vacuum-wall/webui/api/proxy.py

"""Nginx proxy domain management API blueprint.

Exposed at /api/proxy/* and delegates to vacuum-walld.
"""

import logging

from flask import Blueprint, request

from daemon.client import BadRequest, NotFound, delete, get, patch, post
from daemon.iface import (
    DELETE_NGINX_DOMAINS_REMOVE,
    GET_NGINX_CONFIG,
    GET_NGINX_DOMAINS,
    PATCH_NGINX_CONFIG,
    POST_NGINX_APPLY,
    POST_NGINX_CONFIG,
    POST_NGINX_DOMAINS_ADD,
    POST_NGINX_DOMAINS_UPDATE,
    POST_NGINX_SSL_APPLY,
    POST_NGINX_TEST,
)
from webui.api.common import _error, _ok

logger = logging.getLogger(__name__)
bp = Blueprint("proxy", __name__)


@bp.route("/ssl-apply", methods=["POST"])
def ssl_apply_bp():
    """Apply SSL snippet config.

    POST /api/proxy/ssl-apply

    Returns:
        ``{"ok": true}`` on success.

    Raises:
        RuntimeError: If nginx SSL snippet write fails.
    """
    try:
        post(POST_NGINX_SSL_APPLY)
        logger.info("SSL snippet written via API")
        return _ok(None)
    except RuntimeError as exc:
        logger.error("Failed to write SSL snippet: %s", exc)
        return _error(str(exc), 500)


@bp.route("/config", methods=["GET"])
def get_config_bp():
    """Get the current nginx proxy configuration.

    GET /api/proxy/config

    Returns:
        Current config dict from the daemon.
    """
    try:
        return _ok(get(GET_NGINX_CONFIG))
    except RuntimeError as exc:
        logger.error("Failed to read proxy config: %s", exc)
        return _error(str(exc), 500)


@bp.route("/config", methods=["POST"])
def post_config():
    """Save the nginx proxy configuration.

    POST /api/proxy/config

    Body:
        Any JSON object to merge into the config.

    Returns:
        ``{"ok": true}`` on success.
    """
    body = request.get_json(silent=True) or {}
    if not isinstance(body, dict):
        return _error("Request body must be a JSON object", 400)
    try:
        post(POST_NGINX_CONFIG, body)
        logger.info("Proxy config saved: %s", sorted(body.keys()))
        return _ok(None)
    except BadRequest as exc:
        logger.info("Proxy config save rejected: %s", exc)
        return _error(str(exc), 400)
    except RuntimeError as exc:
        logger.error("Failed to save proxy config: %s", exc)
        return _error(str(exc), 500)


@bp.route("/config", methods=["PATCH"])
def patch_config():
    """Partially update the nginx proxy configuration.

    PATCH /api/proxy/config

    Body:
        JSON object with fields to patch.

    Returns:
        ``{"ok": true}`` on success.
    """
    body = request.get_json(silent=True) or {}
    if not isinstance(body, dict):
        return _error("Request body must be a JSON object", 400)
    try:
        patch(PATCH_NGINX_CONFIG, body)
        logger.info("Proxy config patched: %s", sorted(body.keys()))
        return _ok(None)
    except BadRequest as exc:
        logger.info("Proxy config patch rejected: %s", exc)
        return _error(str(exc), 400)
    except RuntimeError as exc:
        logger.error("Failed to patch proxy config: %s", exc)
        return _error(str(exc), 500)


@bp.route("/domains", methods=["GET"])
def list_domains():
    """List all configured proxy domains.

    GET /api/proxy/domains

    Returns:
        List of domain dicts from the daemon.
    """
    try:
        return _ok(get(GET_NGINX_DOMAINS))
    except RuntimeError as exc:
        logger.error("Failed to list proxy domains: %s", exc)
        return _error(str(exc), 500)


@bp.route("/domains", methods=["POST"])
def add_domain_bp():
    """Add a new proxy domain.

    POST /api/proxy/domains

    Body fields (paths mode):
        domain: Domain name.
        paths: Path-to-config map (e.g. ``{"/": {"backend": {...}}, "/app": {...}}``).
        cert: Optional certificate type.
        force_ssl: Optional SSL redirect flag (default ``true``).

    Body fields (legacy mode):
        domain: Domain name.
        backend_host: Upstream host.
        backend_port: Upstream port.
        backend_proto: Protocol (``http`` or ``https``, default ``http``).
        cert: Optional certificate type.
        extra_headers: Optional extra headers dict.

    Returns:
        ``{"domain": ...}`` on success.
    """
    body = request.get_json(silent=True) or {}
    domain = body.get("domain", "").strip()
    if not domain:
        return _error("'domain' is required", 400)

    paths = body.get("paths")
    if paths is not None:
        payload = {
            "domain": domain,
            "paths": paths,
            "cert": body.get("cert"),
            "force_ssl": body.get("force_ssl", True),
        }
    else:
        backend_host = body.get("backend_host", "").strip()
        backend_port = body.get("backend_port")
        backend_proto = body.get("backend_proto", "http").strip() or "http"
        cert = body.get("cert")
        extra_headers = body.get("extra_headers")
        if not backend_host:
            return _error("'backend_host' is required", 400)
        if backend_port is None:
            return _error("'backend_port' is required", 400)
        payload = {
            "domain": domain,
            "backend_host": backend_host,
            "backend_port": int(backend_port),
            "backend_proto": backend_proto,
            "cert": cert,
            "extra_headers": extra_headers,
        }
    try:
        post(POST_NGINX_DOMAINS_ADD, payload)
        logger.info("Proxy domain added via API: %s", domain)
        return _ok({"domain": domain})
    except BadRequest as exc:
        logger.info("Add proxy domain '%s' rejected: %s", domain, exc)
        return _error(str(exc), 400)
    except RuntimeError as exc:
        logger.error("Failed to add proxy domain '%s': %s", domain, exc)
        return _error(str(exc), 500)


@bp.route("/domains/<domain>", methods=["PUT"])
def update_domain_bp(domain):
    """Update an existing proxy domain in-place.

    PUT /api/proxy/domains/<domain>

    Body fields:
        Fields to merge into the domain config.

    Returns:
        ``{"domain": ...}`` on success.
    """
    body = request.get_json(silent=True) or {}
    if not body:
        return _error("Request body must be a JSON object with fields to update", 400)
    try:
        post(POST_NGINX_DOMAINS_UPDATE, {"domain": domain, **body})
        logger.info("Proxy domain '%s' updated via API", domain)
        return _ok({"domain": domain})
    except BadRequest as exc:
        logger.info("Update domain '%s' rejected: %s", domain, exc)
        return _error(str(exc), 400)
    except NotFound as exc:
        logger.info("Domain '%s' not found: %s", domain, exc)
        return _error(str(exc), 404)
    except RuntimeError as exc:
        logger.error("Failed to update domain '%s': %s", domain, exc)
        return _error(str(exc), 500)


@bp.route("/domains/<domain>", methods=["DELETE"])
def remove_domain_bp(domain):
    """Remove a proxy domain.

    DELETE /api/proxy/domains/<domain>

    Returns:
        ``{"domain": ...}`` on success.
    """
    try:
        delete(DELETE_NGINX_DOMAINS_REMOVE, {"domain": domain})
        logger.info("Proxy domain removed via API: %s", domain)
        return _ok({"domain": domain})
    except NotFound as exc:
        logger.info("Domain '%s' not found: %s", domain, exc)
        return _error(str(exc), 404)
    except RuntimeError as exc:
        logger.error("Failed to remove domain '%s': %s", domain, exc)
        return _error(str(exc), 500)


@bp.route("/apply", methods=["POST"])
def apply_bp():
    """Generate all nginx configs and reload nginx.

    POST /api/proxy/apply

    Returns:
        ``{"ok": true}`` on success.
    """
    try:
        post(POST_NGINX_APPLY)
        logger.info("nginx config applied via API")
        return _ok(None)
    except RuntimeError as exc:
        logger.error("Failed to apply nginx config: %s", exc)
        return _error(str(exc), 500)


@bp.route("/test", methods=["POST"])
def test_bp():
    """Test nginx configuration without reloading.

    POST /api/proxy/test

    Returns:
        ``{"valid": true, "output": ...}`` on success. Returns 400 if test fails.
    """
    try:
        result = post(POST_NGINX_TEST)
        if result.get("valid"):
            return _ok({"valid": True, "output": result.get("output", "")})
        return _error(result.get("output", "unknown error"), 400)
    except RuntimeError as exc:
        logger.error("nginx config test failed: %s", exc)
        return _error(str(exc), 500)