refactor: daemon collectors, thin webui proxies, pure config reads
- move state collectors from lib/state.py to daemon/collectors/ (7 modules, registration side-effect; daemon/server.py imports the package before the first populate()) - webui/api: new daemon_route() decorator factory in common.py collapses the try/except daemon-proxy boilerplate in all 8 blueprints (rules/params/body/transform keep responses identical) - firewall: interface-coverage invariant — config is the source of truth for zone interfaces (absent key = empty, no hands-off zones); pure validate_coverage() enforced at save (400) and apply (409, force: true overrides), top-level `unmanaged` exemption - lib: get_config() reads are now pure (no dir creation or writes); new lib/bootstrap.py creates runtime dirs and persists the one-shot nginx legacy migration at daemon start, after system_import (lib.nginx.migrate_config_file) - lib/common: compute_pending() apply-bookkeeping helper - daemon: emit_and_refresh() handler helper; refresh_state(bump=) so /status/refresh no longer bumps versions (poll/mutation only) - acme: move --log last so acme.sh never treats a real arg as the log-file argument - docs: AGENTS.md, config.md, state-model.md, api.md updated; HARDEN.md dropped (plan implemented); apply-confirm force wording Tests: 917 passed; ruff check + format clean.
This commit is contained in:
+112
-296
@@ -3,11 +3,17 @@
|
||||
Exposed at /api/proxy/* and delegates to vacuum-walld.
|
||||
"""
|
||||
|
||||
import logging
|
||||
from typing import Any
|
||||
|
||||
from flask import Blueprint, request
|
||||
from flask import Blueprint
|
||||
|
||||
from daemon.client import BadRequest, Conflict, NotFound, delete, get, patch, post
|
||||
from daemon.client import ( # noqa: F401 (resolved via module globals)
|
||||
BadRequest,
|
||||
delete,
|
||||
get,
|
||||
patch,
|
||||
post,
|
||||
)
|
||||
from daemon.iface import (
|
||||
DELETE_NGINX_BACKENDS_REMOVE,
|
||||
DELETE_NGINX_DOMAINS_REMOVE,
|
||||
@@ -24,144 +30,59 @@ from daemon.iface import (
|
||||
POST_NGINX_SSL_APPLY,
|
||||
POST_NGINX_TEST,
|
||||
)
|
||||
from webui.api.common import _error, _ok
|
||||
from webui.api.common import NO_BODY, daemon_route, require_dict_body, void_transform
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
bp = Blueprint("proxy", __name__)
|
||||
|
||||
|
||||
@bp.route("/ssl-apply", methods=["POST"])
|
||||
# ---------------------------------------------------------------------------
|
||||
# Config
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
@daemon_route(POST_NGINX_SSL_APPLY, bp, body=NO_BODY, transform=void_transform)
|
||||
def ssl_apply_bp():
|
||||
"""Apply SSL snippet config.
|
||||
|
||||
POST /api/proxy/ssl-apply
|
||||
|
||||
Returns:
|
||||
``{"ok": true}`` on success.
|
||||
|
||||
Raises:
|
||||
RuntimeError: If nginx SSL snippet write fails.
|
||||
"""
|
||||
try:
|
||||
post(POST_NGINX_SSL_APPLY)
|
||||
logger.info("SSL snippet written via API")
|
||||
return _ok(None)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to write SSL snippet: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""POST /api/proxy/ssl-apply — Apply the SSL snippet config."""
|
||||
|
||||
|
||||
@bp.route("/config", methods=["GET"])
|
||||
@daemon_route(GET_NGINX_CONFIG, bp)
|
||||
def get_config_bp():
|
||||
"""Get the current nginx proxy configuration.
|
||||
|
||||
GET /api/proxy/config
|
||||
|
||||
Returns:
|
||||
Current config dict from the daemon.
|
||||
"""
|
||||
try:
|
||||
return _ok(get(GET_NGINX_CONFIG))
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to read proxy config: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""GET /api/proxy/config — Get the current nginx proxy configuration."""
|
||||
|
||||
|
||||
@bp.route("/config", methods=["POST"])
|
||||
@daemon_route(
|
||||
POST_NGINX_CONFIG, bp, precheck=require_dict_body, transform=void_transform
|
||||
)
|
||||
def post_config():
|
||||
"""Save the nginx proxy configuration.
|
||||
|
||||
POST /api/proxy/config
|
||||
|
||||
Body:
|
||||
Any JSON object to merge into the config.
|
||||
|
||||
Returns:
|
||||
``{"ok": true}`` on success.
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not isinstance(body, dict):
|
||||
return _error("Request body must be a JSON object", 400)
|
||||
try:
|
||||
post(POST_NGINX_CONFIG, body)
|
||||
logger.info("Proxy config saved: %s", sorted(body.keys()))
|
||||
return _ok(None)
|
||||
except BadRequest as exc:
|
||||
logger.info("Proxy config save rejected: %s", exc)
|
||||
return _error(str(exc), 400)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to save proxy config: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""POST /api/proxy/config — Save the nginx proxy configuration."""
|
||||
|
||||
|
||||
@bp.route("/config", methods=["PATCH"])
|
||||
@daemon_route(
|
||||
PATCH_NGINX_CONFIG, bp, precheck=require_dict_body, transform=void_transform
|
||||
)
|
||||
def patch_config():
|
||||
"""Partially update the nginx proxy configuration.
|
||||
|
||||
PATCH /api/proxy/config
|
||||
|
||||
Body:
|
||||
JSON object with fields to patch.
|
||||
|
||||
Returns:
|
||||
``{"ok": true}`` on success.
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not isinstance(body, dict):
|
||||
return _error("Request body must be a JSON object", 400)
|
||||
try:
|
||||
patch(PATCH_NGINX_CONFIG, body)
|
||||
logger.info("Proxy config patched: %s", sorted(body.keys()))
|
||||
return _ok(None)
|
||||
except BadRequest as exc:
|
||||
logger.info("Proxy config patch rejected: %s", exc)
|
||||
return _error(str(exc), 400)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to patch proxy config: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""PATCH /api/proxy/config — Partially update the nginx proxy configuration."""
|
||||
|
||||
|
||||
@bp.route("/domains", methods=["GET"])
|
||||
@daemon_route(GET_NGINX_DOMAINS, bp)
|
||||
def list_domains():
|
||||
"""List all configured proxy domains.
|
||||
|
||||
GET /api/proxy/domains
|
||||
|
||||
Returns:
|
||||
List of domain dicts from the daemon.
|
||||
"""
|
||||
try:
|
||||
return _ok(get(GET_NGINX_DOMAINS))
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to list proxy domains: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""GET /api/proxy/domains — List all configured proxy domains."""
|
||||
|
||||
|
||||
@bp.route("/domains", methods=["POST"])
|
||||
def add_domain_bp():
|
||||
"""Add a new proxy domain referencing a backend.
|
||||
# ---------------------------------------------------------------------------
|
||||
# Domain CRUD
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
POST /api/proxy/domains
|
||||
|
||||
Body fields:
|
||||
domain: Domain name.
|
||||
backend: Backend name to proxy through.
|
||||
cert: Optional certificate type.
|
||||
force_ssl: Optional SSL redirect flag (default ``true``).
|
||||
auth: Optional domain-level auth override.
|
||||
|
||||
Returns:
|
||||
``{"domain": ...}`` on success.
|
||||
"""
|
||||
def _add_domain_body(request: Any, _va: Any) -> dict[str, Any]:
|
||||
body = request.get_json(silent=True) or {}
|
||||
domain = body.get("domain", "").strip()
|
||||
domain = (body.get("domain") or "").strip()
|
||||
if not domain:
|
||||
return _error("'domain' is required", 400)
|
||||
backend = body.get("backend", "").strip()
|
||||
raise ValueError("'domain' is required")
|
||||
backend = (body.get("backend") or "").strip()
|
||||
if not backend:
|
||||
return _error("'backend' is required", 400)
|
||||
|
||||
payload = {
|
||||
raise ValueError("'backend' is required")
|
||||
payload: dict[str, Any] = {
|
||||
"domain": domain,
|
||||
"backend": backend,
|
||||
"force_ssl": body.get("force_ssl", True),
|
||||
@@ -170,105 +91,62 @@ def add_domain_bp():
|
||||
payload["cert"] = body["cert"]
|
||||
if body.get("auth") is not None:
|
||||
payload["auth"] = body["auth"]
|
||||
|
||||
try:
|
||||
post(POST_NGINX_DOMAINS_ADD, payload)
|
||||
logger.info("Proxy domain added via API: %s", domain)
|
||||
return _ok({"domain": domain})
|
||||
except BadRequest as exc:
|
||||
logger.info("Add proxy domain '%s' rejected: %s", domain, exc)
|
||||
return _error(str(exc), 400)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to add proxy domain '%s': %s", domain, exc)
|
||||
return _error(str(exc), 500)
|
||||
return payload
|
||||
|
||||
|
||||
@bp.route("/domains/<domain>", methods=["PUT"])
|
||||
def update_domain_bp(domain):
|
||||
"""Update an existing proxy domain in-place.
|
||||
|
||||
PUT /api/proxy/domains/<domain>
|
||||
|
||||
Body fields:
|
||||
Fields to merge into the domain config.
|
||||
|
||||
Returns:
|
||||
``{"domain": ...}`` on success.
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not body:
|
||||
return _error("Request body must be a JSON object with fields to update", 400)
|
||||
try:
|
||||
post(POST_NGINX_DOMAINS_UPDATE, {"domain": domain, **body})
|
||||
logger.info("Proxy domain '%s' updated via API", domain)
|
||||
return _ok({"domain": domain})
|
||||
except BadRequest as exc:
|
||||
logger.info("Update domain '%s' rejected: %s", domain, exc)
|
||||
return _error(str(exc), 400)
|
||||
except NotFound as exc:
|
||||
logger.info("Domain '%s' not found: %s", domain, exc)
|
||||
return _error(str(exc), 404)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to update domain '%s': %s", domain, exc)
|
||||
return _error(str(exc), 500)
|
||||
def _domain_echo(_data: Any, _va: Any, sent: Any) -> Any:
|
||||
return {"domain": sent.get("domain")}
|
||||
|
||||
|
||||
@bp.route("/domains/<domain>", methods=["DELETE"])
|
||||
def remove_domain_bp(domain):
|
||||
"""Remove a proxy domain.
|
||||
|
||||
DELETE /api/proxy/domains/<domain>
|
||||
|
||||
Returns:
|
||||
``{"domain": ...}`` on success.
|
||||
"""
|
||||
try:
|
||||
delete(DELETE_NGINX_DOMAINS_REMOVE, {"domain": domain})
|
||||
logger.info("Proxy domain removed via API: %s", domain)
|
||||
return _ok({"domain": domain})
|
||||
except NotFound as exc:
|
||||
logger.info("Domain '%s' not found: %s", domain, exc)
|
||||
return _error(str(exc), 404)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to remove domain '%s': %s", domain, exc)
|
||||
return _error(str(exc), 500)
|
||||
@daemon_route(
|
||||
POST_NGINX_DOMAINS_ADD,
|
||||
bp,
|
||||
rule="/domains",
|
||||
body=_add_domain_body,
|
||||
transform=_domain_echo,
|
||||
)
|
||||
def add_domain_bp():
|
||||
"""POST /api/proxy/domains — Add a new proxy domain referencing a backend."""
|
||||
|
||||
|
||||
@bp.route("/apply", methods=["POST"])
|
||||
def _update_domain_precheck(json: Any, _va: Any) -> None:
|
||||
if not json:
|
||||
raise ValueError("Request body must be a JSON object with fields to update")
|
||||
|
||||
|
||||
@daemon_route(
|
||||
POST_NGINX_DOMAINS_UPDATE,
|
||||
bp,
|
||||
rule="/domains/<domain>",
|
||||
methods=["PUT"],
|
||||
precheck=_update_domain_precheck,
|
||||
transform=_domain_echo,
|
||||
)
|
||||
def update_domain_bp():
|
||||
"""PUT /api/proxy/domains/<domain> — Update an existing proxy domain in-place."""
|
||||
|
||||
|
||||
@daemon_route(
|
||||
DELETE_NGINX_DOMAINS_REMOVE, bp, rule="/domains/<domain>", transform=_domain_echo
|
||||
)
|
||||
def remove_domain_bp():
|
||||
"""DELETE /api/proxy/domains/<domain> — Remove a proxy domain."""
|
||||
|
||||
|
||||
@daemon_route(POST_NGINX_APPLY, bp, body=NO_BODY, transform=void_transform)
|
||||
def apply_bp():
|
||||
"""Generate all nginx configs and reload nginx.
|
||||
|
||||
POST /api/proxy/apply
|
||||
|
||||
Returns:
|
||||
``{"ok": true}`` on success.
|
||||
"""
|
||||
try:
|
||||
post(POST_NGINX_APPLY)
|
||||
logger.info("nginx config applied via API")
|
||||
return _ok(None)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to apply nginx config: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""POST /api/proxy/apply — Generate all nginx configs and reload nginx."""
|
||||
|
||||
|
||||
@bp.route("/test", methods=["POST"])
|
||||
def _test_transform(data: Any, _va: Any, _sent: Any) -> Any:
|
||||
if data.get("valid"):
|
||||
return {"valid": True, "output": data.get("output", "")}
|
||||
raise BadRequest(data.get("output", "unknown error"))
|
||||
|
||||
|
||||
@daemon_route(POST_NGINX_TEST, bp, body=NO_BODY, transform=_test_transform)
|
||||
def test_bp():
|
||||
"""Test nginx configuration without reloading.
|
||||
|
||||
POST /api/proxy/test
|
||||
|
||||
Returns:
|
||||
``{"valid": true, "output": ...}`` on success. Returns 400 if test fails.
|
||||
"""
|
||||
try:
|
||||
result = post(POST_NGINX_TEST)
|
||||
if result.get("valid"):
|
||||
return _ok({"valid": True, "output": result.get("output", "")})
|
||||
return _error(result.get("output", "unknown error"), 400)
|
||||
except RuntimeError as exc:
|
||||
logger.error("nginx config test failed: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""POST /api/proxy/test — Test nginx configuration without reloading."""
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
@@ -276,102 +154,40 @@ def test_bp():
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
@bp.route("/backends", methods=["GET"])
|
||||
def _backend_echo(_data: Any, _va: Any, sent: Any) -> Any:
|
||||
return {"backend": sent.get("name")}
|
||||
|
||||
|
||||
@daemon_route(GET_NGINX_BACKENDS, bp)
|
||||
def list_backends():
|
||||
"""List all configured backends.
|
||||
|
||||
GET /api/proxy/backends
|
||||
|
||||
Returns:
|
||||
Dict of backend configs with secrets stripped.
|
||||
"""
|
||||
try:
|
||||
return _ok(get(GET_NGINX_BACKENDS))
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to list backends: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""GET /api/proxy/backends — List all configured backends (secrets stripped)."""
|
||||
|
||||
|
||||
@bp.route("/backends", methods=["PATCH"])
|
||||
@daemon_route(
|
||||
PATCH_NGINX_BACKENDS, bp, precheck=require_dict_body, transform=_backend_echo
|
||||
)
|
||||
def patch_backend_bp():
|
||||
"""Partially update a backend entry.
|
||||
|
||||
PATCH /api/proxy/backends
|
||||
|
||||
Body fields:
|
||||
name: Backend name.
|
||||
label: Optional new label.
|
||||
paths: Optional new paths dict.
|
||||
auth: Optional new auth config.
|
||||
|
||||
Returns:
|
||||
``{"backend": ...}`` on success.
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
if not isinstance(body, dict):
|
||||
return _error("Request body must be a JSON object", 400)
|
||||
try:
|
||||
patch(PATCH_NGINX_BACKENDS, body)
|
||||
logger.info("Backend '%s' patched via API", body.get("name"))
|
||||
return _ok({"backend": body.get("name")})
|
||||
except BadRequest as exc:
|
||||
logger.info("Backend patch rejected: %s", exc)
|
||||
return _error(str(exc), 400)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to patch backend: %s", exc)
|
||||
return _error(str(exc), 500)
|
||||
"""PATCH /api/proxy/backends — Partially update a backend entry."""
|
||||
|
||||
|
||||
@bp.route("/backends", methods=["POST"])
|
||||
def _add_backend_precheck(json: Any, _va: Any) -> None:
|
||||
if not ((json or {}).get("name") or "").strip():
|
||||
raise ValueError("'name' is required")
|
||||
|
||||
|
||||
@daemon_route(
|
||||
POST_NGINX_BACKENDS_ADD,
|
||||
bp,
|
||||
rule="/backends",
|
||||
precheck=_add_backend_precheck,
|
||||
transform=_backend_echo,
|
||||
)
|
||||
def add_backend_bp():
|
||||
"""Add a new backend.
|
||||
|
||||
POST /api/proxy/backends
|
||||
|
||||
Body fields:
|
||||
name: Backend name (slug, unique).
|
||||
label: Human-readable label.
|
||||
paths: Path-to-config map.
|
||||
auth: Optional auth config.
|
||||
|
||||
Returns:
|
||||
``{"backend": ...}`` on success.
|
||||
"""
|
||||
body = request.get_json(silent=True) or {}
|
||||
name = body.get("name", "").strip()
|
||||
if not name:
|
||||
return _error("'name' is required", 400)
|
||||
try:
|
||||
post(POST_NGINX_BACKENDS_ADD, body)
|
||||
logger.info("Backend added via API: %s", name)
|
||||
return _ok({"backend": name})
|
||||
except BadRequest as exc:
|
||||
logger.info("Add backend '%s' rejected: %s", name, exc)
|
||||
return _error(str(exc), 400)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to add backend '%s': %s", name, exc)
|
||||
return _error(str(exc), 500)
|
||||
"""POST /api/proxy/backends — Add a new backend."""
|
||||
|
||||
|
||||
@bp.route("/backends/<name>", methods=["DELETE"])
|
||||
def remove_backend_bp(name):
|
||||
"""Remove a non-builtin backend.
|
||||
|
||||
DELETE /api/proxy/backends/<name>
|
||||
|
||||
Returns:
|
||||
``{"backend": ...}`` on success.
|
||||
"""
|
||||
try:
|
||||
delete(DELETE_NGINX_BACKENDS_REMOVE, {"name": name})
|
||||
logger.info("Backend removed via API: %s", name)
|
||||
return _ok({"backend": name})
|
||||
except BadRequest as exc:
|
||||
logger.info("Remove backend '%s' rejected: %s", name, exc)
|
||||
return _error(str(exc), 400)
|
||||
except Conflict as exc:
|
||||
logger.info("Remove backend '%s' conflict: %s", name, exc)
|
||||
return _error(str(exc), 409)
|
||||
except RuntimeError as exc:
|
||||
logger.error("Failed to remove backend '%s': %s", name, exc)
|
||||
return _error(str(exc), 500)
|
||||
@daemon_route(
|
||||
DELETE_NGINX_BACKENDS_REMOVE, bp, rule="/backends/<name>", transform=_backend_echo
|
||||
)
|
||||
def remove_backend_bp():
|
||||
"""DELETE /api/proxy/backends/<name> — Remove a non-builtin backend."""
|
||||
|
||||
Reference in New Issue
Block a user