-grid,.profile-grid{grid-template-columns:1fr}.panel{padding:14px}.chart{height:180px}.profile-list form{grid-template-columns:1fr 1fr}.form-grid{grid-template-columns:1fr}.form-grid .full{grid-column:auto}.notice{align-items:flex-start;gap:12px}.notice p{font-size:10px}.table-wrap{margin:0 -14px;border-left:0;border-right:0;border-radius:0}td,th{padding:10px 8px}.session-meta{display:none}} + +.sidebar-foot{margin-top:auto;padding:14px;color:var(--muted);display:flex;align-items:center;gap:9px}.status-dot{width:9px;height:9px;border-radius:50%;background:var(--red);box-shadow:0 0 12px rgba(255,102,125,.5)}.status-dot.ok{background:var(--green);box-shadow:0 0 12px rgba(50,214,163,.5)}.control-profiles{display:grid;grid-template-columns:repeat(4,1fr);gap:12px;padding:18px}.profile-card{position:relative;padding:18px;border:1px solid var(--border);border-top:3px solid var(--accent);border-radius:12px;background:var(--panel2);display:flex;flex-direction:column;gap:8px}.profile-card h3{margin:0}.profile-card strong{font-size:22px}.profile-card small{color:var(--muted)}.profile-dot{position:absolute;right:16px;top:16px;width:10px;height:10px;border-radius:50%;background:var(--accent);box-shadow:0 0 12px var(--accent)}.profile-card button{margin-top:8px}.compact-form{padding:18px}.compact-form label{display:flex;flex-direction:column;gap:7px;color:var(--muted);font-size:12px}.compact-form input,.compact-form select{width:100%;background:var(--bg2);border:1px solid var(--border);border-radius:8px;color:var(--text);padding:11px}.compact-form button.full{grid-column:1/-1}.action-row{display:flex;gap:8px;flex-wrap:wrap;padding:14px}.event-list{padding:6px 18px 18px}.event{display:flex;gap:12px;padding:11px 0;border-bottom:1px solid var(--border)}.event:last-child{border:0}.event-kind{min-width:66px;height:max-content;padding:4px 7px;border-radius:6px;background:rgba(120,87,246,.15);color:var(--violet2);font:10px ui-monospace,monospace;text-transform:uppercase}.event div{min-width:0}.event strong,.event small{display:block}.event small{color:var(--muted);margin-top:4px;overflow-wrap:anywhere}.muted{color:var(--muted)} +@media(max-width:900px){.control-profiles{grid-template-columns:repeat(2,1fr)}}@media(max-width:560px){.control-profiles{grid-template-columns:1fr}.action-row form,.action-row button{width:100%}} From a6516286f144f803a157e0972dda8ab12ba92c86 Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:03:59 +0200 Subject: [PATCH 5/8] feat(control): add stream-control/static/icon.svg --- stream-control/static/icon.svg | 1 + 1 file changed, 1 insertion(+) create mode 100644 stream-control/static/icon.svg diff --git a/stream-control/static/icon.svg b/stream-control/static/icon.svg new file mode 100644 index 0000000..e7468c2 --- /dev/null +++ b/stream-control/static/icon.svg @@ -0,0 +1 @@ + \ No newline at end of file From d052cf3eff2e3d296a3d75f577a42677da859f57 Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:03:59 +0200 Subject: [PATCH 6/8] feat(control): add stream-control/systemd/network-policy-cache.service --- .../systemd/network-policy-cache.service | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 stream-control/systemd/network-policy-cache.service diff --git a/stream-control/systemd/network-policy-cache.service b/stream-control/systemd/network-policy-cache.service new file mode 100644 index 0000000..a1a95be --- /dev/null +++ b/stream-control/systemd/network-policy-cache.service @@ -0,0 +1,21 @@ +[Unit] +Description=Network Profile Cache +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +User=root +WorkingDirectory=/app-config/netprofile-cache +EnvironmentFile=/app-config/netprofile-cache/runtime.env +ExecStart=/usr/bin/python3 -m gunicorn --bind 127.0.0.1:9092 --workers 1 --threads 4 --timeout 45 --access-logfile - app:app +Restart=always +RestartSec=5 +NoNewPrivileges=true +PrivateTmp=true +ProtectHome=read-only +ProtectSystem=strict +ReadWritePaths=/app-config/netprofile-cache + +[Install] +WantedBy=multi-user.target From a52a4b1373431635202298d09935cb9c991e76ef Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:04:00 +0200 Subject: [PATCH 7/8] feat(control): add stream-control/nginx/center.sascha-lutz.de --- stream-control/nginx/center.sascha-lutz.de | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 stream-control/nginx/center.sascha-lutz.de diff --git a/stream-control/nginx/center.sascha-lutz.de b/stream-control/nginx/center.sascha-lutz.de new file mode 100644 index 0000000..015ec18 --- /dev/null +++ b/stream-control/nginx/center.sascha-lutz.de @@ -0,0 +1,22 @@ +server { + listen 80; + listen [::]:80; + server_name center.sascha-lutz.de; + + auth_basic "StreamScope Control"; + auth_basic_user_file /etc/nginx/.center.htpasswd; + + location / { + proxy_pass http://127.0.0.1:9092; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 60s; + proxy_connect_timeout 10s; + add_header X-Content-Type-Options nosniff always; + add_header X-Frame-Options DENY always; + add_header Referrer-Policy no-referrer always; + } +} From 9d6b302a16ba49f2ad657c6eeebf270c220637cd Mon Sep 17 00:00:00 2001 From: sascha Date: Mon, 7 Sep 2026 09:04:01 +0200 Subject: [PATCH 8/8] feat(control): add stream-control/agent/netstate --- stream-control/agent/netstate | 153 ++++++++++++++++++++++++++++++++++ 1 file changed, 153 insertions(+) create mode 100644 stream-control/agent/netstate diff --git a/stream-control/agent/netstate b/stream-control/agent/netstate new file mode 100644 index 0000000..381a043 --- /dev/null +++ b/stream-control/agent/netstate @@ -0,0 +1,153 @@ +#!/usr/bin/env python3 +"""Restricted network-profile helper for the edge host.""" +from __future__ import annotations +import json, os, re, shlex, sqlite3, subprocess, sys, time + +DB = "/var/lib/streamscope/control.db" +DEV = "ens3" +CLASSES = {"ch": "1:200", "vpn": "1:300", "default": "1:999"} +SERVICES = ("netqos", "streamscope-worker", "streamscope-admin", "promtail") + +def run(argv, timeout=30): + try: + p = subprocess.run(argv, capture_output=True, text=True, timeout=timeout) + return p.returncode, p.stdout.strip(), p.stderr.strip() + except Exception as exc: + return 125, "", str(exc) + +def db(): + c = sqlite3.connect(DB, timeout=15) + c.row_factory = sqlite3.Row + c.execute("PRAGMA busy_timeout=15000") + return c + +def rate_map(): + rc, out, _ = run(["sudo", "tc", "class", "show", "dev", DEV]) + found = {} + for line in out.splitlines(): + m = re.search(r"^class htb (1:\w+).*?\brate\s+([0-9.]+)([KMG])bit", line, re.I) + if not m: + continue + value = float(m.group(2)) * {"K": .001, "M": 1, "G": 1000}[m.group(3).upper()] + target = next((k for k, v in CLASSES.items() if v == m.group(1)), m.group(1)) + found[target] = value + return found, rc + +def state(): + c = db() + limits = {r["target"]: r["limit_mbit"] for r in c.execute("SELECT target,limit_mbit FROM global_limits")} + settings = {r["key"]: r["value"] for r in c.execute("SELECT key,value FROM settings")} + active_sessions = c.execute("SELECT count(*) FROM session_history WHERE active=1").fetchone()[0] + recent = [dict(r) for r in c.execute("SELECT ts,user_name,kind,detail FROM multisession_events ORDER BY id DESC LIMIT 8")] + active_blocks = c.execute("SELECT count(*) FROM multisession_blocks WHERE active=1 AND expires_at>strftime('%s','now')").fetchone()[0] + c.close() + tc, tc_rc = rate_map() + ipsets = {} + for name in ("geo-a-v4", "geo-a-v6", "cloud-v4", "cloud-v6", "persist-v4", "persist-v6"): + rc, out, _ = run(["sudo", "ipset", "list", name, "-t"]) + m = re.search(r"Number of entries:\s*(\d+)", out) + ipsets[name] = int(m.group(1)) if m else 0 + services = {} + for name in SERVICES: + rc, out, _ = run(["systemctl", "is-active", name]) + services[name] = out or "unknown" + rc, rules, _ = run(["sudo", "iptables", "-t", "mangle", "-S"]) + return { + "ok": tc_rc == 0 and all(v == "active" for k, v in services.items() if k != "netqos"), + "ts": int(time.time()), "limits": limits, "tc": tc, "ipsets": ipsets, + "services": services, "active_sessions": active_sessions, "active_blocks": active_blocks, + "policy": { + "enabled": settings.get("multisession_enabled", "0") == "1", + "mode": settings.get("multisession_mode", "monitor"), + "min_sessions": int(settings.get("multisession_min_sessions", "2")), + "block_minutes": int(settings.get("multisession_block_minutes", "60")), + "persist_seconds": int(settings.get("multisession_persist_seconds", "60")), + }, + "mark_rules": sum(1 for line in rules.splitlines() if "--set-xmark" in line or "--set-mark" in line), + "recent_events": recent, + } + +def set_limits(ch, vpn): + values = {"ch": float(ch), "vpn": float(vpn)} + if any(not 0.1 <= value <= 100 for value in values.values()): + raise ValueError("rate outside 0.1..100 Mbit") + old, _ = rate_map() + changed = [] + try: + for target, value in values.items(): + cls = CLASSES[target] + rc, out, err = run(["sudo", "tc", "class", "change", "dev", DEV, "parent", "1:", "classid", cls, "htb", "rate", f"{value:g}mbit", "ceil", f"{value:g}mbit"]) + if rc: + raise RuntimeError(err or out or f"tc failed for {target}") + changed.append(target) + c = db() + for target, value in values.items(): + c.execute("UPDATE global_limits SET limit_mbit=?,updated_at=datetime('now') WHERE target=?", (value, target)) + c.execute("UPDATE limit_profiles SET active=0") + c.commit(); c.close() + except Exception: + for target in changed: + if target in old: + value = old[target]; cls = CLASSES[target] + run(["sudo", "tc", "class", "change", "dev", DEV, "parent", "1:", "classid", cls, "htb", "rate", f"{value:g}mbit", "ceil", f"{value:g}mbit"]) + raise + return {"ok": True, "limits": values, "tc": rate_map()[0]} + +def set_policy(mode, min_sessions=None, block_minutes=None): + if mode not in {"off", "monitor", "block"}: + raise ValueError("invalid policy mode") + c = db() + c.execute("UPDATE settings SET value=? WHERE key='multisession_enabled'", ("0" if mode == "off" else "1",)) + if mode != "off": + c.execute("UPDATE settings SET value=? WHERE key='multisession_mode'", (mode,)) + if min_sessions is not None: + value = int(min_sessions) + if not 2 <= value <= 8: raise ValueError("min sessions outside 2..8") + c.execute("UPDATE settings SET value=? WHERE key='multisession_min_sessions'", (str(value),)) + if block_minutes is not None: + value = int(block_minutes) + if not 1 <= value <= 1440: raise ValueError("block minutes outside 1..1440") + c.execute("UPDATE settings SET value=? WHERE key='multisession_block_minutes'", (str(value),)) + c.commit(); c.close() + rc, out, err = run(["sudo", "systemctl", "restart", "streamscope-worker"], timeout=20) + if rc: raise RuntimeError(err or out or "worker restart failed") + return {"ok": True, "policy": state()["policy"]} + +def background_limiter(action): + if action not in {"start", "stop", "refresh"}: raise ValueError("invalid limiter action") + unit = "netprofile-rebuild" if action in {"start", "refresh"} else "netprofile-clear" + rc, out, err = run(["sudo", "systemd-run", "--unit", unit, "--collect", "/usr/lib/systemd/system/netqos/link-optimizer.sh", action], timeout=15) + if rc and "already exists" not in (out + err): raise RuntimeError(err or out) + return {"ok": True, "started": action} + +def restart(name): + mapping = {"worker": "streamscope-worker", "admin": "streamscope-admin"} + if name not in mapping: raise ValueError("invalid service") + rc, out, err = run(["sudo", "systemctl", "restart", mapping[name]], timeout=20) + if rc: raise RuntimeError(err or out) + return {"ok": True, "restarted": name} + +def main(): + raw = os.environ.get("SSH_ORIGINAL_COMMAND", "state").strip() + argv = shlex.split(raw) + if not argv: argv = ["state"] + if argv == ["state"]: + result = state() + elif len(argv) == 3 and argv[0] == "set-limits": + result = set_limits(argv[1], argv[2]) + elif argv[0] == "set-policy" and 2 <= len(argv) <= 4: + result = set_policy(argv[1], argv[2] if len(argv) > 2 else None, argv[3] if len(argv) > 3 else None) + elif len(argv) == 2 and argv[0] == "limiter": + result = background_limiter(argv[1]) + elif len(argv) == 2 and argv[0] == "restart": + result = restart(argv[1]) + else: + raise ValueError("unsupported command") + print(json.dumps(result, ensure_ascii=False, separators=(",", ":"))) + +if __name__ == "__main__": + try: + main() + except Exception as exc: + print(json.dumps({"ok": False, "error": str(exc)[:300]}, ensure_ascii=False, separators=(",", ":"))) + sys.exit(1)