refactor: daemon collectors, thin webui proxies, pure config reads

- move state collectors from lib/state.py to daemon/collectors/ (7
  modules, registration side-effect; daemon/server.py imports the
  package before the first populate())
- webui/api: new daemon_route() decorator factory in common.py
  collapses the try/except daemon-proxy boilerplate in all 8
  blueprints (rules/params/body/transform keep responses identical)
- firewall: interface-coverage invariant — config is the source of
  truth for zone interfaces (absent key = empty, no hands-off
  zones); pure validate_coverage() enforced at save (400) and apply
  (409, force: true overrides), top-level `unmanaged` exemption
- lib: get_config() reads are now pure (no dir creation or writes);
  new lib/bootstrap.py creates runtime dirs and persists the
  one-shot nginx legacy migration at daemon start, after
  system_import (lib.nginx.migrate_config_file)
- lib/common: compute_pending() apply-bookkeeping helper
- daemon: emit_and_refresh() handler helper; refresh_state(bump=) so
  /status/refresh no longer bumps versions (poll/mutation only)
- acme: move --log last so acme.sh never treats a real arg as the
  log-file argument
- docs: AGENTS.md, config.md, state-model.md, api.md updated;
  HARDEN.md dropped (plan implemented); apply-confirm force wording

Tests: 917 passed; ruff check + format clean.
This commit is contained in:
2026-09-03 00:40:56 +00:00
parent 89b64960f3
commit faa076370d
49 changed files with 2834 additions and 3821 deletions
+112 -296
View File
@@ -3,11 +3,17 @@
Exposed at /api/proxy/* and delegates to vacuum-walld.
"""
import logging
from typing import Any
from flask import Blueprint, request
from flask import Blueprint
from daemon.client import BadRequest, Conflict, NotFound, delete, get, patch, post
from daemon.client import ( # noqa: F401 (resolved via module globals)
BadRequest,
delete,
get,
patch,
post,
)
from daemon.iface import (
DELETE_NGINX_BACKENDS_REMOVE,
DELETE_NGINX_DOMAINS_REMOVE,
@@ -24,144 +30,59 @@ from daemon.iface import (
POST_NGINX_SSL_APPLY,
POST_NGINX_TEST,
)
from webui.api.common import _error, _ok
from webui.api.common import NO_BODY, daemon_route, require_dict_body, void_transform
logger = logging.getLogger(__name__)
bp = Blueprint("proxy", __name__)
@bp.route("/ssl-apply", methods=["POST"])
# ---------------------------------------------------------------------------
# Config
# ---------------------------------------------------------------------------
@daemon_route(POST_NGINX_SSL_APPLY, bp, body=NO_BODY, transform=void_transform)
def ssl_apply_bp():
"""Apply SSL snippet config.
POST /api/proxy/ssl-apply
Returns:
``{"ok": true}`` on success.
Raises:
RuntimeError: If nginx SSL snippet write fails.
"""
try:
post(POST_NGINX_SSL_APPLY)
logger.info("SSL snippet written via API")
return _ok(None)
except RuntimeError as exc:
logger.error("Failed to write SSL snippet: %s", exc)
return _error(str(exc), 500)
"""POST /api/proxy/ssl-apply — Apply the SSL snippet config."""
@bp.route("/config", methods=["GET"])
@daemon_route(GET_NGINX_CONFIG, bp)
def get_config_bp():
"""Get the current nginx proxy configuration.
GET /api/proxy/config
Returns:
Current config dict from the daemon.
"""
try:
return _ok(get(GET_NGINX_CONFIG))
except RuntimeError as exc:
logger.error("Failed to read proxy config: %s", exc)
return _error(str(exc), 500)
"""GET /api/proxy/config — Get the current nginx proxy configuration."""
@bp.route("/config", methods=["POST"])
@daemon_route(
POST_NGINX_CONFIG, bp, precheck=require_dict_body, transform=void_transform
)
def post_config():
"""Save the nginx proxy configuration.
POST /api/proxy/config
Body:
Any JSON object to merge into the config.
Returns:
``{"ok": true}`` on success.
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
try:
post(POST_NGINX_CONFIG, body)
logger.info("Proxy config saved: %s", sorted(body.keys()))
return _ok(None)
except BadRequest as exc:
logger.info("Proxy config save rejected: %s", exc)
return _error(str(exc), 400)
except RuntimeError as exc:
logger.error("Failed to save proxy config: %s", exc)
return _error(str(exc), 500)
"""POST /api/proxy/config — Save the nginx proxy configuration."""
@bp.route("/config", methods=["PATCH"])
@daemon_route(
PATCH_NGINX_CONFIG, bp, precheck=require_dict_body, transform=void_transform
)
def patch_config():
"""Partially update the nginx proxy configuration.
PATCH /api/proxy/config
Body:
JSON object with fields to patch.
Returns:
``{"ok": true}`` on success.
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
try:
patch(PATCH_NGINX_CONFIG, body)
logger.info("Proxy config patched: %s", sorted(body.keys()))
return _ok(None)
except BadRequest as exc:
logger.info("Proxy config patch rejected: %s", exc)
return _error(str(exc), 400)
except RuntimeError as exc:
logger.error("Failed to patch proxy config: %s", exc)
return _error(str(exc), 500)
"""PATCH /api/proxy/config — Partially update the nginx proxy configuration."""
@bp.route("/domains", methods=["GET"])
@daemon_route(GET_NGINX_DOMAINS, bp)
def list_domains():
"""List all configured proxy domains.
GET /api/proxy/domains
Returns:
List of domain dicts from the daemon.
"""
try:
return _ok(get(GET_NGINX_DOMAINS))
except RuntimeError as exc:
logger.error("Failed to list proxy domains: %s", exc)
return _error(str(exc), 500)
"""GET /api/proxy/domains — List all configured proxy domains."""
@bp.route("/domains", methods=["POST"])
def add_domain_bp():
"""Add a new proxy domain referencing a backend.
# ---------------------------------------------------------------------------
# Domain CRUD
# ---------------------------------------------------------------------------
POST /api/proxy/domains
Body fields:
domain: Domain name.
backend: Backend name to proxy through.
cert: Optional certificate type.
force_ssl: Optional SSL redirect flag (default ``true``).
auth: Optional domain-level auth override.
Returns:
``{"domain": ...}`` on success.
"""
def _add_domain_body(request: Any, _va: Any) -> dict[str, Any]:
body = request.get_json(silent=True) or {}
domain = body.get("domain", "").strip()
domain = (body.get("domain") or "").strip()
if not domain:
return _error("'domain' is required", 400)
backend = body.get("backend", "").strip()
raise ValueError("'domain' is required")
backend = (body.get("backend") or "").strip()
if not backend:
return _error("'backend' is required", 400)
payload = {
raise ValueError("'backend' is required")
payload: dict[str, Any] = {
"domain": domain,
"backend": backend,
"force_ssl": body.get("force_ssl", True),
@@ -170,105 +91,62 @@ def add_domain_bp():
payload["cert"] = body["cert"]
if body.get("auth") is not None:
payload["auth"] = body["auth"]
try:
post(POST_NGINX_DOMAINS_ADD, payload)
logger.info("Proxy domain added via API: %s", domain)
return _ok({"domain": domain})
except BadRequest as exc:
logger.info("Add proxy domain '%s' rejected: %s", domain, exc)
return _error(str(exc), 400)
except RuntimeError as exc:
logger.error("Failed to add proxy domain '%s': %s", domain, exc)
return _error(str(exc), 500)
return payload
@bp.route("/domains/<domain>", methods=["PUT"])
def update_domain_bp(domain):
"""Update an existing proxy domain in-place.
PUT /api/proxy/domains/<domain>
Body fields:
Fields to merge into the domain config.
Returns:
``{"domain": ...}`` on success.
"""
body = request.get_json(silent=True) or {}
if not body:
return _error("Request body must be a JSON object with fields to update", 400)
try:
post(POST_NGINX_DOMAINS_UPDATE, {"domain": domain, **body})
logger.info("Proxy domain '%s' updated via API", domain)
return _ok({"domain": domain})
except BadRequest as exc:
logger.info("Update domain '%s' rejected: %s", domain, exc)
return _error(str(exc), 400)
except NotFound as exc:
logger.info("Domain '%s' not found: %s", domain, exc)
return _error(str(exc), 404)
except RuntimeError as exc:
logger.error("Failed to update domain '%s': %s", domain, exc)
return _error(str(exc), 500)
def _domain_echo(_data: Any, _va: Any, sent: Any) -> Any:
return {"domain": sent.get("domain")}
@bp.route("/domains/<domain>", methods=["DELETE"])
def remove_domain_bp(domain):
"""Remove a proxy domain.
DELETE /api/proxy/domains/<domain>
Returns:
``{"domain": ...}`` on success.
"""
try:
delete(DELETE_NGINX_DOMAINS_REMOVE, {"domain": domain})
logger.info("Proxy domain removed via API: %s", domain)
return _ok({"domain": domain})
except NotFound as exc:
logger.info("Domain '%s' not found: %s", domain, exc)
return _error(str(exc), 404)
except RuntimeError as exc:
logger.error("Failed to remove domain '%s': %s", domain, exc)
return _error(str(exc), 500)
@daemon_route(
POST_NGINX_DOMAINS_ADD,
bp,
rule="/domains",
body=_add_domain_body,
transform=_domain_echo,
)
def add_domain_bp():
"""POST /api/proxy/domains — Add a new proxy domain referencing a backend."""
@bp.route("/apply", methods=["POST"])
def _update_domain_precheck(json: Any, _va: Any) -> None:
if not json:
raise ValueError("Request body must be a JSON object with fields to update")
@daemon_route(
POST_NGINX_DOMAINS_UPDATE,
bp,
rule="/domains/<domain>",
methods=["PUT"],
precheck=_update_domain_precheck,
transform=_domain_echo,
)
def update_domain_bp():
"""PUT /api/proxy/domains/<domain> — Update an existing proxy domain in-place."""
@daemon_route(
DELETE_NGINX_DOMAINS_REMOVE, bp, rule="/domains/<domain>", transform=_domain_echo
)
def remove_domain_bp():
"""DELETE /api/proxy/domains/<domain> — Remove a proxy domain."""
@daemon_route(POST_NGINX_APPLY, bp, body=NO_BODY, transform=void_transform)
def apply_bp():
"""Generate all nginx configs and reload nginx.
POST /api/proxy/apply
Returns:
``{"ok": true}`` on success.
"""
try:
post(POST_NGINX_APPLY)
logger.info("nginx config applied via API")
return _ok(None)
except RuntimeError as exc:
logger.error("Failed to apply nginx config: %s", exc)
return _error(str(exc), 500)
"""POST /api/proxy/apply — Generate all nginx configs and reload nginx."""
@bp.route("/test", methods=["POST"])
def _test_transform(data: Any, _va: Any, _sent: Any) -> Any:
if data.get("valid"):
return {"valid": True, "output": data.get("output", "")}
raise BadRequest(data.get("output", "unknown error"))
@daemon_route(POST_NGINX_TEST, bp, body=NO_BODY, transform=_test_transform)
def test_bp():
"""Test nginx configuration without reloading.
POST /api/proxy/test
Returns:
``{"valid": true, "output": ...}`` on success. Returns 400 if test fails.
"""
try:
result = post(POST_NGINX_TEST)
if result.get("valid"):
return _ok({"valid": True, "output": result.get("output", "")})
return _error(result.get("output", "unknown error"), 400)
except RuntimeError as exc:
logger.error("nginx config test failed: %s", exc)
return _error(str(exc), 500)
"""POST /api/proxy/test — Test nginx configuration without reloading."""
# ---------------------------------------------------------------------------
@@ -276,102 +154,40 @@ def test_bp():
# ---------------------------------------------------------------------------
@bp.route("/backends", methods=["GET"])
def _backend_echo(_data: Any, _va: Any, sent: Any) -> Any:
return {"backend": sent.get("name")}
@daemon_route(GET_NGINX_BACKENDS, bp)
def list_backends():
"""List all configured backends.
GET /api/proxy/backends
Returns:
Dict of backend configs with secrets stripped.
"""
try:
return _ok(get(GET_NGINX_BACKENDS))
except RuntimeError as exc:
logger.error("Failed to list backends: %s", exc)
return _error(str(exc), 500)
"""GET /api/proxy/backends — List all configured backends (secrets stripped)."""
@bp.route("/backends", methods=["PATCH"])
@daemon_route(
PATCH_NGINX_BACKENDS, bp, precheck=require_dict_body, transform=_backend_echo
)
def patch_backend_bp():
"""Partially update a backend entry.
PATCH /api/proxy/backends
Body fields:
name: Backend name.
label: Optional new label.
paths: Optional new paths dict.
auth: Optional new auth config.
Returns:
``{"backend": ...}`` on success.
"""
body = request.get_json(silent=True) or {}
if not isinstance(body, dict):
return _error("Request body must be a JSON object", 400)
try:
patch(PATCH_NGINX_BACKENDS, body)
logger.info("Backend '%s' patched via API", body.get("name"))
return _ok({"backend": body.get("name")})
except BadRequest as exc:
logger.info("Backend patch rejected: %s", exc)
return _error(str(exc), 400)
except RuntimeError as exc:
logger.error("Failed to patch backend: %s", exc)
return _error(str(exc), 500)
"""PATCH /api/proxy/backends — Partially update a backend entry."""
@bp.route("/backends", methods=["POST"])
def _add_backend_precheck(json: Any, _va: Any) -> None:
if not ((json or {}).get("name") or "").strip():
raise ValueError("'name' is required")
@daemon_route(
POST_NGINX_BACKENDS_ADD,
bp,
rule="/backends",
precheck=_add_backend_precheck,
transform=_backend_echo,
)
def add_backend_bp():
"""Add a new backend.
POST /api/proxy/backends
Body fields:
name: Backend name (slug, unique).
label: Human-readable label.
paths: Path-to-config map.
auth: Optional auth config.
Returns:
``{"backend": ...}`` on success.
"""
body = request.get_json(silent=True) or {}
name = body.get("name", "").strip()
if not name:
return _error("'name' is required", 400)
try:
post(POST_NGINX_BACKENDS_ADD, body)
logger.info("Backend added via API: %s", name)
return _ok({"backend": name})
except BadRequest as exc:
logger.info("Add backend '%s' rejected: %s", name, exc)
return _error(str(exc), 400)
except RuntimeError as exc:
logger.error("Failed to add backend '%s': %s", name, exc)
return _error(str(exc), 500)
"""POST /api/proxy/backends — Add a new backend."""
@bp.route("/backends/<name>", methods=["DELETE"])
def remove_backend_bp(name):
"""Remove a non-builtin backend.
DELETE /api/proxy/backends/<name>
Returns:
``{"backend": ...}`` on success.
"""
try:
delete(DELETE_NGINX_BACKENDS_REMOVE, {"name": name})
logger.info("Backend removed via API: %s", name)
return _ok({"backend": name})
except BadRequest as exc:
logger.info("Remove backend '%s' rejected: %s", name, exc)
return _error(str(exc), 400)
except Conflict as exc:
logger.info("Remove backend '%s' conflict: %s", name, exc)
return _error(str(exc), 409)
except RuntimeError as exc:
logger.error("Failed to remove backend '%s': %s", name, exc)
return _error(str(exc), 500)
@daemon_route(
DELETE_NGINX_BACKENDS_REMOVE, bp, rule="/backends/<name>", transform=_backend_echo
)
def remove_backend_bp():
"""DELETE /api/proxy/backends/<name> — Remove a non-builtin backend."""