mirror of
https://github.com/Finsys/dockhand.git
synced 2026-06-18 11:29:56 +03:00
Compare commits
16 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 jarek
|
107e9c3758 | ||
 sieren
|
f972378117 | ||
|
sieren
|
f588ed787b | ||
|
Jarek Krochmalski
|
6baf6c23e8 | ||
|
Jarek Krochmalski
|
6382b4083e | ||
|
Jarek Krochmalski
|
b269b8d50d | ||
|
jarek
|
410d542c58 | ||
|
jarek
|
a02115e6bc | ||
|
jarek
|
86e4c9eb56 | ||
|
jarek
|
c46870afd1 | ||
|
jarek
|
a8a5623c10 | ||
 Jarek Krochmalski
|
059ecbb1dc | ||
|
Jarek Krochmalski
|
3eab42169c | ||
|
jarek
|
6a7116a5b7 | ||
|
jarek
|
215f52b1f0 | ||
|
jarek
|
de62327a07 |
+144
-47
@@ -1,11 +1,90 @@
|
||||
# Build stage - using Debian to avoid Alpine musl thread creation issues
|
||||
# syntax=docker/dockerfile:1.4
|
||||
# =============================================================================
|
||||
# Dockhand Docker Image - Security-Hardened Build
|
||||
# =============================================================================
|
||||
# This Dockerfile builds a custom Wolfi OS from scratch using apko, ensuring:
|
||||
# - Full transparency (no dependency on pre-built Chainguard images)
|
||||
# - Reproducible builds from open-source Wolfi packages
|
||||
# - Minimal attack surface with only required packages
|
||||
#
|
||||
# Bun is copied from the official oven/bun image (app-builder stage).
|
||||
# For CPUs without AVX support (Celeron, Atom, pre-Haswell), build with:
|
||||
# docker build --build-arg BUN_VARIANT=baseline -t dockhand:baseline .
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Stage 1: OS Generator (Alpine + apko tool)
|
||||
# -----------------------------------------------------------------------------
|
||||
# We use Alpine because it has a shell. This lets us download and run apko
|
||||
# to build our custom Wolfi OS from scratch using open-source packages.
|
||||
FROM alpine:3.21 AS os-builder
|
||||
|
||||
ARG TARGETARCH
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
# Install apko tool (latest stable release)
|
||||
# apko is the tool Chainguard uses to build their images - we use it directly
|
||||
ARG APKO_VERSION=0.30.34
|
||||
RUN apk add --no-cache curl unzip \
|
||||
&& ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") \
|
||||
&& curl -sL "https://github.com/chainguard-dev/apko/releases/download/v${APKO_VERSION}/apko_${APKO_VERSION}_linux_${ARCH}.tar.gz" \
|
||||
| tar -xz --strip-components=1 -C /usr/local/bin \
|
||||
&& chmod +x /usr/local/bin/apko
|
||||
|
||||
# Generate apko.yaml for current target architecture only
|
||||
# We build single-arch to avoid multi-arch layer confusion in extraction
|
||||
# Note: Bun is NOT included here - it's copied from app-builder stage for CPU compatibility
|
||||
RUN APKO_ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "aarch64" || echo "x86_64") \
|
||||
&& printf '%s\n' \
|
||||
"contents:" \
|
||||
" repositories:" \
|
||||
" - https://packages.wolfi.dev/os" \
|
||||
" keyring:" \
|
||||
" - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub" \
|
||||
" packages:" \
|
||||
" - wolfi-base" \
|
||||
" - ca-certificates" \
|
||||
" - busybox" \
|
||||
" - tzdata" \
|
||||
" - docker-cli" \
|
||||
" - docker-compose" \
|
||||
" - sqlite" \
|
||||
" - git" \
|
||||
" - openssh-client" \
|
||||
" - curl" \
|
||||
" - tini" \
|
||||
" - su-exec" \
|
||||
"entrypoint:" \
|
||||
" command: /bin/sh -l" \
|
||||
"archs:" \
|
||||
" - ${APKO_ARCH}" \
|
||||
> apko.yaml
|
||||
|
||||
# Build the OS tarball and extract rootfs
|
||||
# apko creates an OCI tarball - we need to extract the actual filesystem layer
|
||||
RUN apko build apko.yaml dockhand-base:latest output.tar \
|
||||
&& mkdir -p rootfs \
|
||||
&& tar -xf output.tar \
|
||||
&& LAYER=$(tar -tf output.tar | grep '.tar.gz$' | head -1) \
|
||||
&& tar -xzf "$LAYER" -C rootfs
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Stage 2: Application Builder
|
||||
# -----------------------------------------------------------------------------
|
||||
# Using Debian to avoid Alpine musl thread creation issues
|
||||
# Alpine's musl libc causes rayon/tokio thread pool panics during svelte-adapter-bun build
|
||||
FROM oven/bun:1.3.5-debian AS builder
|
||||
FROM oven/bun:1.3.5-debian AS app-builder
|
||||
|
||||
# Build argument for Bun variant (regular or baseline)
|
||||
# baseline is for CPUs without AVX support (Celeron, Atom, pre-Haswell)
|
||||
ARG BUN_VARIANT=regular
|
||||
ARG TARGETARCH
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install build dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends jq git && rm -rf /var/lib/apt/lists/*
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends jq git curl unzip ca-certificates && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy package files and install ALL dependencies (needed for build)
|
||||
COPY package.json bun.lock* bunfig.toml ./
|
||||
@@ -15,72 +94,90 @@ RUN bun install --frozen-lockfile
|
||||
COPY . .
|
||||
|
||||
# Build with parallelism - dedicated build VM has 16 CPUs and 32GB RAM
|
||||
# Increased memory limits for parallel compilation with larger semi-space for GC
|
||||
RUN NODE_OPTIONS="--max-old-space-size=8192 --max-semi-space-size=128" bun run build
|
||||
|
||||
# Production stage - minimal Alpine with Bun runtime
|
||||
FROM oven/bun:1.3.5-alpine
|
||||
# Prepare production node_modules (do this in builder where we have compilers)
|
||||
# This ensures native addons compile correctly before copying to hardened runtime
|
||||
RUN rm -rf node_modules && bun install --production --frozen-lockfile \
|
||||
&& rm -rf node_modules/@types node_modules/bun-types
|
||||
|
||||
# Download baseline Bun binary if BUN_VARIANT=baseline (for CPUs without AVX)
|
||||
# Only applies to amd64 - ARM64 doesn't have AVX concept
|
||||
ARG BUN_VERSION=1.3.5
|
||||
RUN if [ "$BUN_VARIANT" = "baseline" ] && [ "$TARGETARCH" = "amd64" ]; then \
|
||||
echo "Downloading Bun baseline binary for CPUs without AVX support..." && \
|
||||
curl -fsSL "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64-baseline.zip" -o /tmp/bun.zip && \
|
||||
unzip -o /tmp/bun.zip -d /tmp && \
|
||||
cp /tmp/bun-linux-x64-baseline/bun /usr/local/bin/bun && \
|
||||
chmod +x /usr/local/bin/bun && \
|
||||
rm -rf /tmp/bun.zip /tmp/bun-linux-x64-baseline && \
|
||||
echo "Bun baseline binary installed successfully"; \
|
||||
fi
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Stage 3: Final Image (Scratch + Custom Wolfi OS)
|
||||
# -----------------------------------------------------------------------------
|
||||
FROM scratch
|
||||
|
||||
# Install our custom-built Wolfi OS (now we have /bin/sh!)
|
||||
COPY --from=os-builder /work/rootfs/ /
|
||||
|
||||
# Copy Bun from official image - ensures compatibility with all x86_64 CPUs (no AVX2 requirement)
|
||||
# Wolfi's bun package requires AVX2 which breaks on Celeron/Atom CPUs
|
||||
# For baseline builds (BUN_VARIANT=baseline), this contains the baseline binary (no AVX requirement)
|
||||
# For regular builds, this contains the standard oven/bun binary
|
||||
COPY --from=app-builder /usr/local/bin/bun /usr/bin/bun
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install runtime dependencies, create user
|
||||
# Add sqlite for emergency scripts, git for stack git operations, curl for healthchecks
|
||||
# Add docker-cli and docker-cli-compose for stack management (uses host's docker socket)
|
||||
# Add openssh-client for SSH key authentication with git repositories
|
||||
# Upgrade all packages to latest versions for security patches
|
||||
RUN apk upgrade --no-cache \
|
||||
&& apk add --no-cache curl git tini su-exec sqlite docker-cli docker-cli-compose openssh-client iproute2 \
|
||||
&& addgroup -g 1001 dockhand \
|
||||
# Set up environment variables
|
||||
ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
|
||||
SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
|
||||
NODE_ENV=production \
|
||||
PORT=3000 \
|
||||
HOST=0.0.0.0 \
|
||||
DATA_DIR=/app/data \
|
||||
HOME=/home/dockhand \
|
||||
PUID=1001 \
|
||||
PGID=1001
|
||||
|
||||
# Create docker compose plugin symlink (we use `docker compose` syntax, Wolfi has standalone binary)
|
||||
RUN mkdir -p /usr/libexec/docker/cli-plugins \
|
||||
&& ln -s /usr/bin/docker-compose /usr/libexec/docker/cli-plugins/docker-compose
|
||||
|
||||
# Create dockhand user and group (using busybox commands)
|
||||
RUN addgroup -g 1001 dockhand \
|
||||
&& adduser -u 1001 -G dockhand -h /home/dockhand -D dockhand
|
||||
|
||||
# Copy package files and install production dependencies
|
||||
# This is needed because svelte-adapter-bun externalizes some packages (croner, etc.)
|
||||
# that need to be available at runtime. Installing at build time is more reliable
|
||||
# than Bun's auto-install which requires network access and writable cache.
|
||||
COPY package.json bun.lock* ./
|
||||
RUN bun install --production --frozen-lockfile
|
||||
|
||||
# Copy built application (Bun adapter output)
|
||||
COPY --from=builder /app/build ./build
|
||||
|
||||
# Copy bundled subprocess scripts (built by scripts/build-subprocesses.ts)
|
||||
COPY --from=builder /app/build/subprocesses/ ./subprocesses/
|
||||
# Copy application files with correct ownership (avoids layer duplication from chown -R)
|
||||
COPY --from=app-builder --chown=dockhand:dockhand /app/node_modules ./node_modules
|
||||
COPY --from=app-builder --chown=dockhand:dockhand /app/package.json ./
|
||||
COPY --from=app-builder --chown=dockhand:dockhand /app/build ./build
|
||||
COPY --from=app-builder --chown=dockhand:dockhand /app/build/subprocesses/ ./subprocesses/
|
||||
|
||||
# Copy database migrations
|
||||
COPY drizzle/ ./drizzle/
|
||||
COPY drizzle-pg/ ./drizzle-pg/
|
||||
COPY --chown=dockhand:dockhand drizzle/ ./drizzle/
|
||||
COPY --chown=dockhand:dockhand drizzle-pg/ ./drizzle-pg/
|
||||
|
||||
# Copy legal documents
|
||||
COPY LICENSE.txt PRIVACY.txt ./
|
||||
COPY --chown=dockhand:dockhand LICENSE.txt PRIVACY.txt ./
|
||||
|
||||
# Copy entrypoint script
|
||||
# Copy entrypoint script (root-owned, executable)
|
||||
COPY docker-entrypoint.sh /usr/local/bin/
|
||||
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
|
||||
|
||||
# Copy emergency scripts (only the emergency subfolder, not license generation scripts)
|
||||
COPY scripts/emergency/ ./scripts/
|
||||
# Copy emergency scripts
|
||||
COPY --chown=dockhand:dockhand scripts/emergency/ ./scripts/
|
||||
RUN chmod +x ./scripts/*.sh ./scripts/**/*.sh 2>/dev/null || true
|
||||
|
||||
# Create directories with proper ownership
|
||||
# Create data directories with correct ownership
|
||||
RUN mkdir -p /home/dockhand/.dockhand/stacks /app/data \
|
||||
&& chown -R dockhand:dockhand /app /home/dockhand
|
||||
&& chown dockhand:dockhand /app/data /home/dockhand /home/dockhand/.dockhand /home/dockhand/.dockhand/stacks
|
||||
|
||||
EXPOSE 3000
|
||||
|
||||
# Runtime configuration
|
||||
ENV NODE_ENV=production
|
||||
ENV PORT=3000
|
||||
ENV HOST=0.0.0.0
|
||||
ENV DATA_DIR=/app/data
|
||||
ENV HOME=/home/dockhand
|
||||
|
||||
# User/group IDs - customize with -e PUID=1000 -e PGID=1000
|
||||
# The entrypoint will recreate the dockhand user with these IDs
|
||||
ENV PUID=1001
|
||||
ENV PGID=1001
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD curl -f http://localhost:3000/ || exit 1
|
||||
CMD curl -f http://localhost:3000/ || exit 1
|
||||
|
||||
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
|
||||
CMD ["bun", "run", "./build/index.js"]
|
||||
|
||||
+425
@@ -0,0 +1,425 @@
|
||||
DOCKHAND PRIVACY POLICY
|
||||
|
||||
Last Updated: December 14, 2025
|
||||
Effective Date: December 14, 2025
|
||||
|
||||
================================================================================
|
||||
|
||||
1. INTRODUCTION
|
||||
|
||||
This Privacy Policy describes how Finsys Jaroslaw Krochmalski ("Finsys," "we,"
|
||||
"us," or "our") handles data in connection with the Dockhand software
|
||||
application ("Software"). This Policy applies to all users of the Software.
|
||||
|
||||
Finsys is committed to protecting your privacy and ensuring transparency
|
||||
about our data practices. This Policy explains that the Software operates
|
||||
entirely locally on your infrastructure with no data transmitted to Finsys.
|
||||
|
||||
|
||||
2. DATA CONTROLLER INFORMATION
|
||||
|
||||
Finsys Jaroslaw Krochmalski
|
||||
ul. Borki 6
|
||||
05-119 Jozefow
|
||||
Poland
|
||||
|
||||
VAT ID: PL7121835977
|
||||
REGON: 061576391
|
||||
|
||||
Email: enterprise@dockhand.pro
|
||||
Website: https://dockhand.pro
|
||||
|
||||
For the purpose of the General Data Protection Regulation (GDPR) and other
|
||||
applicable data protection laws, Finsys is NOT the data controller for any
|
||||
personal data processed through your installation of the Software. You (the
|
||||
user or your organization) are the data controller for all data stored in
|
||||
your Software installation.
|
||||
|
||||
|
||||
3. OUR FUNDAMENTAL PRINCIPLE: LOCAL-ONLY DATA
|
||||
|
||||
The Software is designed with privacy as a core principle:
|
||||
|
||||
- ALL DATA STAYS LOCAL: The Software stores all data exclusively on your
|
||||
infrastructure (your servers, your databases, your storage).
|
||||
|
||||
- NO DATA TRANSMISSION: The Software does not transmit any data to Finsys
|
||||
servers, third-party servers, or any external services.
|
||||
|
||||
- NO TELEMETRY: The Software contains no telemetry, analytics, usage
|
||||
tracking, crash reporting, or any other data collection mechanisms.
|
||||
|
||||
- FULLY SELF-CONTAINED: The Software operates entirely within your
|
||||
infrastructure without requiring any connection to Finsys systems.
|
||||
|
||||
- FINSYS HAS NO ACCESS: Finsys cannot access, view, retrieve, or process
|
||||
any data stored in your Software installation.
|
||||
|
||||
|
||||
4. DATA PROCESSED BY THE SOFTWARE
|
||||
|
||||
When you use the Software, the following types of data may be stored
|
||||
LOCALLY on your infrastructure:
|
||||
|
||||
4.1 User Account Data
|
||||
- Usernames and email addresses
|
||||
- Password hashes (never stored in plain text)
|
||||
- Multi-factor authentication (MFA) secrets (Enterprise Edition)
|
||||
- User profile information and avatars
|
||||
- Role assignments and permissions (Enterprise Edition)
|
||||
|
||||
4.2 Authentication Data
|
||||
- Session tokens and cookies
|
||||
- OIDC/SSO tokens and provider configurations
|
||||
- LDAP/Active Directory connection settings (Enterprise Edition)
|
||||
- API tokens for remote access
|
||||
|
||||
4.3 Docker Environment Data
|
||||
- Docker host connection details (URLs, ports, socket paths)
|
||||
- Docker container information (names, IDs, configurations)
|
||||
- Container logs and metrics
|
||||
- Image and volume data
|
||||
- Network configurations
|
||||
- Compose stack definitions
|
||||
|
||||
4.4 Git Integration Data
|
||||
- Git repository URLs and credentials
|
||||
- SSH keys and access tokens
|
||||
- Deployment webhooks
|
||||
|
||||
4.5 Registry Data
|
||||
- Docker registry URLs and credentials
|
||||
- Image pull/push history
|
||||
|
||||
4.6 Activity and Audit Data
|
||||
- User activity logs
|
||||
- Container events and operations
|
||||
- Audit trails (Enterprise Edition)
|
||||
|
||||
4.7 Application Settings
|
||||
- General configuration preferences
|
||||
- Notification channel settings (SMTP, webhooks)
|
||||
- Scheduled task configurations
|
||||
|
||||
All of the above data is stored exclusively in your local database
|
||||
(SQLite or PostgreSQL) and on your local filesystem. None of this data
|
||||
is transmitted to or accessible by Finsys.
|
||||
|
||||
|
||||
5. HOW DATA IS STORED
|
||||
|
||||
5.1 Database Storage
|
||||
|
||||
The Software uses either SQLite or PostgreSQL as configured by you:
|
||||
- SQLite: Data stored in a local file on your server
|
||||
- PostgreSQL: Data stored in your PostgreSQL database instance
|
||||
|
||||
5.2 File Storage
|
||||
|
||||
Certain data is stored in the local filesystem:
|
||||
- Compose stack files
|
||||
- Uploaded files (e.g., user avatars)
|
||||
- Temporary files during operations
|
||||
|
||||
5.3 Encryption
|
||||
|
||||
- Passwords are hashed using secure algorithms (Argon2id)
|
||||
- Sensitive credentials may be encrypted at rest depending on your
|
||||
database configuration
|
||||
- You are responsible for implementing disk encryption, database
|
||||
encryption, and network security for your infrastructure
|
||||
|
||||
|
||||
6. YOUR RESPONSIBILITIES AS DATA CONTROLLER
|
||||
|
||||
Since all data is stored locally on your infrastructure, YOU are the
|
||||
data controller for purposes of GDPR and other data protection laws.
|
||||
As data controller, you are responsible for:
|
||||
|
||||
6.1 Legal Basis for Processing
|
||||
Ensuring you have a valid legal basis for processing personal data of
|
||||
your users (e.g., consent, legitimate interest, contractual necessity).
|
||||
|
||||
6.2 Data Subject Rights
|
||||
Responding to data subject requests including:
|
||||
- Right of access (Article 15 GDPR)
|
||||
- Right to rectification (Article 16 GDPR)
|
||||
- Right to erasure (Article 17 GDPR)
|
||||
- Right to restriction of processing (Article 18 GDPR)
|
||||
- Right to data portability (Article 20 GDPR)
|
||||
- Right to object (Article 21 GDPR)
|
||||
|
||||
6.3 Security Measures
|
||||
Implementing appropriate technical and organizational measures to
|
||||
protect personal data, including:
|
||||
- Access controls and authentication
|
||||
- Encryption of data at rest and in transit
|
||||
- Regular security updates and patches
|
||||
- Backup and disaster recovery procedures
|
||||
- Network security (firewalls, VPNs, etc.)
|
||||
|
||||
6.4 Data Retention
|
||||
Establishing and implementing appropriate data retention policies.
|
||||
|
||||
6.5 Breach Notification
|
||||
Notifying supervisory authorities and affected individuals in case
|
||||
of a personal data breach, as required by applicable law.
|
||||
|
||||
6.6 Privacy Notices
|
||||
Providing appropriate privacy notices to your users regarding how
|
||||
their data is processed within the Software.
|
||||
|
||||
|
||||
7. DATA WE DO NOT COLLECT
|
||||
|
||||
To be absolutely clear, Finsys does NOT collect, receive, access, or
|
||||
process ANY of the following:
|
||||
|
||||
- Your identity or contact information (unless you contact us directly)
|
||||
- Your Docker infrastructure information
|
||||
- Your container configurations or data
|
||||
- Your user accounts or credentials
|
||||
- Your activity logs or audit trails
|
||||
- Your git repositories or deployment data
|
||||
- Usage statistics or analytics
|
||||
- Error reports or crash data
|
||||
- Any telemetry or diagnostic data
|
||||
- Any data whatsoever from your Software installation
|
||||
|
||||
|
||||
8. WHEN FINSYS MAY RECEIVE DATA
|
||||
|
||||
The only circumstances in which Finsys may receive data from you are:
|
||||
|
||||
8.1 Direct Communication
|
||||
When you voluntarily contact us via email (enterprise@dockhand.pro),
|
||||
we receive and process the information you provide (name, email address,
|
||||
message content). This data is processed for the purpose of responding
|
||||
to your inquiry based on our legitimate interest in providing customer
|
||||
support.
|
||||
|
||||
8.2 License Purchase
|
||||
|
||||
When you purchase an Enterprise Edition license, we collect and process:
|
||||
|
||||
Data Collected:
|
||||
- Name and/or company name
|
||||
- Email address
|
||||
- Billing address
|
||||
- Payment information (processed by payment provider)
|
||||
- Licensed hostname/identifier
|
||||
|
||||
Legal Basis (GDPR Article 6):
|
||||
- Contract performance (Art. 6(1)(b)) - to fulfill the license agreement
|
||||
- Legal obligation (Art. 6(1)(c)) - for invoicing and tax records
|
||||
|
||||
How We Use This Data:
|
||||
- To issue and deliver your License Key
|
||||
- To send license renewal reminders
|
||||
- To provide support related to your license
|
||||
- To comply with tax and accounting obligations
|
||||
|
||||
Data Retention:
|
||||
- License and invoice records: 7 years (Polish tax law requirement)
|
||||
- Email correspondence: 3 years after last contact
|
||||
|
||||
Data Sharing:
|
||||
- Payment processor (for payment transactions only)
|
||||
- No other third parties
|
||||
- No marketing or advertising use
|
||||
|
||||
8.3 Website Visits
|
||||
If you visit our website (https://dockhand.pro), standard web server
|
||||
logs may be collected. See our website privacy policy for details.
|
||||
|
||||
|
||||
9. LICENSE KEY DATA
|
||||
|
||||
Enterprise Edition License Keys contain:
|
||||
- Customer name (as registered)
|
||||
- Licensed hostname or identifier
|
||||
- Expiration date
|
||||
- Cryptographic signature
|
||||
|
||||
This information is embedded in the License Key itself and stored
|
||||
locally in your Software installation. Finsys retains a record of
|
||||
issued licenses for license management purposes.
|
||||
|
||||
|
||||
10. INTERNATIONAL DATA TRANSFERS
|
||||
|
||||
Since all Software data is stored locally on your infrastructure, no
|
||||
international data transfers occur through the Software itself.
|
||||
|
||||
If your infrastructure is located outside the European Economic Area
|
||||
(EEA), you are responsible for ensuring appropriate safeguards for
|
||||
any personal data stored therein.
|
||||
|
||||
|
||||
11. DATA RETENTION
|
||||
|
||||
11.1 Software Data
|
||||
You control the retention of all data in your Software installation.
|
||||
The Software does not automatically delete data unless you configure
|
||||
retention policies or manually delete data.
|
||||
|
||||
11.2 Communication Data
|
||||
If you contact us directly, we retain correspondence for as long as
|
||||
necessary to respond to your inquiry and for our records, typically
|
||||
not exceeding 3 years unless required for legal purposes.
|
||||
|
||||
11.3 License Records
|
||||
We retain license purchase and activation records for the duration
|
||||
required by tax and accounting regulations (typically 5-7 years).
|
||||
|
||||
|
||||
12. CHILDREN'S PRIVACY
|
||||
|
||||
The Software is not intended for use by children under 16 years of age.
|
||||
We do not knowingly collect personal data from children. If you are a
|
||||
parent or guardian and believe your child has provided personal data
|
||||
to us through direct communication, please contact us.
|
||||
|
||||
|
||||
13. THIRD-PARTY SERVICES
|
||||
|
||||
13.1 Software Integrations
|
||||
|
||||
The Software may connect to third-party services as configured by you:
|
||||
- Docker registries
|
||||
- Git repositories (GitHub, GitLab, etc.)
|
||||
- OIDC/SSO providers
|
||||
- LDAP/Active Directory servers
|
||||
- Notification services (SMTP, Discord, Slack, etc.)
|
||||
|
||||
These connections are initiated by you, configured by you, and occur
|
||||
between your infrastructure and these third-party services. Finsys is
|
||||
not involved in these connections and has no access to the data
|
||||
exchanged. The privacy policies of these third-party services apply
|
||||
to your use of them.
|
||||
|
||||
13.2 No Hidden Third-Party Data Sharing
|
||||
|
||||
The Software does not share any data with third parties on our behalf.
|
||||
There are no embedded analytics services, advertising networks, or
|
||||
data brokers within the Software.
|
||||
|
||||
|
||||
14. SECURITY
|
||||
|
||||
14.1 Software Security
|
||||
|
||||
We implement security measures in the Software design:
|
||||
- Secure password hashing (Argon2id)
|
||||
- Session management with secure tokens
|
||||
- Input validation and sanitization
|
||||
- Protection against common web vulnerabilities
|
||||
|
||||
14.2 Your Security Responsibilities
|
||||
|
||||
Since all data is stored on your infrastructure, you are responsible
|
||||
for:
|
||||
- Keeping the Software updated
|
||||
- Securing your server and database
|
||||
- Implementing network security measures
|
||||
- Managing user access and authentication
|
||||
- Creating and securing backups
|
||||
|
||||
|
||||
15. CHANGES TO THIS PRIVACY POLICY
|
||||
|
||||
We may update this Privacy Policy from time to time. Material changes
|
||||
will be communicated through:
|
||||
- Updated "Last Updated" date at the top of this Policy
|
||||
- Notice on our website
|
||||
- Notice within the Software (for significant changes)
|
||||
|
||||
We encourage you to review this Privacy Policy periodically.
|
||||
|
||||
|
||||
16. GDPR COMPLIANCE
|
||||
|
||||
Finsys complies with the General Data Protection Regulation (EU) 2016/679.
|
||||
|
||||
Summary of Our Data Processing:
|
||||
- We only collect personal data (email, name) when you purchase a license
|
||||
- Legal basis: Contract performance and legal obligation
|
||||
- Data is stored securely in the EU (Poland)
|
||||
- Retention: 7 years for tax records, 3 years for correspondence
|
||||
- No automated decision-making or profiling
|
||||
- No data sold or shared for marketing purposes
|
||||
|
||||
Your GDPR Rights (Articles 15-22):
|
||||
You have the right to access, rectify, erase, restrict processing,
|
||||
data portability, and object to processing of your personal data.
|
||||
|
||||
To exercise any of these rights, contact: enterprise@dockhand.pro
|
||||
We will respond within 30 days as required by GDPR.
|
||||
|
||||
|
||||
17. YOUR RIGHTS
|
||||
|
||||
If you are located in the European Economic Area (EEA), United Kingdom,
|
||||
or other jurisdiction with data protection laws, you have rights
|
||||
regarding personal data we hold about you (from direct communications
|
||||
or license purchases):
|
||||
|
||||
- Access: Request access to personal data we hold about you
|
||||
- Rectification: Request correction of inaccurate data
|
||||
- Erasure: Request deletion of your data
|
||||
- Restriction: Request restriction of processing
|
||||
- Portability: Request a copy of your data in portable format
|
||||
- Objection: Object to processing based on legitimate interests
|
||||
- Complaint: Lodge a complaint with a supervisory authority
|
||||
|
||||
To exercise these rights, contact us at enterprise@dockhand.pro.
|
||||
|
||||
Note: These rights apply to data WE hold (from direct communication or
|
||||
license purchases), not to data in YOUR Software installation. For data
|
||||
in your installation, YOU are the data controller and responsible for
|
||||
handling such requests from your users.
|
||||
|
||||
|
||||
18. SUPERVISORY AUTHORITY
|
||||
|
||||
If you are located in Poland, the relevant supervisory authority is:
|
||||
|
||||
Urzad Ochrony Danych Osobowych (UODO)
|
||||
ul. Stawki 2
|
||||
00-193 Warszawa
|
||||
Poland
|
||||
https://uodo.gov.pl
|
||||
|
||||
If you are located in another EEA country, you may contact your local
|
||||
data protection authority.
|
||||
|
||||
|
||||
19. CONTACT US
|
||||
|
||||
For any privacy-related questions, concerns, or requests:
|
||||
|
||||
Finsys Jaroslaw Krochmalski
|
||||
ul. Borki 6
|
||||
05-119 Jozefow
|
||||
Poland
|
||||
|
||||
Email: enterprise@dockhand.pro
|
||||
Website: https://dockhand.pro
|
||||
|
||||
|
||||
================================================================================
|
||||
SUMMARY
|
||||
|
||||
Dockhand is a privacy-respecting application:
|
||||
- All data stays on YOUR infrastructure
|
||||
- NO data is sent to Finsys servers
|
||||
- NO telemetry or analytics
|
||||
- YOU are the data controller for your installation
|
||||
- Finsys has NO access to your data
|
||||
|
||||
We believe privacy is a fundamental right, and we have designed Dockhand
|
||||
to respect that right by ensuring you maintain complete control over your
|
||||
data at all times.
|
||||
================================================================================
|
||||
|
||||
Copyright (c) 2025-2026 Finsys Jaroslaw Krochmalski. All rights reserved.
|
||||
@@ -16,7 +16,7 @@
|
||||
|
||||
## About
|
||||
|
||||
Dockhand is a modern, efficient Docker management application providing real-time container management, Compose stack orchestration, and multi-environment support.
|
||||
Dockhand is a modern, efficient Docker management application providing real-time container management, Compose stack orchestration, and multi-environment support. All in a lightweight, secure and privacy-focused package.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -30,6 +30,7 @@ Dockhand is a modern, efficient Docker management application providing real-tim
|
||||
|
||||
## Tech Stack
|
||||
|
||||
- **Base**: own OS layer built from scratch using <a href="https://github.com/wolfi-dev/os">Wolfi packages</a> via apko. Every package is explicitly declared in the Dockerfile.
|
||||
- **Frontend**: SvelteKit 2, Svelte 5, shadcn-svelte, TailwindCSS
|
||||
- **Backend**: Bun runtime with SvelteKit API routes
|
||||
- **Database**: SQLite or PostgreSQL via Drizzle ORM
|
||||
|
||||
+28
-13
@@ -80,15 +80,24 @@ else
|
||||
if [ "$PUID" != "1001" ] || [ "$PGID" != "1001" ]; then
|
||||
echo "Configuring user with PUID=$PUID PGID=$PGID"
|
||||
|
||||
# Remove existing dockhand user/group (only dockhand, not others)
|
||||
# Remove existing dockhand user/group (using busybox commands)
|
||||
deluser dockhand 2>/dev/null || true
|
||||
delgroup dockhand 2>/dev/null || true
|
||||
|
||||
# Check for UID conflicts - warn but don't delete other users
|
||||
SKIP_USER_CREATE=false
|
||||
if getent passwd "$PUID" >/dev/null 2>&1; then
|
||||
EXISTING=$(getent passwd "$PUID" | cut -d: -f1)
|
||||
echo "WARNING: UID $PUID already in use by '$EXISTING'. Using default UID 1001."
|
||||
PUID=1001
|
||||
if [ "$EXISTING" = "bun" ]; then
|
||||
echo "Note: UID $PUID is used by the 'bun' runtime user - reusing it for dockhand"
|
||||
echo "If upgrading from a previous version, you may need to fix data permissions:"
|
||||
echo " chown -R $PUID:$PGID /path/to/your/data"
|
||||
RUN_USER="bun"
|
||||
SKIP_USER_CREATE=true
|
||||
else
|
||||
echo "WARNING: UID $PUID already in use by '$EXISTING'. Using default UID 1001."
|
||||
PUID=1001
|
||||
fi
|
||||
fi
|
||||
|
||||
# Handle GID - reuse existing group or create new
|
||||
@@ -99,21 +108,26 @@ else
|
||||
TARGET_GROUP="dockhand"
|
||||
fi
|
||||
|
||||
adduser -u "$PUID" -G "$TARGET_GROUP" -h /home/dockhand -D dockhand
|
||||
if [ "$SKIP_USER_CREATE" = "false" ]; then
|
||||
adduser -u "$PUID" -G "$TARGET_GROUP" -h /home/dockhand -D dockhand
|
||||
fi
|
||||
fi
|
||||
|
||||
# === Directory Ownership ===
|
||||
chown -R dockhand:dockhand /app/data /home/dockhand 2>/dev/null || true
|
||||
chown -R "$RUN_USER":"$RUN_USER" /app/data 2>/dev/null || true
|
||||
if [ "$RUN_USER" = "dockhand" ]; then
|
||||
chown -R dockhand:dockhand /home/dockhand 2>/dev/null || true
|
||||
fi
|
||||
|
||||
if [ -n "$DATA_DIR" ] && [ "$DATA_DIR" != "/app/data" ] && [ "$DATA_DIR" != "./data" ]; then
|
||||
mkdir -p "$DATA_DIR"
|
||||
chown -R dockhand:dockhand "$DATA_DIR" 2>/dev/null || true
|
||||
chown -R "$RUN_USER":"$RUN_USER" "$DATA_DIR" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
|
||||
# === Docker Socket Access (Optional) ===
|
||||
# Check if Docker socket is mounted and accessible
|
||||
# Socket path can be configured via environment-specific settings in the app
|
||||
# Note: DOCKER_HOST with tcp:// requires configuring an environment via the web UI
|
||||
SOCKET_PATH="/var/run/docker.sock"
|
||||
|
||||
if [ -S "$SOCKET_PATH" ]; then
|
||||
@@ -121,7 +135,7 @@ if [ -S "$SOCKET_PATH" ]; then
|
||||
if [ "$RUN_USER" != "root" ]; then
|
||||
if ! su-exec "$RUN_USER" test -r "$SOCKET_PATH" 2>/dev/null; then
|
||||
SOCKET_GID=$(stat -c '%g' "$SOCKET_PATH" 2>/dev/null || echo "unknown")
|
||||
echo "WARNING: Docker socket at $SOCKET_PATH is not readable by dockhand user"
|
||||
echo "WARNING: Docker socket at $SOCKET_PATH is not readable by $RUN_USER user"
|
||||
echo ""
|
||||
echo "To use local Docker, fix with one of these options:"
|
||||
echo ""
|
||||
@@ -154,8 +168,8 @@ if [ -S "$SOCKET_PATH" ]; then
|
||||
echo "Using configured hostname: $DOCKHAND_HOSTNAME"
|
||||
fi
|
||||
else
|
||||
echo "No Docker socket found at $SOCKET_PATH"
|
||||
echo "Configure Docker environments via the web UI (Settings > Environments)"
|
||||
echo "No local Docker socket mounted (this is normal when using socket-proxy or remote Docker)"
|
||||
echo "Configure your Docker environment via the web UI: Settings > Environments"
|
||||
fi
|
||||
|
||||
# === Run Application ===
|
||||
@@ -167,10 +181,11 @@ if [ "$RUN_USER" = "root" ]; then
|
||||
exec "$@"
|
||||
fi
|
||||
else
|
||||
# Running as dockhand user
|
||||
# Running as non-root user
|
||||
echo "Running as user: $RUN_USER"
|
||||
if [ "$1" = "" ]; then
|
||||
exec su-exec dockhand bun run ./build/index.js
|
||||
exec su-exec "$RUN_USER" bun run ./build/index.js
|
||||
else
|
||||
exec su-exec dockhand "$@"
|
||||
exec su-exec "$RUN_USER" "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
ALTER TABLE "stack_sources" ADD COLUMN "compose_path" text;--> statement-breakpoint
|
||||
ALTER TABLE "stack_sources" ADD COLUMN "env_path" text;
|
||||
File diff suppressed because it is too large
Load Diff
@@ -22,6 +22,13 @@
|
||||
"when": 1766763867484,
|
||||
"tag": "0002_add_pending_container_updates",
|
||||
"breakpoints": true
|
||||
},
|
||||
{
|
||||
"idx": 3,
|
||||
"version": "7",
|
||||
"when": 1767687362730,
|
||||
"tag": "0003_add_stack_paths",
|
||||
"breakpoints": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,2 @@
|
||||
ALTER TABLE `stack_sources` ADD `compose_path` text;--> statement-breakpoint
|
||||
ALTER TABLE `stack_sources` ADD `env_path` text;
|
||||
File diff suppressed because it is too large
Load Diff
@@ -22,6 +22,13 @@
|
||||
"when": 1766763860091,
|
||||
"tag": "0002_add_pending_container_updates",
|
||||
"breakpoints": true
|
||||
},
|
||||
{
|
||||
"idx": 3,
|
||||
"version": "6",
|
||||
"when": 1767689000000,
|
||||
"tag": "0003_add_stack_paths",
|
||||
"breakpoints": true
|
||||
}
|
||||
]
|
||||
}
|
||||
+38
-30
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "dockhand",
|
||||
"private": true,
|
||||
"version": "1.0.4",
|
||||
"version": "1.0.8",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"dev": "bunx --bun vite dev",
|
||||
@@ -39,7 +39,7 @@
|
||||
},
|
||||
"dependencies": {
|
||||
"@codemirror/autocomplete": "6.20.0",
|
||||
"@codemirror/commands": "6.10.0",
|
||||
"@codemirror/commands": "6.10.1",
|
||||
"@codemirror/lang-css": "6.3.1",
|
||||
"@codemirror/lang-html": "6.4.11",
|
||||
"@codemirror/lang-javascript": "6.2.4",
|
||||
@@ -48,63 +48,71 @@
|
||||
"@codemirror/lang-python": "6.2.1",
|
||||
"@codemirror/lang-sql": "6.10.0",
|
||||
"@codemirror/lang-xml": "6.1.0",
|
||||
"@codemirror/language": "6.11.3",
|
||||
"@codemirror/lang-yaml": "6.1.2",
|
||||
"@codemirror/language": "6.12.1",
|
||||
"@codemirror/search": "6.5.11",
|
||||
"@codemirror/state": "6.5.3",
|
||||
"@codemirror/theme-one-dark": "6.1.3",
|
||||
"@codemirror/view": "6.39.9",
|
||||
"@lezer/highlight": "1.2.3",
|
||||
"@lucide/lab": "^0.1.2",
|
||||
"codemirror": "6.0.2",
|
||||
"croner": "9.1.0",
|
||||
"cronstrue": "3.9.0",
|
||||
"drizzle-orm": "0.45.0",
|
||||
"drizzle-orm": "0.45.1",
|
||||
"hash-wasm": "4.12.0",
|
||||
"js-yaml": "^4.1.1",
|
||||
"ldapts": "^8.0.9",
|
||||
"nodemailer": "^7.0.11",
|
||||
"ldapts": "^8.1.3",
|
||||
"nodemailer": "^7.0.12",
|
||||
"otpauth": "^9.4.1",
|
||||
"postgres": "3.4.7",
|
||||
"postgres": "3.4.8",
|
||||
"qrcode": "^1.5.4",
|
||||
"svelte-dnd-action": "0.9.68",
|
||||
"svelte-dnd-action": "0.9.69",
|
||||
"svelte-sonner": "1.0.7"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@codemirror/lang-yaml": "^6.1.2",
|
||||
"@codemirror/state": "^6.5.2",
|
||||
"@codemirror/theme-one-dark": "^6.1.3",
|
||||
"@codemirror/view": "^6.38.8",
|
||||
"@internationalized/date": "^3.10.0",
|
||||
"@internationalized/date": "^3.10.1",
|
||||
"@layerstack/tailwind": "^1.0.1",
|
||||
"@lucide/svelte": "^0.544.0",
|
||||
"@lucide/svelte": "^0.562.0",
|
||||
"@playwright/test": "1.57.0",
|
||||
"@sveltejs/kit": "^2.48.5",
|
||||
"@sveltejs/vite-plugin-svelte": "^6.2.1",
|
||||
"@tailwindcss/vite": "^4.1.17",
|
||||
"@types/bun": "^1.2.5",
|
||||
"@sveltejs/kit": "^2.49.3",
|
||||
"@sveltejs/vite-plugin-svelte": "^6.2.3",
|
||||
"@tailwindcss/vite": "^4.1.18",
|
||||
"@types/bun": "^1.3.5",
|
||||
"@types/js-yaml": "^4.0.9",
|
||||
"@types/nodemailer": "^7.0.4",
|
||||
"@types/qrcode": "^1.5.6",
|
||||
"@xterm/addon-fit": "^0.10.0",
|
||||
"@xterm/addon-web-links": "^0.11.0",
|
||||
"@xterm/xterm": "^5.5.0",
|
||||
"autoprefixer": "^10.4.22",
|
||||
"bits-ui": "^2.14.4",
|
||||
"@xterm/addon-fit": "^0.11.0",
|
||||
"@xterm/addon-web-links": "^0.12.0",
|
||||
"@xterm/xterm": "^6.0.0",
|
||||
"autoprefixer": "^10.4.23",
|
||||
"bits-ui": "^2.15.4",
|
||||
"clsx": "^2.1.1",
|
||||
"codemirror": "^6.0.2",
|
||||
"cytoscape": "^3.33.1",
|
||||
"d3-scale": "^4.0.2",
|
||||
"d3-shape": "^3.2.0",
|
||||
"drizzle-kit": "0.31.8",
|
||||
"layerchart": "^1.0.12",
|
||||
"lucide-svelte": "^0.555.0",
|
||||
"layerchart": "^1.0.13",
|
||||
"lucide-svelte": "^0.562.0",
|
||||
"mode-watcher": "^1.1.0",
|
||||
"postcss": "^8.5.6",
|
||||
"svelte": "^5.43.8",
|
||||
"svelte": "^5.46.1",
|
||||
"svelte-adapter-bun": "1.0.1",
|
||||
"svelte-check": "^4.3.4",
|
||||
"svelte-check": "^4.3.5",
|
||||
"svelte-easy-crop": "^5.0.0",
|
||||
"svelte-virtual-scroll-list": "^1.3.0",
|
||||
"tailwind-merge": "^3.4.0",
|
||||
"tailwind-variants": "^3.2.2",
|
||||
"tailwindcss": "^4.1.17",
|
||||
"tailwindcss": "^4.1.18",
|
||||
"tw-animate-css": "^1.4.0",
|
||||
"typescript": "^5.9.3",
|
||||
"vite": "^7.2.2"
|
||||
"vite": "^7.3.1"
|
||||
},
|
||||
"overrides": {
|
||||
"@codemirror/state": "6.5.3",
|
||||
"@codemirror/view": "6.39.9",
|
||||
"@codemirror/language": "6.12.1",
|
||||
"@lezer/common": "1.5.0",
|
||||
"@lezer/highlight": "1.2.3"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
/**
|
||||
* Build subprocess scripts as standalone bundles for production.
|
||||
*
|
||||
* Subprocesses run via Bun.spawn and need all dependencies bundled
|
||||
* since they can't access the SvelteKit build output's chunked modules.
|
||||
*/
|
||||
|
||||
const subprocesses = ['metrics-subprocess', 'event-subprocess'];
|
||||
|
||||
console.log('[build-subprocesses] Bundling subprocess scripts...');
|
||||
|
||||
for (const name of subprocesses) {
|
||||
const result = await Bun.build({
|
||||
entrypoints: [`./src/lib/server/subprocesses/${name}.ts`],
|
||||
outdir: './build/subprocesses',
|
||||
target: 'bun',
|
||||
minify: false
|
||||
});
|
||||
|
||||
if (!result.success) {
|
||||
console.error(`[build-subprocesses] Failed to bundle ${name}:`);
|
||||
for (const log of result.logs) {
|
||||
console.error(log);
|
||||
}
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
console.log(`[build-subprocesses] Bundled ${name}.js`);
|
||||
}
|
||||
|
||||
console.log('[build-subprocesses] Done');
|
||||
Executable
+20
@@ -0,0 +1,20 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to backup the database
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/backup-db.sh [output_dir]
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/backup-db.sh /app/data/backups
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/backup-db.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/backup-db.sh" "$@"
|
||||
fi
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to clear all user sessions
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/clear-sessions.sh
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/clear-sessions.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/clear-sessions.sh" "$@"
|
||||
fi
|
||||
Executable
+20
@@ -0,0 +1,20 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to create an admin user
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/create-admin.sh
|
||||
#
|
||||
# Default credentials: admin / admin123
|
||||
# CHANGE THE PASSWORD IMMEDIATELY after logging in!
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/create-admin.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/create-admin.sh" "$@"
|
||||
fi
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to disable authentication
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/disable-auth.sh
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/disable-auth.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/disable-auth.sh" "$@"
|
||||
fi
|
||||
Executable
+94
@@ -0,0 +1,94 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to export all compose stacks
|
||||
# Exports docker-compose.yml files from the stacks directory
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/export-stacks.sh [output_dir]
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/export-stacks.sh /tmp/stacks-backup
|
||||
#
|
||||
# Default output: /app/data/stacks-export
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Export Compose Stacks"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Default paths
|
||||
STACKS_DIR="${DOCKHAND_STACKS:-/home/dockhand/.dockhand/stacks}"
|
||||
OUTPUT_DIR="${1:-/app/data/stacks-export}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -d "$STACKS_DIR" ] && [ -d "$HOME/.dockhand/stacks" ]; then
|
||||
STACKS_DIR="$HOME/.dockhand/stacks"
|
||||
fi
|
||||
|
||||
if [ ! -d "$STACKS_DIR" ]; then
|
||||
echo "Error: Stacks directory not found at $STACKS_DIR"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Count stacks
|
||||
STACK_COUNT=$(find "$STACKS_DIR" -maxdepth 1 -type d ! -path "$STACKS_DIR" 2>/dev/null | wc -l | tr -d ' ')
|
||||
|
||||
echo "This script will export all compose stacks."
|
||||
echo ""
|
||||
echo "Stacks directory: $STACKS_DIR"
|
||||
echo "Output directory: $OUTPUT_DIR"
|
||||
echo "Stacks found: $STACK_COUNT"
|
||||
echo ""
|
||||
|
||||
if [ "$STACK_COUNT" -eq "0" ]; then
|
||||
echo "No stacks found to export."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
|
||||
# Create output directory
|
||||
mkdir -p "$OUTPUT_DIR"
|
||||
|
||||
echo "Exporting stacks..."
|
||||
echo ""
|
||||
|
||||
# Export each stack
|
||||
find "$STACKS_DIR" -maxdepth 1 -type d ! -path "$STACKS_DIR" | while read stack_dir; do
|
||||
STACK_NAME=$(basename "$stack_dir")
|
||||
COMPOSE_FILE="$stack_dir/docker-compose.yml"
|
||||
|
||||
if [ -f "$COMPOSE_FILE" ]; then
|
||||
mkdir -p "$OUTPUT_DIR/$STACK_NAME"
|
||||
cp "$COMPOSE_FILE" "$OUTPUT_DIR/$STACK_NAME/"
|
||||
|
||||
# Also copy .env file if exists
|
||||
if [ -f "$stack_dir/.env" ]; then
|
||||
cp "$stack_dir/.env" "$OUTPUT_DIR/$STACK_NAME/"
|
||||
fi
|
||||
|
||||
echo " Exported: $STACK_NAME"
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Export complete!"
|
||||
echo "Stacks exported to: $OUTPUT_DIR"
|
||||
echo ""
|
||||
echo "To copy from Docker container to host:"
|
||||
echo " docker cp dockhand:$OUTPUT_DIR ./stacks-backup"
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to list all users
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/list-users.sh
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/list-users.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/list-users.sh" "$@"
|
||||
fi
|
||||
Executable
+101
@@ -0,0 +1,101 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to backup the database
|
||||
# Creates a timestamped dump of the database
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/backup-db.sh [output_dir]
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/backup-db.sh /app/data/backups
|
||||
#
|
||||
# Default output: /app/data
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Backup Database (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
OUTPUT_DIR="${1:-/app/data}"
|
||||
|
||||
# Parse DATABASE_URL
|
||||
# Format: postgres://user:password@host:port/database
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
# Extract credentials
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
# Generate backup filename with timestamp
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
BACKUP_FILE="$OUTPUT_DIR/dockhand_backup_$TIMESTAMP.sql"
|
||||
|
||||
echo "This script will create a backup of the database."
|
||||
echo ""
|
||||
echo "Host: $DB_HOST:$DB_PORT"
|
||||
echo "Database: $DB_NAME"
|
||||
echo "Backup: $BACKUP_FILE"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
|
||||
# Create output directory if needed
|
||||
mkdir -p "$OUTPUT_DIR"
|
||||
|
||||
echo "Creating database backup..."
|
||||
|
||||
# Use pg_dump to create backup
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
if command -v pg_dump >/dev/null 2>&1; then
|
||||
pg_dump -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -F p -f "$BACKUP_FILE"
|
||||
else
|
||||
echo "Error: pg_dump not found"
|
||||
echo "Install PostgreSQL client tools to use this script"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $? -eq 0 ] && [ -f "$BACKUP_FILE" ]; then
|
||||
SIZE=$(ls -lh "$BACKUP_FILE" | awk '{print $5}')
|
||||
echo ""
|
||||
echo "Backup created successfully!"
|
||||
echo "Size: $SIZE"
|
||||
echo ""
|
||||
echo "To copy from Docker container to host:"
|
||||
echo " docker cp dockhand:$BACKUP_FILE ./dockhand_backup_$TIMESTAMP.sql"
|
||||
else
|
||||
echo "Error: Failed to create backup"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+75
@@ -0,0 +1,75 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to clear all user sessions
|
||||
# Use this to force all users to re-login
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/clear-sessions.sh
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Clear All Sessions (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "This script will clear all user sessions,"
|
||||
echo "forcing all users to log in again."
|
||||
echo ""
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
COUNT=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM sessions;" 2>/dev/null | tr -d ' ')
|
||||
|
||||
echo "Database: $DB_HOST:$DB_PORT/$DB_NAME"
|
||||
echo "Active sessions: $COUNT"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Clearing all user sessions..."
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "DELETE FROM sessions;"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Cleared $COUNT session(s) successfully."
|
||||
echo "All users will need to log in again."
|
||||
else
|
||||
echo "Error: Failed to clear sessions"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+117
@@ -0,0 +1,117 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to create an admin user
|
||||
# Use this if you're locked out of Dockhand and need to create a new admin
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/create-admin.sh
|
||||
#
|
||||
# Default credentials: admin / admin123
|
||||
# CHANGE THE PASSWORD IMMEDIATELY after logging in!
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Create Admin User (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "This script will create an admin user with:"
|
||||
echo " Username: admin"
|
||||
echo " Password: admin123"
|
||||
echo ""
|
||||
echo "If user 'admin' already exists, password will"
|
||||
echo "be reset and admin privileges restored."
|
||||
echo ""
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
echo "Database: $DB_HOST:$DB_PORT/$DB_NAME"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Username and password
|
||||
USERNAME="admin"
|
||||
# Password: admin123
|
||||
# This is an argon2id hash of "admin123" - generated with default argon2 settings
|
||||
PASSWORD_HASH='$argon2id$v=19$m=65536,t=3,p=4$Jq4am2SfyYKmc0PAHe+yzg$cq/27vK/Qg2eZb/jMDy0ExLDhOG+58cKAximxpG5Dss'
|
||||
|
||||
echo ""
|
||||
echo "Creating admin user..."
|
||||
|
||||
# Check if admin user already exists
|
||||
EXISTING=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM users WHERE username='$USERNAME';" 2>/dev/null | tr -d ' ')
|
||||
|
||||
if [ "$EXISTING" -gt "0" ]; then
|
||||
echo "User '$USERNAME' already exists."
|
||||
echo "Resetting password and ensuring active status..."
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "UPDATE users SET password_hash='$PASSWORD_HASH', is_active=true WHERE username='$USERNAME';"
|
||||
USER_ID=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT id FROM users WHERE username='$USERNAME';" 2>/dev/null | tr -d ' ')
|
||||
else
|
||||
echo "Creating new admin user..."
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "INSERT INTO users (username, password_hash, is_active, auth_provider, created_at, updated_at) VALUES ('$USERNAME', '$PASSWORD_HASH', true, 'local', NOW(), NOW());"
|
||||
USER_ID=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT id FROM users WHERE username='$USERNAME';" 2>/dev/null | tr -d ' ')
|
||||
echo "Admin user created successfully."
|
||||
fi
|
||||
|
||||
# Get the Admin role ID (it's a system role)
|
||||
ADMIN_ROLE_ID=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT id FROM roles WHERE name='Admin';" 2>/dev/null | tr -d ' ')
|
||||
|
||||
if [ -z "$ADMIN_ROLE_ID" ]; then
|
||||
echo "Warning: Admin role not found in database."
|
||||
echo "The user was created but may not have admin privileges."
|
||||
echo "Please check Settings > Auth > Roles after logging in."
|
||||
else
|
||||
# Check if user already has Admin role
|
||||
HAS_ROLE=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM user_roles WHERE user_id=$USER_ID AND role_id=$ADMIN_ROLE_ID;" 2>/dev/null | tr -d ' ')
|
||||
|
||||
if [ "$HAS_ROLE" -eq "0" ]; then
|
||||
echo "Assigning Admin role..."
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "INSERT INTO user_roles (user_id, role_id, created_at) VALUES ($USER_ID, $ADMIN_ROLE_ID, NOW());"
|
||||
echo "Admin role assigned."
|
||||
else
|
||||
echo "User already has Admin role."
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Credentials:"
|
||||
echo " Username: admin"
|
||||
echo " Password: admin123"
|
||||
echo ""
|
||||
echo "WARNING: Change the password immediately after logging in!"
|
||||
Executable
+74
@@ -0,0 +1,74 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to disable authentication
|
||||
# Use this if you're locked out of Dockhand
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/disable-auth.sh
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Disable Authentication (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "This script will disable authentication,"
|
||||
echo "allowing access to Dockhand without login."
|
||||
echo ""
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
echo "Database: $DB_HOST:$DB_PORT/$DB_NAME"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Disabling authentication..."
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "UPDATE auth_settings SET auth_enabled = false WHERE id = 1;"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Authentication disabled successfully."
|
||||
echo "You can now access Dockhand without logging in."
|
||||
echo ""
|
||||
echo "Remember to re-enable authentication in Settings after regaining access."
|
||||
else
|
||||
echo "Error: Failed to disable authentication"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+94
@@ -0,0 +1,94 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to list all users
|
||||
# Shows username, admin status, active status, and last login
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/list-users.sh
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - List Users (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
# Get user count
|
||||
USER_COUNT=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM users;" 2>/dev/null | tr -d ' ')
|
||||
|
||||
if [ "$USER_COUNT" -eq "0" ]; then
|
||||
echo "No users found."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Get Admin role ID for checking admin status
|
||||
ADMIN_ROLE_ID=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT id FROM roles WHERE name='Admin';" 2>/dev/null | tr -d ' ')
|
||||
|
||||
# Print header
|
||||
printf "%-4s %-20s %-8s %-8s %-6s %s\n" "ID" "Username" "Admin" "Active" "MFA" "Last Login"
|
||||
printf "%-4s %-20s %-8s %-8s %-6s %s\n" "----" "--------------------" "--------" "--------" "------" "-------------------"
|
||||
|
||||
# List users (check admin status via user_roles table)
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -A -F '|' -c "SELECT id, username, is_active, mfa_enabled, COALESCE(last_login::text, 'Never') FROM users ORDER BY id;" 2>/dev/null | while IFS='|' read id username is_active mfa_enabled last_login; do
|
||||
# Check if user has Admin role
|
||||
if [ -n "$ADMIN_ROLE_ID" ]; then
|
||||
HAS_ADMIN=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM user_roles WHERE user_id=$id AND role_id=$ADMIN_ROLE_ID;" 2>/dev/null | tr -d ' ')
|
||||
if [ "$HAS_ADMIN" -gt "0" ]; then
|
||||
admin_str="Yes"
|
||||
else
|
||||
admin_str="No"
|
||||
fi
|
||||
else
|
||||
admin_str="N/A"
|
||||
fi
|
||||
|
||||
# Convert boolean values (PostgreSQL returns t/f)
|
||||
if [ "$is_active" = "t" ]; then
|
||||
active_str="Yes"
|
||||
else
|
||||
active_str="No"
|
||||
fi
|
||||
|
||||
if [ "$mfa_enabled" = "t" ]; then
|
||||
mfa_str="Yes"
|
||||
else
|
||||
mfa_str="No"
|
||||
fi
|
||||
|
||||
printf "%-4s %-20s %-8s %-8s %-6s %s\n" "$id" "$username" "$admin_str" "$active_str" "$mfa_str" "$last_login"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Total: $USER_COUNT user(s)"
|
||||
|
||||
# Show session count
|
||||
SESSION_COUNT=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM sessions;" 2>/dev/null | tr -d ' ')
|
||||
echo "Active sessions: $SESSION_COUNT"
|
||||
Executable
+118
@@ -0,0 +1,118 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to factory reset the database
|
||||
# WARNING: This will DELETE ALL DATA including users, settings, and activity logs!
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/reset-db.sh
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Factory Reset Database (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "WARNING: This will DELETE ALL DATA!"
|
||||
echo ""
|
||||
echo "This includes:"
|
||||
echo " - All users and their settings"
|
||||
echo " - All sessions"
|
||||
echo " - Authentication settings"
|
||||
echo " - Activity logs"
|
||||
echo " - Environment configurations"
|
||||
echo " - OIDC/SSO settings"
|
||||
echo ""
|
||||
echo "The database tables will be truncated."
|
||||
echo ""
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
echo "Database: $DB_HOST:$DB_PORT/$DB_NAME"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Creating backup before reset..."
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
BACKUP_FILE="/app/data/dockhand_backup_pre_reset_$TIMESTAMP.sql"
|
||||
if command -v pg_dump >/dev/null 2>&1; then
|
||||
pg_dump -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -F p -f "$BACKUP_FILE" 2>/dev/null || true
|
||||
if [ -f "$BACKUP_FILE" ]; then
|
||||
echo "Backup saved to: $BACKUP_FILE"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Truncating all tables..."
|
||||
|
||||
# Truncate all tables in the correct order (respecting foreign keys)
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" <<EOF
|
||||
TRUNCATE TABLE
|
||||
sessions,
|
||||
user_roles,
|
||||
dashboard_preferences,
|
||||
audit_logs,
|
||||
container_events,
|
||||
vulnerability_scans,
|
||||
stack_sources,
|
||||
git_stacks,
|
||||
git_repositories,
|
||||
git_credentials,
|
||||
host_metrics,
|
||||
stack_events,
|
||||
environment_notifications,
|
||||
auto_update_settings,
|
||||
users,
|
||||
roles,
|
||||
oidc_config,
|
||||
ldap_config,
|
||||
auth_settings,
|
||||
notification_settings,
|
||||
config_sets,
|
||||
registries,
|
||||
environments,
|
||||
settings
|
||||
CASCADE;
|
||||
EOF
|
||||
|
||||
echo ""
|
||||
echo "Database reset successfully."
|
||||
echo ""
|
||||
echo "Restart Dockhand to recreate default data:"
|
||||
echo " docker restart dockhand"
|
||||
Executable
+139
@@ -0,0 +1,139 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to reset a user's password
|
||||
# Use this if a user is locked out and needs a password reset
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/reset-password.sh <username> <new_password>
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/reset-password.sh admin MyNewPassword123
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Reset User Password (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Check arguments
|
||||
if [ -z "$1" ] || [ -z "$2" ]; then
|
||||
echo "Usage: $0 <username> <new_password>"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 admin MyNewPassword123"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USERNAME="$1"
|
||||
NEW_PASSWORD="$2"
|
||||
|
||||
# Validate password length
|
||||
if [ ${#NEW_PASSWORD} -lt 8 ]; then
|
||||
echo "Error: Password must be at least 8 characters"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
# Check if user exists
|
||||
EXISTING=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT COUNT(*) FROM users WHERE username='$USERNAME';" 2>/dev/null | tr -d ' ')
|
||||
|
||||
if [ "$EXISTING" -eq "0" ]; then
|
||||
echo "Error: User '$USERNAME' not found"
|
||||
echo ""
|
||||
echo "Available users:"
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT username FROM users;" 2>/dev/null | while read user; do
|
||||
user=$(echo "$user" | tr -d ' ')
|
||||
if [ -n "$user" ]; then
|
||||
echo " - $user"
|
||||
fi
|
||||
done
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "This script will reset the password for user '$USERNAME'."
|
||||
echo ""
|
||||
echo "Database: $DB_HOST:$DB_PORT/$DB_NAME"
|
||||
echo "Username: $USERNAME"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Generate password hash using node (argon2 is available in the app)
|
||||
echo ""
|
||||
echo "Generating password hash..."
|
||||
|
||||
# Check if node and argon2 are available
|
||||
if command -v node >/dev/null 2>&1; then
|
||||
# Try to use argon2 from node_modules
|
||||
PASSWORD_HASH=$(node -e "
|
||||
try {
|
||||
const argon2 = require('argon2');
|
||||
argon2.hash('$NEW_PASSWORD').then(h => console.log(h)).catch(e => process.exit(1));
|
||||
} catch(e) {
|
||||
process.exit(1);
|
||||
}
|
||||
" 2>/dev/null)
|
||||
|
||||
if [ -z "$PASSWORD_HASH" ]; then
|
||||
echo "Error: Could not generate password hash (argon2 not available)"
|
||||
echo "This script requires Node.js with argon2 module"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "Error: Node.js is required to generate password hash"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Resetting password for user '$USERNAME'..."
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "UPDATE users SET password_hash='$PASSWORD_HASH', updated_at=NOW() WHERE username='$USERNAME';"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Password reset successfully for user '$USERNAME'"
|
||||
echo ""
|
||||
# Invalidate sessions
|
||||
USER_ID=$(psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -t -c "SELECT id FROM users WHERE username='$USERNAME';" 2>/dev/null | tr -d ' ')
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "DELETE FROM sessions WHERE user_id=$USER_ID;" 2>/dev/null || true
|
||||
echo "All existing sessions have been invalidated."
|
||||
echo "The user can now log in with the new password."
|
||||
else
|
||||
echo "Error: Failed to reset password"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+117
@@ -0,0 +1,117 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# PostgreSQL: Emergency script to restore the database from a backup
|
||||
# WARNING: This will overwrite the current database!
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/restore-db.sh <backup_file>
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/postgres/restore-db.sh /app/data/dockhand_backup_20240115_120000.sql
|
||||
#
|
||||
# To copy backup into container first:
|
||||
# docker cp ./dockhand_backup.sql dockhand:/app/data/
|
||||
#
|
||||
# Requires: DATABASE_URL environment variable
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Restore Database (PostgreSQL)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Check argument
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: $0 <backup_file>"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 /app/data/dockhand_backup_20240115_120000.sql"
|
||||
echo ""
|
||||
echo "To copy backup into container first:"
|
||||
echo " docker cp ./dockhand_backup.sql dockhand:/app/data/"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BACKUP_FILE="$1"
|
||||
|
||||
# Check DATABASE_URL
|
||||
if [ -z "$DATABASE_URL" ]; then
|
||||
echo "Error: DATABASE_URL environment variable not set"
|
||||
echo ""
|
||||
echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse DATABASE_URL
|
||||
DB_URL="$DATABASE_URL"
|
||||
DB_URL="${DB_URL#postgres://}"
|
||||
DB_URL="${DB_URL#postgresql://}"
|
||||
|
||||
DB_USER="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PASS="${DB_URL%%@*}"
|
||||
DB_URL="${DB_URL#*@}"
|
||||
DB_HOST="${DB_URL%%:*}"
|
||||
DB_URL="${DB_URL#*:}"
|
||||
DB_PORT="${DB_URL%%/*}"
|
||||
DB_NAME="${DB_URL#*/}"
|
||||
DB_NAME="${DB_NAME%%\?*}"
|
||||
|
||||
export PGPASSWORD="$DB_PASS"
|
||||
|
||||
# Check if backup file exists
|
||||
if [ ! -f "$BACKUP_FILE" ]; then
|
||||
echo "Error: Backup file not found: $BACKUP_FILE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Get backup file size
|
||||
BACKUP_SIZE=$(ls -lh "$BACKUP_FILE" | awk '{print $5}')
|
||||
|
||||
echo "WARNING: This will overwrite the current database!"
|
||||
echo ""
|
||||
echo "Database: $DB_HOST:$DB_PORT/$DB_NAME"
|
||||
echo "Backup to restore: $BACKUP_FILE ($BACKUP_SIZE)"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Create backup of current database before restoring
|
||||
echo ""
|
||||
echo "Creating backup of current database..."
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
PRE_RESTORE_BACKUP="/app/data/dockhand_pre_restore_$TIMESTAMP.sql"
|
||||
if command -v pg_dump >/dev/null 2>&1; then
|
||||
pg_dump -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -F p -f "$PRE_RESTORE_BACKUP" 2>/dev/null || true
|
||||
if [ -f "$PRE_RESTORE_BACKUP" ]; then
|
||||
echo "Current database backed up to: $PRE_RESTORE_BACKUP"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Restoring database..."
|
||||
|
||||
# Drop and recreate all tables by running the backup
|
||||
psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -f "$BACKUP_FILE"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Database restored successfully!"
|
||||
echo ""
|
||||
echo "Restart Dockhand to apply changes:"
|
||||
echo " docker restart dockhand"
|
||||
else
|
||||
echo "Error: Failed to restore database"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+18
@@ -0,0 +1,18 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to factory reset the database
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
# WARNING: This will DELETE ALL DATA!
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/reset-db.sh
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/reset-db.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/reset-db.sh" "$@"
|
||||
fi
|
||||
Executable
+20
@@ -0,0 +1,20 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to reset a user's password
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/reset-password.sh <username> <new_password>
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/reset-password.sh admin MyNewPassword123
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/reset-password.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/reset-password.sh" "$@"
|
||||
fi
|
||||
Executable
+21
@@ -0,0 +1,21 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Emergency script to restore the database from a backup
|
||||
# Automatically detects database type (SQLite or PostgreSQL)
|
||||
# WARNING: This will overwrite the current database!
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/restore-db.sh <backup_file>
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/restore-db.sh /app/data/dockhand_backup_20240115_120000.db
|
||||
#
|
||||
|
||||
SCRIPT_DIR="$(dirname "$0")"
|
||||
|
||||
# Detect database type
|
||||
if [ -n "$DATABASE_URL" ] && (echo "$DATABASE_URL" | grep -qE '^postgres(ql)?://'); then
|
||||
exec "$SCRIPT_DIR/postgres/restore-db.sh" "$@"
|
||||
else
|
||||
exec "$SCRIPT_DIR/sqlite/restore-db.sh" "$@"
|
||||
fi
|
||||
Executable
+88
@@ -0,0 +1,88 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to backup the database
|
||||
# Creates a timestamped copy of the database file
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/backup-db.sh [output_dir]
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/backup-db.sh /app/data/backups
|
||||
#
|
||||
# Default output: /app/data (same directory as database)
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Backup Database (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
OUTPUT_DIR="${1:-$(dirname "$DB_PATH")}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
OUTPUT_DIR="${1:-./data/db}"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate backup filename with timestamp
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
BACKUP_FILE="$OUTPUT_DIR/dockhand_backup_$TIMESTAMP.db"
|
||||
|
||||
# Get database size
|
||||
DB_SIZE=$(ls -lh "$DB_PATH" | awk '{print $5}')
|
||||
|
||||
echo "This script will create a backup of the database."
|
||||
echo ""
|
||||
echo "Source: $DB_PATH ($DB_SIZE)"
|
||||
echo "Backup: $BACKUP_FILE"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
|
||||
# Create output directory if needed
|
||||
mkdir -p "$OUTPUT_DIR"
|
||||
|
||||
echo "Creating database backup..."
|
||||
|
||||
# Use sqlite3 backup command for safe backup (handles WAL mode)
|
||||
if command -v sqlite3 >/dev/null 2>&1; then
|
||||
sqlite3 "$DB_PATH" ".backup '$BACKUP_FILE'"
|
||||
else
|
||||
# Fallback to file copy if sqlite3 not available
|
||||
cp "$DB_PATH" "$BACKUP_FILE"
|
||||
fi
|
||||
|
||||
if [ $? -eq 0 ] && [ -f "$BACKUP_FILE" ]; then
|
||||
SIZE=$(ls -lh "$BACKUP_FILE" | awk '{print $5}')
|
||||
echo ""
|
||||
echo "Backup created successfully!"
|
||||
echo "Size: $SIZE"
|
||||
echo ""
|
||||
echo "To copy from Docker container to host:"
|
||||
echo " docker cp dockhand:$BACKUP_FILE ./dockhand_backup_$TIMESTAMP.db"
|
||||
else
|
||||
echo "Error: Failed to create backup"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+62
@@ -0,0 +1,62 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to clear all user sessions
|
||||
# Use this to force all users to re-login
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/clear-sessions.sh
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Clear All Sessions (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "This script will clear all user sessions,"
|
||||
echo "forcing all users to log in again."
|
||||
echo ""
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
COUNT=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM sessions;")
|
||||
|
||||
echo "Database: $DB_PATH"
|
||||
echo "Active sessions: $COUNT"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Clearing all user sessions..."
|
||||
sqlite3 "$DB_PATH" "DELETE FROM sessions;"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Cleared $COUNT session(s) successfully."
|
||||
echo "All users will need to log in again."
|
||||
else
|
||||
echo "Error: Failed to clear sessions"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+104
@@ -0,0 +1,104 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to create an admin user
|
||||
# Use this if you're locked out of Dockhand and need to create a new admin
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/create-admin.sh
|
||||
#
|
||||
# Default credentials: admin / admin123
|
||||
# CHANGE THE PASSWORD IMMEDIATELY after logging in!
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Create Admin User (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "This script will create an admin user with:"
|
||||
echo " Username: admin"
|
||||
echo " Password: admin123"
|
||||
echo ""
|
||||
echo "If user 'admin' already exists, password will"
|
||||
echo "be reset and admin privileges restored."
|
||||
echo ""
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Database: $DB_PATH"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Username and password
|
||||
USERNAME="admin"
|
||||
# Password: admin123
|
||||
# This is an argon2id hash of "admin123" - generated with default argon2 settings
|
||||
PASSWORD_HASH='$argon2id$v=19$m=65536,t=3,p=4$Jq4am2SfyYKmc0PAHe+yzg$cq/27vK/Qg2eZb/jMDy0ExLDhOG+58cKAximxpG5Dss'
|
||||
|
||||
echo ""
|
||||
echo "Creating admin user..."
|
||||
|
||||
# Check if admin user already exists
|
||||
EXISTING=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM users WHERE username='$USERNAME';")
|
||||
|
||||
if [ "$EXISTING" -gt "0" ]; then
|
||||
echo "User '$USERNAME' already exists."
|
||||
echo "Resetting password and ensuring active status..."
|
||||
sqlite3 "$DB_PATH" "UPDATE users SET password_hash='$PASSWORD_HASH', is_active=1 WHERE username='$USERNAME';"
|
||||
USER_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM users WHERE username='$USERNAME';")
|
||||
else
|
||||
echo "Creating new admin user..."
|
||||
sqlite3 "$DB_PATH" "INSERT INTO users (username, password_hash, is_active, auth_provider, created_at, updated_at) VALUES ('$USERNAME', '$PASSWORD_HASH', 1, 'local', datetime('now'), datetime('now'));"
|
||||
USER_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM users WHERE username='$USERNAME';")
|
||||
echo "Admin user created successfully."
|
||||
fi
|
||||
|
||||
# Get the Admin role ID (it's a system role)
|
||||
ADMIN_ROLE_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM roles WHERE name='Admin';")
|
||||
|
||||
if [ -z "$ADMIN_ROLE_ID" ]; then
|
||||
echo "Warning: Admin role not found in database."
|
||||
echo "The user was created but may not have admin privileges."
|
||||
echo "Please check Settings > Auth > Roles after logging in."
|
||||
else
|
||||
# Check if user already has Admin role
|
||||
HAS_ROLE=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM user_roles WHERE user_id=$USER_ID AND role_id=$ADMIN_ROLE_ID;")
|
||||
|
||||
if [ "$HAS_ROLE" -eq "0" ]; then
|
||||
echo "Assigning Admin role..."
|
||||
sqlite3 "$DB_PATH" "INSERT INTO user_roles (user_id, role_id, created_at) VALUES ($USER_ID, $ADMIN_ROLE_ID, datetime('now'));"
|
||||
echo "Admin role assigned."
|
||||
else
|
||||
echo "User already has Admin role."
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Credentials:"
|
||||
echo " Username: admin"
|
||||
echo " Password: admin123"
|
||||
echo ""
|
||||
echo "WARNING: Change the password immediately after logging in!"
|
||||
Executable
+61
@@ -0,0 +1,61 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to disable authentication
|
||||
# Use this if you're locked out of Dockhand
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/disable-auth.sh
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Disable Authentication (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "This script will disable authentication,"
|
||||
echo "allowing access to Dockhand without login."
|
||||
echo ""
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Database: $DB_PATH"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Disabling authentication..."
|
||||
sqlite3 "$DB_PATH" "UPDATE auth_settings SET auth_enabled = 0 WHERE id = 1;"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Authentication disabled successfully."
|
||||
echo "You can now access Dockhand without logging in."
|
||||
echo ""
|
||||
echo "Remember to re-enable authentication in Settings after regaining access."
|
||||
else
|
||||
echo "Error: Failed to disable authentication"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+80
@@ -0,0 +1,80 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to list all users
|
||||
# Shows username, admin status, active status, and last login
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/list-users.sh
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - List Users (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Get user count
|
||||
USER_COUNT=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM users;")
|
||||
|
||||
if [ "$USER_COUNT" -eq "0" ]; then
|
||||
echo "No users found."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Get Admin role ID for checking admin status
|
||||
ADMIN_ROLE_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM roles WHERE name='Admin';" 2>/dev/null || echo "")
|
||||
|
||||
# Print header
|
||||
printf "%-4s %-20s %-8s %-8s %-6s %s\n" "ID" "Username" "Admin" "Active" "MFA" "Last Login"
|
||||
printf "%-4s %-20s %-8s %-8s %-6s %s\n" "----" "--------------------" "--------" "--------" "------" "-------------------"
|
||||
|
||||
# List users (check admin status via user_roles table)
|
||||
sqlite3 -separator '|' "$DB_PATH" "SELECT id, username, is_active, mfa_enabled, COALESCE(last_login, 'Never') FROM users ORDER BY id;" | while IFS='|' read id username is_active mfa_enabled last_login; do
|
||||
# Check if user has Admin role
|
||||
if [ -n "$ADMIN_ROLE_ID" ]; then
|
||||
HAS_ADMIN=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM user_roles WHERE user_id=$id AND role_id=$ADMIN_ROLE_ID;")
|
||||
if [ "$HAS_ADMIN" -gt "0" ]; then
|
||||
admin_str="Yes"
|
||||
else
|
||||
admin_str="No"
|
||||
fi
|
||||
else
|
||||
admin_str="N/A"
|
||||
fi
|
||||
|
||||
if [ "$is_active" = "1" ]; then
|
||||
active_str="Yes"
|
||||
else
|
||||
active_str="No"
|
||||
fi
|
||||
|
||||
if [ "$mfa_enabled" = "1" ]; then
|
||||
mfa_str="Yes"
|
||||
else
|
||||
mfa_str="No"
|
||||
fi
|
||||
|
||||
printf "%-4s %-20s %-8s %-8s %-6s %s\n" "$id" "$username" "$admin_str" "$active_str" "$mfa_str" "$last_login"
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Total: $USER_COUNT user(s)"
|
||||
|
||||
# Show session count
|
||||
SESSION_COUNT=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM sessions;")
|
||||
echo "Active sessions: $SESSION_COUNT"
|
||||
Executable
+73
@@ -0,0 +1,73 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to factory reset the database
|
||||
# WARNING: This will DELETE ALL DATA including users, settings, and activity logs!
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/reset-db.sh
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Factory Reset Database (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
echo "WARNING: This will DELETE ALL DATA!"
|
||||
echo ""
|
||||
echo "This includes:"
|
||||
echo " - All users and their settings"
|
||||
echo " - All sessions"
|
||||
echo " - Authentication settings"
|
||||
echo " - Activity logs"
|
||||
echo " - Environment configurations"
|
||||
echo " - OIDC/SSO settings"
|
||||
echo ""
|
||||
echo "The database will be recreated on next startup."
|
||||
echo ""
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Nothing to reset."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Database: $DB_PATH"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo ""
|
||||
echo "Creating backup before reset..."
|
||||
BACKUP_FILE="${DB_PATH}.backup.$(date +%Y%m%d_%H%M%S)"
|
||||
cp "$DB_PATH" "$BACKUP_FILE"
|
||||
echo "Backup saved to: $BACKUP_FILE"
|
||||
|
||||
echo ""
|
||||
echo "Deleting database..."
|
||||
rm -f "$DB_PATH"
|
||||
rm -f "${DB_PATH}-wal"
|
||||
rm -f "${DB_PATH}-shm"
|
||||
|
||||
echo ""
|
||||
echo "Database deleted successfully."
|
||||
echo ""
|
||||
echo "Restart Dockhand to recreate a fresh database:"
|
||||
echo " docker restart dockhand"
|
||||
Executable
+123
@@ -0,0 +1,123 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to reset a user's password
|
||||
# Use this if a user is locked out and needs a password reset
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/reset-password.sh <username> <new_password>
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/reset-password.sh admin MyNewPassword123
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Reset User Password (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Check arguments
|
||||
if [ -z "$1" ] || [ -z "$2" ]; then
|
||||
echo "Usage: $0 <username> <new_password>"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 admin MyNewPassword123"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USERNAME="$1"
|
||||
NEW_PASSWORD="$2"
|
||||
|
||||
# Validate password length
|
||||
if [ ${#NEW_PASSWORD} -lt 8 ]; then
|
||||
echo "Error: Password must be at least 8 characters"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
if [ ! -f "$DB_PATH" ]; then
|
||||
echo "Error: Database not found at $DB_PATH"
|
||||
echo "Set DOCKHAND_DB environment variable to specify the database path"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if user exists
|
||||
EXISTING=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM users WHERE username='$USERNAME';")
|
||||
|
||||
if [ "$EXISTING" -eq "0" ]; then
|
||||
echo "Error: User '$USERNAME' not found"
|
||||
echo ""
|
||||
echo "Available users:"
|
||||
sqlite3 "$DB_PATH" "SELECT username FROM users;" | while read user; do
|
||||
echo " - $user"
|
||||
done
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "This script will reset the password for user '$USERNAME'."
|
||||
echo ""
|
||||
echo "Database: $DB_PATH"
|
||||
echo "Username: $USERNAME"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Generate password hash using node (argon2 is available in the app)
|
||||
echo ""
|
||||
echo "Generating password hash..."
|
||||
|
||||
# Check if node and argon2 are available
|
||||
if command -v node >/dev/null 2>&1; then
|
||||
# Try to use argon2 from node_modules
|
||||
PASSWORD_HASH=$(node -e "
|
||||
try {
|
||||
const argon2 = require('argon2');
|
||||
argon2.hash('$NEW_PASSWORD').then(h => console.log(h)).catch(e => process.exit(1));
|
||||
} catch(e) {
|
||||
process.exit(1);
|
||||
}
|
||||
" 2>/dev/null)
|
||||
|
||||
if [ -z "$PASSWORD_HASH" ]; then
|
||||
echo "Error: Could not generate password hash (argon2 not available)"
|
||||
echo "This script requires Node.js with argon2 module"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "Error: Node.js is required to generate password hash"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Resetting password for user '$USERNAME'..."
|
||||
sqlite3 "$DB_PATH" "UPDATE users SET password_hash='$PASSWORD_HASH', updated_at=datetime('now') WHERE username='$USERNAME';"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Password reset successfully for user '$USERNAME'"
|
||||
echo ""
|
||||
# Invalidate sessions
|
||||
USER_ID=$(sqlite3 "$DB_PATH" "SELECT id FROM users WHERE username='$USERNAME';")
|
||||
sqlite3 "$DB_PATH" "DELETE FROM sessions WHERE user_id=$USER_ID;" 2>/dev/null || true
|
||||
echo "All existing sessions have been invalidated."
|
||||
echo "The user can now log in with the new password."
|
||||
else
|
||||
echo "Error: Failed to reset password"
|
||||
exit 1
|
||||
fi
|
||||
Executable
+106
@@ -0,0 +1,106 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# SQLite: Emergency script to restore the database from a backup
|
||||
# WARNING: This will overwrite the current database!
|
||||
#
|
||||
# Usage:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/restore-db.sh <backup_file>
|
||||
#
|
||||
# Example:
|
||||
# docker exec -it dockhand /app/scripts/emergency/sqlite/restore-db.sh /app/data/dockhand_backup_20240115_120000.db
|
||||
#
|
||||
# To copy backup into container first:
|
||||
# docker cp ./dockhand_backup.db dockhand:/app/data/
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
echo "========================================"
|
||||
echo " Dockhand - Restore Database (SQLite)"
|
||||
echo "========================================"
|
||||
echo ""
|
||||
|
||||
# Check argument
|
||||
if [ -z "$1" ]; then
|
||||
echo "Usage: $0 <backup_file>"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $0 /app/data/dockhand_backup_20240115_120000.db"
|
||||
echo ""
|
||||
echo "To copy backup into container first:"
|
||||
echo " docker cp ./dockhand_backup.db dockhand:/app/data/"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BACKUP_FILE="$1"
|
||||
|
||||
# Default database path
|
||||
DB_PATH="${DOCKHAND_DB:-/app/data/db/dockhand.db}"
|
||||
|
||||
# Check if running locally (not in Docker)
|
||||
if [ ! -f "$DB_PATH" ] && [ -f "./data/db/dockhand.db" ]; then
|
||||
DB_PATH="./data/db/dockhand.db"
|
||||
fi
|
||||
|
||||
# Check if backup file exists
|
||||
if [ ! -f "$BACKUP_FILE" ]; then
|
||||
echo "Error: Backup file not found: $BACKUP_FILE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify it's a valid SQLite database
|
||||
if ! sqlite3 "$BACKUP_FILE" "SELECT 1;" >/dev/null 2>&1; then
|
||||
echo "Error: File is not a valid SQLite database: $BACKUP_FILE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Get backup file size
|
||||
BACKUP_SIZE=$(ls -lh "$BACKUP_FILE" | awk '{print $5}')
|
||||
|
||||
echo "WARNING: This will overwrite the current database!"
|
||||
echo ""
|
||||
echo "Current database: $DB_PATH"
|
||||
echo "Backup to restore: $BACKUP_FILE ($BACKUP_SIZE)"
|
||||
echo ""
|
||||
printf "Continue? [y/N]: "
|
||||
read CONFIRM
|
||||
|
||||
case "$CONFIRM" in
|
||||
[yY]|[yY][eE][sS])
|
||||
;;
|
||||
*)
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
# Create backup of current database before restoring
|
||||
if [ -f "$DB_PATH" ]; then
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
PRE_RESTORE_BACKUP="${DB_PATH}.pre-restore.$TIMESTAMP"
|
||||
echo ""
|
||||
echo "Creating backup of current database..."
|
||||
cp "$DB_PATH" "$PRE_RESTORE_BACKUP"
|
||||
echo "Current database backed up to: $PRE_RESTORE_BACKUP"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Restoring database..."
|
||||
|
||||
# Remove WAL files if they exist
|
||||
rm -f "${DB_PATH}-wal"
|
||||
rm -f "${DB_PATH}-shm"
|
||||
|
||||
# Copy backup to database location
|
||||
cp "$BACKUP_FILE" "$DB_PATH"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo ""
|
||||
echo "Database restored successfully!"
|
||||
echo ""
|
||||
echo "Restart Dockhand to apply changes:"
|
||||
echo " docker restart dockhand"
|
||||
else
|
||||
echo "Error: Failed to restore database"
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,164 @@
|
||||
#!/usr/bin/env bun
|
||||
/**
|
||||
* Generate changelog section in webpage/index.html from src/lib/data/changelog.json
|
||||
* This ensures a single source of truth for release information
|
||||
*/
|
||||
|
||||
import { readFileSync, writeFileSync } from 'fs';
|
||||
import { join } from 'path';
|
||||
|
||||
const ROOT_DIR = join(import.meta.dir, '..');
|
||||
const CHANGELOG_PATH = join(ROOT_DIR, 'src/lib/data/changelog.json');
|
||||
const INDEX_PATH = join(ROOT_DIR, 'webpage/index.html');
|
||||
|
||||
interface ChangelogEntry {
|
||||
version: string;
|
||||
date: string;
|
||||
changes: Array<{ type: 'feature' | 'fix'; text: string }>;
|
||||
imageTag: string;
|
||||
}
|
||||
|
||||
// SVG icons for change types
|
||||
const FEATURE_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="m12 3-1.912 5.813a2 2 0 0 1-1.275 1.275L3 12l5.813 1.912a2 2 0 0 1 1.275 1.275L12 21l1.912-5.813a2 2 0 0 1 1.275-1.275L21 12l-5.813-1.912a2 2 0 0 1-1.275-1.275L12 3Z"/><path d="M5 3v4"/><path d="M19 17v4"/><path d="M3 5h4"/><path d="M17 19h4"/></svg>`;
|
||||
|
||||
const FIX_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect width="8" height="14" x="8" y="6" rx="4"/><path d="m19 7-3 2"/><path d="m5 7 3 2"/><path d="m19 19-3-2"/><path d="m5 19 3-2"/><path d="M20 13h-4"/><path d="M4 13h4"/><path d="m10 4 1 2"/><path d="m14 4-1 2"/></svg>`;
|
||||
|
||||
const TOGGLE_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="6 9 12 15 18 9"/></svg>`;
|
||||
|
||||
const COPY_SVG = `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/></svg>`;
|
||||
|
||||
function formatDate(dateStr: string): string {
|
||||
const date = new Date(dateStr);
|
||||
return date.toLocaleDateString('en-US', {
|
||||
year: 'numeric',
|
||||
month: 'long',
|
||||
day: 'numeric'
|
||||
});
|
||||
}
|
||||
|
||||
function generateChangeItem(change: { type: 'feature' | 'fix'; text: string }): string {
|
||||
const pillClass = change.type === 'feature' ? 'changelog-pill-feature' : 'changelog-pill-fix';
|
||||
const svg = change.type === 'feature' ? FEATURE_SVG : FIX_SVG;
|
||||
const label = change.type === 'feature' ? 'New' : 'Fix';
|
||||
return ` <li><span class="changelog-pill ${pillClass}">${svg}${label}</span>${change.text}</li>`;
|
||||
}
|
||||
|
||||
function generateLatestEntry(entry: ChangelogEntry): string {
|
||||
const changes = entry.changes.map(generateChangeItem).join('\n');
|
||||
const version = entry.version.startsWith('v') ? entry.version : `v${entry.version}`;
|
||||
|
||||
return ` <!-- ${version} -->
|
||||
<div class="changelog-entry">
|
||||
<div class="changelog-header">
|
||||
<div class="changelog-version">
|
||||
<h3>${version}</h3>
|
||||
<span class="changelog-badge">Latest</span>
|
||||
</div>
|
||||
<span class="changelog-date">${formatDate(entry.date)}</span>
|
||||
</div>
|
||||
<ul class="changelog-changes">
|
||||
${changes}
|
||||
</ul>
|
||||
<div class="changelog-image-tag">
|
||||
<span>Docker image:</span>
|
||||
<code>${entry.imageTag}</code>
|
||||
<button class="copy-btn" onclick="copyDockerImage(this, '${entry.imageTag}')" title="Copy to clipboard">${COPY_SVG}</button>
|
||||
<span style="color: var(--text-muted); margin: 0 0.25rem;">or</span>
|
||||
<code>fnsys/dockhand:latest</code>
|
||||
<button class="copy-btn" onclick="copyDockerImage(this, 'fnsys/dockhand:latest')" title="Copy to clipboard">${COPY_SVG}</button>
|
||||
</div>
|
||||
</div>`;
|
||||
}
|
||||
|
||||
function generateCollapsibleEntry(entry: ChangelogEntry): string {
|
||||
const changes = entry.changes.map(generateChangeItem).join('\n');
|
||||
const version = entry.version.startsWith('v') ? entry.version : `v${entry.version}`;
|
||||
|
||||
return ` <!-- ${version} (collapsible) -->
|
||||
<div class="changelog-entry collapsible" data-version="${version}">
|
||||
<div class="changelog-header">
|
||||
<div class="changelog-version">
|
||||
<h3>${version}</h3>
|
||||
<span class="changelog-toggle">${TOGGLE_SVG}</span>
|
||||
</div>
|
||||
<span class="changelog-date">${formatDate(entry.date)}</span>
|
||||
</div>
|
||||
<div class="changelog-content">
|
||||
<ul class="changelog-changes">
|
||||
${changes}
|
||||
</ul>
|
||||
<div class="changelog-image-tag">
|
||||
<span>Docker image:</span>
|
||||
<code>${entry.imageTag}</code>
|
||||
<button class="copy-btn" onclick="copyDockerImage(this, '${entry.imageTag}')" title="Copy to clipboard">${COPY_SVG}</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`;
|
||||
}
|
||||
|
||||
function generateChangelogSection(entries: ChangelogEntry[]): string {
|
||||
if (entries.length === 0) {
|
||||
return '';
|
||||
}
|
||||
|
||||
const [latest, ...rest] = entries;
|
||||
const latestHtml = generateLatestEntry(latest);
|
||||
const restHtml = rest.map(generateCollapsibleEntry).join('\n');
|
||||
|
||||
return ` <!-- Changelog Section -->
|
||||
<section class="changelog" id="changelog">
|
||||
<div class="changelog-container">
|
||||
<div class="section-header">
|
||||
<div class="section-label">Changelog</div>
|
||||
<h2 class="section-title">Release history</h2>
|
||||
<p class="section-subtitle">Track our progress and see what's new in each version. <span style="color: #fbbf24; white-space: nowrap;">Spoiler: it gets better every time.</span></p>
|
||||
</div>
|
||||
<div class="changelog-list">
|
||||
${latestHtml}
|
||||
${restHtml}
|
||||
</div>
|
||||
</div>
|
||||
</section>`;
|
||||
}
|
||||
|
||||
// Read changelog.json
|
||||
console.log('Reading changelog from:', CHANGELOG_PATH);
|
||||
const changelog: ChangelogEntry[] = JSON.parse(readFileSync(CHANGELOG_PATH, 'utf-8'));
|
||||
console.log(`Found ${changelog.length} changelog entries`);
|
||||
|
||||
// Read index.html
|
||||
console.log('Reading index.html from:', INDEX_PATH);
|
||||
let indexHtml = readFileSync(INDEX_PATH, 'utf-8');
|
||||
|
||||
// Generate new changelog section
|
||||
const newChangelogSection = generateChangelogSection(changelog);
|
||||
|
||||
// Replace changelog section using regex
|
||||
// Match from "<!-- Changelog Section -->" to the closing "</section>" before "<!-- CTA -->"
|
||||
const changelogRegex = / <!-- Changelog Section -->[\s\S]*?<\/section>(?=\s*\n\s*<!-- CTA -->)/;
|
||||
|
||||
if (!changelogRegex.test(indexHtml)) {
|
||||
console.error('ERROR: Could not find changelog section in index.html');
|
||||
console.error('Looking for pattern: <!-- Changelog Section --> ... </section> followed by <!-- CTA -->');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
indexHtml = indexHtml.replace(changelogRegex, newChangelogSection);
|
||||
|
||||
// Also update softwareVersion in JSON-LD schema
|
||||
if (changelog.length > 0) {
|
||||
const latestVersion = changelog[0].version;
|
||||
// Match "softwareVersion": "X.X" or "softwareVersion": "X.X.X"
|
||||
const versionRegex = /"softwareVersion":\s*"[\d.]+"/;
|
||||
if (versionRegex.test(indexHtml)) {
|
||||
indexHtml = indexHtml.replace(versionRegex, `"softwareVersion": "${latestVersion}"`);
|
||||
console.log(`Updated softwareVersion to: ${latestVersion}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Write back to index.html
|
||||
writeFileSync(INDEX_PATH, indexHtml);
|
||||
console.log('');
|
||||
console.log('Generated changelog in webpage/index.html');
|
||||
console.log(` - Latest version: v${changelog[0]?.version || 'unknown'}`);
|
||||
console.log(` - Total entries: ${changelog.length}`);
|
||||
@@ -0,0 +1,137 @@
|
||||
#!/usr/bin/env bun
|
||||
/**
|
||||
* Generate static HTML pages for License and Privacy from .txt files
|
||||
* This ensures a single source of truth for legal documents
|
||||
*/
|
||||
|
||||
import { readFileSync, writeFileSync } from 'fs';
|
||||
import { join } from 'path';
|
||||
|
||||
const ROOT_DIR = join(import.meta.dir, '..');
|
||||
const WEBPAGE_DIR = join(ROOT_DIR, 'webpage');
|
||||
|
||||
function escapeHtml(text: string): string {
|
||||
return text
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>');
|
||||
}
|
||||
|
||||
function generateHtmlPage(title: string, content: string): string {
|
||||
return `<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>${title} - Dockhand</title>
|
||||
<link rel="icon" type="image/png" href="images/favicon.png">
|
||||
<style>
|
||||
* {
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
body {
|
||||
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
|
||||
background: #0a0a0f;
|
||||
color: #e0e0e0;
|
||||
line-height: 1.6;
|
||||
min-height: 100vh;
|
||||
}
|
||||
.container {
|
||||
max-width: 900px;
|
||||
margin: 0 auto;
|
||||
padding: 2rem;
|
||||
}
|
||||
header {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 1rem 0;
|
||||
margin-bottom: 2rem;
|
||||
border-bottom: 1px solid rgba(255,255,255,0.1);
|
||||
}
|
||||
.logo-img {
|
||||
height: 40px;
|
||||
}
|
||||
.back-link {
|
||||
color: #60a5fa;
|
||||
text-decoration: none;
|
||||
font-size: 0.9rem;
|
||||
}
|
||||
.back-link:hover {
|
||||
text-decoration: underline;
|
||||
}
|
||||
h1 {
|
||||
font-size: 1.75rem;
|
||||
margin-bottom: 1.5rem;
|
||||
color: #fff;
|
||||
}
|
||||
.content {
|
||||
background: rgba(255,255,255,0.03);
|
||||
border: 1px solid rgba(255,255,255,0.1);
|
||||
border-radius: 8px;
|
||||
padding: 2rem;
|
||||
}
|
||||
pre {
|
||||
font-family: 'SF Mono', Monaco, 'Cascadia Code', monospace;
|
||||
font-size: 0.8rem;
|
||||
white-space: pre-wrap;
|
||||
word-wrap: break-word;
|
||||
color: #c0c0c0;
|
||||
}
|
||||
footer {
|
||||
margin-top: 3rem;
|
||||
padding-top: 1.5rem;
|
||||
border-top: 1px solid rgba(255,255,255,0.1);
|
||||
text-align: center;
|
||||
font-size: 0.85rem;
|
||||
color: #888;
|
||||
}
|
||||
footer a {
|
||||
color: #60a5fa;
|
||||
text-decoration: none;
|
||||
}
|
||||
footer a:hover {
|
||||
text-decoration: underline;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<header>
|
||||
<a href="index.html">
|
||||
<img src="images/logo-dark.webp" alt="Dockhand" class="logo-img">
|
||||
</a>
|
||||
<a href="index.html" class="back-link">← Back to home</a>
|
||||
</header>
|
||||
|
||||
<h1>${title}</h1>
|
||||
|
||||
<div class="content">
|
||||
<pre>${escapeHtml(content)}</pre>
|
||||
</div>
|
||||
|
||||
<footer>
|
||||
<p>© 2025-2026 Finsys / Jarek Krochmalski · <a href="https://dockhand.pro">https://dockhand.pro</a></p>
|
||||
</footer>
|
||||
</div>
|
||||
</body>
|
||||
</html>`;
|
||||
}
|
||||
|
||||
// Read the source files
|
||||
const licenseContent = readFileSync(join(ROOT_DIR, 'LICENSE.txt'), 'utf-8');
|
||||
const privacyContent = readFileSync(join(ROOT_DIR, 'PRIVACY.txt'), 'utf-8');
|
||||
|
||||
// Generate HTML pages
|
||||
const licenseHtml = generateHtmlPage('License Terms and Conditions', licenseContent);
|
||||
const privacyHtml = generateHtmlPage('Privacy Policy', privacyContent);
|
||||
|
||||
// Write to webpage directory
|
||||
writeFileSync(join(WEBPAGE_DIR, 'license.html'), licenseHtml);
|
||||
writeFileSync(join(WEBPAGE_DIR, 'privacy.html'), privacyHtml);
|
||||
|
||||
console.log('Generated legal pages:');
|
||||
console.log(' - webpage/license.html');
|
||||
console.log(' - webpage/privacy.html');
|
||||
@@ -0,0 +1,575 @@
|
||||
/**
|
||||
* Post-build script to fix svelte-adapter-bun WebSocket issue
|
||||
* The adapter calls server.websocket() which doesn't exist in SvelteKit.
|
||||
*
|
||||
* IMPORTANT: Terminal WebSocket logic is shared with vite.config.ts
|
||||
* Core functions like resolveDockerTarget are defined in:
|
||||
* src/lib/server/ws-terminal-shared.ts
|
||||
*
|
||||
* When updating WebSocket terminal handling, update the shared module
|
||||
* and this file will use the same logic at build time.
|
||||
*/
|
||||
|
||||
import { join } from 'node:path';
|
||||
|
||||
const BUILD_DIR = join(import.meta.dir, '../build');
|
||||
|
||||
async function patchHandler() {
|
||||
const handlerPath = join(BUILD_DIR, 'handler.js');
|
||||
const handlerFile = Bun.file(handlerPath);
|
||||
|
||||
if (!await handlerFile.exists()) {
|
||||
console.error('handler.js not found');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
let content = await handlerFile.text();
|
||||
|
||||
// Replace broken server.websocket() call
|
||||
content = content.replace(
|
||||
'const websocket = server.websocket();',
|
||||
'const websocket = null;'
|
||||
);
|
||||
|
||||
// Add WebSocket upgrade detection before ssr handler
|
||||
const ssrIndex = content.indexOf('var ssr = async (request, bunServer) => {');
|
||||
if (ssrIndex > -1) {
|
||||
const upgradeCode = `
|
||||
var handleUpgrade = (request, bunServer) => {
|
||||
const url = new URL(request.url);
|
||||
const isUpgrade = request.headers.get('connection')?.toLowerCase().includes('upgrade') &&
|
||||
request.headers.get('upgrade')?.toLowerCase() === 'websocket';
|
||||
if (!isUpgrade) return null;
|
||||
|
||||
// Handle terminal exec WebSocket
|
||||
if (url.pathname.includes('/api/containers/') && url.pathname.includes('/exec')) {
|
||||
const pathParts = url.pathname.split('/');
|
||||
const containerIdIndex = pathParts.indexOf('containers') + 1;
|
||||
const containerId = pathParts[containerIdIndex];
|
||||
const shell = url.searchParams.get('shell') || '/bin/sh';
|
||||
const user = url.searchParams.get('user') || 'root';
|
||||
const envId = url.searchParams.get('envId') ? parseInt(url.searchParams.get('envId'), 10) : undefined;
|
||||
if (bunServer.upgrade(request, { data: { type: 'terminal', containerId, shell, user, envId } })) {
|
||||
return new Response(null, { status: 101 });
|
||||
}
|
||||
}
|
||||
|
||||
// Handle Hawser Edge WebSocket
|
||||
if (url.pathname === '/api/hawser/connect') {
|
||||
if (bunServer.upgrade(request, { data: { type: 'hawser' } })) {
|
||||
return new Response(null, { status: 101 });
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
};
|
||||
`;
|
||||
content = content.slice(0, ssrIndex) + upgradeCode + content.slice(ssrIndex);
|
||||
}
|
||||
|
||||
// Modify handler to check for upgrade first
|
||||
content = content.replace(
|
||||
'return ssr(request, server2);',
|
||||
'const upgradeResponse = handleUpgrade(request, server2); if (upgradeResponse) return upgradeResponse; return ssr(request, server2);'
|
||||
);
|
||||
|
||||
await Bun.write(handlerPath, content);
|
||||
console.log('✓ Patched handler.js');
|
||||
}
|
||||
|
||||
async function patchIndex() {
|
||||
const indexPath = join(BUILD_DIR, 'index.js');
|
||||
const indexFile = Bun.file(indexPath);
|
||||
|
||||
if (!await indexFile.exists()) {
|
||||
console.error('index.js not found');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
let content = await indexFile.text();
|
||||
|
||||
const wsHandler = `
|
||||
import { existsSync as _existsSync } from 'fs';
|
||||
import { homedir as _homedir } from 'os';
|
||||
import { Database as _Database } from 'bun:sqlite';
|
||||
import { SQL as _SQL } from 'bun';
|
||||
import { join as _join } from 'path';
|
||||
|
||||
// Database connection (supports both SQLite and PostgreSQL)
|
||||
let _db = null;
|
||||
let _isPostgres = false;
|
||||
function _getDb() {
|
||||
if (!_db) {
|
||||
const dbUrl = process.env.DATABASE_URL;
|
||||
if (dbUrl && (dbUrl.startsWith('postgres://') || dbUrl.startsWith('postgresql://'))) {
|
||||
_db = new _SQL(dbUrl);
|
||||
_isPostgres = true;
|
||||
} else {
|
||||
const _dbPath = _join(process.cwd(), 'data', 'db', 'dockhand.db');
|
||||
if (_existsSync(_dbPath)) {
|
||||
_db = new _Database(_dbPath);
|
||||
}
|
||||
}
|
||||
}
|
||||
return _db;
|
||||
}
|
||||
|
||||
async function _getEnvironment(id) {
|
||||
const db = _getDb();
|
||||
if (!db) return null;
|
||||
let row;
|
||||
if (_isPostgres) {
|
||||
const result = await db.unsafe('SELECT * FROM environments WHERE id = $1', [id]);
|
||||
row = result[0];
|
||||
} else {
|
||||
row = db.prepare('SELECT * FROM environments WHERE id = ?').get(id);
|
||||
}
|
||||
return row ? { ...row, is_local: Boolean(row.is_local), connection_type: row.connection_type, hawser_token: row.hawser_token } : null;
|
||||
}
|
||||
|
||||
function detectDockerSocket() {
|
||||
if (process.env.DOCKER_SOCKET && _existsSync(process.env.DOCKER_SOCKET)) return process.env.DOCKER_SOCKET;
|
||||
if (process.env.DOCKER_HOST?.startsWith('unix://')) {
|
||||
const p = process.env.DOCKER_HOST.replace('unix://', '');
|
||||
if (_existsSync(p)) return p;
|
||||
}
|
||||
for (const s of ['/var/run/docker.sock', _homedir() + '/.docker/run/docker.sock', _homedir() + '/.orbstack/run/docker.sock', '/run/docker.sock']) {
|
||||
if (_existsSync(s)) return s;
|
||||
}
|
||||
return '/var/run/docker.sock';
|
||||
}
|
||||
const dockerSocketPath = detectDockerSocket();
|
||||
console.log('Detected Docker socket at:', dockerSocketPath);
|
||||
|
||||
const dockerStreams = new Map();
|
||||
let _wsConnCounter = 0;
|
||||
|
||||
async function _getDockerTarget(envId) {
|
||||
if (!envId) return { type: 'unix', socket: dockerSocketPath };
|
||||
const env = await _getEnvironment(envId);
|
||||
if (!env) return { type: 'unix', socket: dockerSocketPath };
|
||||
// Check for socket connection type (local Unix socket)
|
||||
if (env.is_local || env.connection_type === 'socket' || !env.connection_type) {
|
||||
return { type: 'unix', socket: env.socket_path || dockerSocketPath };
|
||||
}
|
||||
if (env.connection_type === 'hawser-edge') return { type: 'hawser-edge', environmentId: envId };
|
||||
return { type: 'tcp', host: env.host, port: env.port || 2375, hawserToken: env.connection_type === 'hawser-standard' ? env.hawser_token : undefined };
|
||||
}
|
||||
|
||||
async function createExec(containerId, cmd, user, target) {
|
||||
const headers = { 'Content-Type': 'application/json' };
|
||||
const fetchOpts = {
|
||||
method: 'POST',
|
||||
headers,
|
||||
body: JSON.stringify({ AttachStdin: true, AttachStdout: true, AttachStderr: true, Tty: true, Cmd: cmd, User: user })
|
||||
};
|
||||
let url;
|
||||
if (target.type === 'unix') {
|
||||
url = 'http://localhost/containers/' + containerId + '/exec';
|
||||
fetchOpts.unix = target.socket;
|
||||
} else {
|
||||
url = 'http://' + target.host + ':' + target.port + '/containers/' + containerId + '/exec';
|
||||
if (target.hawserToken) headers['X-Hawser-Token'] = target.hawserToken;
|
||||
}
|
||||
const res = await fetch(url, fetchOpts);
|
||||
if (!res.ok) throw new Error('Failed to create exec: ' + (await res.text()));
|
||||
return res.json();
|
||||
}
|
||||
|
||||
async function resizeExec(execId, cols, rows, target) {
|
||||
try {
|
||||
const fetchOpts = { method: 'POST' };
|
||||
let url;
|
||||
if (target.type === 'unix') {
|
||||
url = 'http://localhost/exec/' + execId + '/resize?h=' + rows + '&w=' + cols;
|
||||
fetchOpts.unix = target.socket;
|
||||
} else {
|
||||
url = 'http://' + target.host + ':' + target.port + '/exec/' + execId + '/resize?h=' + rows + '&w=' + cols;
|
||||
if (target.hawserToken) fetchOpts.headers = { 'X-Hawser-Token': target.hawserToken };
|
||||
}
|
||||
await fetch(url, fetchOpts);
|
||||
} catch {}
|
||||
}
|
||||
|
||||
// ============ Hawser Edge Support ============
|
||||
// Global edge connections map (shared with hawser.ts via globalThis)
|
||||
if (!globalThis.__hawserEdgeConnections) globalThis.__hawserEdgeConnections = new Map();
|
||||
const _edgeConnections = globalThis.__hawserEdgeConnections;
|
||||
|
||||
// Map WebSocket to environmentId for quick lookup
|
||||
const _wsToEnvId = new Map();
|
||||
|
||||
// Edge exec sessions (execId -> frontend WebSocket)
|
||||
const _edgeExecSessions = new Map();
|
||||
|
||||
// Validate Hawser token against database
|
||||
async function _validateHawserToken(token) {
|
||||
const db = _getDb();
|
||||
if (!db) return { valid: false };
|
||||
let tokens;
|
||||
if (_isPostgres) {
|
||||
tokens = await db.unsafe('SELECT * FROM hawser_tokens WHERE is_active = true');
|
||||
} else {
|
||||
tokens = db.prepare('SELECT * FROM hawser_tokens WHERE is_active = 1').all();
|
||||
}
|
||||
for (const t of tokens) {
|
||||
try {
|
||||
const isValid = await Bun.password.verify(token, t.token);
|
||||
if (isValid) {
|
||||
if (_isPostgres) {
|
||||
await db.unsafe('UPDATE hawser_tokens SET last_used = NOW() WHERE id = $1', [t.id]);
|
||||
} else {
|
||||
db.prepare('UPDATE hawser_tokens SET last_used = datetime(\\'now\\') WHERE id = ?').run(t.id);
|
||||
}
|
||||
return { valid: true, environmentId: t.environment_id, tokenId: t.id };
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
return { valid: false };
|
||||
}
|
||||
|
||||
// Update environment status in database
|
||||
async function _updateEnvStatus(envId, conn) {
|
||||
const db = _getDb();
|
||||
if (!db) return;
|
||||
try {
|
||||
if (conn) {
|
||||
if (_isPostgres) {
|
||||
await db.unsafe('UPDATE environments SET hawser_last_seen = NOW(), hawser_agent_id = $1, hawser_agent_name = $2, hawser_version = $3, hawser_capabilities = $4 WHERE id = $5',
|
||||
[conn.agentId, conn.agentName, conn.agentVersion, JSON.stringify(conn.capabilities || []), envId]);
|
||||
} else {
|
||||
db.prepare('UPDATE environments SET hawser_last_seen = datetime(\\'now\\'), hawser_agent_id = ?, hawser_agent_name = ?, hawser_version = ?, hawser_capabilities = ? WHERE id = ?')
|
||||
.run(conn.agentId, conn.agentName, conn.agentVersion, JSON.stringify(conn.capabilities || []), envId);
|
||||
}
|
||||
} else {
|
||||
if (_isPostgres) {
|
||||
await db.unsafe('UPDATE environments SET hawser_last_seen = NOW() WHERE id = $1', [envId]);
|
||||
} else {
|
||||
db.prepare('UPDATE environments SET hawser_last_seen = datetime(\\'now\\') WHERE id = ?').run(envId);
|
||||
}
|
||||
}
|
||||
} catch {}
|
||||
}
|
||||
|
||||
// Handle Hawser Edge protocol messages
|
||||
async function _handleHawserMessage(ws, msg) {
|
||||
if (msg.type === 'hello') {
|
||||
console.log('[Hawser] Hello from agent:', msg.agentName, '(' + msg.agentId + ')');
|
||||
const validation = await _validateHawserToken(msg.token);
|
||||
if (!validation.valid) {
|
||||
console.log('[Hawser] Invalid token');
|
||||
ws.send(JSON.stringify({ type: 'error', error: 'Invalid token' }));
|
||||
ws.close();
|
||||
return;
|
||||
}
|
||||
const envId = validation.environmentId;
|
||||
const existing = _edgeConnections.get(envId);
|
||||
if (existing) {
|
||||
const pendingCount = existing.pendingRequests.size;
|
||||
const streamCount = existing.pendingStreamRequests.size;
|
||||
console.log('[Hawser] Replacing existing connection for env', envId, '- rejecting', pendingCount, 'pending requests and', streamCount, 'stream requests');
|
||||
// Reject all pending requests before closing
|
||||
for (const [requestId, pending] of existing.pendingRequests) {
|
||||
clearTimeout(pending.timeout);
|
||||
pending.reject(new Error('Connection replaced by new agent'));
|
||||
}
|
||||
for (const [requestId, pending] of existing.pendingStreamRequests) {
|
||||
pending.onEnd?.('Connection replaced by new agent');
|
||||
}
|
||||
existing.pendingRequests.clear();
|
||||
existing.pendingStreamRequests.clear();
|
||||
existing.ws.close(1000, 'Replaced');
|
||||
_wsToEnvId.delete(existing.ws);
|
||||
}
|
||||
const conn = {
|
||||
ws, environmentId: envId, agentId: msg.agentId, agentName: msg.agentName,
|
||||
agentVersion: msg.version || 'unknown', dockerVersion: msg.dockerVersion || 'unknown',
|
||||
hostname: msg.hostname || 'unknown', capabilities: msg.capabilities || [],
|
||||
connectedAt: new Date(), lastHeartbeat: new Date(),
|
||||
pendingRequests: new Map(), pendingStreamRequests: new Map(),
|
||||
pingInterval: null
|
||||
};
|
||||
_edgeConnections.set(envId, conn);
|
||||
_wsToEnvId.set(ws, envId);
|
||||
await _updateEnvStatus(envId, conn);
|
||||
ws.send(JSON.stringify({ type: 'welcome', environmentId: envId, message: 'Connected to Dockhand' }));
|
||||
// Start server-side ping interval to keep connection alive through Traefik/proxies (5s)
|
||||
conn.pingInterval = setInterval(() => {
|
||||
try { ws.send(JSON.stringify({ type: 'ping', timestamp: Date.now() })); }
|
||||
catch { if (conn.pingInterval) { clearInterval(conn.pingInterval); conn.pingInterval = null; } }
|
||||
}, 5000);
|
||||
console.log('[Hawser] Agent', msg.agentName, 'connected for env', envId);
|
||||
} else if (msg.type === 'ping') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (envId) { const c = _edgeConnections.get(envId); if (c) c.lastHeartbeat = new Date(); }
|
||||
ws.send(JSON.stringify({ type: 'pong', timestamp: Date.now() }));
|
||||
} else if (msg.type === 'pong') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (envId) { const c = _edgeConnections.get(envId); if (c) c.lastHeartbeat = new Date(); }
|
||||
} else if (msg.type === 'response') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (!envId) {
|
||||
console.warn('[Hawser] Response from unknown WebSocket, requestId=' + msg.requestId);
|
||||
return;
|
||||
}
|
||||
const conn = _edgeConnections.get(envId);
|
||||
if (conn) {
|
||||
const pending = conn.pendingRequests.get(msg.requestId);
|
||||
if (pending) {
|
||||
clearTimeout(pending.timeout);
|
||||
conn.pendingRequests.delete(msg.requestId);
|
||||
pending.resolve({ statusCode: msg.statusCode, headers: msg.headers || {}, body: msg.body || '', isBinary: msg.isBinary || false });
|
||||
} else {
|
||||
console.warn('[Hawser] Response for unknown request ' + msg.requestId + ' on env ' + envId);
|
||||
}
|
||||
}
|
||||
} else if (msg.type === 'stream') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (!envId) {
|
||||
console.warn('[Hawser] Stream data from unknown WebSocket, requestId=' + msg.requestId);
|
||||
return;
|
||||
}
|
||||
const conn = _edgeConnections.get(envId);
|
||||
if (conn?.pendingStreamRequests) {
|
||||
const pending = conn.pendingStreamRequests.get(msg.requestId);
|
||||
if (pending) {
|
||||
pending.onData(msg.data, msg.stream);
|
||||
} else {
|
||||
console.warn('[Hawser] Stream data for unknown request ' + msg.requestId + ' on env ' + envId);
|
||||
}
|
||||
}
|
||||
} else if (msg.type === 'stream_end') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (!envId) {
|
||||
console.warn('[Hawser] Stream end from unknown WebSocket, requestId=' + msg.requestId);
|
||||
return;
|
||||
}
|
||||
const conn = _edgeConnections.get(envId);
|
||||
if (conn?.pendingStreamRequests) {
|
||||
const pending = conn.pendingStreamRequests.get(msg.requestId);
|
||||
if (pending) {
|
||||
conn.pendingStreamRequests.delete(msg.requestId);
|
||||
pending.onEnd(msg.reason);
|
||||
} else {
|
||||
console.warn('[Hawser] Stream end for unknown request ' + msg.requestId + ' on env ' + envId);
|
||||
}
|
||||
}
|
||||
} else if (msg.type === 'exec_ready') {
|
||||
const session = _edgeExecSessions.get(msg.execId);
|
||||
if (session?.ws?.readyState === 1) console.log('[Hawser] Exec ready:', msg.execId);
|
||||
} else if (msg.type === 'exec_output') {
|
||||
const session = _edgeExecSessions.get(msg.execId);
|
||||
if (session?.ws?.readyState === 1) {
|
||||
const data = Buffer.from(msg.data, 'base64').toString('utf-8');
|
||||
session.ws.send(JSON.stringify({ type: 'output', data }));
|
||||
}
|
||||
} else if (msg.type === 'exec_end') {
|
||||
const session = _edgeExecSessions.get(msg.execId);
|
||||
if (session) {
|
||||
console.log('[Hawser] Exec ended:', msg.execId);
|
||||
if (session.ws?.readyState === 1) { session.ws.send(JSON.stringify({ type: 'exit' })); session.ws.close(); }
|
||||
_edgeExecSessions.delete(msg.execId);
|
||||
}
|
||||
} else if (msg.type === 'container_event') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (envId && msg.event) {
|
||||
// Call the global handler registered by hawser.ts
|
||||
if (globalThis.__hawserHandleContainerEvent) {
|
||||
globalThis.__hawserHandleContainerEvent(envId, msg.event).catch((err) => {
|
||||
console.error('[Hawser] Error handling container event:', err);
|
||||
});
|
||||
}
|
||||
}
|
||||
} else if (msg.type === 'metrics') {
|
||||
// Metrics from agent - save to database for dashboard graphs
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (envId && msg.metrics) {
|
||||
if (globalThis.__hawserHandleMetrics) {
|
||||
globalThis.__hawserHandleMetrics(envId, msg.metrics).catch((err) => {
|
||||
console.error('[Hawser] Error saving metrics:', err);
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Expose send function for hawser.ts module
|
||||
globalThis.__hawserSendMessage = (envId, message) => {
|
||||
const conn = _edgeConnections.get(envId);
|
||||
if (!conn?.ws) return false;
|
||||
try { conn.ws.send(message); return true; } catch { return false; }
|
||||
};
|
||||
|
||||
// ============ Combined WebSocket Handler ============
|
||||
const combinedWebsocket = {
|
||||
async open(ws) {
|
||||
const connType = ws.data?.type;
|
||||
|
||||
// Hawser Edge connection - wait for hello message
|
||||
if (connType === 'hawser') {
|
||||
console.log('[Hawser] New connection pending authentication');
|
||||
return;
|
||||
}
|
||||
|
||||
// Terminal connection
|
||||
const connId = 'ws-' + (++_wsConnCounter);
|
||||
ws.data = ws.data || {};
|
||||
ws.data.connId = connId;
|
||||
const { containerId, shell, user, envId } = ws.data;
|
||||
if (!containerId) { ws.send(JSON.stringify({ type: 'error', message: 'No container ID' })); ws.close(); return; }
|
||||
const target = await _getDockerTarget(envId);
|
||||
console.log('[WS] Open:', connId, containerId, 'target:', target.type);
|
||||
|
||||
// Handle Hawser Edge terminal
|
||||
if (target.type === 'hawser-edge') {
|
||||
const conn = _edgeConnections.get(target.environmentId);
|
||||
if (!conn) { ws.send(JSON.stringify({ type: 'error', message: 'Edge agent not connected' })); ws.close(); return; }
|
||||
const execId = crypto.randomUUID();
|
||||
_edgeExecSessions.set(execId, { ws, execId, environmentId: target.environmentId });
|
||||
ws.data.edgeExecId = execId;
|
||||
conn.ws.send(JSON.stringify({ type: 'exec_start', execId, containerId, cmd: shell || '/bin/sh', user: user || 'root', cols: 120, rows: 30 }));
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
const exec = await createExec(containerId, [shell || '/bin/sh'], user || 'root', target);
|
||||
const execId = exec.Id;
|
||||
let dockerStream;
|
||||
let headersStripped = false;
|
||||
let isChunked = false;
|
||||
const socketHandler = {
|
||||
data(socket, data) {
|
||||
if (ws.readyState === 1) {
|
||||
let text = new TextDecoder().decode(data);
|
||||
if (!headersStripped) {
|
||||
if (text.toLowerCase().includes('transfer-encoding: chunked')) isChunked = true;
|
||||
const i = text.indexOf('\\r\\n\\r\\n');
|
||||
if (i > -1) { text = text.slice(i + 4); headersStripped = true; }
|
||||
else if (text.startsWith('HTTP/')) return;
|
||||
}
|
||||
if (isChunked && text) text = text.replace(/^[0-9a-fA-F]+\\r\\n/gm, '').replace(/\\r\\n$/g, '');
|
||||
if (text) ws.send(JSON.stringify({ type: 'output', data: text }));
|
||||
}
|
||||
},
|
||||
close() { if (ws.readyState === 1) { ws.send(JSON.stringify({ type: 'exit' })); ws.close(); } },
|
||||
error() {},
|
||||
open(socket) {
|
||||
const body = JSON.stringify({ Detach: false, Tty: true });
|
||||
const tokenHeader = target.type === 'tcp' && target.hawserToken ? 'X-Hawser-Token: ' + target.hawserToken + '\\r\\n' : '';
|
||||
socket.write('POST /exec/' + execId + '/start HTTP/1.1\\r\\nHost: localhost\\r\\nContent-Type: application/json\\r\\n' + tokenHeader + 'Connection: Upgrade\\r\\nUpgrade: tcp\\r\\nContent-Length: ' + body.length + '\\r\\n\\r\\n' + body);
|
||||
}
|
||||
};
|
||||
if (target.type === 'unix') {
|
||||
dockerStream = await Bun.connect({ unix: target.socket, socket: socketHandler });
|
||||
} else {
|
||||
dockerStream = await Bun.connect({ hostname: target.host, port: target.port, socket: socketHandler });
|
||||
}
|
||||
dockerStreams.set(connId, { stream: dockerStream, execId, target });
|
||||
} catch (e) { ws.send(JSON.stringify({ type: 'error', message: e.message })); ws.close(); }
|
||||
},
|
||||
async message(ws, message) {
|
||||
const connType = ws.data?.type;
|
||||
|
||||
// Hawser Edge message
|
||||
if (connType === 'hawser') {
|
||||
try {
|
||||
let msgStr = typeof message === 'string' ? message : message instanceof ArrayBuffer ? new TextDecoder().decode(message) : Buffer.isBuffer(message) ? message.toString('utf-8') : new TextDecoder().decode(new Uint8Array(message));
|
||||
const msg = JSON.parse(msgStr);
|
||||
await _handleHawserMessage(ws, msg);
|
||||
} catch (e) {
|
||||
console.error('[Hawser] Error:', e.message);
|
||||
ws.send(JSON.stringify({ type: 'error', error: e.message }));
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Edge exec session input
|
||||
const edgeExecId = ws.data?.edgeExecId;
|
||||
if (edgeExecId) {
|
||||
const session = _edgeExecSessions.get(edgeExecId);
|
||||
if (session) {
|
||||
const conn = _edgeConnections.get(session.environmentId);
|
||||
if (conn) {
|
||||
try {
|
||||
const msg = JSON.parse(message.toString());
|
||||
if (msg.type === 'input') conn.ws.send(JSON.stringify({ type: 'exec_input', execId: edgeExecId, data: Buffer.from(msg.data).toString('base64') }));
|
||||
else if (msg.type === 'resize') conn.ws.send(JSON.stringify({ type: 'exec_resize', execId: edgeExecId, cols: msg.cols, rows: msg.rows }));
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Terminal message
|
||||
const connId = ws.data?.connId;
|
||||
if (!connId) return;
|
||||
const d = dockerStreams.get(connId);
|
||||
if (!d) return;
|
||||
try {
|
||||
const msg = JSON.parse(message.toString());
|
||||
if (msg.type === 'input' && d.stream) d.stream.write(msg.data);
|
||||
else if (msg.type === 'resize' && d.execId) resizeExec(d.execId, msg.cols, msg.rows, d.target);
|
||||
} catch { if (d.stream) d.stream.write(message); }
|
||||
},
|
||||
close(ws) {
|
||||
const connType = ws.data?.type;
|
||||
|
||||
// Hawser Edge disconnection
|
||||
if (connType === 'hawser') {
|
||||
const envId = _wsToEnvId.get(ws);
|
||||
if (envId) {
|
||||
const conn = _edgeConnections.get(envId);
|
||||
if (conn) {
|
||||
console.log('[Hawser] Agent disconnected:', conn.agentId);
|
||||
// Clear server-side ping interval
|
||||
if (conn.pingInterval) { clearInterval(conn.pingInterval); conn.pingInterval = null; }
|
||||
for (const [, p] of conn.pendingRequests) { clearTimeout(p.timeout); p.reject(new Error('Connection closed')); }
|
||||
for (const [, p] of conn.pendingStreamRequests) { p.onEnd('Connection closed'); }
|
||||
_edgeConnections.delete(envId);
|
||||
_updateEnvStatus(envId, null);
|
||||
}
|
||||
_wsToEnvId.delete(ws);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Edge exec session close
|
||||
const edgeExecId = ws.data?.edgeExecId;
|
||||
if (edgeExecId) {
|
||||
const session = _edgeExecSessions.get(edgeExecId);
|
||||
if (session) {
|
||||
const conn = _edgeConnections.get(session.environmentId);
|
||||
if (conn) conn.ws.send(JSON.stringify({ type: 'exec_end', execId: edgeExecId, reason: 'user_closed' }));
|
||||
_edgeExecSessions.delete(edgeExecId);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Terminal close
|
||||
const connId = ws.data?.connId;
|
||||
if (!connId) return;
|
||||
const d = dockerStreams.get(connId);
|
||||
if (d?.stream) d.stream.end();
|
||||
dockerStreams.delete(connId);
|
||||
}
|
||||
};
|
||||
`;
|
||||
|
||||
const insertPoint = content.indexOf('var path = env(');
|
||||
if (insertPoint > -1) {
|
||||
content = content.slice(0, insertPoint) + wsHandler + content.slice(insertPoint);
|
||||
}
|
||||
|
||||
content = content.replace(
|
||||
'var { fetch: handlerFetch, websocket } = getHandler();',
|
||||
'var { fetch: handlerFetch, websocket: _ } = getHandler(); var websocket = combinedWebsocket;'
|
||||
);
|
||||
|
||||
await Bun.write(indexPath, content);
|
||||
console.log('✓ Patched index.js');
|
||||
}
|
||||
|
||||
console.log('Patching build...');
|
||||
await patchHandler();
|
||||
await patchIndex();
|
||||
console.log('✓ Done');
|
||||
+128
@@ -0,0 +1,128 @@
|
||||
Business Source License 1.1
|
||||
|
||||
License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
|
||||
"Business Source License" is a trademark of MariaDB Corporation Ab.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Parameters
|
||||
|
||||
Licensor: Finsys / Jarek Krochmalski
|
||||
|
||||
Licensed Work: Dockhand
|
||||
The Licensed Work is (c) 2025-2026 Finsys / Jarek Krochmalski.
|
||||
|
||||
Additional Use Grant: You may use the Licensed Work for any purpose, including
|
||||
production use, provided that you do not offer the Licensed
|
||||
Work, or any derivative work of the Licensed Work, to third
|
||||
parties as a commercial hosted service, managed service, or
|
||||
software-as-a-service (SaaS) offering where the primary value
|
||||
proposition to users is Docker container management
|
||||
functionality substantially similar to the Licensed Work.
|
||||
|
||||
For clarity, the following uses are explicitly permitted
|
||||
without any restriction:
|
||||
|
||||
(a) Personal use, including home labs and hobby projects
|
||||
(b) Internal business use within your organization, regardless
|
||||
of the number of Docker environments managed
|
||||
(c) Use by non-profit organizations and charitable entities
|
||||
(d) Educational, academic, and research purposes
|
||||
(e) Evaluation, testing, development, and demonstration purposes
|
||||
(f) Embedding or integrating the Licensed Work into internal
|
||||
tools or platforms that are not offered commercially to
|
||||
third parties
|
||||
(g) Use by managed service providers (MSPs) to manage Docker
|
||||
infrastructure on behalf of their clients, provided the
|
||||
MSP does not offer Dockhand itself as the service
|
||||
|
||||
Change Date: January 1, 2029
|
||||
|
||||
Change License: Apache License, Version 2.0
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Terms
|
||||
|
||||
The Licensor hereby grants you the right to copy, modify, create derivative
|
||||
works, redistribute, and make non-production use of the Licensed Work. The
|
||||
Licensor may make an Additional Use Grant, above, permitting limited
|
||||
production use.
|
||||
|
||||
Effective on the Change Date, or the fourth anniversary of the first publicly
|
||||
available distribution of a specific version of the Licensed Work under this
|
||||
License, whichever comes first, the Licensor hereby grants you rights under
|
||||
the terms of the Change License, and the rights granted in the paragraph
|
||||
above terminate.
|
||||
|
||||
If your use of the Licensed Work does not comply with the requirements
|
||||
currently in effect as described in this License, you must purchase a
|
||||
commercial license from the Licensor, its affiliated entities, or authorized
|
||||
resellers, or you must refrain from using the Licensed Work.
|
||||
|
||||
All copies of the original and modified Licensed Work, and derivative works
|
||||
of the Licensed Work, are subject to this License. This License applies
|
||||
separately for each version of the Licensed Work and the Change Date may vary
|
||||
for each version of the Licensed Work released by Licensor.
|
||||
|
||||
You must conspicuously display this License on each original or modified copy
|
||||
of the Licensed Work. If you receive the Licensed Work in original or
|
||||
modified form from a third party, the terms and conditions set forth in this
|
||||
License apply to your use of that work.
|
||||
|
||||
Any use of the Licensed Work in violation of this License will automatically
|
||||
terminate your rights under this License for the current and all other
|
||||
versions of the Licensed Work.
|
||||
|
||||
This License does not grant you any right in any trademark or logo of
|
||||
Licensor or its affiliates (provided that you may use a trademark or logo of
|
||||
Licensor as expressly required by this License).
|
||||
|
||||
TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
|
||||
AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
|
||||
EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
|
||||
TITLE.
|
||||
|
||||
MariaDB hereby grants you permission to use this License's text to license
|
||||
your works, and to refer to it using the trademark "Business Source License",
|
||||
as long as you comply with the Covenants of Licensor below.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Covenants of Licensor
|
||||
|
||||
In consideration of the right to use this License's text and the "Business
|
||||
Source License" name and trademark, Licensor covenants to MariaDB, and to all
|
||||
other recipients of the licensed work to be provided by Licensor:
|
||||
|
||||
1. To specify as the Change License the GPL Version 2.0 or any later version,
|
||||
or a license that is compatible with GPL Version 2.0 or a later version,
|
||||
where "compatible" means that software provided under the Change License can
|
||||
be included in a program with software provided under GPL Version 2.0 or a
|
||||
later version. Licensor may specify additional Change Licenses without
|
||||
limitation.
|
||||
|
||||
2. To either: (a) specify an additional grant of rights to use that does not
|
||||
impose any additional restriction on the right granted in this License, as
|
||||
the Additional Use Grant; or (b) insert the text "None".
|
||||
|
||||
3. To specify a Change Date.
|
||||
|
||||
4. Not to modify this License in any other way.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
Notice
|
||||
|
||||
The Business Source License (this document, or the "License") is not an Open
|
||||
Source license. However, the Licensed Work will eventually be made available
|
||||
under an Open Source License, as stated in this License.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
For licensing inquiries, commercial licensing, or enterprise features:
|
||||
|
||||
Website: https://dockhand.io
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
@@ -13,5 +13,3 @@
|
||||
<div style="display: contents">%sveltekit.body%</div>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
|
||||
+10
-1
@@ -4,6 +4,7 @@ import { startScheduler } from '$lib/server/scheduler';
|
||||
import { isAuthEnabled, validateSession } from '$lib/server/auth';
|
||||
import { setServerStartTime } from '$lib/server/uptime';
|
||||
import { checkLicenseExpiry, getHostname } from '$lib/server/license';
|
||||
import { initCryptoFallback } from '$lib/server/crypto-fallback';
|
||||
import type { HandleServerError, Handle } from '@sveltejs/kit';
|
||||
import { redirect } from '@sveltejs/kit';
|
||||
|
||||
@@ -20,6 +21,9 @@ let initialized = false;
|
||||
|
||||
if (!initialized) {
|
||||
try {
|
||||
// Initialize crypto fallback first (detects old kernels and logs status)
|
||||
initCryptoFallback();
|
||||
|
||||
setServerStartTime(); // Track when server started
|
||||
initDatabase();
|
||||
// Log hostname for license validation (set by entrypoint in Docker, or os.hostname() outside)
|
||||
@@ -68,11 +72,16 @@ const PUBLIC_PATHS = [
|
||||
'/api/auth/oidc',
|
||||
'/api/license',
|
||||
'/api/changelog',
|
||||
'/api/dependencies'
|
||||
'/api/dependencies',
|
||||
'/api/health'
|
||||
];
|
||||
|
||||
// Check if path is public
|
||||
function isPublicPath(pathname: string): boolean {
|
||||
// Webhook endpoints have their own auth (signature/secret verification)
|
||||
if (pathname.match(/^\/api\/git\/stacks\/\d+\/webhook$/)) return true;
|
||||
if (pathname.match(/^\/api\/git\/webhook\/\d+$/)) return true;
|
||||
|
||||
return PUBLIC_PATHS.some(path => pathname === path || pathname.startsWith(path + '/'));
|
||||
}
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 9.7 KiB |
@@ -2,6 +2,8 @@
|
||||
import { onMount, onDestroy } from 'svelte';
|
||||
import { EditorState, StateField, StateEffect, RangeSet } from '@codemirror/state';
|
||||
import { EditorView, keymap, lineNumbers, highlightActiveLine, highlightActiveLineGutter, gutter, GutterMarker, Decoration, WidgetType, type DecorationSet } from '@codemirror/view';
|
||||
// Note: Secret masking was removed - secrets are now excluded from the raw editor entirely
|
||||
// and are only stored in the database (never written to .env file)
|
||||
import { defaultKeymap, history, historyKeymap, indentWithTab } from '@codemirror/commands';
|
||||
import { syntaxHighlighting, defaultHighlightStyle, indentOnInput, bracketMatching, StreamLanguage, type StreamParser } from '@codemirror/language';
|
||||
import { searchKeymap, highlightSelectionMatches } from '@codemirror/search';
|
||||
@@ -212,7 +214,10 @@
|
||||
variableMarkers?: VariableMarker[];
|
||||
}
|
||||
|
||||
let { value = '', language = 'yaml', readonly = false, theme = 'dark', onchange, class: className = '', variableMarkers = [] }: Props = $props();
|
||||
let { value = '', language = 'yaml', readonly = false, theme = 'dark', onchange, class: className = '', variableMarkers: variableMarkersProp = [] }: Props = $props();
|
||||
|
||||
// Keep markers reactive - destructured props with defaults lose reactivity
|
||||
const variableMarkers = $derived(variableMarkersProp);
|
||||
|
||||
let container: HTMLDivElement;
|
||||
let view: EditorView | null = null;
|
||||
@@ -220,6 +225,9 @@
|
||||
// Mutable ref for callback - allows updating without recreating editor
|
||||
let onchangeRef: ((value: string) => void) | undefined = onchange;
|
||||
|
||||
// Flag to suppress onchange during programmatic value sync
|
||||
let isSyncingExternalValue = false;
|
||||
|
||||
// Keep callback ref updated when prop changes
|
||||
$effect(() => {
|
||||
onchangeRef = onchange;
|
||||
@@ -412,38 +420,61 @@
|
||||
// Effect to update variable markers
|
||||
const updateMarkersEffect = StateEffect.define<VariableMarker[]>();
|
||||
|
||||
// State field to store current markers (used for recalculation on doc change)
|
||||
const currentMarkersField = StateField.define<VariableMarker[]>({
|
||||
create() {
|
||||
return [];
|
||||
},
|
||||
update(markers, tr) {
|
||||
for (const effect of tr.effects) {
|
||||
if (effect.is(updateMarkersEffect)) {
|
||||
return effect.value;
|
||||
}
|
||||
}
|
||||
return markers;
|
||||
}
|
||||
});
|
||||
|
||||
// State field to track variable markers (gutter)
|
||||
// IMPORTANT: Only updates via effects, not closure reference (fixes stale closure bug)
|
||||
// Recalculates on doc change to avoid position mapping issues
|
||||
const variableMarkersField = StateField.define<RangeSet<GutterMarker>>({
|
||||
create() {
|
||||
// Start empty - markers will be pushed via effect
|
||||
return RangeSet.empty;
|
||||
},
|
||||
update(markers, tr) {
|
||||
// Check for marker updates first
|
||||
for (const effect of tr.effects) {
|
||||
if (effect.is(updateMarkersEffect)) {
|
||||
return createVariableDecorations(tr.state.doc, effect.value);
|
||||
}
|
||||
}
|
||||
// Don't recalculate on docChanged - wait for explicit effect from parent
|
||||
// Recalculate on doc change using stored markers
|
||||
if (tr.docChanged) {
|
||||
const currentMarkers = tr.state.field(currentMarkersField);
|
||||
return createVariableDecorations(tr.state.doc, currentMarkers);
|
||||
}
|
||||
return markers;
|
||||
}
|
||||
});
|
||||
|
||||
// State field to track value decorations (inline widgets)
|
||||
// IMPORTANT: Only updates via effects, not closure reference (fixes stale closure bug)
|
||||
// Recalculates on doc change to avoid widget duplication issues
|
||||
const valueDecorationsField = StateField.define<DecorationSet>({
|
||||
create() {
|
||||
// Start empty - decorations will be pushed via effect
|
||||
return Decoration.none;
|
||||
},
|
||||
update(decorations, tr) {
|
||||
// Check for marker updates first
|
||||
for (const effect of tr.effects) {
|
||||
if (effect.is(updateMarkersEffect)) {
|
||||
return createValueDecorations(tr.state.doc, effect.value);
|
||||
}
|
||||
}
|
||||
// Don't recalculate on docChanged - wait for explicit effect from parent
|
||||
// Recalculate on doc change using stored markers
|
||||
if (tr.docChanged) {
|
||||
const currentMarkers = tr.state.field(currentMarkersField);
|
||||
return createValueDecorations(tr.state.doc, currentMarkers);
|
||||
}
|
||||
return decorations;
|
||||
},
|
||||
provide: f => EditorView.decorations.from(f)
|
||||
@@ -639,7 +670,7 @@
|
||||
}
|
||||
|
||||
// Always add variable markers gutter and value decorations (can be updated dynamically)
|
||||
extensions.push(variableMarkersField, variableGutter, valueDecorationsField);
|
||||
extensions.push(currentMarkersField, variableMarkersField, variableGutter, valueDecorationsField);
|
||||
|
||||
const state = EditorState.create({
|
||||
doc: value,
|
||||
@@ -655,16 +686,14 @@
|
||||
view.update(trs);
|
||||
|
||||
// Check if any transaction changed the document
|
||||
// Skip onchange during programmatic value sync (only fire for user edits)
|
||||
const lastChangingTr = trs.findLast(tr => tr.docChanged);
|
||||
if (lastChangingTr && onchangeRef) {
|
||||
// Defer callback to next microtask to avoid blocking input handling
|
||||
// This allows key repeat to work properly
|
||||
if (lastChangingTr && onchangeRef && !isSyncingExternalValue) {
|
||||
// Call synchronously to ensure parent state updates before any
|
||||
// reactive $effect runs - this prevents race conditions on iPad Safari
|
||||
// where paste content was being overwritten by stale external value
|
||||
const newContent = lastChangingTr.newDoc.toString();
|
||||
queueMicrotask(() => {
|
||||
if (onchangeRef) {
|
||||
onchangeRef(newContent);
|
||||
}
|
||||
});
|
||||
onchangeRef(newContent);
|
||||
}
|
||||
};
|
||||
|
||||
@@ -787,6 +816,24 @@
|
||||
updateVariableMarkers(markers);
|
||||
}
|
||||
});
|
||||
|
||||
// Sync external value changes to the editor (e.g., when parent clears the content)
|
||||
$effect(() => {
|
||||
const externalValue = value;
|
||||
if (view) {
|
||||
const currentContent = view.state.doc.toString();
|
||||
// Only update if the external value differs from editor content
|
||||
// This prevents feedback loops from editor changes
|
||||
if (externalValue !== currentContent) {
|
||||
// Suppress onchange during programmatic sync - only user edits should trigger it
|
||||
isSyncingExternalValue = true;
|
||||
view.dispatch({
|
||||
changes: { from: 0, to: currentContent.length, insert: externalValue }
|
||||
});
|
||||
isSyncingExternalValue = false;
|
||||
}
|
||||
}
|
||||
});
|
||||
</script>
|
||||
|
||||
<div
|
||||
|
||||
@@ -61,7 +61,6 @@
|
||||
});
|
||||
|
||||
function handleConfirm() {
|
||||
console.log('[ConfirmPopover] handleConfirm called, onConfirm:', typeof onConfirm);
|
||||
onConfirm();
|
||||
open = false;
|
||||
onOpenChange(false);
|
||||
|
||||
@@ -27,6 +27,7 @@
|
||||
sources?: Record<string, 'file' | 'override'>; // Key -> source mapping
|
||||
placeholder?: { key: string; value: string };
|
||||
existingSecretKeys?: Set<string>; // Keys of secrets loaded from DB (can't toggle visibility)
|
||||
onchange?: () => void;
|
||||
}
|
||||
|
||||
let {
|
||||
@@ -36,7 +37,8 @@
|
||||
showSource = false,
|
||||
sources = {},
|
||||
placeholder = { key: 'VARIABLE_NAME', value: 'value' },
|
||||
existingSecretKeys = new Set<string>()
|
||||
existingSecretKeys = new Set<string>(),
|
||||
onchange
|
||||
}: Props = $props();
|
||||
|
||||
// Check if a variable is an existing secret that was loaded from DB
|
||||
@@ -46,14 +48,17 @@
|
||||
|
||||
function addVariable() {
|
||||
variables = [...variables, { key: '', value: '', isSecret: false }];
|
||||
onchange?.();
|
||||
}
|
||||
|
||||
function removeVariable(index: number) {
|
||||
variables = variables.filter((_, i) => i !== index);
|
||||
onchange?.();
|
||||
}
|
||||
|
||||
function toggleSecret(index: number) {
|
||||
variables[index].isSecret = !variables[index].isSecret;
|
||||
onchange?.();
|
||||
}
|
||||
|
||||
// Check if a variable key is missing (required but not defined)
|
||||
@@ -163,6 +168,7 @@
|
||||
<Input
|
||||
bind:value={variable.key}
|
||||
disabled={readonly}
|
||||
oninput={() => onchange?.()}
|
||||
class="h-9 font-mono text-xs"
|
||||
/>
|
||||
</div>
|
||||
@@ -174,6 +180,7 @@
|
||||
bind:value={variable.value}
|
||||
type={variable.isSecret ? 'password' : 'text'}
|
||||
disabled={readonly}
|
||||
oninput={() => onchange?.()}
|
||||
class="h-9 font-mono text-xs"
|
||||
/>
|
||||
</div>
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
<script lang="ts">
|
||||
import { tick, untrack } from 'svelte';
|
||||
import { tick } from 'svelte';
|
||||
import { Button } from '$lib/components/ui/button';
|
||||
import StackEnvVarsEditor, { type EnvVar, type ValidationResult } from '$lib/components/StackEnvVarsEditor.svelte';
|
||||
import CodeEditor from '$lib/components/CodeEditor.svelte';
|
||||
import ConfirmPopover from '$lib/components/ConfirmPopover.svelte';
|
||||
import { Plus, Info, Upload, Trash2, List, FileText, AlertTriangle } from 'lucide-svelte';
|
||||
import { Plus, Info, Upload, Trash2, List, FileText, AlertTriangle, ShieldAlert } from 'lucide-svelte';
|
||||
import * as Tooltip from '$lib/components/ui/tooltip';
|
||||
|
||||
interface Props {
|
||||
variables: EnvVar[]; // Bindable - kept in sync with rawContent
|
||||
rawContent?: string; // The actual content saved to disk - source of truth
|
||||
variables: EnvVar[]; // Bindable - ALL variables (secrets + non-secrets)
|
||||
rawContent: string; // Bindable - raw .env file content (comments preserved, no secrets)
|
||||
validation?: ValidationResult | null;
|
||||
readonly?: boolean;
|
||||
showSource?: boolean;
|
||||
@@ -17,6 +17,7 @@
|
||||
placeholder?: { key: string; value: string };
|
||||
infoText?: string;
|
||||
existingSecretKeys?: Set<string>;
|
||||
theme?: 'light' | 'dark';
|
||||
class?: string;
|
||||
onchange?: () => void;
|
||||
}
|
||||
@@ -31,6 +32,7 @@
|
||||
placeholder = { key: 'VARIABLE_NAME', value: 'value' },
|
||||
infoText,
|
||||
existingSecretKeys = new Set<string>(),
|
||||
theme = 'dark',
|
||||
class: className = '',
|
||||
onchange
|
||||
}: Props = $props();
|
||||
@@ -44,15 +46,40 @@
|
||||
let confirmClearOpen = $state(false);
|
||||
let contentAreaRef: HTMLDivElement;
|
||||
let parseWarnings = $state<string[]>([]);
|
||||
let editorTheme = $state<'light' | 'dark'>('dark');
|
||||
|
||||
// Track previous variables to detect form changes
|
||||
let prevVariablesJson = $state('');
|
||||
// Count of secrets (for display in hint)
|
||||
const secretCount = $derived(variables.filter(v => v.isSecret && v.key.trim()).length);
|
||||
|
||||
// Track if initial sync has been done (to distinguish initial load from user action)
|
||||
let initialized = $state(false);
|
||||
/**
|
||||
* Sync variables with rawContent after initial load.
|
||||
* Pass the loaded data directly to avoid timing issues with bindable props.
|
||||
* Merges: secrets from loadedVars (DB) + non-secrets from loadedRaw (file).
|
||||
*/
|
||||
export function syncAfterLoad(loadedVars: EnvVar[], loadedRaw: string) {
|
||||
if (!loadedRaw.trim()) {
|
||||
// No raw content - just use the loaded variables as-is
|
||||
variables = loadedVars;
|
||||
rawContent = '';
|
||||
return;
|
||||
}
|
||||
|
||||
// Parse raw content to EnvVar array
|
||||
const { vars: rawVars } = parseRawContent(loadedRaw);
|
||||
|
||||
// Secrets come from loadedVars (DB), non-secrets come from loadedRaw (file)
|
||||
const secrets = loadedVars.filter(v => v.isSecret);
|
||||
|
||||
// Also keep non-secrets from loadedVars that aren't in raw (new vars added before first save)
|
||||
const rawKeys = new Set(rawVars.map(v => v.key));
|
||||
const newNonSecrets = loadedVars.filter(v => !v.isSecret && v.key.trim() && !rawKeys.has(v.key));
|
||||
|
||||
// Set both at once to avoid any intermediate states
|
||||
variables = [...rawVars, ...newNonSecrets, ...secrets];
|
||||
rawContent = loadedRaw;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse raw content to extract non-secret variables.
|
||||
*/
|
||||
function parseRawContent(content: string): { vars: EnvVar[], warnings: string[] } {
|
||||
const result: EnvVar[] = [];
|
||||
const warnings: string[] = [];
|
||||
@@ -82,123 +109,124 @@
|
||||
warnings.push(`Line ${lineNum}: "${key}" (invalid variable name)`);
|
||||
continue;
|
||||
}
|
||||
result.push({
|
||||
key,
|
||||
value,
|
||||
isSecret: existingSecretKeys.has(key) || false
|
||||
});
|
||||
result.push({ key, value, isSecret: false });
|
||||
}
|
||||
}
|
||||
|
||||
return { vars: result, warnings };
|
||||
}
|
||||
|
||||
// Update rawContent when variables change - replace var lines by position, preserve comments
|
||||
function syncRawContentFromVariables(newVars: EnvVar[]) {
|
||||
/**
|
||||
* Sync variables (non-secrets) TO rawContent.
|
||||
* Preserves comments and formatting. Secrets are excluded.
|
||||
*/
|
||||
function syncVariablesToRaw() {
|
||||
const nonSecretVars = variables.filter(v => v.key.trim() && !v.isSecret);
|
||||
|
||||
// If no raw content exists, generate fresh
|
||||
if (!rawContent.trim()) {
|
||||
if (nonSecretVars.length > 0) {
|
||||
rawContent = nonSecretVars.map(v => `${v.key.trim()}=${v.value}`).join('\n') + '\n';
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Update existing raw content - preserve comments, update/add/remove variables
|
||||
const varMap = new Map(nonSecretVars.map(v => [v.key.trim(), v]));
|
||||
const usedKeys = new Set<string>();
|
||||
const lines = rawContent.split('\n');
|
||||
const resultLines: string[] = [];
|
||||
const varsWithKeys = newVars.filter(v => v.key.trim());
|
||||
let varIdx = 0;
|
||||
|
||||
for (const line of lines) {
|
||||
const trimmed = line.trim();
|
||||
|
||||
// Keep comments and blank lines
|
||||
if (!trimmed || trimmed.startsWith('#')) {
|
||||
resultLines.push(line);
|
||||
continue;
|
||||
}
|
||||
|
||||
// Check if this is a variable line
|
||||
const eqIndex = trimmed.indexOf('=');
|
||||
if (eqIndex > 0) {
|
||||
const key = trimmed.slice(0, eqIndex).trim();
|
||||
if (/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
|
||||
// This is a valid variable line - replace with var at current index
|
||||
if (varIdx < varsWithKeys.length) {
|
||||
const v = varsWithKeys[varIdx];
|
||||
resultLines.push(`${v.key.trim()}=${v.value}`);
|
||||
varIdx++;
|
||||
const varData = varMap.get(key);
|
||||
if (varData) {
|
||||
// Update value
|
||||
resultLines.push(`${key}=${varData.value}`);
|
||||
usedKeys.add(key);
|
||||
}
|
||||
// If we have fewer vars, this line is deleted
|
||||
// If not in varMap, variable was deleted - skip line
|
||||
continue;
|
||||
}
|
||||
}
|
||||
// Keep invalid lines as-is
|
||||
|
||||
resultLines.push(line);
|
||||
}
|
||||
|
||||
// Append any new variables
|
||||
while (varIdx < varsWithKeys.length) {
|
||||
const v = varsWithKeys[varIdx];
|
||||
resultLines.push(`${v.key.trim()}=${v.value}`);
|
||||
varIdx++;
|
||||
// Append new variables
|
||||
for (const v of nonSecretVars) {
|
||||
if (!usedKeys.has(v.key.trim())) {
|
||||
resultLines.push(`${v.key.trim()}=${v.value}`);
|
||||
}
|
||||
}
|
||||
|
||||
let result = resultLines.join('\n');
|
||||
if (result && !result.endsWith('\n')) {
|
||||
result += '\n';
|
||||
}
|
||||
return result;
|
||||
rawContent = result;
|
||||
}
|
||||
|
||||
// When rawContent changes externally (text view, file load), update variables
|
||||
$effect(() => {
|
||||
/**
|
||||
* Sync rawContent TO variables.
|
||||
* Parses raw content for non-secrets, preserves existing secrets.
|
||||
*/
|
||||
function syncRawToVariables() {
|
||||
const { vars, warnings } = parseRawContent(rawContent);
|
||||
parseWarnings = warnings;
|
||||
|
||||
// Initial load with no .env file: don't overwrite DB-loaded variables
|
||||
// Let the second $effect generate rawContent from the existing variables instead
|
||||
if (!initialized && !rawContent.trim() && variables.length > 0) {
|
||||
initialized = true;
|
||||
return;
|
||||
// Preserve existing secrets (they're not in rawContent)
|
||||
const existingSecrets = variables.filter(v => v.isSecret);
|
||||
|
||||
// Merge: non-secrets from raw + existing secrets
|
||||
variables = [...vars, ...existingSecrets];
|
||||
}
|
||||
|
||||
/**
|
||||
* Call before saving. Ensures variables and rawContent are in sync.
|
||||
* Always syncs variables→raw to get proper .env content for disk.
|
||||
*/
|
||||
export function prepareForSave(): { rawContent: string; variables: EnvVar[] } {
|
||||
// If in text view, first sync raw→variables to capture edits
|
||||
if (viewMode === 'text') {
|
||||
syncRawToVariables();
|
||||
}
|
||||
initialized = true;
|
||||
// Then sync variables→raw to ensure rawContent is up to date
|
||||
syncVariablesToRaw();
|
||||
|
||||
// When rawContent has content, merge parsed vars with existing DB secrets
|
||||
// This handles the case where .env file exists but DB has additional secrets
|
||||
let finalVars = vars;
|
||||
if (rawContent.trim()) {
|
||||
const parsedKeys = new Set(vars.map(v => v.key));
|
||||
const existingSecrets = untrack(() =>
|
||||
variables.filter(v => v.isSecret && !parsedKeys.has(v.key))
|
||||
);
|
||||
if (existingSecrets.length > 0) {
|
||||
finalVars = [...vars, ...existingSecrets];
|
||||
}
|
||||
}
|
||||
|
||||
const newJson = JSON.stringify(finalVars.map(v => ({ key: v.key, value: v.value })));
|
||||
// Use untrack to read variables without creating a dependency on it
|
||||
// This prevents the effect from running when variables changes (only rawContent should trigger it)
|
||||
const currentNonEmptyJson = untrack(() =>
|
||||
JSON.stringify(variables.filter(v => v.key.trim()).map(v => ({ key: v.key, value: v.value })))
|
||||
);
|
||||
|
||||
if (newJson !== currentNonEmptyJson) {
|
||||
variables = finalVars;
|
||||
prevVariablesJson = newJson;
|
||||
}
|
||||
});
|
||||
|
||||
// When variables change from form edits, update rawContent
|
||||
$effect(() => {
|
||||
const currentJson = JSON.stringify(variables.map(v => ({ key: v.key, value: v.value })));
|
||||
|
||||
// Only sync if variables actually changed (not from parsing rawContent)
|
||||
if (currentJson !== prevVariablesJson) {
|
||||
prevVariablesJson = currentJson;
|
||||
const newRaw = syncRawContentFromVariables(variables);
|
||||
if (newRaw !== rawContent) {
|
||||
rawContent = newRaw;
|
||||
}
|
||||
}
|
||||
});
|
||||
return {
|
||||
rawContent,
|
||||
variables: variables.filter(v => v.key.trim())
|
||||
};
|
||||
}
|
||||
|
||||
function handleTextChange(value: string) {
|
||||
rawContent = value;
|
||||
syncRawToVariables(); // Sync to variables so parent's envVars updates (for compose decorations)
|
||||
onchange?.();
|
||||
}
|
||||
|
||||
function handleViewModeChange(newMode: 'form' | 'text') {
|
||||
if (newMode === 'text' && viewMode === 'form') {
|
||||
// Form → Text: sync variables to raw (preserves comments)
|
||||
syncVariablesToRaw();
|
||||
} else if (newMode === 'form' && viewMode === 'text') {
|
||||
// Text → Form: sync raw to variables (preserves secrets)
|
||||
syncRawToVariables();
|
||||
}
|
||||
|
||||
viewMode = newMode;
|
||||
localStorage.setItem(STORAGE_KEY_VIEW_MODE, newMode);
|
||||
}
|
||||
@@ -233,6 +261,11 @@
|
||||
const reader = new FileReader();
|
||||
reader.onload = (e) => {
|
||||
rawContent = e.target?.result as string;
|
||||
// Parse and merge with existing secrets
|
||||
syncRawToVariables();
|
||||
// Switch to text view to show loaded content
|
||||
viewMode = 'text';
|
||||
localStorage.setItem(STORAGE_KEY_VIEW_MODE, 'text');
|
||||
onchange?.();
|
||||
};
|
||||
reader.readAsText(file);
|
||||
@@ -251,46 +284,68 @@
|
||||
<div class="flex flex-col h-full {className}">
|
||||
<!-- Header -->
|
||||
<div class="px-4 py-2.5 border-b border-zinc-200 dark:border-zinc-700 flex flex-col gap-1.5">
|
||||
<div class="flex items-center justify-between gap-2">
|
||||
<div class="flex items-center gap-2 flex-nowrap min-w-0">
|
||||
<span class="text-xs text-zinc-500 dark:text-zinc-400">Environment variables</span>
|
||||
{#if infoText}
|
||||
<Tooltip.Root>
|
||||
<Tooltip.Trigger>
|
||||
<Info class="w-3.5 h-3.5 text-blue-400" />
|
||||
</Tooltip.Trigger>
|
||||
<Tooltip.Portal>
|
||||
<Tooltip.Content side="bottom" sideOffset={8} class="max-w-xs w-64 bg-white dark:bg-zinc-900 text-zinc-900 dark:text-zinc-100 border-zinc-200 dark:border-zinc-700">
|
||||
<p class="text-xs text-left">{infoText}</p>
|
||||
</Tooltip.Content>
|
||||
</Tooltip.Portal>
|
||||
</Tooltip.Root>
|
||||
{/if}
|
||||
<!-- View mode toggle -->
|
||||
<div class="flex items-center gap-0.5 bg-zinc-100 dark:bg-zinc-800 rounded p-0.5 ml-1">
|
||||
<button
|
||||
type="button"
|
||||
class="flex items-center gap-1 px-1.5 py-0.5 rounded text-2xs transition-colors {viewMode === 'form' ? 'bg-white dark:bg-zinc-700 text-zinc-800 dark:text-zinc-100 shadow-sm' : 'text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200'}"
|
||||
onclick={() => handleViewModeChange('form')}
|
||||
title="Form view"
|
||||
>
|
||||
<List class="w-3 h-3" />
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
class="flex items-center gap-1 px-1.5 py-0.5 rounded text-2xs transition-colors {viewMode === 'text' ? 'bg-white dark:bg-zinc-700 text-zinc-800 dark:text-zinc-100 shadow-sm' : 'text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200'}"
|
||||
onclick={() => handleViewModeChange('text')}
|
||||
title="Text view (raw .env file)"
|
||||
>
|
||||
<FileText class="w-3 h-3" />
|
||||
</button>
|
||||
</div>
|
||||
<!-- Header row: title + info + view toggle + validation pills + actions -->
|
||||
<div class="flex items-center gap-2 justify-between">
|
||||
<div class="flex items-center gap-2 flex-wrap min-w-0">
|
||||
<span class="text-xs text-zinc-500 dark:text-zinc-400 shrink-0">Environment variables</span>
|
||||
{#if infoText}
|
||||
<Tooltip.Root>
|
||||
<Tooltip.Trigger>
|
||||
<Info class="w-3.5 h-3.5 text-blue-400 shrink-0" />
|
||||
</Tooltip.Trigger>
|
||||
<Tooltip.Portal>
|
||||
<Tooltip.Content side="bottom" sideOffset={8} class="max-w-xs w-64 bg-white dark:bg-zinc-900 text-zinc-900 dark:text-zinc-100 border-zinc-200 dark:border-zinc-700">
|
||||
<p class="text-xs text-left">{infoText}</p>
|
||||
</Tooltip.Content>
|
||||
</Tooltip.Portal>
|
||||
</Tooltip.Root>
|
||||
{/if}
|
||||
<!-- View mode toggle -->
|
||||
<div class="flex items-center gap-0.5 bg-zinc-100 dark:bg-zinc-800 rounded p-0.5 shrink-0">
|
||||
<button
|
||||
type="button"
|
||||
class="flex items-center gap-1 px-1.5 py-0.5 rounded text-2xs transition-colors {viewMode === 'form' ? 'bg-white dark:bg-zinc-700 text-zinc-800 dark:text-zinc-100 shadow-sm' : 'text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200'}"
|
||||
onclick={() => handleViewModeChange('form')}
|
||||
title="Form view"
|
||||
>
|
||||
<List class="w-3 h-3" />
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
class="flex items-center gap-1 px-1.5 py-0.5 rounded text-2xs transition-colors {viewMode === 'text' ? 'bg-white dark:bg-zinc-700 text-zinc-800 dark:text-zinc-100 shadow-sm' : 'text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200'}"
|
||||
onclick={() => handleViewModeChange('text')}
|
||||
title="Text view (raw .env file)"
|
||||
>
|
||||
<FileText class="w-3 h-3" />
|
||||
</button>
|
||||
</div>
|
||||
<!-- Validation status pills -->
|
||||
{#if validation}
|
||||
<div class="flex gap-1 flex-wrap">
|
||||
{#if validation.missing.length > 0}
|
||||
<span class="inline-flex items-center px-1.5 py-0.5 rounded text-2xs font-medium bg-red-100 text-red-700 dark:bg-red-900/30 dark:text-red-300">
|
||||
{validation.missing.length} missing
|
||||
</span>
|
||||
{/if}
|
||||
{#if validation.required.length > 0}
|
||||
<span class="inline-flex items-center px-1.5 py-0.5 rounded text-2xs font-medium bg-green-100 text-green-700 dark:bg-green-900/30 dark:text-green-300">
|
||||
{validation.required.length - validation.missing.length} defined
|
||||
</span>
|
||||
{/if}
|
||||
{#if validation.optional.length > 0}
|
||||
<span class="inline-flex items-center px-1.5 py-0.5 rounded text-2xs font-medium bg-blue-100 text-blue-700 dark:bg-blue-900/30 dark:text-blue-300">
|
||||
{validation.optional.length} optional
|
||||
</span>
|
||||
{/if}
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
<!-- Actions - right-aligned -->
|
||||
{#if !readonly}
|
||||
<div class="flex items-center gap-1 shrink-0 ml-4">
|
||||
<div class="flex items-center gap-1 shrink-0">
|
||||
<Button type="button" size="sm" variant="ghost" onclick={handleLoadFromFile} class="h-6 text-xs px-2">
|
||||
<Upload class="w-3.5 h-3.5 mr-1" />
|
||||
Load .env
|
||||
Load
|
||||
</Button>
|
||||
{#if viewMode === 'form'}
|
||||
<Button type="button" size="sm" variant="ghost" onclick={addEnvVariable} class="h-6 text-xs px-2">
|
||||
@@ -298,24 +353,28 @@
|
||||
Add
|
||||
</Button>
|
||||
{/if}
|
||||
<div class="{hasContent ? '' : 'invisible'}">
|
||||
<ConfirmPopover
|
||||
bind:open={confirmClearOpen}
|
||||
title="Clear all variables?"
|
||||
action="clear"
|
||||
itemType="environment variables"
|
||||
confirmText="Clear all"
|
||||
onConfirm={clearAll}
|
||||
onOpenChange={(o) => confirmClearOpen = o}
|
||||
>
|
||||
{#snippet children({ open })}
|
||||
<Button type="button" size="sm" variant="ghost" class="h-6 text-xs px-2 text-destructive hover:text-destructive">
|
||||
<Trash2 class="w-3.5 h-3.5 mr-1" />
|
||||
Clear
|
||||
</Button>
|
||||
{/snippet}
|
||||
</ConfirmPopover>
|
||||
</div>
|
||||
<ConfirmPopover
|
||||
bind:open={confirmClearOpen}
|
||||
title="Clear all variables?"
|
||||
action="clear"
|
||||
itemType="environment variables"
|
||||
confirmText="Clear all"
|
||||
onConfirm={clearAll}
|
||||
onOpenChange={(o) => confirmClearOpen = o}
|
||||
>
|
||||
{#snippet children({ open })}
|
||||
<Button
|
||||
type="button"
|
||||
size="sm"
|
||||
variant="ghost"
|
||||
class="h-6 text-xs px-2 {hasContent ? 'text-destructive hover:text-destructive' : 'text-muted-foreground/50 cursor-not-allowed'}"
|
||||
disabled={!hasContent}
|
||||
>
|
||||
<Trash2 class="w-3.5 h-3.5 mr-1" />
|
||||
Clear
|
||||
</Button>
|
||||
{/snippet}
|
||||
</ConfirmPopover>
|
||||
</div>
|
||||
<input
|
||||
bind:this={fileInputRef}
|
||||
@@ -333,9 +392,14 @@
|
||||
<span><span class="text-zinc-500 dark:text-zinc-400">${`{VAR:-default}`}</span> optional</span>
|
||||
<span><span class="text-zinc-500 dark:text-zinc-400">${`{VAR:?error}`}</span> required w/ error</span>
|
||||
</div>
|
||||
{:else}
|
||||
<div class="text-2xs text-zinc-400 dark:text-zinc-500">
|
||||
Raw .env file (comments preserved, saved exactly as typed)
|
||||
{:else if secretCount > 0}
|
||||
<!-- Text view hint about secrets (only shown when secrets exist) -->
|
||||
<div class="flex items-start gap-2 px-2.5 py-2 rounded bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800/50">
|
||||
<ShieldAlert class="w-4 h-4 text-amber-500 shrink-0 mt-0.5" />
|
||||
<div class="text-xs text-amber-700 dark:text-amber-300">
|
||||
<span class="font-medium">{secretCount} secret{secretCount === 1 ? '' : 's'} not shown.</span>
|
||||
<span class="text-amber-600 dark:text-amber-400">Secrets are never written to disk and are injected via shell environment when the stack starts.</span>
|
||||
</div>
|
||||
</div>
|
||||
{/if}
|
||||
<!-- Parse warnings (form mode only) -->
|
||||
@@ -383,12 +447,13 @@
|
||||
{sources}
|
||||
{placeholder}
|
||||
{existingSecretKeys}
|
||||
{onchange}
|
||||
/>
|
||||
{:else}
|
||||
<CodeEditor
|
||||
value={rawContent}
|
||||
language="dotenv"
|
||||
theme={editorTheme}
|
||||
theme={theme}
|
||||
readonly={readonly}
|
||||
onchange={handleTextChange}
|
||||
class="h-full min-h-[200px] rounded-md overflow-hidden border border-zinc-200 dark:border-zinc-700"
|
||||
|
||||
@@ -111,7 +111,7 @@
|
||||
</Button>
|
||||
{/snippet}
|
||||
</Popover.Trigger>
|
||||
<Popover.Content class="w-[350px] p-0" align="start">
|
||||
<Popover.Content class="w-[350px] p-0 z-[200]" align="start">
|
||||
<Command.Root shouldFilter={false}>
|
||||
<Command.Input bind:value={searchQuery} placeholder="Search timezone..." />
|
||||
<Command.List class="max-h-[300px]">
|
||||
|
||||
@@ -67,6 +67,7 @@
|
||||
cell?: Snippet<[ColumnConfig, T, DataGridRowState]>;
|
||||
emptyState?: Snippet;
|
||||
loadingState?: Snippet;
|
||||
footer?: Snippet;
|
||||
}
|
||||
|
||||
let {
|
||||
@@ -100,7 +101,8 @@
|
||||
headerCell,
|
||||
cell,
|
||||
emptyState,
|
||||
loadingState
|
||||
loadingState,
|
||||
footer
|
||||
}: Props = $props();
|
||||
|
||||
// Column configuration
|
||||
@@ -112,14 +114,16 @@
|
||||
// Grid preferences (reactive)
|
||||
const gridPrefs = $derived($gridPreferencesStore);
|
||||
|
||||
// Get ordered visible columns from preferences
|
||||
// Get ordered visible columns from preferences (excluding fixed columns)
|
||||
const orderedColumns = $derived.by(() => {
|
||||
const prefs = gridPrefs[gridId];
|
||||
if (!prefs?.columns?.length) {
|
||||
// Default: all configurable columns visible
|
||||
return columnConfigs.filter((c) => !c.fixed).map((c) => c.id);
|
||||
}
|
||||
return prefs.columns.filter((c) => c.visible).map((c) => c.id);
|
||||
// Filter out fixed columns - they're rendered separately via fixedStartCols/fixedEndCols
|
||||
const fixedIds = new Set([...fixedStartCols, ...fixedEndCols]);
|
||||
return prefs.columns.filter((c) => c.visible && !fixedIds.has(c.id)).map((c) => c.id);
|
||||
});
|
||||
|
||||
// Identify visible grow columns (columns with grow: true that are currently visible)
|
||||
@@ -152,6 +156,9 @@
|
||||
// RAF throttling for performance
|
||||
let resizeRAF: number | null = null;
|
||||
let scrollRAF: number | null = null;
|
||||
let visibleRangeRAF: number | null = null;
|
||||
let containerResizeRAF: number | null = null;
|
||||
let loadMorePending = false;
|
||||
|
||||
// Helper to get base width for a column (without grow calculation)
|
||||
function getBaseWidth(colId: string): number {
|
||||
@@ -346,20 +353,58 @@
|
||||
|
||||
// Virtual scroll calculations
|
||||
const totalHeight = $derived(virtualScroll ? data.length * rowHeight : 0);
|
||||
|
||||
// Memoization state for visibleData to prevent creating new arrays on every scroll
|
||||
let prevStartIndex = -1;
|
||||
let prevEndIndex = -1;
|
||||
let prevDataRef: T[] | null = null;
|
||||
let cachedVisibleData: T[] = [];
|
||||
|
||||
// Memoized startIndex/endIndex/visibleData calculation
|
||||
const startIndex = $derived(virtualScroll ? Math.max(0, Math.floor(scrollTop / rowHeight) - bufferRows) : 0);
|
||||
const endIndex = $derived(
|
||||
virtualScroll ? Math.min(data.length, Math.ceil((scrollTop + containerHeight) / rowHeight) + bufferRows) : data.length
|
||||
);
|
||||
const visibleData = $derived(virtualScroll ? data.slice(startIndex, endIndex) : data);
|
||||
|
||||
// Memoized visibleData - only create new array when bounds or data actually change
|
||||
const visibleData = $derived.by(() => {
|
||||
if (!virtualScroll) return data;
|
||||
|
||||
// If data reference changed, we must reslice
|
||||
const dataChanged = data !== prevDataRef;
|
||||
|
||||
// Only create new array if bounds or data actually changed
|
||||
if (!dataChanged && startIndex === prevStartIndex && endIndex === prevEndIndex && cachedVisibleData.length > 0) {
|
||||
return cachedVisibleData;
|
||||
}
|
||||
|
||||
prevStartIndex = startIndex;
|
||||
prevEndIndex = endIndex;
|
||||
prevDataRef = data;
|
||||
cachedVisibleData = data.slice(startIndex, endIndex);
|
||||
return cachedVisibleData;
|
||||
});
|
||||
|
||||
const offsetY = $derived(virtualScroll ? startIndex * rowHeight : 0);
|
||||
|
||||
// Notify parent of visible range changes
|
||||
// Notify parent of visible range changes (throttled via RAF)
|
||||
$effect(() => {
|
||||
if (virtualScroll && onVisibleRangeChange && data.length > 0) {
|
||||
// Calculate actual visible range (without buffer)
|
||||
const visibleStart = Math.max(1, Math.floor(scrollTop / rowHeight) + 1);
|
||||
const visibleEnd = Math.min(data.length, Math.ceil((scrollTop + containerHeight) / rowHeight));
|
||||
onVisibleRangeChange(visibleStart, Math.max(visibleEnd, visibleStart), data.length);
|
||||
// Capture values for RAF callback
|
||||
const st = scrollTop;
|
||||
const ch = containerHeight;
|
||||
const len = data.length;
|
||||
const rh = rowHeight;
|
||||
const cb = onVisibleRangeChange;
|
||||
|
||||
if (visibleRangeRAF) cancelAnimationFrame(visibleRangeRAF);
|
||||
visibleRangeRAF = requestAnimationFrame(() => {
|
||||
visibleRangeRAF = null;
|
||||
// Calculate actual visible range (without buffer)
|
||||
const visibleStart = Math.max(1, Math.floor(st / rh) + 1);
|
||||
const visibleEnd = Math.min(len, Math.ceil((st + ch) / rh));
|
||||
cb(visibleStart, Math.max(visibleEnd, visibleStart), len);
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
@@ -376,11 +421,14 @@
|
||||
// Update container height on scroll (in case of resize)
|
||||
containerHeight = target.clientHeight;
|
||||
|
||||
// Infinite scroll trigger
|
||||
if (hasMore && onLoadMore) {
|
||||
// Infinite scroll trigger (with guard to prevent repeated calls)
|
||||
if (hasMore && onLoadMore && !loadMorePending) {
|
||||
const scrollBottom = target.scrollHeight - target.scrollTop - target.clientHeight;
|
||||
if (scrollBottom < loadMoreThreshold) {
|
||||
loadMorePending = true;
|
||||
onLoadMore();
|
||||
// Reset after a short delay to allow the next load
|
||||
setTimeout(() => { loadMorePending = false; }, 100);
|
||||
}
|
||||
}
|
||||
});
|
||||
@@ -398,12 +446,17 @@
|
||||
}
|
||||
|
||||
const resizeObserver = new ResizeObserver((entries) => {
|
||||
for (const entry of entries) {
|
||||
scrollContainerWidth = entry.contentRect.width;
|
||||
if (virtualScroll) {
|
||||
containerHeight = entry.contentRect.height;
|
||||
// Throttle with RAF to prevent "ResizeObserver loop" warnings
|
||||
if (containerResizeRAF) return;
|
||||
containerResizeRAF = requestAnimationFrame(() => {
|
||||
containerResizeRAF = null;
|
||||
for (const entry of entries) {
|
||||
scrollContainerWidth = entry.contentRect.width;
|
||||
if (virtualScroll) {
|
||||
containerHeight = entry.contentRect.height;
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
resizeObserver.observe(scrollContainer);
|
||||
|
||||
@@ -417,6 +470,8 @@
|
||||
onDestroy(() => {
|
||||
if (resizeRAF) cancelAnimationFrame(resizeRAF);
|
||||
if (scrollRAF) cancelAnimationFrame(scrollRAF);
|
||||
if (visibleRangeRAF) cancelAnimationFrame(visibleRangeRAF);
|
||||
if (containerResizeRAF) cancelAnimationFrame(containerResizeRAF);
|
||||
});
|
||||
|
||||
// Set context for child components
|
||||
@@ -440,15 +495,47 @@
|
||||
highlightedKey
|
||||
});
|
||||
|
||||
// Helper to get row state
|
||||
// Row state cache to prevent creating new objects on every scroll
|
||||
// Use $derived to track dependencies synchronously (unlike $effect which is async)
|
||||
let rowStateCache = new WeakMap<object, DataGridRowState>();
|
||||
|
||||
// Track cache invalidation keys - when these change, cache is stale
|
||||
let cachedSelectedKeysRef: Set<unknown> | null = null;
|
||||
let cachedExpandedKeysRef: Set<unknown> | null = null;
|
||||
let cachedHighlightedKeyRef: unknown = undefined;
|
||||
|
||||
// Helper to get row state (memoized via WeakMap)
|
||||
// Cache is invalidated synchronously when selection/expansion changes
|
||||
function getRowState(item: T, index: number): DataGridRowState {
|
||||
return {
|
||||
const actualIndex = virtualScroll ? startIndex + index : index;
|
||||
|
||||
// Check if cache needs to be cleared (synchronous check)
|
||||
if (selectedKeys !== cachedSelectedKeysRef ||
|
||||
expandedKeys !== cachedExpandedKeysRef ||
|
||||
highlightedKey !== cachedHighlightedKeyRef) {
|
||||
rowStateCache = new WeakMap();
|
||||
cachedSelectedKeysRef = selectedKeys;
|
||||
cachedExpandedKeysRef = expandedKeys;
|
||||
cachedHighlightedKeyRef = highlightedKey;
|
||||
}
|
||||
|
||||
// Try to get cached state
|
||||
const cached = rowStateCache.get(item as object);
|
||||
if (cached && cached.index === actualIndex) {
|
||||
return cached;
|
||||
}
|
||||
|
||||
// Create new state object and cache it
|
||||
const state: DataGridRowState = {
|
||||
isSelected: isSelected(item[keyField]),
|
||||
isHighlighted: highlightedKey === item[keyField],
|
||||
isSelectable: isItemSelectable(item),
|
||||
isExpanded: isExpanded(item[keyField]),
|
||||
index: virtualScroll ? startIndex + index : index
|
||||
index: actualIndex
|
||||
};
|
||||
|
||||
rowStateCache.set(item as object, state);
|
||||
return state;
|
||||
}
|
||||
|
||||
// Helper to check if column is resizable
|
||||
@@ -672,7 +759,7 @@
|
||||
e.stopPropagation();
|
||||
toggleSelection(item[keyField]);
|
||||
}}
|
||||
class="flex items-center justify-center transition-colors cursor-pointer {rowState.isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-40 hover:!opacity-100'}"
|
||||
class="flex items-center justify-center w-full h-full min-h-[24px] transition-colors cursor-pointer {rowState.isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-40 hover:!opacity-100'}"
|
||||
>
|
||||
{#if rowState.isSelected}
|
||||
<CheckSquare class="w-3.5 h-3.5 text-muted-foreground" />
|
||||
@@ -781,7 +868,7 @@
|
||||
<button
|
||||
type="button"
|
||||
onclick={(e) => { e.stopPropagation(); toggleSelection(item[keyField]); }}
|
||||
class="flex items-center justify-center transition-colors cursor-pointer {rowState.isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-40 hover:!opacity-100'}"
|
||||
class="flex items-center justify-center w-full h-full min-h-[24px] transition-colors cursor-pointer {rowState.isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-40 hover:!opacity-100'}"
|
||||
>
|
||||
{#if rowState.isSelected}
|
||||
<CheckSquare class="w-3.5 h-3.5 text-muted-foreground" />
|
||||
@@ -841,6 +928,10 @@
|
||||
{#if totalHeight - offsetY - (visibleData.length * rowHeight) > 0}
|
||||
<tr><td colspan={fixedStartCols.length + orderedColumns.length + fixedEndCols.length} style="height: {totalHeight - offsetY - (visibleData.length * rowHeight)}px; padding: 0; border: none;"></td></tr>
|
||||
{/if}
|
||||
<!-- Footer (rendered at the bottom of virtual scroll) -->
|
||||
{#if footer}
|
||||
<tr><td colspan={fixedStartCols.length + orderedColumns.length + fixedEndCols.length} class="p-0 border-none">{@render footer()}</td></tr>
|
||||
{/if}
|
||||
</tbody>
|
||||
</table>
|
||||
{:else}
|
||||
|
||||
@@ -37,7 +37,7 @@
|
||||
<CurrentIcon class="h-4 w-4" />
|
||||
</Button>
|
||||
</Popover.Trigger>
|
||||
<Popover.Content class="w-80 p-3" align="start">
|
||||
<Popover.Content class="w-80 p-3 z-[200]" align="start">
|
||||
<div class="space-y-3">
|
||||
<Input
|
||||
bind:value={searchQuery}
|
||||
|
||||
@@ -62,7 +62,7 @@
|
||||
<span class="text-xs">{placeholder}</span>
|
||||
{/if}
|
||||
</Popover.Trigger>
|
||||
<Popover.Content class="w-auto p-0" align="start">
|
||||
<Popover.Content class="w-auto p-0 z-[200]" align="start">
|
||||
<Calendar
|
||||
type="single"
|
||||
value={dateValue}
|
||||
|
||||
@@ -27,7 +27,7 @@
|
||||
bind:ref
|
||||
data-slot="dialog-content"
|
||||
class={cn(
|
||||
"bg-background fixed start-[50%] top-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg",
|
||||
"bg-background fixed start-[50%] top-[50%] z-[150] grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg",
|
||||
!className?.includes('max-w-') && "sm:max-w-lg",
|
||||
className
|
||||
)}
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
bind:ref
|
||||
data-slot="dialog-overlay"
|
||||
class={cn(
|
||||
"data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
|
||||
"data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-[150] bg-black/50",
|
||||
className
|
||||
)}
|
||||
{...restProps}
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
data-slot="dropdown-menu-content"
|
||||
{sideOffset}
|
||||
class={cn(
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 max-h-(--bits-dropdown-menu-content-available-height) origin-(--bits-dropdown-menu-content-transform-origin) z-50 min-w-[8rem] overflow-y-auto overflow-x-hidden rounded-md border p-1 shadow-md outline-none",
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 max-h-(--bits-dropdown-menu-content-available-height) origin-(--bits-dropdown-menu-content-transform-origin) z-[200] min-w-[8rem] overflow-y-auto overflow-x-hidden rounded-md border p-1 shadow-md outline-none",
|
||||
className
|
||||
)}
|
||||
{...restProps}
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
bind:ref
|
||||
data-slot="dropdown-menu-sub-content"
|
||||
class={cn(
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 origin-(--bits-dropdown-menu-content-transform-origin) z-50 min-w-[8rem] overflow-hidden rounded-md border p-1 shadow-lg",
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 origin-(--bits-dropdown-menu-content-transform-origin) z-[200] min-w-[8rem] overflow-hidden rounded-md border p-1 shadow-lg",
|
||||
className
|
||||
)}
|
||||
{...restProps}
|
||||
|
||||
@@ -0,0 +1,183 @@
|
||||
<script lang="ts">
|
||||
import * as Dialog from '$lib/components/ui/dialog';
|
||||
import { Button } from '$lib/components/ui/button';
|
||||
import { AlertCircle, Copy, Check, AlertTriangle, CheckCircle2, XCircle } from 'lucide-svelte';
|
||||
|
||||
interface Props {
|
||||
open: boolean;
|
||||
title: string;
|
||||
message: string;
|
||||
details?: string;
|
||||
onClose: () => void;
|
||||
}
|
||||
|
||||
let { open = $bindable(), title, message, details, onClose }: Props = $props();
|
||||
let copied = $state(false);
|
||||
|
||||
interface ParsedOutput {
|
||||
warnings: string[];
|
||||
steps: { action: string; status: 'creating' | 'created' | 'starting' | 'started' | 'error' }[];
|
||||
error: string | null;
|
||||
raw: string;
|
||||
parsed: boolean;
|
||||
}
|
||||
|
||||
// Parse docker compose output into structured format
|
||||
function parseDockerOutput(text: string): ParsedOutput {
|
||||
const result: ParsedOutput = {
|
||||
warnings: [],
|
||||
steps: [],
|
||||
error: null,
|
||||
raw: text,
|
||||
parsed: false
|
||||
};
|
||||
|
||||
try {
|
||||
const lines = text.split('\n').map(l => l.trim()).filter(Boolean);
|
||||
|
||||
for (const line of lines) {
|
||||
// Parse time="..." level=warning msg="..."
|
||||
const warningMatch = line.match(/time="[^"]*"\s+level=warning\s+msg="([^"]+)"/);
|
||||
if (warningMatch) {
|
||||
result.warnings.push(warningMatch[1]);
|
||||
result.parsed = true;
|
||||
continue;
|
||||
}
|
||||
|
||||
// Parse container/network steps: "Network foo Creating" or "Container foo-1 Created"
|
||||
const stepMatch = line.match(/^\s*(Network|Container|Volume)\s+(\S+)\s+(Creating|Created|Starting|Started|Stopping|Stopped|Removing|Removed)\s*$/i);
|
||||
if (stepMatch) {
|
||||
const [, type, name, status] = stepMatch;
|
||||
const normalizedStatus = status.toLowerCase() as any;
|
||||
result.steps.push({
|
||||
action: `${type} ${name}`,
|
||||
status: normalizedStatus
|
||||
});
|
||||
result.parsed = true;
|
||||
continue;
|
||||
}
|
||||
|
||||
// Parse error lines
|
||||
if (line.startsWith('Error') || line.includes('error') || line.includes('failed')) {
|
||||
result.error = result.error ? `${result.error}\n${line}` : line;
|
||||
result.parsed = true;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
// If we parsed something but have no clear error, check for remaining unparsed content
|
||||
if (result.parsed && !result.error) {
|
||||
const unparsed = lines.filter(line => {
|
||||
if (line.match(/time="[^"]*"\s+level=warning/)) return false;
|
||||
if (line.match(/^\s*(Network|Container|Volume)\s+\S+\s+(Creating|Created|Starting|Started|Stopping|Stopped|Removing|Removed)\s*$/i)) return false;
|
||||
return true;
|
||||
});
|
||||
if (unparsed.length > 0) {
|
||||
result.error = unparsed.join('\n');
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
// Parsing failed, will show raw message
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
const parsed = $derived(parseDockerOutput(message));
|
||||
|
||||
async function copyError() {
|
||||
const text = details ? `${message}\n\n${details}` : message;
|
||||
await navigator.clipboard.writeText(text);
|
||||
copied = true;
|
||||
setTimeout(() => (copied = false), 2000);
|
||||
}
|
||||
|
||||
function handleClose() {
|
||||
open = false;
|
||||
onClose();
|
||||
}
|
||||
</script>
|
||||
|
||||
<Dialog.Root bind:open onOpenChange={(o) => !o && handleClose()}>
|
||||
<Dialog.Content class="max-w-2xl">
|
||||
<Dialog.Header>
|
||||
<Dialog.Title class="flex items-center gap-2 text-destructive">
|
||||
<AlertCircle class="w-5 h-5" />
|
||||
{title}
|
||||
</Dialog.Title>
|
||||
</Dialog.Header>
|
||||
<div class="space-y-3 max-h-[60vh] overflow-y-auto">
|
||||
{#if parsed.parsed}
|
||||
<!-- Parsed docker compose output -->
|
||||
{#if parsed.warnings.length > 0}
|
||||
<div class="space-y-1">
|
||||
{#each parsed.warnings as warning}
|
||||
<div class="flex items-start gap-2 text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800/50 px-2.5 py-1.5 rounded-md">
|
||||
<AlertTriangle class="w-3.5 h-3.5 shrink-0 mt-0.5" />
|
||||
<span>{warning}</span>
|
||||
</div>
|
||||
{/each}
|
||||
</div>
|
||||
{/if}
|
||||
|
||||
{#if parsed.steps.length > 0}
|
||||
<div class="bg-zinc-100 dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-md p-2.5 space-y-1">
|
||||
{#each parsed.steps as step}
|
||||
<div class="flex items-center gap-2 text-xs font-mono">
|
||||
{#if step.status === 'created' || step.status === 'started' || step.status === 'removed' || step.status === 'stopped'}
|
||||
<CheckCircle2 class="w-3.5 h-3.5 text-green-500" />
|
||||
{:else if step.status === 'error'}
|
||||
<XCircle class="w-3.5 h-3.5 text-red-500" />
|
||||
{:else}
|
||||
<div class="w-3.5 h-3.5 rounded-full border-2 border-zinc-400"></div>
|
||||
{/if}
|
||||
<span class="text-zinc-600 dark:text-zinc-300">{step.action}</span>
|
||||
<span class="text-zinc-400 dark:text-zinc-500 capitalize">{step.status}</span>
|
||||
</div>
|
||||
{/each}
|
||||
</div>
|
||||
{/if}
|
||||
|
||||
{#if parsed.error}
|
||||
<div class="bg-zinc-100 dark:bg-zinc-800 border border-zinc-200 dark:border-zinc-700 rounded-md p-3 relative group">
|
||||
<button
|
||||
onclick={copyError}
|
||||
class="absolute top-2 right-2 p-1 rounded text-zinc-400 hover:text-zinc-600 dark:text-zinc-500 dark:hover:text-zinc-300 hover:bg-zinc-200 dark:hover:bg-zinc-700 transition-opacity"
|
||||
title="Copy error"
|
||||
>
|
||||
{#if copied}
|
||||
<Check class="w-3.5 h-3.5" />
|
||||
{:else}
|
||||
<Copy class="w-3.5 h-3.5" />
|
||||
{/if}
|
||||
</button>
|
||||
<pre class="text-sm text-zinc-700 dark:text-zinc-300 whitespace-pre-wrap break-words font-mono pr-6">{parsed.error}</pre>
|
||||
</div>
|
||||
{/if}
|
||||
{:else}
|
||||
<!-- Fallback to raw message -->
|
||||
<div class="relative group">
|
||||
<button
|
||||
onclick={copyError}
|
||||
class="absolute top-1 right-1 p-1 rounded text-zinc-400 hover:text-zinc-600 dark:text-zinc-500 dark:hover:text-zinc-300 hover:bg-zinc-100 dark:hover:bg-zinc-700 opacity-0 group-hover:opacity-100 transition-opacity"
|
||||
title="Copy error"
|
||||
>
|
||||
{#if copied}
|
||||
<Check class="w-3.5 h-3.5" />
|
||||
{:else}
|
||||
<Copy class="w-3.5 h-3.5" />
|
||||
{/if}
|
||||
</button>
|
||||
<pre class="text-sm whitespace-pre-wrap font-sans pr-6">{message}</pre>
|
||||
</div>
|
||||
{/if}
|
||||
|
||||
{#if details}
|
||||
<pre class="text-xs bg-zinc-100 dark:bg-zinc-800 p-3 rounded-md overflow-auto max-h-64 whitespace-pre-wrap break-all">{details}</pre>
|
||||
{/if}
|
||||
</div>
|
||||
<Dialog.Footer class="flex gap-2 sm:justify-end">
|
||||
<Button onclick={handleClose}>OK</Button>
|
||||
</Dialog.Footer>
|
||||
</Dialog.Content>
|
||||
</Dialog.Root>
|
||||
@@ -0,0 +1,3 @@
|
||||
import ErrorDialog from './error-dialog.svelte';
|
||||
|
||||
export { ErrorDialog };
|
||||
@@ -21,7 +21,7 @@
|
||||
{sideOffset}
|
||||
{align}
|
||||
class={cn(
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 origin-(--bits-popover-content-transform-origin) outline-hidden z-50 w-72 rounded-md border p-4 shadow-md",
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 origin-(--bits-popover-content-transform-origin) outline-hidden z-[200] w-72 rounded-md border p-4 shadow-md",
|
||||
className
|
||||
)}
|
||||
{...restProps}
|
||||
|
||||
@@ -24,7 +24,7 @@
|
||||
{preventScroll}
|
||||
data-slot="select-content"
|
||||
class={cn(
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 max-h-(--bits-select-content-available-height) origin-(--bits-select-content-transform-origin) relative z-50 min-w-[8rem] overflow-y-auto overflow-x-hidden rounded-md border shadow-md data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
|
||||
"bg-popover text-popover-foreground data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 max-h-(--bits-select-content-available-height) origin-(--bits-select-content-transform-origin) relative z-[200] min-w-[8rem] overflow-y-auto overflow-x-hidden rounded-md border shadow-md data-[side=bottom]:translate-y-1 data-[side=left]:-translate-x-1 data-[side=right]:translate-x-1 data-[side=top]:-translate-y-1",
|
||||
className
|
||||
)}
|
||||
{...restProps}
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
{sideOffset}
|
||||
{side}
|
||||
class={cn(
|
||||
"bg-popover text-popover-foreground border shadow-lg animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 origin-(--bits-tooltip-content-transform-origin) z-[100] w-fit fixed text-balance rounded-md px-3 py-1.5 text-xs",
|
||||
"bg-popover text-popover-foreground border shadow-lg animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-end-2 data-[side=right]:slide-in-from-start-2 data-[side=top]:slide-in-from-bottom-2 origin-(--bits-tooltip-content-transform-origin) z-[200] w-fit fixed text-balance rounded-md px-3 py-1.5 text-xs",
|
||||
className
|
||||
)}
|
||||
{...restProps}
|
||||
|
||||
@@ -37,7 +37,8 @@ export const imageTagColumns: ColumnConfig[] = [
|
||||
{ id: 'id', label: 'ID', width: 120, minWidth: 80 },
|
||||
{ id: 'size', label: 'Size', width: 80, minWidth: 60 },
|
||||
{ id: 'created', label: 'Created', width: 140, minWidth: 100 },
|
||||
{ id: 'actions', label: '', fixed: 'end', width: 100, resizable: false }
|
||||
{ id: 'used', label: 'Used by', width: 100, minWidth: 70 },
|
||||
{ id: 'actions', label: '', fixed: 'end', width: 200, resizable: false }
|
||||
];
|
||||
|
||||
// Network grid columns
|
||||
@@ -58,7 +59,8 @@ export const stackColumns: ColumnConfig[] = [
|
||||
{ id: 'expand', label: '', fixed: 'start', width: 24, resizable: false },
|
||||
{ id: 'name', label: 'Name', sortable: true, sortField: 'name', width: 180, minWidth: 100, grow: true },
|
||||
{ id: 'status', label: 'Status', sortable: true, sortField: 'status', width: 120, minWidth: 90 },
|
||||
{ id: 'source', label: 'Source', width: 100, minWidth: 60 },
|
||||
{ id: 'source', label: 'Source', width: 100, minWidth: 100, noTruncate: true },
|
||||
{ id: 'location', label: 'Location', width: 180, minWidth: 100 },
|
||||
{ id: 'containers', label: 'Containers', sortable: true, sortField: 'containers', width: 100, minWidth: 70 },
|
||||
{ id: 'cpu', label: 'CPU', sortable: true, sortField: 'cpu', width: 60, minWidth: 50, align: 'right' },
|
||||
{ id: 'memory', label: 'Memory', sortable: true, sortField: 'memory', width: 70, minWidth: 50, align: 'right' },
|
||||
|
||||
@@ -1,13 +1,61 @@
|
||||
[
|
||||
{
|
||||
"version": "1.0.8",
|
||||
"date": "2026-01-13",
|
||||
"changes": [
|
||||
{ "type": "fix", "text": "Fix imported stack working directory for relative volume paths" },
|
||||
{ "type": "fix", "text": "Fix environment refresh after auth login" },
|
||||
{ "type": "fix", "text": "Fix single container update clearing up all update badges" },
|
||||
{ "type": "fix", "text": "Fix code editor paste issue on Safari on iPad" },
|
||||
{ "type": "fix", "text": "Fix registry login failing due to Bun stdin API incompatibility" },
|
||||
{ "type": "fix", "text": "Fix env var editor focus issues" },
|
||||
{ "type": "fix", "text": "Fix git stack naming issues: validation, rename sync, and delete cleanup" }
|
||||
],
|
||||
"imageTag": "fnsys/dockhand:v1.0.8"
|
||||
},
|
||||
{
|
||||
"version": "1.0.7",
|
||||
"date": "2026-01-06",
|
||||
"comingSoon": false,
|
||||
"changes": [
|
||||
{ "type": "feature", "text": "Adopt stacks created outside Dockhand" },
|
||||
{ "type": "feature", "text": "Activity event collection mode (Stream/Poll) and metrics interval settings for reduced CPU usage" },
|
||||
{ "type": "feature", "text": "Baseline Docker images for CPUs without AVX support" },
|
||||
{ "type": "feature", "text": "Show amber \"Unused\" badge for images not used by any container" },
|
||||
{ "type": "feature", "text": "Prune unused button to remove all unused images (not just dangling)" },
|
||||
{ "type": "fix", "text": "Stack collision on disk - stacks are now saved in environment folders" },
|
||||
{ "type": "fix", "text": "Checkbox selection delay in datagrid" },
|
||||
{ "type": "fix", "text": "Crypto fallback for old Linux kernels (<3.17) that lack getrandom() syscall" },
|
||||
{ "type": "fix", "text": "Dashboard performance with many environments" },
|
||||
{ "type": "fix", "text": "Can't use authenticated custom registry"},
|
||||
{ "type": "fix", "text": "mTLS connections failing due to Bun TLS caching bug"}
|
||||
],
|
||||
"imageTag": "fnsys/dockhand:v1.0.7"
|
||||
},
|
||||
{
|
||||
"version": "1.0.6",
|
||||
"date": "2026-01-03",
|
||||
"changes": [
|
||||
{ "type": "fix", "text": "Legacy CPU support (Celeron, Atom) - Bun binary now copied from official image instead of Wolfi package" },
|
||||
{ "type": "fix", "text": "Stack modal layouts improved with resizable split panels" },
|
||||
{ "type": "fix", "text": "Missing column headers in images overview" }
|
||||
],
|
||||
"imageTag": "fnsys/dockhand:v1.0.6"
|
||||
},
|
||||
{
|
||||
"version": "1.0.5",
|
||||
"date": "2026-01-01",
|
||||
"changes": [
|
||||
{ "type": "feature", "text": "Custom hardened image built from scratch using Wolfi packages, eliminating Alpine vulnerabilities" },
|
||||
{ "type": "feature", "text": "Clicking container name opens container details" },
|
||||
{ "type": "feature", "text": "Clicking stack name opens stack editor (internal stacks)" },
|
||||
{ "type": "feature", "text": "Stack env editor now supports freestyle text entry for pasting env contents" },
|
||||
{ "type": "feature", "text": "Stack env vars saved as .env file next to compose, respecting external edits" },
|
||||
{ "type": "feature", "text": "Additional container options: ulimits, security options, DNS settings" },
|
||||
{ "type": "fix", "text": "DataGrid performance and memory leak on Activity page with thousands of rows" },
|
||||
{ "type": "fix", "text": "Webhook endpoints bypass session authentication when auth is enabled" },
|
||||
{ "type": "fix", "text": "PUID 1000 conflict with existing dockhand user in container" },
|
||||
{ "type": "fix", "text": "Gmail SMTP notification errors" },
|
||||
{ "type": "fix", "text": "More detailed error messages when stack fails to start" },
|
||||
{ "type": "fix", "text": "Container startup with user: directive in compose" },
|
||||
{ "type": "fix", "text": "Stack editor flickering when typing fast" },
|
||||
|
||||
+44
-278
@@ -11,6 +11,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/commands"
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/commands",
|
||||
"version": "6.10.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/commands"
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/lang-css",
|
||||
"version": "6.3.1",
|
||||
@@ -59,9 +65,15 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/lang-xml"
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/lang-yaml",
|
||||
"version": "6.1.2",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/lang-yaml"
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/language",
|
||||
"version": "6.11.3",
|
||||
"version": "6.12.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/language"
|
||||
},
|
||||
@@ -79,13 +91,19 @@
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/state",
|
||||
"version": "6.5.2",
|
||||
"version": "6.5.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/state"
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/theme-one-dark",
|
||||
"version": "6.1.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/theme-one-dark"
|
||||
},
|
||||
{
|
||||
"name": "@codemirror/view",
|
||||
"version": "6.38.8",
|
||||
"version": "6.39.9",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/view"
|
||||
},
|
||||
@@ -121,7 +139,7 @@
|
||||
},
|
||||
{
|
||||
"name": "@lezer/common",
|
||||
"version": "1.4.0",
|
||||
"version": "1.5.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/lezer-parser/common"
|
||||
},
|
||||
@@ -179,6 +197,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/lezer-parser/xml"
|
||||
},
|
||||
{
|
||||
"name": "@lezer/yaml",
|
||||
"version": "1.0.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/lezer-parser/yaml"
|
||||
},
|
||||
{
|
||||
"name": "@lucide/lab",
|
||||
"version": "0.1.2",
|
||||
@@ -203,18 +227,6 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sveltejs/acorn-typescript"
|
||||
},
|
||||
{
|
||||
"name": "@types/asn1",
|
||||
"version": "0.2.4",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/DefinitelyTyped/DefinitelyTyped"
|
||||
},
|
||||
{
|
||||
"name": "@types/better-sqlite3",
|
||||
"version": "7.6.13",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/DefinitelyTyped/DefinitelyTyped"
|
||||
},
|
||||
{
|
||||
"name": "@types/estree",
|
||||
"version": "1.0.8",
|
||||
@@ -257,51 +269,15 @@
|
||||
"license": "Apache-2.0",
|
||||
"repository": "https://github.com/A11yance/aria-query"
|
||||
},
|
||||
{
|
||||
"name": "asn1",
|
||||
"version": "0.2.6",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/joyent/node-asn1"
|
||||
},
|
||||
{
|
||||
"name": "axobject-query",
|
||||
"version": "4.1.0",
|
||||
"license": "Apache-2.0",
|
||||
"repository": "https://github.com/A11yance/axobject-query"
|
||||
},
|
||||
{
|
||||
"name": "base64-js",
|
||||
"version": "1.5.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/beatgammit/base64-js"
|
||||
},
|
||||
{
|
||||
"name": "better-sqlite3",
|
||||
"version": "12.5.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/WiseLibs/better-sqlite3"
|
||||
},
|
||||
{
|
||||
"name": "bindings",
|
||||
"version": "1.5.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/TooTallNate/node-bindings"
|
||||
},
|
||||
{
|
||||
"name": "bl",
|
||||
"version": "4.1.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/rvagg/bl"
|
||||
},
|
||||
{
|
||||
"name": "buffer",
|
||||
"version": "5.7.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/feross/buffer"
|
||||
},
|
||||
{
|
||||
"name": "bun-types",
|
||||
"version": "1.3.3",
|
||||
"version": "1.3.5",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/oven-sh/bun"
|
||||
},
|
||||
@@ -311,12 +287,6 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/camelcase"
|
||||
},
|
||||
{
|
||||
"name": "chownr",
|
||||
"version": "1.1.4",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/isaacs/chownr"
|
||||
},
|
||||
{
|
||||
"name": "cliui",
|
||||
"version": "6.0.0",
|
||||
@@ -329,6 +299,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/lukeed/clsx"
|
||||
},
|
||||
{
|
||||
"name": "codemirror",
|
||||
"version": "6.0.2",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/codemirror/basic-setup"
|
||||
},
|
||||
{
|
||||
"name": "color-convert",
|
||||
"version": "2.0.1",
|
||||
@@ -359,36 +335,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/bradymholt/cronstrue"
|
||||
},
|
||||
{
|
||||
"name": "debug",
|
||||
"version": "4.4.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/debug-js/debug"
|
||||
},
|
||||
{
|
||||
"name": "decamelize",
|
||||
"version": "1.2.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/decamelize"
|
||||
},
|
||||
{
|
||||
"name": "decompress-response",
|
||||
"version": "6.0.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/decompress-response"
|
||||
},
|
||||
{
|
||||
"name": "deep-extend",
|
||||
"version": "0.6.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/unclechu/node-deep-extend"
|
||||
},
|
||||
{
|
||||
"name": "detect-libc",
|
||||
"version": "2.1.2",
|
||||
"license": "Apache-2.0",
|
||||
"repository": "https://github.com/lovell/detect-libc"
|
||||
},
|
||||
{
|
||||
"name": "devalue",
|
||||
"version": "5.5.0",
|
||||
@@ -409,7 +361,7 @@
|
||||
},
|
||||
{
|
||||
"name": "drizzle-orm",
|
||||
"version": "0.45.0",
|
||||
"version": "0.45.1",
|
||||
"license": "Apache-2.0",
|
||||
"repository": "https://github.com/drizzle-team/drizzle-orm"
|
||||
},
|
||||
@@ -419,12 +371,6 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mathiasbynens/emoji-regex"
|
||||
},
|
||||
{
|
||||
"name": "end-of-stream",
|
||||
"version": "1.4.5",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mafintosh/end-of-stream"
|
||||
},
|
||||
{
|
||||
"name": "esm-env",
|
||||
"version": "1.2.2",
|
||||
@@ -437,30 +383,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sveltejs/esrap"
|
||||
},
|
||||
{
|
||||
"name": "expand-template",
|
||||
"version": "2.0.3",
|
||||
"license": "(MIT OR WTFPL)",
|
||||
"repository": "https://github.com/ralphtheninja/expand-template"
|
||||
},
|
||||
{
|
||||
"name": "file-uri-to-path",
|
||||
"version": "1.0.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/TooTallNate/file-uri-to-path"
|
||||
},
|
||||
{
|
||||
"name": "find-up",
|
||||
"version": "4.1.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/find-up"
|
||||
},
|
||||
{
|
||||
"name": "fs-constants",
|
||||
"version": "1.0.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mafintosh/fs-constants"
|
||||
},
|
||||
{
|
||||
"name": "get-caller-file",
|
||||
"version": "2.0.5",
|
||||
@@ -468,28 +396,10 @@
|
||||
"repository": "https://github.com/stefanpenner/get-caller-file"
|
||||
},
|
||||
{
|
||||
"name": "github-from-package",
|
||||
"version": "0.0.0",
|
||||
"name": "hash-wasm",
|
||||
"version": "4.12.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/substack/github-from-package"
|
||||
},
|
||||
{
|
||||
"name": "ieee754",
|
||||
"version": "1.2.1",
|
||||
"license": "BSD-3-Clause",
|
||||
"repository": "https://github.com/feross/ieee754"
|
||||
},
|
||||
{
|
||||
"name": "inherits",
|
||||
"version": "2.0.4",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/isaacs/inherits"
|
||||
},
|
||||
{
|
||||
"name": "ini",
|
||||
"version": "1.3.8",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/isaacs/ini"
|
||||
"repository": "https://github.com/Daninet/hash-wasm"
|
||||
},
|
||||
{
|
||||
"name": "is-fullwidth-code-point",
|
||||
@@ -511,7 +421,7 @@
|
||||
},
|
||||
{
|
||||
"name": "ldapts",
|
||||
"version": "8.0.12",
|
||||
"version": "8.1.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/ldapts/ldapts"
|
||||
},
|
||||
@@ -533,54 +443,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/Rich-Harris/magic-string"
|
||||
},
|
||||
{
|
||||
"name": "mimic-response",
|
||||
"version": "3.1.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/mimic-response"
|
||||
},
|
||||
{
|
||||
"name": "minimist",
|
||||
"version": "1.2.8",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/minimistjs/minimist"
|
||||
},
|
||||
{
|
||||
"name": "mkdirp-classic",
|
||||
"version": "0.5.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mafintosh/mkdirp-classic"
|
||||
},
|
||||
{
|
||||
"name": "ms",
|
||||
"version": "2.1.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/vercel/ms"
|
||||
},
|
||||
{
|
||||
"name": "napi-build-utils",
|
||||
"version": "2.0.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/inspiredware/napi-build-utils"
|
||||
},
|
||||
{
|
||||
"name": "node-abi",
|
||||
"version": "3.85.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/electron/node-abi"
|
||||
},
|
||||
{
|
||||
"name": "nodemailer",
|
||||
"version": "7.0.11",
|
||||
"version": "7.0.12",
|
||||
"license": "MIT-0",
|
||||
"repository": "https://github.com/nodemailer/nodemailer"
|
||||
},
|
||||
{
|
||||
"name": "once",
|
||||
"version": "1.4.0",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/isaacs/once"
|
||||
},
|
||||
{
|
||||
"name": "otpauth",
|
||||
"version": "9.4.1",
|
||||
@@ -619,22 +487,10 @@
|
||||
},
|
||||
{
|
||||
"name": "postgres",
|
||||
"version": "3.4.7",
|
||||
"version": "3.4.8",
|
||||
"license": "Unlicense",
|
||||
"repository": "https://github.com/porsager/postgres"
|
||||
},
|
||||
{
|
||||
"name": "prebuild-install",
|
||||
"version": "7.1.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/prebuild/prebuild-install"
|
||||
},
|
||||
{
|
||||
"name": "pump",
|
||||
"version": "3.0.3",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mafintosh/pump"
|
||||
},
|
||||
{
|
||||
"name": "punycode",
|
||||
"version": "2.3.1",
|
||||
@@ -647,18 +503,6 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/soldair/node-qrcode"
|
||||
},
|
||||
{
|
||||
"name": "rc",
|
||||
"version": "1.2.8",
|
||||
"license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
|
||||
"repository": "https://github.com/dominictarr/rc"
|
||||
},
|
||||
{
|
||||
"name": "readable-stream",
|
||||
"version": "3.6.2",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/nodejs/readable-stream"
|
||||
},
|
||||
{
|
||||
"name": "require-directory",
|
||||
"version": "2.1.1",
|
||||
@@ -677,42 +521,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/svecosystem/runed"
|
||||
},
|
||||
{
|
||||
"name": "safe-buffer",
|
||||
"version": "5.2.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/feross/safe-buffer"
|
||||
},
|
||||
{
|
||||
"name": "safer-buffer",
|
||||
"version": "2.1.2",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/ChALkeR/safer-buffer"
|
||||
},
|
||||
{
|
||||
"name": "semver",
|
||||
"version": "7.7.3",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/npm/node-semver"
|
||||
},
|
||||
{
|
||||
"name": "set-blocking",
|
||||
"version": "2.0.0",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/yargs/set-blocking"
|
||||
},
|
||||
{
|
||||
"name": "simple-concat",
|
||||
"version": "1.0.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/feross/simple-concat"
|
||||
},
|
||||
{
|
||||
"name": "simple-get",
|
||||
"version": "4.0.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/feross/simple-get"
|
||||
},
|
||||
{
|
||||
"name": "strict-event-emitter-types",
|
||||
"version": "2.0.0",
|
||||
@@ -725,24 +539,12 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/string-width"
|
||||
},
|
||||
{
|
||||
"name": "string_decoder",
|
||||
"version": "1.3.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/nodejs/string_decoder"
|
||||
},
|
||||
{
|
||||
"name": "strip-ansi",
|
||||
"version": "6.0.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/chalk/strip-ansi"
|
||||
},
|
||||
{
|
||||
"name": "strip-json-comments",
|
||||
"version": "2.0.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sindresorhus/strip-json-comments"
|
||||
},
|
||||
{
|
||||
"name": "style-mod",
|
||||
"version": "4.1.3",
|
||||
@@ -751,13 +553,13 @@
|
||||
},
|
||||
{
|
||||
"name": "svelte",
|
||||
"version": "5.45.5",
|
||||
"version": "5.46.1",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/sveltejs/svelte"
|
||||
},
|
||||
{
|
||||
"name": "svelte-dnd-action",
|
||||
"version": "0.9.68",
|
||||
"version": "0.9.69",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/isaacHagoel/svelte-dnd-action"
|
||||
},
|
||||
@@ -767,48 +569,18 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/wobsoriano/svelte-sonner"
|
||||
},
|
||||
{
|
||||
"name": "tar-fs",
|
||||
"version": "2.1.4",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mafintosh/tar-fs"
|
||||
},
|
||||
{
|
||||
"name": "tar-stream",
|
||||
"version": "2.2.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/mafintosh/tar-stream"
|
||||
},
|
||||
{
|
||||
"name": "tr46",
|
||||
"version": "6.0.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/jsdom/tr46"
|
||||
},
|
||||
{
|
||||
"name": "tunnel-agent",
|
||||
"version": "0.6.0",
|
||||
"license": "Apache-2.0",
|
||||
"repository": "https://github.com/mikeal/tunnel-agent"
|
||||
},
|
||||
{
|
||||
"name": "undici-types",
|
||||
"version": "7.16.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/nodejs/undici"
|
||||
},
|
||||
{
|
||||
"name": "util-deprecate",
|
||||
"version": "1.0.2",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/TooTallNate/util-deprecate"
|
||||
},
|
||||
{
|
||||
"name": "uuid",
|
||||
"version": "13.0.0",
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/uuidjs/uuid"
|
||||
},
|
||||
{
|
||||
"name": "w3c-keyname",
|
||||
"version": "2.2.8",
|
||||
@@ -839,12 +611,6 @@
|
||||
"license": "MIT",
|
||||
"repository": "https://github.com/chalk/wrap-ansi"
|
||||
},
|
||||
{
|
||||
"name": "wrappy",
|
||||
"version": "1.0.2",
|
||||
"license": "ISC",
|
||||
"repository": "https://github.com/npm/wrappy"
|
||||
},
|
||||
{
|
||||
"name": "y18n",
|
||||
"version": "4.0.3",
|
||||
|
||||
+46
-10
@@ -9,8 +9,9 @@
|
||||
* - SameSite=Strict (CSRF protection)
|
||||
*/
|
||||
|
||||
import { randomBytes } from 'node:crypto';
|
||||
import os from 'node:os';
|
||||
import { secureRandomBytes, usingFallback } from './crypto-fallback';
|
||||
import { argon2id, argon2Verify } from 'hash-wasm';
|
||||
import type { Cookies } from '@sveltejs/kit';
|
||||
import {
|
||||
getAuthSettings,
|
||||
@@ -94,27 +95,62 @@ export interface LoginResult {
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// Password Hashing (Argon2id via Bun.password)
|
||||
// Password Hashing (Argon2id)
|
||||
// ============================================
|
||||
|
||||
// Argon2id parameters (matching Bun.password defaults)
|
||||
const ARGON2_MEMORY_COST = 65536; // 64 MB in kibibytes
|
||||
const ARGON2_TIME_COST = 3; // 3 iterations
|
||||
const ARGON2_PARALLELISM = 1; // Single-threaded
|
||||
const ARGON2_HASH_LENGTH = 32; // 256-bit output
|
||||
const ARGON2_SALT_LENGTH = 16; // 128-bit salt
|
||||
|
||||
/**
|
||||
* Hash a password using Argon2id via Bun's native password API
|
||||
* Hash a password using Argon2id
|
||||
*
|
||||
* On modern kernels (>=3.17): Uses Bun's native password API (faster)
|
||||
* On old kernels (<3.17): Uses hash-wasm (WASM-based, no getrandom dependency)
|
||||
*
|
||||
* Argon2id is the recommended variant - resistant to both side-channel and GPU attacks
|
||||
*/
|
||||
export async function hashPassword(password: string): Promise<string> {
|
||||
// On old kernels, Bun.password.hash() crashes because it internally uses getrandom()
|
||||
// Use hash-wasm as a fallback which is pure WASM and doesn't depend on the syscall
|
||||
if (usingFallback()) {
|
||||
const salt = secureRandomBytes(ARGON2_SALT_LENGTH);
|
||||
return argon2id({
|
||||
password,
|
||||
salt,
|
||||
iterations: ARGON2_TIME_COST,
|
||||
parallelism: ARGON2_PARALLELISM,
|
||||
memorySize: ARGON2_MEMORY_COST,
|
||||
hashLength: ARGON2_HASH_LENGTH,
|
||||
outputType: 'encoded' // Returns PHC format: $argon2id$v=19$m=65536,t=3,p=1$...
|
||||
});
|
||||
}
|
||||
|
||||
// Modern kernels: use Bun's native implementation (faster)
|
||||
return Bun.password.hash(password, {
|
||||
algorithm: 'argon2id',
|
||||
memoryCost: 65536, // 64 MB
|
||||
timeCost: 3 // 3 iterations
|
||||
memoryCost: ARGON2_MEMORY_COST,
|
||||
timeCost: ARGON2_TIME_COST
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Verify a password against a hash
|
||||
* Uses constant-time comparison internally
|
||||
*
|
||||
* Both Bun.password and hash-wasm use the same PHC format, so hashes are compatible
|
||||
*/
|
||||
export async function verifyPassword(password: string, hash: string): Promise<boolean> {
|
||||
try {
|
||||
// On old kernels, use hash-wasm for verification
|
||||
if (usingFallback()) {
|
||||
return await argon2Verify({ password, hash });
|
||||
}
|
||||
|
||||
// Modern kernels: use Bun's native implementation
|
||||
return await Bun.password.verify(password, hash);
|
||||
} catch {
|
||||
return false;
|
||||
@@ -130,7 +166,7 @@ export async function verifyPassword(password: string, hash: string): Promise<bo
|
||||
* 32 bytes = 256 bits of entropy
|
||||
*/
|
||||
function generateSessionToken(): string {
|
||||
return randomBytes(32).toString('base64url');
|
||||
return secureRandomBytes(32).toString('base64url');
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -411,7 +447,7 @@ export async function authenticateLocal(
|
||||
|
||||
if (!user) {
|
||||
// Use constant time to prevent timing attacks
|
||||
await Bun.password.hash('dummy', { algorithm: 'argon2id' });
|
||||
await hashPassword('dummy');
|
||||
return { success: false, error: 'Invalid username or password' };
|
||||
}
|
||||
|
||||
@@ -1127,7 +1163,7 @@ async function getOidcDiscovery(issuerUrl: string): Promise<OidcDiscoveryDocumen
|
||||
* Generate PKCE code verifier and challenge
|
||||
*/
|
||||
function generatePkce(): { codeVerifier: string; codeChallenge: string } {
|
||||
const codeVerifier = randomBytes(32).toString('base64url');
|
||||
const codeVerifier = secureRandomBytes(32).toString('base64url');
|
||||
const hasher = new Bun.CryptoHasher('sha256');
|
||||
hasher.update(codeVerifier);
|
||||
const codeChallenge = hasher.digest('base64url') as string;
|
||||
@@ -1150,8 +1186,8 @@ export async function buildOidcAuthorizationUrl(
|
||||
const discovery = await getOidcDiscovery(config.issuerUrl);
|
||||
|
||||
// Generate state, nonce, and PKCE
|
||||
const state = randomBytes(32).toString('base64url');
|
||||
const nonce = randomBytes(16).toString('base64url');
|
||||
const state = secureRandomBytes(32).toString('base64url');
|
||||
const nonce = secureRandomBytes(16).toString('base64url');
|
||||
const { codeVerifier, codeChallenge } = generatePkce();
|
||||
|
||||
// Store state for callback verification (expires in 10 minutes)
|
||||
|
||||
@@ -0,0 +1,199 @@
|
||||
/**
|
||||
* Crypto Fallback for Old Linux Kernels
|
||||
*
|
||||
* The getrandom() syscall was added in Linux 3.17. On older kernels (like 3.10.x),
|
||||
* Bun's built-in crypto functions will fail with "getrandom() failed to provide entropy".
|
||||
*
|
||||
* This module provides fallback implementations that read from /dev/urandom directly
|
||||
* when running on kernels older than 3.17.
|
||||
*/
|
||||
|
||||
import { existsSync, openSync, readSync, closeSync } from 'node:fs';
|
||||
import os from 'node:os';
|
||||
|
||||
// Cache kernel version check result
|
||||
let needsFallback: boolean | null = null;
|
||||
let fallbackInitialized = false;
|
||||
|
||||
/**
|
||||
* Parse Linux kernel version string (e.g., "3.10.108" -> { major: 3, minor: 10, patch: 108 })
|
||||
*/
|
||||
function parseKernelVersion(release: string): { major: number; minor: number; patch: number } | null {
|
||||
const match = release.match(/^(\d+)\.(\d+)\.(\d+)/);
|
||||
if (!match) return null;
|
||||
return {
|
||||
major: parseInt(match[1], 10),
|
||||
minor: parseInt(match[2], 10),
|
||||
patch: parseInt(match[3], 10)
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if kernel version is older than 3.17 (when getrandom() was added)
|
||||
*/
|
||||
function isOldKernel(): boolean {
|
||||
const release = os.release();
|
||||
const version = parseKernelVersion(release);
|
||||
|
||||
if (!version) {
|
||||
// Can't parse version, assume modern kernel
|
||||
return false;
|
||||
}
|
||||
|
||||
// getrandom() was added in Linux 3.17
|
||||
if (version.major < 3) return true;
|
||||
if (version.major === 3 && version.minor < 17) return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if we're on Linux (only Linux has kernel version concerns)
|
||||
*/
|
||||
function isLinux(): boolean {
|
||||
return os.platform() === 'linux';
|
||||
}
|
||||
|
||||
/**
|
||||
* Determine if we need to use the fallback (cached)
|
||||
*/
|
||||
function checkNeedsFallback(): boolean {
|
||||
if (needsFallback !== null) return needsFallback;
|
||||
|
||||
if (!isLinux()) {
|
||||
needsFallback = false;
|
||||
return false;
|
||||
}
|
||||
|
||||
const oldKernel = isOldKernel();
|
||||
if (oldKernel) {
|
||||
console.log(`[Crypto] Detected old Linux kernel (${os.release()}), using /dev/urandom fallback`);
|
||||
needsFallback = true;
|
||||
} else {
|
||||
needsFallback = false;
|
||||
}
|
||||
|
||||
return needsFallback;
|
||||
}
|
||||
|
||||
/**
|
||||
* Read random bytes from /dev/urandom (synchronous)
|
||||
*/
|
||||
function readFromUrandom(size: number): Buffer {
|
||||
const buffer = Buffer.alloc(size);
|
||||
const fd = openSync('/dev/urandom', 'r');
|
||||
try {
|
||||
readSync(fd, buffer, 0, size, null);
|
||||
} finally {
|
||||
closeSync(fd);
|
||||
}
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize the crypto fallback - call this early at startup
|
||||
* Returns true if fallback is needed, false otherwise
|
||||
*/
|
||||
export function initCryptoFallback(): boolean {
|
||||
if (fallbackInitialized) return needsFallback ?? false;
|
||||
|
||||
const release = os.release();
|
||||
const platform = os.platform();
|
||||
const useFallback = checkNeedsFallback();
|
||||
|
||||
if (useFallback) {
|
||||
console.log(`[Crypto] Kernel: ${release} (old kernel detected, using /dev/urandom fallback)`);
|
||||
|
||||
// Verify /dev/urandom exists
|
||||
if (!existsSync('/dev/urandom')) {
|
||||
console.error('[Crypto] FATAL: /dev/urandom not found, cannot provide entropy');
|
||||
throw new Error('/dev/urandom not available');
|
||||
}
|
||||
|
||||
// Test that we can read from it
|
||||
try {
|
||||
const testBytes = readFromUrandom(8);
|
||||
if (testBytes.length !== 8) {
|
||||
throw new Error('Failed to read expected bytes');
|
||||
}
|
||||
console.log('[Crypto] /dev/urandom fallback initialized successfully');
|
||||
} catch (err) {
|
||||
console.error('[Crypto] FATAL: Failed to read from /dev/urandom:', err);
|
||||
throw err;
|
||||
}
|
||||
} else {
|
||||
console.log(`[Crypto] Kernel: ${platform === 'linux' ? release : platform} (using native crypto)`);
|
||||
}
|
||||
|
||||
fallbackInitialized = true;
|
||||
return useFallback;
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate cryptographically secure random bytes
|
||||
* Uses /dev/urandom on old kernels, native crypto otherwise
|
||||
*/
|
||||
export function secureRandomBytes(size: number): Buffer {
|
||||
if (checkNeedsFallback()) {
|
||||
return readFromUrandom(size);
|
||||
}
|
||||
|
||||
// Use native crypto on modern kernels
|
||||
const { randomBytes } = require('node:crypto');
|
||||
return randomBytes(size);
|
||||
}
|
||||
|
||||
/**
|
||||
* Fill a Uint8Array with cryptographically secure random values
|
||||
* Compatible with crypto.getRandomValues() API
|
||||
*/
|
||||
export function secureGetRandomValues<T extends ArrayBufferView>(array: T): T {
|
||||
if (checkNeedsFallback()) {
|
||||
const bytes = readFromUrandom(array.byteLength);
|
||||
const target = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);
|
||||
target.set(bytes);
|
||||
return array;
|
||||
}
|
||||
|
||||
// Use native crypto on modern kernels
|
||||
return crypto.getRandomValues(array);
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a random UUID (v4)
|
||||
* Compatible with crypto.randomUUID() API
|
||||
*/
|
||||
export function secureRandomUUID(): string {
|
||||
if (checkNeedsFallback()) {
|
||||
// Generate 16 random bytes
|
||||
const bytes = readFromUrandom(16);
|
||||
|
||||
// Set version (4) and variant (RFC 4122)
|
||||
bytes[6] = (bytes[6] & 0x0f) | 0x40; // Version 4
|
||||
bytes[8] = (bytes[8] & 0x3f) | 0x80; // Variant 10
|
||||
|
||||
// Convert to UUID string
|
||||
const hex = bytes.toString('hex');
|
||||
return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
|
||||
}
|
||||
|
||||
// Use native crypto on modern kernels
|
||||
return crypto.randomUUID();
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if running on an old kernel that needs the fallback
|
||||
*/
|
||||
export function usingFallback(): boolean {
|
||||
return checkNeedsFallback();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get kernel version info (useful for diagnostics)
|
||||
*/
|
||||
export function getKernelInfo(): { release: string; needsFallback: boolean } {
|
||||
return {
|
||||
release: os.release(),
|
||||
needsFallback: checkNeedsFallback()
|
||||
};
|
||||
}
|
||||
+218
-8
@@ -125,6 +125,11 @@ export async function getEnvironment(id: number): Promise<Environment | undefine
|
||||
return results[0];
|
||||
}
|
||||
|
||||
export async function getEnvironmentByName(name: string): Promise<Environment | undefined> {
|
||||
const results = await db.select().from(environments).where(eq(environments.name, name));
|
||||
return results[0];
|
||||
}
|
||||
|
||||
export async function createEnvironment(env: Omit<Environment, 'id' | 'createdAt' | 'updatedAt'>): Promise<Environment> {
|
||||
const result = await db.insert(environments).values({
|
||||
name: env.name,
|
||||
@@ -2487,6 +2492,8 @@ export interface StackSourceData {
|
||||
sourceType: StackSourceType;
|
||||
gitRepositoryId: number | null;
|
||||
gitStackId: number | null;
|
||||
composePath: string | null;
|
||||
envPath: string | null;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
@@ -2527,9 +2534,10 @@ export async function getStackSource(stackName: string, environmentId?: number |
|
||||
|
||||
export async function getStackSources(environmentId?: number | null): Promise<StackSourceWithRepo[]> {
|
||||
let results;
|
||||
if (environmentId !== undefined) {
|
||||
if (environmentId !== undefined && environmentId !== null) {
|
||||
// Only get stacks for the specific environment
|
||||
results = await db.select().from(stackSources)
|
||||
.where(or(eq(stackSources.environmentId, environmentId), isNull(stackSources.environmentId)))
|
||||
.where(eq(stackSources.environmentId, environmentId))
|
||||
.orderBy(asc(stackSources.stackName));
|
||||
} else {
|
||||
results = await db.select().from(stackSources).orderBy(asc(stackSources.stackName));
|
||||
@@ -2563,6 +2571,8 @@ export async function upsertStackSource(data: {
|
||||
sourceType: StackSourceType;
|
||||
gitRepositoryId?: number | null;
|
||||
gitStackId?: number | null;
|
||||
composePath?: string | null;
|
||||
envPath?: string | null;
|
||||
}): Promise<StackSourceData> {
|
||||
const existing = await getStackSource(data.stackName, data.environmentId);
|
||||
|
||||
@@ -2572,6 +2582,8 @@ export async function upsertStackSource(data: {
|
||||
sourceType: data.sourceType,
|
||||
gitRepositoryId: data.gitRepositoryId || null,
|
||||
gitStackId: data.gitStackId || null,
|
||||
composePath: data.composePath ?? null,
|
||||
envPath: data.envPath ?? null,
|
||||
updatedAt: new Date().toISOString()
|
||||
})
|
||||
.where(eq(stackSources.id, existing.id));
|
||||
@@ -2582,12 +2594,33 @@ export async function upsertStackSource(data: {
|
||||
environmentId: data.environmentId ?? null,
|
||||
sourceType: data.sourceType,
|
||||
gitRepositoryId: data.gitRepositoryId || null,
|
||||
gitStackId: data.gitStackId || null
|
||||
gitStackId: data.gitStackId || null,
|
||||
composePath: data.composePath ?? null,
|
||||
envPath: data.envPath ?? null
|
||||
});
|
||||
return getStackSource(data.stackName, data.environmentId) as Promise<StackSourceData>;
|
||||
}
|
||||
}
|
||||
|
||||
export async function updateStackSource(
|
||||
stackName: string,
|
||||
environmentId: number | null,
|
||||
updates: { composePath?: string | null; envPath?: string | null }
|
||||
): Promise<boolean> {
|
||||
const existing = await getStackSource(stackName, environmentId);
|
||||
if (!existing) return false;
|
||||
|
||||
await db.update(stackSources)
|
||||
.set({
|
||||
composePath: updates.composePath !== undefined ? updates.composePath : existing.composePath,
|
||||
envPath: updates.envPath !== undefined ? updates.envPath : existing.envPath,
|
||||
updatedAt: new Date().toISOString()
|
||||
})
|
||||
.where(eq(stackSources.id, existing.id));
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
export async function deleteStackSource(stackName: string, environmentId?: number | null): Promise<boolean> {
|
||||
// Delete matching record (either with specific envId or NULL)
|
||||
await db.delete(stackSources)
|
||||
@@ -2610,6 +2643,25 @@ export async function deleteStackSource(stackName: string, environmentId?: numbe
|
||||
return true;
|
||||
}
|
||||
|
||||
export async function updateStackSourceName(
|
||||
oldStackName: string,
|
||||
newStackName: string,
|
||||
environmentId?: number | null
|
||||
): Promise<boolean> {
|
||||
await db.update(stackSources)
|
||||
.set({
|
||||
stackName: newStackName,
|
||||
updatedAt: new Date().toISOString()
|
||||
})
|
||||
.where(and(
|
||||
eq(stackSources.stackName, oldStackName),
|
||||
environmentId !== undefined && environmentId !== null
|
||||
? eq(stackSources.environmentId, environmentId)
|
||||
: isNull(stackSources.environmentId)
|
||||
));
|
||||
return true;
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// VULNERABILITY SCAN RESULTS
|
||||
// =============================================================================
|
||||
@@ -3083,10 +3135,8 @@ export interface ContainerEventResult {
|
||||
}
|
||||
|
||||
export async function logContainerEvent(data: ContainerEventCreateData): Promise<ContainerEventData> {
|
||||
// Timestamp is always a string with nanosecond precision (stored as text in both SQLite and PostgreSQL)
|
||||
// For PostgreSQL, we convert to Date since the schema uses native timestamp type
|
||||
const timestamp = isPostgres ? new Date(data.timestamp) : data.timestamp;
|
||||
|
||||
// Timestamp is already an ISO-8601 string from event-subprocess
|
||||
// Both SQLite and PostgreSQL schemas use mode: 'string' so we pass it directly
|
||||
const result = await db.insert(containerEvents).values({
|
||||
environmentId: data.environmentId ?? null,
|
||||
containerId: data.containerId,
|
||||
@@ -3094,7 +3144,7 @@ export async function logContainerEvent(data: ContainerEventCreateData): Promise
|
||||
image: data.image ?? null,
|
||||
action: data.action,
|
||||
actorAttributes: data.actorAttributes ? JSON.stringify(data.actorAttributes) : null,
|
||||
timestamp
|
||||
timestamp: data.timestamp
|
||||
}).returning();
|
||||
|
||||
return getContainerEvent(result[0].id) as Promise<ContainerEventData>;
|
||||
@@ -3896,6 +3946,73 @@ export async function setEventCleanupEnabled(enabled: boolean): Promise<void> {
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// EXTERNAL STACK PATHS
|
||||
// =============================================================================
|
||||
|
||||
const EXTERNAL_STACK_PATHS_KEY = 'external_stack_paths';
|
||||
|
||||
export async function getExternalStackPaths(): Promise<string[]> {
|
||||
const result = await db.select().from(settings).where(eq(settings.key, EXTERNAL_STACK_PATHS_KEY));
|
||||
if (result[0]) {
|
||||
try {
|
||||
const parsed = JSON.parse(result[0].value);
|
||||
return Array.isArray(parsed) ? parsed : [];
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
}
|
||||
return [];
|
||||
}
|
||||
|
||||
export async function setExternalStackPaths(paths: string[]): Promise<void> {
|
||||
const jsonValue = JSON.stringify(paths);
|
||||
const existing = await db.select().from(settings).where(eq(settings.key, EXTERNAL_STACK_PATHS_KEY));
|
||||
if (existing.length > 0) {
|
||||
await db.update(settings)
|
||||
.set({ value: jsonValue, updatedAt: new Date().toISOString() })
|
||||
.where(eq(settings.key, EXTERNAL_STACK_PATHS_KEY));
|
||||
} else {
|
||||
await db.insert(settings).values({
|
||||
key: EXTERNAL_STACK_PATHS_KEY,
|
||||
value: jsonValue
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// PRIMARY STACK LOCATION
|
||||
// =============================================================================
|
||||
|
||||
const PRIMARY_STACK_LOCATION_KEY = 'primary_stack_location';
|
||||
|
||||
export async function getPrimaryStackLocation(): Promise<string | null> {
|
||||
const result = await db.select().from(settings).where(eq(settings.key, PRIMARY_STACK_LOCATION_KEY));
|
||||
if (result[0]?.value) {
|
||||
return result[0].value;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
export async function setPrimaryStackLocation(path: string | null): Promise<void> {
|
||||
const existing = await db.select().from(settings).where(eq(settings.key, PRIMARY_STACK_LOCATION_KEY));
|
||||
if (path === null) {
|
||||
// Delete the setting if path is null
|
||||
if (existing.length > 0) {
|
||||
await db.delete(settings).where(eq(settings.key, PRIMARY_STACK_LOCATION_KEY));
|
||||
}
|
||||
} else if (existing.length > 0) {
|
||||
await db.update(settings)
|
||||
.set({ value: path, updatedAt: new Date().toISOString() })
|
||||
.where(eq(settings.key, PRIMARY_STACK_LOCATION_KEY));
|
||||
} else {
|
||||
await db.insert(settings).values({
|
||||
key: PRIMARY_STACK_LOCATION_KEY,
|
||||
value: path
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// ENVIRONMENT UPDATE CHECK SETTINGS
|
||||
// =============================================================================
|
||||
@@ -3988,6 +4105,66 @@ export async function setDefaultTimezone(timezone: string): Promise<void> {
|
||||
await setSetting('default_timezone', timezone);
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// BACKGROUND MONITORING SETTINGS
|
||||
// =============================================================================
|
||||
|
||||
/**
|
||||
* Get event collection mode ('stream' or 'poll').
|
||||
* Defaults to 'stream' for real-time event streaming.
|
||||
*/
|
||||
export async function getEventCollectionMode(): Promise<'stream' | 'poll'> {
|
||||
const value = await getSetting('event_collection_mode');
|
||||
return value || 'stream';
|
||||
}
|
||||
|
||||
/**
|
||||
* Set event collection mode.
|
||||
*/
|
||||
export async function setEventCollectionMode(mode: 'stream' | 'poll'): Promise<void> {
|
||||
await setSetting('event_collection_mode', mode);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get event poll interval in milliseconds.
|
||||
* Defaults to 60000ms (60 seconds).
|
||||
*/
|
||||
export async function getEventPollInterval(): Promise<number> {
|
||||
const value = await getSetting('event_poll_interval');
|
||||
return value || 60000;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set event poll interval in milliseconds.
|
||||
* Valid range: 30000ms (30s) to 300000ms (5min).
|
||||
*/
|
||||
export async function setEventPollInterval(interval: number): Promise<void> {
|
||||
if (interval < 30000 || interval > 300000) {
|
||||
throw new Error('Event poll interval must be between 30s and 300s');
|
||||
}
|
||||
await setSetting('event_poll_interval', interval);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get metrics collection interval in milliseconds.
|
||||
* Defaults to 30000ms (30 seconds) - changed from hardcoded 10s.
|
||||
*/
|
||||
export async function getMetricsCollectionInterval(): Promise<number> {
|
||||
const value = await getSetting('metrics_collection_interval');
|
||||
return value || 30000;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set metrics collection interval in milliseconds.
|
||||
* Valid range: 10000ms (10s) to 300000ms (5min).
|
||||
*/
|
||||
export async function setMetricsCollectionInterval(interval: number): Promise<void> {
|
||||
if (interval < 10000 || interval > 300000) {
|
||||
throw new Error('Metrics collection interval must be between 10s and 300s');
|
||||
}
|
||||
await setSetting('metrics_collection_interval', interval);
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// STACK ENVIRONMENT VARIABLES OPERATIONS
|
||||
// =============================================================================
|
||||
@@ -4064,6 +4241,39 @@ export async function getStackEnvVarsAsRecord(
|
||||
return Object.fromEntries(vars.map(v => [v.key, v.value]));
|
||||
}
|
||||
|
||||
/**
|
||||
* Get only SECRET environment variables as a key-value record (for shell injection).
|
||||
* Returns unmasked real values - used to inject secrets via shell environment at runtime.
|
||||
* These secrets are NEVER written to .env files on disk.
|
||||
* @param stackName - Name of the stack
|
||||
* @param environmentId - Optional environment ID
|
||||
*/
|
||||
export async function getSecretEnvVarsAsRecord(
|
||||
stackName: string,
|
||||
environmentId?: number | null
|
||||
): Promise<Record<string, string>> {
|
||||
const vars = await getStackEnvVars(stackName, environmentId, false);
|
||||
return Object.fromEntries(
|
||||
vars.filter(v => v.isSecret).map(v => [v.key, v.value])
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get only NON-SECRET environment variables as a key-value record.
|
||||
* Used for .env file operations where secrets should be excluded.
|
||||
* @param stackName - Name of the stack
|
||||
* @param environmentId - Optional environment ID
|
||||
*/
|
||||
export async function getNonSecretEnvVarsAsRecord(
|
||||
stackName: string,
|
||||
environmentId?: number | null
|
||||
): Promise<Record<string, string>> {
|
||||
const vars = await getStackEnvVars(stackName, environmentId, false);
|
||||
return Object.fromEntries(
|
||||
vars.filter(v => !v.isSecret).map(v => [v.key, v.value])
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Set/replace all environment variables for a stack.
|
||||
* Deletes existing vars and inserts new ones in a transaction-like manner.
|
||||
|
||||
@@ -604,21 +604,21 @@ async function initializeDatabase() {
|
||||
logHeader('DATABASE INITIALIZATION');
|
||||
|
||||
if (isPostgres) {
|
||||
// PostgreSQL via Bun.sql
|
||||
// PostgreSQL via postgres-js (more stable than bun:sql for concurrent queries)
|
||||
validatePostgresUrl(config.databaseUrl!);
|
||||
|
||||
logInfo(`Database: PostgreSQL`);
|
||||
logInfo(`Connection: ${maskPassword(config.databaseUrl!)}`);
|
||||
|
||||
const { drizzle } = await import('drizzle-orm/bun-sql');
|
||||
const { SQL } = await import('bun');
|
||||
const { drizzle } = await import('drizzle-orm/postgres-js');
|
||||
const postgres = (await import('postgres')).default;
|
||||
|
||||
// Import PostgreSQL schema
|
||||
schema = await import('./schema/pg-schema.js');
|
||||
|
||||
if (verbose) logStep('Connecting to PostgreSQL...');
|
||||
try {
|
||||
rawClient = new SQL(config.databaseUrl!);
|
||||
rawClient = postgres(config.databaseUrl!);
|
||||
db = drizzle({ client: rawClient, schema });
|
||||
logSuccess('PostgreSQL connection established');
|
||||
} catch (error) {
|
||||
|
||||
@@ -332,6 +332,8 @@ export const stackSources = sqliteTable('stack_sources', {
|
||||
sourceType: text('source_type').notNull().default('internal'),
|
||||
gitRepositoryId: integer('git_repository_id').references(() => gitRepositories.id, { onDelete: 'set null' }),
|
||||
gitStackId: integer('git_stack_id').references(() => gitStacks.id, { onDelete: 'set null' }),
|
||||
composePath: text('compose_path'), // Custom path to compose file (for stacks with non-default location)
|
||||
envPath: text('env_path'), // Custom path to .env file (for stacks with non-default location)
|
||||
createdAt: text('created_at').default(sql`CURRENT_TIMESTAMP`),
|
||||
updatedAt: text('updated_at').default(sql`CURRENT_TIMESTAMP`)
|
||||
}, (table) => ({
|
||||
|
||||
@@ -335,6 +335,8 @@ export const stackSources = pgTable('stack_sources', {
|
||||
sourceType: text('source_type').notNull().default('internal'),
|
||||
gitRepositoryId: integer('git_repository_id').references(() => gitRepositories.id, { onDelete: 'set null' }),
|
||||
gitStackId: integer('git_stack_id').references(() => gitStacks.id, { onDelete: 'set null' }),
|
||||
composePath: text('compose_path'), // Custom path to compose file (for stacks with non-default location)
|
||||
envPath: text('env_path'), // Custom path to .env file (for stacks with non-default location)
|
||||
createdAt: timestamp('created_at', { mode: 'string' }).defaultNow(),
|
||||
updatedAt: timestamp('updated_at', { mode: 'string' }).defaultNow()
|
||||
}, (table) => ({
|
||||
|
||||
+98
-23
@@ -469,13 +469,16 @@ export async function dockerFetch(
|
||||
streaming ? 300000 : 30000 // 5 min for streaming, 30s for normal requests
|
||||
);
|
||||
const elapsed = Date.now() - startTime;
|
||||
if (elapsed > 5000) {
|
||||
// Only warn for slow requests, but skip /stats which is expected to be slow (5-10s)
|
||||
if (elapsed > 5000 && !path.includes('/stats')) {
|
||||
console.warn(`[Docker] Edge env ${config.environmentId}: ${method} ${path} took ${elapsed}ms`);
|
||||
}
|
||||
return edgeResponseToResponse(edgeResponse);
|
||||
} catch (error) {
|
||||
} catch (error: any) {
|
||||
const elapsed = Date.now() - startTime;
|
||||
console.error(`[Docker] Edge env ${config.environmentId}: ${method} ${path} failed after ${elapsed}ms:`, error);
|
||||
// Log error message only, not full stack trace
|
||||
const msg = error?.message || String(error);
|
||||
console.error(`[Docker] Edge env ${config.environmentId}: ${method} ${path} failed after ${elapsed}ms: ${msg}`);
|
||||
throw DockerConnectionError.fromError(error);
|
||||
}
|
||||
}
|
||||
@@ -491,13 +494,16 @@ export async function dockerFetch(
|
||||
...bunOptions
|
||||
});
|
||||
const elapsed = Date.now() - startTime;
|
||||
if (elapsed > 5000) {
|
||||
// Only warn for slow requests, but skip /stats which is expected to be slow (5-10s)
|
||||
if (elapsed > 5000 && !path.includes('/stats')) {
|
||||
console.warn(`[Docker] Socket: ${method} ${path} took ${elapsed}ms`);
|
||||
}
|
||||
return response;
|
||||
} catch (error) {
|
||||
} catch (error: any) {
|
||||
const elapsed = Date.now() - startTime;
|
||||
console.error(`[Docker] Socket: ${method} ${path} failed after ${elapsed}ms:`, error);
|
||||
// Log error message only, not full stack trace
|
||||
const msg = error?.message || String(error);
|
||||
console.error(`[Docker] Socket: ${method} ${path} failed after ${elapsed}ms: ${msg}`);
|
||||
throw DockerConnectionError.fromError(error);
|
||||
}
|
||||
} else {
|
||||
@@ -516,21 +522,30 @@ export async function dockerFetch(
|
||||
}
|
||||
|
||||
// For HTTPS with TLS certificates, we need to configure TLS
|
||||
// IMPORTANT: Bun requires certificates as Buffer objects, not strings
|
||||
// Pass certificate strings directly to Bun's fetch - no temp files needed
|
||||
if (config.type === 'https') {
|
||||
const tlsOptions: Record<string, unknown> = {};
|
||||
|
||||
// CA certificate - must be array of Buffers for Bun
|
||||
// DISABLE TLS SESSION CACHING: Bun reuses TLS sessions across different hosts,
|
||||
// which causes client certificate mismatches in mTLS scenarios. By setting
|
||||
// sessionTimeout to 0, we force a fresh TLS handshake for every connection.
|
||||
tlsOptions.sessionTimeout = 0;
|
||||
|
||||
// Set explicit servername for SNI - helps isolate TLS contexts per host
|
||||
tlsOptions.servername = config.host;
|
||||
|
||||
// Load CA certificate (just this environment's CA, not composite)
|
||||
// The sessionTimeout=0 should prevent session reuse across hosts
|
||||
if (config.ca) {
|
||||
tlsOptions.ca = [Buffer.from(config.ca)];
|
||||
tlsOptions.ca = [config.ca];
|
||||
}
|
||||
|
||||
// Client certificate and key for mTLS - must be Buffers
|
||||
// Client cert and key for mTLS authentication
|
||||
if (config.cert) {
|
||||
tlsOptions.cert = Buffer.from(config.cert);
|
||||
tlsOptions.cert = [config.cert];
|
||||
}
|
||||
if (config.key) {
|
||||
tlsOptions.key = Buffer.from(config.key);
|
||||
tlsOptions.key = config.key;
|
||||
}
|
||||
|
||||
// Skip verification (self-signed without CA)
|
||||
@@ -541,8 +556,27 @@ export async function dockerFetch(
|
||||
}
|
||||
|
||||
if (Object.keys(tlsOptions).length > 0) {
|
||||
// @ts-ignore - Bun supports tls options with Buffer certs
|
||||
// @ts-ignore - Bun supports tls options with string certs
|
||||
finalOptions.tls = tlsOptions;
|
||||
// Force new connection for each request to prevent Bun from reusing
|
||||
// a TLS session with wrong client certificates (pool key doesn't include certs)
|
||||
// @ts-ignore - Bun supports keepalive option
|
||||
finalOptions.keepalive = false;
|
||||
}
|
||||
|
||||
// Explicitly close connection to prevent TLS session reuse issues
|
||||
// But only for non-streaming requests (logs, events, exec need keep-alive)
|
||||
if (!streaming) {
|
||||
finalOptions.headers = {
|
||||
...finalOptions.headers,
|
||||
'Connection': 'close'
|
||||
};
|
||||
}
|
||||
|
||||
// Optional verbose TLS debugging
|
||||
if (process.env.DEBUG_TLS) {
|
||||
// @ts-ignore - Bun-specific verbose option
|
||||
finalOptions.verbose = true;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -550,13 +584,16 @@ export async function dockerFetch(
|
||||
try {
|
||||
const response = await fetch(url, { ...finalOptions, ...bunOptions });
|
||||
const elapsed = Date.now() - startTime;
|
||||
if (elapsed > 5000) {
|
||||
// Only warn for slow requests, but skip /stats which is expected to be slow (5-10s)
|
||||
if (elapsed > 5000 && !path.includes('/stats')) {
|
||||
console.warn(`[Docker] ${config.connectionType || 'direct'} ${config.host}: ${method} ${path} took ${elapsed}ms`);
|
||||
}
|
||||
return response;
|
||||
} catch (error) {
|
||||
} catch (error: any) {
|
||||
const elapsed = Date.now() - startTime;
|
||||
console.error(`[Docker] ${config.connectionType || 'direct'} ${config.host}: ${method} ${path} failed after ${elapsed}ms:`, error);
|
||||
// Log error message only, not full stack trace
|
||||
const msg = error?.message || String(error);
|
||||
console.error(`[Docker] ${config.connectionType || 'direct'} ${config.host}: ${method} ${path} failed after ${elapsed}ms: ${msg}`);
|
||||
throw DockerConnectionError.fromError(error);
|
||||
}
|
||||
}
|
||||
@@ -994,12 +1031,31 @@ export async function updateContainer(id: string, options: CreateContainerOption
|
||||
|
||||
// Image operations
|
||||
export async function listImages(envId?: number | null): Promise<ImageInfo[]> {
|
||||
const images = await dockerJsonRequest<any[]>('/images/json', {}, envId);
|
||||
// Fetch images and containers in parallel
|
||||
const [images, containers] = await Promise.all([
|
||||
dockerJsonRequest<any[]>('/images/json', {}, envId),
|
||||
dockerJsonRequest<any[]>('/containers/json?all=true', {}, envId).catch(() => [] as any[])
|
||||
]);
|
||||
|
||||
// Build a map of imageId -> container count
|
||||
// Docker may return -1 for Containers field on some hosts, so we compute it ourselves
|
||||
const imageContainerCount = new Map<string, number>();
|
||||
for (const container of containers) {
|
||||
const imageId = container.ImageID || container.Image;
|
||||
if (imageId) {
|
||||
imageContainerCount.set(imageId, (imageContainerCount.get(imageId) || 0) + 1);
|
||||
}
|
||||
}
|
||||
|
||||
return images.map((image) => ({
|
||||
id: image.Id,
|
||||
repoTags: image.RepoTags || [],
|
||||
tags: image.RepoTags || [],
|
||||
size: image.Size,
|
||||
created: image.Created
|
||||
virtualSize: image.VirtualSize || image.Size,
|
||||
created: image.Created,
|
||||
labels: image.Labels || {},
|
||||
containers: imageContainerCount.get(image.Id) || 0
|
||||
}));
|
||||
}
|
||||
|
||||
@@ -1943,7 +1999,10 @@ export async function pruneContainers(envId?: number | null) {
|
||||
}
|
||||
|
||||
export async function pruneImages(dangling = true, envId?: number | null) {
|
||||
const filters = dangling ? '{"dangling":["true"]}' : '{}';
|
||||
// dangling=true: only remove untagged images (default Docker behavior)
|
||||
// dangling=false: remove ALL unused images including tagged ones
|
||||
// Docker API quirk: to remove all unused, we pass dangling=false filter
|
||||
const filters = dangling ? '{"dangling":["true"]}' : '{"dangling":["false"]}';
|
||||
return dockerJsonRequest(`/images/prune?filters=${encodeURIComponent(filters)}`, { method: 'POST' }, envId);
|
||||
}
|
||||
|
||||
@@ -2042,18 +2101,30 @@ export async function execInContainer(
|
||||
}
|
||||
|
||||
// Get Docker events as a stream (for SSE)
|
||||
// For streaming mode: call with just filters
|
||||
// For polling mode: call with since and until to get a finite window of events
|
||||
export async function getDockerEvents(
|
||||
filters: Record<string, string[]>,
|
||||
envId?: number | null
|
||||
envId?: number | null,
|
||||
options?: { since?: string; until?: string }
|
||||
): Promise<ReadableStream<Uint8Array> | null> {
|
||||
const filterJson = JSON.stringify(filters);
|
||||
|
||||
// Build query string with optional since/until for polling mode
|
||||
let queryString = `filters=${encodeURIComponent(filterJson)}`;
|
||||
if (options?.since) {
|
||||
queryString += `&since=${encodeURIComponent(options.since)}`;
|
||||
}
|
||||
if (options?.until) {
|
||||
queryString += `&until=${encodeURIComponent(options.until)}`;
|
||||
}
|
||||
|
||||
try {
|
||||
// Note: We use streaming: true to disable Bun's idle timeout for this long-lived connection.
|
||||
// The Docker events API keeps the connection open indefinitely, sending events as they occur.
|
||||
// Without streaming: true, Bun would terminate the connection after ~5 seconds of inactivity.
|
||||
const response = await dockerFetch(
|
||||
`/events?filters=${encodeURIComponent(filterJson)}`,
|
||||
`/events?${queryString}`,
|
||||
{ streaming: true },
|
||||
envId
|
||||
);
|
||||
@@ -3114,8 +3185,12 @@ async function cleanupStaleVolumeHelpersForEnv(envId?: number | null): Promise<n
|
||||
}
|
||||
|
||||
return removed;
|
||||
} catch (err) {
|
||||
console.warn('Failed to query stale volume helpers:', err);
|
||||
} catch (err: any) {
|
||||
// Don't spam logs for expected failures (e.g., edge agent offline)
|
||||
const msg = err?.message || String(err);
|
||||
if (!msg.includes('not connected') && !msg.includes('offline')) {
|
||||
console.warn('Failed to query stale volume helpers:', msg);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -58,7 +58,14 @@ async function buildGitEnv(credential: GitCredential | null): Promise<GitEnv> {
|
||||
if (credential?.authType === 'ssh' && credential.sshPrivateKey) {
|
||||
// Create a temporary SSH key file (use absolute path so SSH can find it)
|
||||
const sshKeyPath = resolve(join(GIT_REPOS_DIR, `.ssh-key-${credential.id}`));
|
||||
await Bun.write(sshKeyPath, credential.sshPrivateKey);
|
||||
|
||||
// Ensure SSH key ends with a newline (newer SSH versions are strict about this)
|
||||
let keyContent = credential.sshPrivateKey;
|
||||
if (!keyContent.endsWith('\n')) {
|
||||
keyContent += '\n';
|
||||
}
|
||||
|
||||
await Bun.write(sshKeyPath, keyContent);
|
||||
// Ensure SSH key has correct permissions (0600 = owner read/write only)
|
||||
// Bun.write's mode option doesn't always work reliably, so use chmodSync
|
||||
chmodSync(sshKeyPath, 0o600);
|
||||
|
||||
@@ -9,6 +9,8 @@ import { db, hawserTokens, environments, eq } from './db/drizzle.js';
|
||||
import { logContainerEvent, saveHostMetric, type ContainerEventAction } from './db.js';
|
||||
import { containerEventEmitter } from './event-collector.js';
|
||||
import { sendEnvironmentNotification } from './notifications.js';
|
||||
import { secureGetRandomValues, secureRandomUUID } from './crypto-fallback.js';
|
||||
import { hashPassword, verifyPassword } from './auth.js';
|
||||
|
||||
// Protocol constants
|
||||
export const HAWSER_PROTOCOL_VERSION = '1.0';
|
||||
@@ -243,7 +245,7 @@ export async function validateHawserToken(
|
||||
// Check each token (tokens are hashed)
|
||||
for (const t of tokens) {
|
||||
try {
|
||||
const isValid = await Bun.password.verify(token, t.token);
|
||||
const isValid = await verifyPassword(token, t.token);
|
||||
if (isValid) {
|
||||
// Update last used timestamp
|
||||
await db
|
||||
@@ -292,16 +294,12 @@ export async function generateHawserToken(
|
||||
} else {
|
||||
// Generate a secure random token (32 bytes = 256 bits)
|
||||
const tokenBytes = new Uint8Array(32);
|
||||
crypto.getRandomValues(tokenBytes);
|
||||
secureGetRandomValues(tokenBytes);
|
||||
token = Buffer.from(tokenBytes).toString('base64url');
|
||||
}
|
||||
|
||||
// Hash the token for storage (using Bun's built-in Argon2id)
|
||||
const hashedToken = await Bun.password.hash(token, {
|
||||
algorithm: 'argon2id',
|
||||
memoryCost: 19456,
|
||||
timeCost: 2
|
||||
});
|
||||
// Hash the token for storage (using Argon2id)
|
||||
const hashedToken = await hashPassword(token);
|
||||
|
||||
// Get prefix for identification
|
||||
const tokenPrefix = token.substring(0, 8);
|
||||
@@ -477,7 +475,7 @@ export async function sendEdgeRequest(
|
||||
throw new Error('Edge agent not connected');
|
||||
}
|
||||
|
||||
const requestId = crypto.randomUUID();
|
||||
const requestId = secureRandomUUID();
|
||||
|
||||
return new Promise((resolve, reject) => {
|
||||
const timeoutHandle = setTimeout(() => {
|
||||
@@ -614,7 +612,7 @@ export function sendEdgeStreamRequest(
|
||||
return { requestId: '', cancel: () => {} };
|
||||
}
|
||||
|
||||
const requestId = crypto.randomUUID();
|
||||
const requestId = secureRandomUUID();
|
||||
|
||||
// Initialize pendingStreamRequests if not present (can happen in dev mode due to HMR)
|
||||
if (!connection.pendingStreamRequests) {
|
||||
|
||||
@@ -1,271 +0,0 @@
|
||||
import { saveHostMetric, getEnvironments, getEnvSetting } from './db';
|
||||
import { listContainers, getContainerStats, getDockerInfo, getDiskUsage } from './docker';
|
||||
import { sendEventNotification } from './notifications';
|
||||
import os from 'node:os';
|
||||
|
||||
const COLLECT_INTERVAL = 10000; // 10 seconds
|
||||
const DISK_CHECK_INTERVAL = 300000; // 5 minutes
|
||||
const DEFAULT_DISK_THRESHOLD = 80; // 80% threshold for disk warnings
|
||||
|
||||
let collectorInterval: ReturnType<typeof setInterval> | null = null;
|
||||
let diskCheckInterval: ReturnType<typeof setInterval> | null = null;
|
||||
|
||||
// Track last disk warning sent per environment to avoid spamming
|
||||
const lastDiskWarning: Map<number, number> = new Map();
|
||||
const DISK_WARNING_COOLDOWN = 3600000; // 1 hour between warnings
|
||||
|
||||
/**
|
||||
* Collect metrics for a single environment
|
||||
*/
|
||||
async function collectEnvMetrics(env: { id: number; name: string; collectMetrics?: boolean }) {
|
||||
try {
|
||||
// Skip environments where metrics collection is disabled
|
||||
if (env.collectMetrics === false) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Get running containers
|
||||
const containers = await listContainers(false, env.id); // Only running
|
||||
let totalCpuPercent = 0;
|
||||
let totalMemUsed = 0;
|
||||
|
||||
// Get stats for each running container
|
||||
const statsPromises = containers.map(async (container) => {
|
||||
try {
|
||||
const stats = await getContainerStats(container.id, env.id) as any;
|
||||
|
||||
// Calculate CPU percentage
|
||||
const cpuDelta = stats.cpu_stats.cpu_usage.total_usage - stats.precpu_stats.cpu_usage.total_usage;
|
||||
const systemDelta = stats.cpu_stats.system_cpu_usage - stats.precpu_stats.system_cpu_usage;
|
||||
const cpuCount = stats.cpu_stats.online_cpus || os.cpus().length;
|
||||
|
||||
let cpuPercent = 0;
|
||||
if (systemDelta > 0 && cpuDelta > 0) {
|
||||
cpuPercent = (cpuDelta / systemDelta) * cpuCount * 100;
|
||||
}
|
||||
|
||||
// Get container memory usage
|
||||
const memUsage = stats.memory_stats?.usage || 0;
|
||||
const memCache = stats.memory_stats?.stats?.cache || 0;
|
||||
// Subtract cache from usage to get actual memory used by the container
|
||||
const actualMemUsed = memUsage - memCache;
|
||||
|
||||
return { cpu: cpuPercent, mem: actualMemUsed > 0 ? actualMemUsed : memUsage };
|
||||
} catch {
|
||||
return { cpu: 0, mem: 0 };
|
||||
}
|
||||
});
|
||||
|
||||
const statsResults = await Promise.all(statsPromises);
|
||||
totalCpuPercent = statsResults.reduce((sum, v) => sum + v.cpu, 0);
|
||||
totalMemUsed = statsResults.reduce((sum, v) => sum + v.mem, 0);
|
||||
|
||||
// Get host total memory from Docker info (this is the remote host's memory)
|
||||
const info = await getDockerInfo(env.id) as any;
|
||||
const memTotal = info.MemTotal || os.totalmem();
|
||||
|
||||
// Calculate memory percentage based on container usage vs host total
|
||||
const memPercent = memTotal > 0 ? (totalMemUsed / memTotal) * 100 : 0;
|
||||
|
||||
// Normalize CPU by number of cores from the remote host
|
||||
const cpuCount = info.NCPU || os.cpus().length;
|
||||
const normalizedCpu = totalCpuPercent / cpuCount;
|
||||
|
||||
// Save to database
|
||||
await saveHostMetric(
|
||||
normalizedCpu,
|
||||
memPercent,
|
||||
totalMemUsed,
|
||||
memTotal,
|
||||
env.id
|
||||
);
|
||||
} catch (error) {
|
||||
// Skip this environment if it fails (might be offline)
|
||||
console.error(`Failed to collect metrics for ${env.name}:`, error);
|
||||
}
|
||||
}
|
||||
|
||||
async function collectMetrics() {
|
||||
try {
|
||||
const environments = await getEnvironments();
|
||||
|
||||
// Filter enabled environments and collect metrics in parallel
|
||||
const enabledEnvs = environments.filter(env => env.collectMetrics !== false);
|
||||
|
||||
// Process all environments in parallel for better performance
|
||||
await Promise.all(enabledEnvs.map(env => collectEnvMetrics(env)));
|
||||
} catch (error) {
|
||||
console.error('Metrics collection error:', error);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check disk space for a single environment
|
||||
*/
|
||||
async function checkEnvDiskSpace(env: { id: number; name: string; collectMetrics?: boolean }) {
|
||||
try {
|
||||
// Skip environments where metrics collection is disabled
|
||||
if (env.collectMetrics === false) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Check if we're in cooldown for this environment
|
||||
const lastWarningTime = lastDiskWarning.get(env.id);
|
||||
if (lastWarningTime && Date.now() - lastWarningTime < DISK_WARNING_COOLDOWN) {
|
||||
return; // Skip this environment, still in cooldown
|
||||
}
|
||||
|
||||
// Get Docker disk usage data
|
||||
const diskData = await getDiskUsage(env.id) as any;
|
||||
if (!diskData) return;
|
||||
|
||||
// Calculate total Docker disk usage using reduce for cleaner code
|
||||
let totalUsed = 0;
|
||||
if (diskData.Images) {
|
||||
totalUsed += diskData.Images.reduce((sum: number, img: any) => sum + (img.Size || 0), 0);
|
||||
}
|
||||
if (diskData.Containers) {
|
||||
totalUsed += diskData.Containers.reduce((sum: number, c: any) => sum + (c.SizeRw || 0), 0);
|
||||
}
|
||||
if (diskData.Volumes) {
|
||||
totalUsed += diskData.Volumes.reduce((sum: number, v: any) => sum + (v.UsageData?.Size || 0), 0);
|
||||
}
|
||||
if (diskData.BuildCache) {
|
||||
totalUsed += diskData.BuildCache.reduce((sum: number, bc: any) => sum + (bc.Size || 0), 0);
|
||||
}
|
||||
|
||||
// Get Docker root filesystem info from Docker info
|
||||
const info = await getDockerInfo(env.id) as any;
|
||||
const driverStatus = info?.DriverStatus;
|
||||
|
||||
// Try to find "Data Space Total" from driver status
|
||||
let dataSpaceTotal = 0;
|
||||
let diskPercentUsed = 0;
|
||||
|
||||
if (driverStatus) {
|
||||
for (const [key, value] of driverStatus) {
|
||||
if (key === 'Data Space Total' && typeof value === 'string') {
|
||||
dataSpaceTotal = parseSize(value);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// If we found total disk space, calculate percentage
|
||||
if (dataSpaceTotal > 0) {
|
||||
diskPercentUsed = (totalUsed / dataSpaceTotal) * 100;
|
||||
} else {
|
||||
// Fallback: just report absolute usage if we can't determine percentage
|
||||
const GB = 1024 * 1024 * 1024;
|
||||
if (totalUsed > 50 * GB) {
|
||||
await sendEventNotification('disk_space_warning', {
|
||||
title: 'High Docker disk usage',
|
||||
message: `Environment "${env.name}" is using ${formatSize(totalUsed)} of Docker disk space`,
|
||||
type: 'warning'
|
||||
}, env.id);
|
||||
lastDiskWarning.set(env.id, Date.now());
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Check against threshold
|
||||
const threshold = await getEnvSetting('disk_warning_threshold', env.id) || DEFAULT_DISK_THRESHOLD;
|
||||
if (diskPercentUsed >= threshold) {
|
||||
console.log(`[Metrics] Docker disk usage for ${env.name}: ${diskPercentUsed.toFixed(1)}% (threshold: ${threshold}%)`);
|
||||
|
||||
await sendEventNotification('disk_space_warning', {
|
||||
title: 'Disk space warning',
|
||||
message: `Environment "${env.name}" Docker disk usage is at ${diskPercentUsed.toFixed(1)}% (${formatSize(totalUsed)} used)`,
|
||||
type: 'warning'
|
||||
}, env.id);
|
||||
|
||||
lastDiskWarning.set(env.id, Date.now());
|
||||
}
|
||||
} catch (error) {
|
||||
// Skip this environment if it fails
|
||||
console.error(`Failed to check disk space for ${env.name}:`, error);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check Docker disk usage and send warnings if above threshold
|
||||
*/
|
||||
async function checkDiskSpace() {
|
||||
try {
|
||||
const environments = await getEnvironments();
|
||||
|
||||
// Filter enabled environments and check disk space in parallel
|
||||
const enabledEnvs = environments.filter(env => env.collectMetrics !== false);
|
||||
|
||||
// Process all environments in parallel for better performance
|
||||
await Promise.all(enabledEnvs.map(env => checkEnvDiskSpace(env)));
|
||||
} catch (error) {
|
||||
console.error('Disk space check error:', error);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse size string like "107.4GB" to bytes
|
||||
*/
|
||||
function parseSize(sizeStr: string): number {
|
||||
const units: Record<string, number> = {
|
||||
'B': 1,
|
||||
'KB': 1024,
|
||||
'MB': 1024 * 1024,
|
||||
'GB': 1024 * 1024 * 1024,
|
||||
'TB': 1024 * 1024 * 1024 * 1024
|
||||
};
|
||||
|
||||
const match = sizeStr.match(/^([\d.]+)\s*([KMGT]?B)$/i);
|
||||
if (!match) return 0;
|
||||
|
||||
const value = parseFloat(match[1]);
|
||||
const unit = match[2].toUpperCase();
|
||||
return value * (units[unit] || 1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Format bytes to human readable string
|
||||
*/
|
||||
function formatSize(bytes: number): string {
|
||||
const units = ['B', 'KB', 'MB', 'GB', 'TB'];
|
||||
let unitIndex = 0;
|
||||
let size = bytes;
|
||||
|
||||
while (size >= 1024 && unitIndex < units.length - 1) {
|
||||
size /= 1024;
|
||||
unitIndex++;
|
||||
}
|
||||
|
||||
return `${size.toFixed(1)} ${units[unitIndex]}`;
|
||||
}
|
||||
|
||||
export function startMetricsCollector() {
|
||||
if (collectorInterval) return; // Already running
|
||||
|
||||
console.log('Starting server-side metrics collector (every 10s)');
|
||||
|
||||
// Initial collection
|
||||
collectMetrics();
|
||||
|
||||
// Schedule regular collection
|
||||
collectorInterval = setInterval(collectMetrics, COLLECT_INTERVAL);
|
||||
|
||||
// Start disk space checking (every 5 minutes)
|
||||
console.log('Starting disk space monitoring (every 5 minutes)');
|
||||
checkDiskSpace(); // Initial check
|
||||
diskCheckInterval = setInterval(checkDiskSpace, DISK_CHECK_INTERVAL);
|
||||
}
|
||||
|
||||
export function stopMetricsCollector() {
|
||||
if (collectorInterval) {
|
||||
clearInterval(collectorInterval);
|
||||
collectorInterval = null;
|
||||
}
|
||||
if (diskCheckInterval) {
|
||||
clearInterval(diskCheckInterval);
|
||||
diskCheckInterval = null;
|
||||
}
|
||||
lastDiskWarning.clear();
|
||||
console.log('Metrics collector stopped');
|
||||
}
|
||||
@@ -0,0 +1,508 @@
|
||||
/**
|
||||
* Stack Scanner Service
|
||||
*
|
||||
* Scans external filesystem paths for Docker Compose files and adopts them as stacks.
|
||||
* Discovered stacks are editable - compose and .env files are modified in their original location.
|
||||
*/
|
||||
|
||||
import { readdirSync, existsSync, statSync } from 'node:fs';
|
||||
import { join, basename, dirname, resolve } from 'node:path';
|
||||
import { getExternalStackPaths, getStackSources, upsertStackSource, type StackSourceType } from './db';
|
||||
|
||||
// Compose file patterns to detect (in order of priority)
|
||||
const COMPOSE_PATTERNS = ['docker-compose.yml', 'docker-compose.yaml', 'compose.yml', 'compose.yaml'];
|
||||
|
||||
// Directories to skip during scanning
|
||||
const SKIP_DIRECTORIES = ['.git', 'node_modules', '.docker', '__pycache__', '.venv', 'venv'];
|
||||
|
||||
// Maximum recursion depth to prevent runaway scanning
|
||||
const MAX_DEPTH = 5;
|
||||
|
||||
export interface RunningStackInfo {
|
||||
envId: number;
|
||||
envName: string;
|
||||
containerCount: number;
|
||||
}
|
||||
|
||||
export interface DiscoveredStack {
|
||||
name: string;
|
||||
composePath: string;
|
||||
envPath: string | null;
|
||||
sourceDir: string;
|
||||
serviceCount?: number; // Number of services defined in compose file
|
||||
runningOn?: RunningStackInfo[];
|
||||
}
|
||||
|
||||
export interface ScanResult {
|
||||
discovered: DiscoveredStack[];
|
||||
adopted: string[];
|
||||
skipped: DiscoveredStack[];
|
||||
errors: { path: string; error: string }[];
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize a stack name to be valid (lowercase alphanumeric with hyphens/underscores)
|
||||
*/
|
||||
function normalizeStackName(name: string): string {
|
||||
return name
|
||||
.toLowerCase()
|
||||
.replace(/[^a-z0-9_-]/g, '-')
|
||||
.replace(/-+/g, '-')
|
||||
.replace(/^-|-$/g, '');
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a file looks like a compose file (contains 'services:' key)
|
||||
*/
|
||||
async function isComposeFile(filePath: string): Promise<boolean> {
|
||||
try {
|
||||
const file = Bun.file(filePath);
|
||||
const content = await file.text();
|
||||
// Basic check for services key - could be more sophisticated
|
||||
return /^services:/m.test(content) || /\nservices:/m.test(content);
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Count the number of services defined in a compose file
|
||||
* Uses simple regex to count top-level keys under 'services:' section
|
||||
*/
|
||||
async function countServices(filePath: string): Promise<number> {
|
||||
try {
|
||||
const file = Bun.file(filePath);
|
||||
const content = await file.text();
|
||||
|
||||
// Find the services section and count top-level keys
|
||||
const servicesMatch = content.match(/^services:\s*\n((?:[ \t]+\S[^\n]*\n?)*)/m) ||
|
||||
content.match(/\nservices:\s*\n((?:[ \t]+\S[^\n]*\n?)*)/m);
|
||||
|
||||
if (!servicesMatch) return 0;
|
||||
|
||||
const servicesBlock = servicesMatch[1];
|
||||
// Count lines that start with exactly 2 spaces followed by a non-space (service names)
|
||||
const serviceLines = servicesBlock.match(/^ [a-zA-Z0-9_-]+:/gm);
|
||||
return serviceLines?.length || 0;
|
||||
} catch {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan a single directory path for compose files
|
||||
*/
|
||||
async function scanPath(basePath: string): Promise<{ stacks: DiscoveredStack[]; errors: { path: string; error: string }[] }> {
|
||||
const discovered: DiscoveredStack[] = [];
|
||||
const errors: { path: string; error: string }[] = [];
|
||||
|
||||
// Resolve to absolute path
|
||||
const absolutePath = resolve(basePath);
|
||||
|
||||
// Verify path exists and is a directory
|
||||
if (!existsSync(absolutePath)) {
|
||||
errors.push({ path: basePath, error: 'Path does not exist' });
|
||||
return { stacks: discovered, errors };
|
||||
}
|
||||
|
||||
try {
|
||||
const stat = statSync(absolutePath);
|
||||
if (!stat.isDirectory()) {
|
||||
errors.push({ path: basePath, error: 'Path is not a directory' });
|
||||
return { stacks: discovered, errors };
|
||||
}
|
||||
} catch (err) {
|
||||
errors.push({ path: basePath, error: 'Cannot access path' });
|
||||
return { stacks: discovered, errors };
|
||||
}
|
||||
|
||||
// Track which directories we've found compose files in (to avoid duplicate scanning)
|
||||
const foundStackDirs = new Set<string>();
|
||||
|
||||
async function scan(currentPath: string, depth: number = 0): Promise<void> {
|
||||
// Limit depth to prevent runaway scanning
|
||||
if (depth > MAX_DEPTH) return;
|
||||
|
||||
let entries;
|
||||
try {
|
||||
entries = readdirSync(currentPath, { withFileTypes: true });
|
||||
} catch (err) {
|
||||
// Skip inaccessible directories
|
||||
return;
|
||||
}
|
||||
|
||||
// First pass: check for compose files in this directory
|
||||
for (const pattern of COMPOSE_PATTERNS) {
|
||||
const composePath = join(currentPath, pattern);
|
||||
if (existsSync(composePath)) {
|
||||
// Found a stack! Stack name = directory name
|
||||
const stackName = normalizeStackName(basename(currentPath));
|
||||
if (stackName) {
|
||||
// Check for .env file
|
||||
const envPath = join(currentPath, '.env');
|
||||
// Count services in compose file
|
||||
const serviceCount = await countServices(composePath);
|
||||
discovered.push({
|
||||
name: stackName,
|
||||
composePath,
|
||||
envPath: existsSync(envPath) ? envPath : null,
|
||||
sourceDir: currentPath,
|
||||
serviceCount
|
||||
});
|
||||
foundStackDirs.add(currentPath);
|
||||
}
|
||||
// Don't continue scanning in this directory - it's a stack
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Second pass: check for standalone compose files (*.yml, *.yaml) and recurse into subdirectories
|
||||
for (const entry of entries) {
|
||||
const entryPath = join(currentPath, entry.name);
|
||||
|
||||
if (entry.isDirectory()) {
|
||||
// Skip excluded directories
|
||||
if (SKIP_DIRECTORIES.includes(entry.name)) continue;
|
||||
|
||||
// Skip if we already found a compose file here
|
||||
if (foundStackDirs.has(entryPath)) continue;
|
||||
|
||||
// Recurse into subdirectory
|
||||
await scan(entryPath, depth + 1);
|
||||
} else if (entry.isFile()) {
|
||||
const lowerName = entry.name.toLowerCase();
|
||||
|
||||
// Skip standard compose patterns (already handled above)
|
||||
if (COMPOSE_PATTERNS.includes(entry.name)) continue;
|
||||
|
||||
// Check for standalone compose files (e.g., myapp.yml, myapp.yaml)
|
||||
if (lowerName.endsWith('.yml') || lowerName.endsWith('.yaml')) {
|
||||
// Validate it's actually a compose file
|
||||
if (await isComposeFile(entryPath)) {
|
||||
const stackName = normalizeStackName(
|
||||
entry.name.replace(/\.(yml|yaml)$/i, '')
|
||||
);
|
||||
if (stackName) {
|
||||
// Check for .env file in same directory
|
||||
const envPath = join(currentPath, '.env');
|
||||
// Count services in compose file
|
||||
const serviceCount = await countServices(entryPath);
|
||||
discovered.push({
|
||||
name: stackName,
|
||||
composePath: entryPath,
|
||||
envPath: existsSync(envPath) ? envPath : null,
|
||||
sourceDir: currentPath,
|
||||
serviceCount
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
await scan(absolutePath);
|
||||
return { stacks: discovered, errors };
|
||||
}
|
||||
|
||||
/**
|
||||
* Adopt a single stack into the database
|
||||
* - Checks if stack already exists (by composePath)
|
||||
* - Creates stackSource record with sourceType: 'internal'
|
||||
* - Does NOT deploy - just registers the stack
|
||||
*/
|
||||
export async function adoptStack(
|
||||
stack: DiscoveredStack,
|
||||
environmentId: number
|
||||
): Promise<{ success: boolean; adoptedName?: string; error?: string }> {
|
||||
// Get all existing stack sources to check for duplicates
|
||||
const existingSources = await getStackSources();
|
||||
|
||||
// Check if already adopted (by composePath)
|
||||
const alreadyAdopted = existingSources.some(
|
||||
(s) => s.composePath === stack.composePath
|
||||
);
|
||||
|
||||
if (alreadyAdopted) {
|
||||
return { success: false, error: 'Already adopted' };
|
||||
}
|
||||
|
||||
// Check for name conflict within the same environment
|
||||
let finalName = stack.name;
|
||||
const existingNames = new Set(
|
||||
existingSources
|
||||
.filter((s) => s.environmentId === environmentId)
|
||||
.map((s) => s.stackName)
|
||||
);
|
||||
|
||||
if (existingNames.has(finalName)) {
|
||||
// Append suffix to make unique
|
||||
let suffix = 1;
|
||||
while (existingNames.has(`${stack.name}-${suffix}`)) {
|
||||
suffix++;
|
||||
}
|
||||
finalName = `${stack.name}-${suffix}`;
|
||||
}
|
||||
|
||||
// Create stack source record - use 'internal' since we know the file paths
|
||||
try {
|
||||
await upsertStackSource({
|
||||
stackName: finalName,
|
||||
environmentId,
|
||||
sourceType: 'internal' as StackSourceType,
|
||||
composePath: stack.composePath,
|
||||
envPath: stack.envPath
|
||||
});
|
||||
|
||||
return { success: true, adoptedName: finalName };
|
||||
} catch (err) {
|
||||
console.error(`[Stack Scanner] Failed to adopt ${stack.name}:`, err);
|
||||
return { success: false, error: err instanceof Error ? err.message : 'Unknown error' };
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Adopt multiple selected stacks into the database
|
||||
*/
|
||||
export async function adoptSelectedStacks(
|
||||
stacks: DiscoveredStack[],
|
||||
environmentId: number
|
||||
): Promise<{ adopted: string[]; failed: { name: string; error: string }[] }> {
|
||||
const adopted: string[] = [];
|
||||
const failed: { name: string; error: string }[] = [];
|
||||
|
||||
for (const stack of stacks) {
|
||||
const result = await adoptStack(stack, environmentId);
|
||||
if (result.success && result.adoptedName) {
|
||||
adopted.push(result.adoptedName);
|
||||
} else {
|
||||
failed.push({ name: stack.name, error: result.error || 'Unknown error' });
|
||||
}
|
||||
}
|
||||
|
||||
return { adopted, failed };
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan specific paths and return discovered stacks (without adopting)
|
||||
*/
|
||||
export async function scanPaths(paths: string[]): Promise<ScanResult> {
|
||||
if (paths.length === 0) {
|
||||
return { discovered: [], adopted: [], skipped: [], errors: [] };
|
||||
}
|
||||
|
||||
console.log(`[Stack Scanner] Scanning ${paths.length} path(s)...`);
|
||||
|
||||
const allDiscovered: DiscoveredStack[] = [];
|
||||
const allErrors: { path: string; error: string }[] = [];
|
||||
|
||||
// Scan all paths
|
||||
for (const path of paths) {
|
||||
const { stacks, errors } = await scanPath(path);
|
||||
allDiscovered.push(...stacks);
|
||||
allErrors.push(...errors);
|
||||
}
|
||||
|
||||
console.log(`[Stack Scanner] Found ${allDiscovered.length} compose file(s)`);
|
||||
|
||||
// Check which stacks are already adopted
|
||||
const existingSources = await getStackSources();
|
||||
const alreadyAdopted: DiscoveredStack[] = [];
|
||||
const newStacks: DiscoveredStack[] = [];
|
||||
|
||||
for (const stack of allDiscovered) {
|
||||
const isAdopted = existingSources.some(s => s.composePath === stack.composePath);
|
||||
if (isAdopted) {
|
||||
alreadyAdopted.push(stack);
|
||||
} else {
|
||||
newStacks.push(stack);
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
discovered: newStacks,
|
||||
adopted: [],
|
||||
skipped: alreadyAdopted,
|
||||
errors: allErrors
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan all configured external paths and return discovered stacks (without adopting)
|
||||
*/
|
||||
export async function scanExternalPaths(): Promise<ScanResult> {
|
||||
const paths = await getExternalStackPaths();
|
||||
|
||||
if (paths.length === 0) {
|
||||
return { discovered: [], adopted: [], skipped: [], errors: [] };
|
||||
}
|
||||
|
||||
console.log(`[Stack Scanner] Scanning ${paths.length} external path(s)...`);
|
||||
|
||||
const allDiscovered: DiscoveredStack[] = [];
|
||||
const allErrors: { path: string; error: string }[] = [];
|
||||
|
||||
// Scan all paths
|
||||
for (const path of paths) {
|
||||
const { stacks, errors } = await scanPath(path);
|
||||
allDiscovered.push(...stacks);
|
||||
allErrors.push(...errors);
|
||||
}
|
||||
|
||||
console.log(`[Stack Scanner] Found ${allDiscovered.length} compose file(s)`);
|
||||
|
||||
// Check which stacks are already adopted
|
||||
const existingSources = await getStackSources();
|
||||
const alreadyAdopted: DiscoveredStack[] = [];
|
||||
const newStacks: DiscoveredStack[] = [];
|
||||
|
||||
for (const stack of allDiscovered) {
|
||||
const isAdopted = existingSources.some(s => s.composePath === stack.composePath);
|
||||
if (isAdopted) {
|
||||
alreadyAdopted.push(stack);
|
||||
} else {
|
||||
newStacks.push(stack);
|
||||
}
|
||||
}
|
||||
|
||||
if (alreadyAdopted.length > 0) {
|
||||
console.log(`[Stack Scanner] ${alreadyAdopted.length} stack(s) already adopted`);
|
||||
}
|
||||
if (newStacks.length > 0) {
|
||||
console.log(`[Stack Scanner] ${newStacks.length} new stack(s) available for adoption`);
|
||||
}
|
||||
if (allErrors.length > 0) {
|
||||
console.warn(`[Stack Scanner] ${allErrors.length} error(s) during scanning`);
|
||||
}
|
||||
|
||||
return {
|
||||
discovered: newStacks, // Only return stacks not yet adopted
|
||||
adopted: [], // No auto-adopt anymore
|
||||
skipped: alreadyAdopted,
|
||||
errors: allErrors
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if two paths overlap (one is parent/child of the other)
|
||||
*/
|
||||
function pathsOverlap(path1: string, path2: string): 'parent' | 'child' | 'same' | null {
|
||||
const resolved1 = resolve(path1);
|
||||
const resolved2 = resolve(path2);
|
||||
|
||||
if (resolved1 === resolved2) {
|
||||
return 'same';
|
||||
}
|
||||
|
||||
// Normalize paths with trailing slash for proper prefix matching
|
||||
const normalized1 = resolved1.endsWith('/') ? resolved1 : resolved1 + '/';
|
||||
const normalized2 = resolved2.endsWith('/') ? resolved2 : resolved2 + '/';
|
||||
|
||||
if (normalized2.startsWith(normalized1)) {
|
||||
// path1 is parent of path2
|
||||
return 'parent';
|
||||
}
|
||||
|
||||
if (normalized1.startsWith(normalized2)) {
|
||||
// path1 is child of path2
|
||||
return 'child';
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate that a path exists, is a directory, and doesn't overlap with existing paths
|
||||
*/
|
||||
export function validatePath(
|
||||
path: string,
|
||||
existingPaths: string[] = []
|
||||
): { valid: boolean; error?: string; resolvedPath?: string } {
|
||||
if (!path || typeof path !== 'string') {
|
||||
return { valid: false, error: 'Path is required' };
|
||||
}
|
||||
|
||||
const resolvedPath = resolve(path.trim());
|
||||
|
||||
if (!existsSync(resolvedPath)) {
|
||||
return { valid: false, error: 'Path does not exist' };
|
||||
}
|
||||
|
||||
try {
|
||||
const stat = statSync(resolvedPath);
|
||||
if (!stat.isDirectory()) {
|
||||
return { valid: false, error: 'Path is not a directory' };
|
||||
}
|
||||
} catch {
|
||||
return { valid: false, error: 'Cannot access path' };
|
||||
}
|
||||
|
||||
// Check for overlapping paths
|
||||
for (const existingPath of existingPaths) {
|
||||
const overlap = pathsOverlap(resolvedPath, existingPath);
|
||||
if (overlap === 'same') {
|
||||
return { valid: false, error: 'This location is already added' };
|
||||
}
|
||||
if (overlap === 'parent') {
|
||||
return { valid: false, error: `This path contains an existing location: ${existingPath}` };
|
||||
}
|
||||
if (overlap === 'child') {
|
||||
return { valid: false, error: `This path is inside an existing location: ${existingPath}` };
|
||||
}
|
||||
}
|
||||
|
||||
return { valid: true, resolvedPath };
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect which discovered stacks are already running on any environment.
|
||||
* Matches by stack name (com.docker.compose.project label) since paths may differ.
|
||||
*/
|
||||
export async function detectRunningStacks(
|
||||
discovered: DiscoveredStack[]
|
||||
): Promise<DiscoveredStack[]> {
|
||||
if (discovered.length === 0) {
|
||||
return discovered;
|
||||
}
|
||||
|
||||
// Dynamic imports to avoid circular dependencies
|
||||
const { listComposeStacks } = await import('./stacks.js');
|
||||
const { getEnvironments } = await import('./db.js');
|
||||
|
||||
// Get all environments
|
||||
const environments = await getEnvironments();
|
||||
|
||||
if (environments.length === 0) {
|
||||
return discovered;
|
||||
}
|
||||
|
||||
// Build map of stack name -> running info across all environments
|
||||
const runningStacksMap = new Map<string, RunningStackInfo[]>();
|
||||
|
||||
// Query each environment in parallel for running stacks
|
||||
await Promise.all(
|
||||
environments.map(async (env) => {
|
||||
try {
|
||||
const stacks = await listComposeStacks(env.id);
|
||||
for (const stack of stacks) {
|
||||
const existing = runningStacksMap.get(stack.name) || [];
|
||||
existing.push({
|
||||
envId: env.id,
|
||||
envName: env.name,
|
||||
containerCount: stack.containers?.length || 0
|
||||
});
|
||||
runningStacksMap.set(stack.name, existing);
|
||||
}
|
||||
} catch (error) {
|
||||
// Environment might be offline - skip silently
|
||||
console.warn(`[Stack Scanner] Failed to query environment ${env.name}:`, error);
|
||||
}
|
||||
})
|
||||
);
|
||||
|
||||
// Attach running info to discovered stacks by matching name
|
||||
return discovered.map((stack) => ({
|
||||
...stack,
|
||||
runningOn: runningStacksMap.get(stack.name)
|
||||
}));
|
||||
}
|
||||
+769
-149
File diff suppressed because it is too large
Load Diff
@@ -102,7 +102,12 @@ export interface ShutdownCommand {
|
||||
type: 'shutdown';
|
||||
}
|
||||
|
||||
export type MainProcessCommand = RefreshEnvironmentsCommand | ShutdownCommand;
|
||||
export interface UpdateIntervalCommand {
|
||||
type: 'update_interval';
|
||||
intervalMs: number;
|
||||
}
|
||||
|
||||
export type MainProcessCommand = RefreshEnvironmentsCommand | ShutdownCommand | UpdateIntervalCommand;
|
||||
|
||||
// Subprocess configuration
|
||||
interface SubprocessConfig {
|
||||
@@ -198,6 +203,20 @@ class SubprocessManager {
|
||||
this.sendToEvents({ type: 'refresh_environments' });
|
||||
}
|
||||
|
||||
/**
|
||||
* Send message to metrics subprocess
|
||||
*/
|
||||
sendToMetricsSubprocess(message: MainProcessCommand): void {
|
||||
this.sendToMetrics(message);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send message to events subprocess
|
||||
*/
|
||||
sendToEventsSubprocess(message: MainProcessCommand): void {
|
||||
this.sendToEvents(message);
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the metrics collection subprocess
|
||||
*/
|
||||
@@ -591,3 +610,21 @@ export function refreshSubprocessEnvironments(): void {
|
||||
manager.refreshEnvironments();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Send message to event subprocess
|
||||
*/
|
||||
export function sendToEventSubprocess(message: MainProcessCommand): void {
|
||||
if (manager) {
|
||||
manager.sendToEventsSubprocess(message);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Send message to metrics subprocess
|
||||
*/
|
||||
export function sendToMetricsSubprocess(message: MainProcessCommand): void {
|
||||
if (manager) {
|
||||
manager.sendToMetricsSubprocess(message);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
* Communication with main process via IPC (process.send).
|
||||
*/
|
||||
|
||||
import { getEnvironments, type ContainerEventAction } from '../db';
|
||||
import { getEnvironments, getEventCollectionMode, getEventPollInterval, type ContainerEventAction } from '../db';
|
||||
import { getDockerEvents } from '../docker';
|
||||
import type { MainProcessCommand } from '../subprocess-manager';
|
||||
|
||||
@@ -19,9 +19,15 @@ const MAX_RECONNECT_DELAY = 60000; // 1 minute max
|
||||
// Only send notifications on status CHANGES, not on every reconnect attempt
|
||||
const environmentOnlineStatus: Map<number, boolean> = new Map();
|
||||
|
||||
// Active collectors per environment
|
||||
// Active collectors per environment (for streaming mode)
|
||||
const collectors: Map<number, AbortController> = new Map();
|
||||
|
||||
// Poll intervals per environment (for polling mode)
|
||||
const pollIntervals: Map<number, ReturnType<typeof setInterval>> = new Map();
|
||||
|
||||
// Last poll timestamp per environment (for polling mode)
|
||||
const lastPollTime: Map<number, number> = new Map();
|
||||
|
||||
// Recent event cache for deduplication (key: timeNano-containerId-action)
|
||||
const recentEvents: Map<string, number> = new Map();
|
||||
const DEDUP_WINDOW_MS = 5000; // 5 second window for deduplication
|
||||
@@ -30,6 +36,10 @@ const CACHE_CLEANUP_INTERVAL_MS = 30000; // Clean up cache every 30 seconds
|
||||
let cacheCleanupInterval: ReturnType<typeof setInterval> | null = null;
|
||||
let isShuttingDown = false;
|
||||
|
||||
// Track current settings to detect changes
|
||||
let currentPollInterval: number = 60000;
|
||||
let currentMode: 'stream' | 'poll' = 'stream';
|
||||
|
||||
// Actions we care about for container activity
|
||||
const CONTAINER_ACTIONS: ContainerEventAction[] = [
|
||||
'create',
|
||||
@@ -211,6 +221,76 @@ function processEvent(event: DockerEvent, envId: number) {
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Poll events for a specific environment (polling mode)
|
||||
*/
|
||||
async function pollEnvironmentEvents(envId: number, envName: string) {
|
||||
try {
|
||||
// Calculate 'since' timestamp (use last poll time, or start from 30s ago if first poll)
|
||||
const now = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
|
||||
const since = lastPollTime.get(envId) || (now - 30); // Default to 30s ago on first poll
|
||||
|
||||
// Fetch events since last check until now
|
||||
// IMPORTANT: 'until' is required for polling mode, otherwise Docker keeps the connection open
|
||||
const eventStream = await getDockerEvents(
|
||||
{ type: ['container'] },
|
||||
envId,
|
||||
{ since: since.toString(), until: now.toString() }
|
||||
);
|
||||
|
||||
if (!eventStream) {
|
||||
console.error(`[EventSubprocess] Failed to fetch events for ${envName}`);
|
||||
updateEnvironmentStatus(envId, envName, false, 'Failed to fetch Docker events');
|
||||
return;
|
||||
}
|
||||
|
||||
// Mark environment as online
|
||||
updateEnvironmentStatus(envId, envName, true);
|
||||
|
||||
// Read and process all events
|
||||
const reader = eventStream.getReader();
|
||||
const decoder = new TextDecoder();
|
||||
let buffer = '';
|
||||
|
||||
try {
|
||||
while (true) {
|
||||
const { done, value } = await reader.read();
|
||||
if (done) break;
|
||||
|
||||
buffer += decoder.decode(value, { stream: true });
|
||||
const lines = buffer.split('\n');
|
||||
buffer = lines.pop() || '';
|
||||
|
||||
for (const line of lines) {
|
||||
if (line.trim()) {
|
||||
try {
|
||||
const event = JSON.parse(line) as DockerEvent;
|
||||
processEvent(event, envId);
|
||||
} catch {
|
||||
// Ignore parse errors
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
try {
|
||||
reader.releaseLock();
|
||||
} catch {
|
||||
// Reader already released
|
||||
}
|
||||
}
|
||||
|
||||
// Update last poll time
|
||||
lastPollTime.set(envId, now);
|
||||
|
||||
} catch (error: any) {
|
||||
if (!isShuttingDown) {
|
||||
console.error(`[EventSubprocess] Poll error for ${envName}:`, error.message);
|
||||
updateEnvironmentStatus(envId, envName, false, error.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Start collecting events for a specific environment
|
||||
*/
|
||||
@@ -332,7 +412,42 @@ async function startEnvironmentCollector(envId: number, envName: string) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop collecting events for a specific environment
|
||||
* Start polling mode for a specific environment
|
||||
*/
|
||||
async function startEnvironmentPoller(envId: number, envName: string, interval: number) {
|
||||
// Stop existing poller if any
|
||||
stopEnvironmentPoller(envId);
|
||||
|
||||
console.log(`[EventSubprocess] Starting poller for ${envName} (every ${interval / 1000}s)`);
|
||||
|
||||
// Initial poll immediately
|
||||
await pollEnvironmentEvents(envId, envName);
|
||||
|
||||
// Set up interval for subsequent polls
|
||||
const intervalId = setInterval(async () => {
|
||||
if (!isShuttingDown) {
|
||||
await pollEnvironmentEvents(envId, envName);
|
||||
}
|
||||
}, interval);
|
||||
|
||||
pollIntervals.set(envId, intervalId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop polling for a specific environment
|
||||
*/
|
||||
function stopEnvironmentPoller(envId: number) {
|
||||
const intervalId = pollIntervals.get(envId);
|
||||
if (intervalId) {
|
||||
clearInterval(intervalId);
|
||||
pollIntervals.delete(envId);
|
||||
lastPollTime.delete(envId);
|
||||
environmentOnlineStatus.delete(envId);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop collecting events for a specific environment (streaming mode)
|
||||
*/
|
||||
function stopEnvironmentCollector(envId: number) {
|
||||
const controller = collectors.get(envId);
|
||||
@@ -351,6 +466,21 @@ async function refreshEventCollectors() {
|
||||
|
||||
try {
|
||||
const environments = await getEnvironments();
|
||||
const mode = await getEventCollectionMode();
|
||||
const pollInterval = await getEventPollInterval();
|
||||
|
||||
// Detect if settings changed
|
||||
const modeChanged = mode !== currentMode;
|
||||
const intervalChanged = pollInterval !== currentPollInterval;
|
||||
|
||||
if (modeChanged) {
|
||||
console.log(`[EventSubprocess] Mode changed from ${currentMode} to ${mode}`);
|
||||
currentMode = mode;
|
||||
}
|
||||
if (intervalChanged) {
|
||||
console.log(`[EventSubprocess] Poll interval changed from ${currentPollInterval}ms to ${pollInterval}ms`);
|
||||
currentPollInterval = pollInterval;
|
||||
}
|
||||
|
||||
// Filter: only collect for environments with activity enabled AND not Hawser Edge
|
||||
const activeEnvIds = new Set(
|
||||
@@ -362,18 +492,55 @@ async function refreshEventCollectors() {
|
||||
// Stop collectors for removed environments or those with collection disabled
|
||||
for (const envId of collectors.keys()) {
|
||||
if (!activeEnvIds.has(envId)) {
|
||||
console.log(`[EventSubprocess] Stopping collector for environment ${envId}`);
|
||||
console.log(`[EventSubprocess] Stopping stream collector for environment ${envId}`);
|
||||
stopEnvironmentCollector(envId);
|
||||
}
|
||||
}
|
||||
|
||||
// Start collectors for environments with collection enabled
|
||||
// Stop pollers for removed environments or those with collection disabled
|
||||
// Also restart all pollers if interval changed
|
||||
for (const envId of pollIntervals.keys()) {
|
||||
if (!activeEnvIds.has(envId)) {
|
||||
console.log(`[EventSubprocess] Stopping poller for environment ${envId}`);
|
||||
stopEnvironmentPoller(envId);
|
||||
} else if (intervalChanged && mode === 'poll') {
|
||||
// Restart poller with new interval
|
||||
console.log(`[EventSubprocess] Restarting poller for environment ${envId} with new interval`);
|
||||
stopEnvironmentPoller(envId);
|
||||
}
|
||||
}
|
||||
|
||||
// Start collectors based on mode
|
||||
for (const env of environments) {
|
||||
// Skip Hawser Edge (handled by main process)
|
||||
if (env.connectionType === 'hawser-edge') continue;
|
||||
|
||||
if (env.collectActivity && !collectors.has(env.id)) {
|
||||
startEnvironmentCollector(env.id, env.name);
|
||||
// Skip if activity collection is disabled
|
||||
if (!env.collectActivity) continue;
|
||||
|
||||
const hasStreamCollector = collectors.has(env.id);
|
||||
const hasPoller = pollIntervals.has(env.id);
|
||||
|
||||
if (mode === 'stream') {
|
||||
// Switch from polling to streaming if needed
|
||||
if (hasPoller) {
|
||||
console.log(`[EventSubprocess] Switching ${env.name} from poll to stream`);
|
||||
stopEnvironmentPoller(env.id);
|
||||
}
|
||||
// Start stream if not already running
|
||||
if (!hasStreamCollector) {
|
||||
startEnvironmentCollector(env.id, env.name);
|
||||
}
|
||||
} else if (mode === 'poll') {
|
||||
// Switch from streaming to polling if needed
|
||||
if (hasStreamCollector) {
|
||||
console.log(`[EventSubprocess] Switching ${env.name} from stream to poll`);
|
||||
stopEnvironmentCollector(env.id);
|
||||
}
|
||||
// Start poller if not already running (will also restart after interval change above)
|
||||
if (!hasPoller) {
|
||||
startEnvironmentPoller(env.id, env.name, pollInterval);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
@@ -392,6 +559,13 @@ function handleCommand(command: MainProcessCommand): void {
|
||||
refreshEventCollectors();
|
||||
break;
|
||||
|
||||
case 'update_interval':
|
||||
// This is used by metrics subprocess, but we handle it here too for consistency
|
||||
// Event subprocess re-reads interval from DB on refresh
|
||||
console.log('[EventSubprocess] Interval update - refreshing collectors...');
|
||||
refreshEventCollectors();
|
||||
break;
|
||||
|
||||
case 'shutdown':
|
||||
console.log('[EventSubprocess] Shutdown requested');
|
||||
shutdown();
|
||||
@@ -411,11 +585,16 @@ function shutdown(): void {
|
||||
cacheCleanupInterval = null;
|
||||
}
|
||||
|
||||
// Stop all environment collectors
|
||||
// Stop all environment stream collectors
|
||||
for (const envId of collectors.keys()) {
|
||||
stopEnvironmentCollector(envId);
|
||||
}
|
||||
|
||||
// Stop all environment pollers
|
||||
for (const envId of pollIntervals.keys()) {
|
||||
stopEnvironmentPoller(envId);
|
||||
}
|
||||
|
||||
// Clear the deduplication cache
|
||||
recentEvents.clear();
|
||||
|
||||
@@ -429,6 +608,15 @@ function shutdown(): void {
|
||||
async function start(): Promise<void> {
|
||||
console.log('[EventSubprocess] Starting container event collection...');
|
||||
|
||||
// Initialize current settings from database
|
||||
try {
|
||||
currentMode = await getEventCollectionMode();
|
||||
currentPollInterval = await getEventPollInterval();
|
||||
console.log(`[EventSubprocess] Initial mode: ${currentMode}, poll interval: ${currentPollInterval}ms`);
|
||||
} catch (error) {
|
||||
console.error('[EventSubprocess] Failed to load settings, using defaults:', error);
|
||||
}
|
||||
|
||||
// Start collectors for all environments
|
||||
await refreshEventCollectors();
|
||||
|
||||
|
||||
@@ -7,12 +7,12 @@
|
||||
* Communication with main process via IPC (process.send).
|
||||
*/
|
||||
|
||||
import { getEnvironments, getEnvSetting } from '../db';
|
||||
import { getEnvironments, getEnvSetting, getMetricsCollectionInterval } from '../db';
|
||||
import { listContainers, getContainerStats, getDockerInfo, getDiskUsage } from '../docker';
|
||||
import os from 'node:os';
|
||||
import type { MainProcessCommand } from '../subprocess-manager';
|
||||
|
||||
const COLLECT_INTERVAL = 10000; // 10 seconds
|
||||
let COLLECT_INTERVAL = 30000; // 30 seconds (default, will be loaded from settings)
|
||||
const DISK_CHECK_INTERVAL = 300000; // 5 minutes
|
||||
const DEFAULT_DISK_THRESHOLD = 80; // 80% threshold for disk warnings
|
||||
const ENV_METRICS_TIMEOUT = 15000; // 15 seconds timeout per environment for metrics
|
||||
@@ -82,12 +82,16 @@ async function collectEnvMetrics(env: { id: number; name: string; host?: string;
|
||||
cpuPercent = (cpuDelta / systemDelta) * cpuCount * 100;
|
||||
}
|
||||
|
||||
// Get container memory usage (subtract cache for actual usage)
|
||||
// Get container memory usage using the same formula as Docker CLI
|
||||
// Docker subtracts cache (inactive_file) from total usage
|
||||
// - cgroup v2: uses 'inactive_file'
|
||||
// - cgroup v1: uses 'total_inactive_file'
|
||||
const memUsage = stats.memory_stats?.usage || 0;
|
||||
const memCache = stats.memory_stats?.stats?.cache || 0;
|
||||
const actualMemUsed = memUsage - memCache;
|
||||
const memStats = stats.memory_stats?.stats || {};
|
||||
const memCache = memStats.inactive_file ?? memStats.total_inactive_file ?? 0;
|
||||
const actualMemUsed = memCache > 0 && memCache < memUsage ? memUsage - memCache : memUsage;
|
||||
|
||||
return { cpuPercent, memUsage: actualMemUsed > 0 ? actualMemUsed : memUsage };
|
||||
return { cpuPercent, memUsage: actualMemUsed };
|
||||
} catch {
|
||||
return { cpuPercent: 0, memUsage: 0 };
|
||||
}
|
||||
@@ -356,6 +360,16 @@ function handleCommand(command: MainProcessCommand): void {
|
||||
// The next collection cycle will pick up the new environments
|
||||
break;
|
||||
|
||||
case 'update_interval':
|
||||
console.log(`[MetricsSubprocess] Updating collection interval to ${command.intervalMs}ms`);
|
||||
COLLECT_INTERVAL = command.intervalMs;
|
||||
// Clear existing interval and restart with new timing
|
||||
if (collectInterval) {
|
||||
clearInterval(collectInterval);
|
||||
collectInterval = setInterval(collectMetrics, COLLECT_INTERVAL);
|
||||
}
|
||||
break;
|
||||
|
||||
case 'shutdown':
|
||||
console.log('[MetricsSubprocess] Shutdown requested');
|
||||
shutdown();
|
||||
@@ -386,8 +400,15 @@ function shutdown(): void {
|
||||
/**
|
||||
* Start the metrics collector
|
||||
*/
|
||||
function start(): void {
|
||||
console.log('[MetricsSubprocess] Starting metrics collection (every 10s)...');
|
||||
async function start(): Promise<void> {
|
||||
// Load interval from settings
|
||||
try {
|
||||
COLLECT_INTERVAL = await getMetricsCollectionInterval();
|
||||
console.log(`[MetricsSubprocess] Starting metrics collection (every ${COLLECT_INTERVAL / 1000}s)...`);
|
||||
} catch (error) {
|
||||
console.error('[MetricsSubprocess] Failed to load interval from settings, using default 30s');
|
||||
COLLECT_INTERVAL = 30000;
|
||||
}
|
||||
|
||||
// Initial collection
|
||||
collectMetrics();
|
||||
|
||||
@@ -70,8 +70,21 @@ function createGridPreferencesStore() {
|
||||
return getDefaultColumnPreferences(gridId);
|
||||
}
|
||||
|
||||
// Return columns in saved order, filtering to visible ones
|
||||
return gridPrefs.columns.filter((col) => col.visible);
|
||||
// Merge with defaults to ensure new columns are included
|
||||
const defaults = getDefaultColumnPreferences(gridId);
|
||||
const savedIds = new Set(gridPrefs.columns.map((c) => c.id));
|
||||
|
||||
// Start with saved visible columns
|
||||
const result = gridPrefs.columns.filter((col) => col.visible);
|
||||
|
||||
// Add any new default columns that aren't in saved preferences
|
||||
for (const def of defaults) {
|
||||
if (!savedIds.has(def.id) && def.visible) {
|
||||
result.push(def);
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
},
|
||||
|
||||
// Get all columns for a grid (visible and hidden, in order)
|
||||
|
||||
@@ -4,6 +4,7 @@ import { browser } from '$app/environment';
|
||||
export type TimeFormat = '12h' | '24h';
|
||||
export type DateFormat = 'MM/DD/YYYY' | 'DD/MM/YYYY' | 'YYYY-MM-DD' | 'DD.MM.YYYY';
|
||||
export type DownloadFormat = 'tar' | 'tar.gz';
|
||||
export type EventCollectionMode = 'stream' | 'poll';
|
||||
|
||||
export interface AppSettings {
|
||||
confirmDestructive: boolean;
|
||||
@@ -22,6 +23,11 @@ export interface AppSettings {
|
||||
eventCleanupEnabled: boolean;
|
||||
logBufferSizeKb: number;
|
||||
defaultTimezone: string;
|
||||
eventCollectionMode: EventCollectionMode;
|
||||
eventPollInterval: number;
|
||||
metricsCollectionInterval: number;
|
||||
externalStackPaths: string[];
|
||||
primaryStackLocation: string | null;
|
||||
}
|
||||
|
||||
const DEFAULT_SETTINGS: AppSettings = {
|
||||
@@ -40,7 +46,12 @@ const DEFAULT_SETTINGS: AppSettings = {
|
||||
scheduleCleanupEnabled: true,
|
||||
eventCleanupEnabled: true,
|
||||
logBufferSizeKb: 500,
|
||||
defaultTimezone: 'UTC'
|
||||
defaultTimezone: 'UTC',
|
||||
eventCollectionMode: 'stream',
|
||||
eventPollInterval: 60000,
|
||||
metricsCollectionInterval: 30000,
|
||||
externalStackPaths: [],
|
||||
primaryStackLocation: null
|
||||
};
|
||||
|
||||
// Create a writable store for app settings
|
||||
@@ -73,7 +84,12 @@ function createSettingsStore() {
|
||||
scheduleCleanupEnabled: settings.scheduleCleanupEnabled ?? DEFAULT_SETTINGS.scheduleCleanupEnabled,
|
||||
eventCleanupEnabled: settings.eventCleanupEnabled ?? DEFAULT_SETTINGS.eventCleanupEnabled,
|
||||
logBufferSizeKb: settings.logBufferSizeKb ?? DEFAULT_SETTINGS.logBufferSizeKb,
|
||||
defaultTimezone: settings.defaultTimezone ?? DEFAULT_SETTINGS.defaultTimezone
|
||||
defaultTimezone: settings.defaultTimezone ?? DEFAULT_SETTINGS.defaultTimezone,
|
||||
eventCollectionMode: settings.eventCollectionMode ?? DEFAULT_SETTINGS.eventCollectionMode,
|
||||
eventPollInterval: settings.eventPollInterval ?? DEFAULT_SETTINGS.eventPollInterval,
|
||||
metricsCollectionInterval: settings.metricsCollectionInterval ?? DEFAULT_SETTINGS.metricsCollectionInterval,
|
||||
externalStackPaths: settings.externalStackPaths ?? DEFAULT_SETTINGS.externalStackPaths,
|
||||
primaryStackLocation: settings.primaryStackLocation ?? DEFAULT_SETTINGS.primaryStackLocation
|
||||
});
|
||||
}
|
||||
} catch {
|
||||
@@ -109,7 +125,12 @@ function createSettingsStore() {
|
||||
scheduleCleanupEnabled: updatedSettings.scheduleCleanupEnabled ?? DEFAULT_SETTINGS.scheduleCleanupEnabled,
|
||||
eventCleanupEnabled: updatedSettings.eventCleanupEnabled ?? DEFAULT_SETTINGS.eventCleanupEnabled,
|
||||
logBufferSizeKb: updatedSettings.logBufferSizeKb ?? DEFAULT_SETTINGS.logBufferSizeKb,
|
||||
defaultTimezone: updatedSettings.defaultTimezone ?? DEFAULT_SETTINGS.defaultTimezone
|
||||
defaultTimezone: updatedSettings.defaultTimezone ?? DEFAULT_SETTINGS.defaultTimezone,
|
||||
eventCollectionMode: updatedSettings.eventCollectionMode ?? DEFAULT_SETTINGS.eventCollectionMode,
|
||||
eventPollInterval: updatedSettings.eventPollInterval ?? DEFAULT_SETTINGS.eventPollInterval,
|
||||
metricsCollectionInterval: updatedSettings.metricsCollectionInterval ?? DEFAULT_SETTINGS.metricsCollectionInterval,
|
||||
externalStackPaths: updatedSettings.externalStackPaths ?? DEFAULT_SETTINGS.externalStackPaths,
|
||||
primaryStackLocation: updatedSettings.primaryStackLocation ?? DEFAULT_SETTINGS.primaryStackLocation
|
||||
});
|
||||
}
|
||||
} catch (error) {
|
||||
@@ -248,6 +269,41 @@ function createSettingsStore() {
|
||||
return newSettings;
|
||||
});
|
||||
},
|
||||
setEventCollectionMode: (value: EventCollectionMode) => {
|
||||
update((current) => {
|
||||
const newSettings = { ...current, eventCollectionMode: value };
|
||||
saveSettings({ eventCollectionMode: value });
|
||||
return newSettings;
|
||||
});
|
||||
},
|
||||
setEventPollInterval: (value: number) => {
|
||||
update((current) => {
|
||||
const newSettings = { ...current, eventPollInterval: value };
|
||||
saveSettings({ eventPollInterval: value });
|
||||
return newSettings;
|
||||
});
|
||||
},
|
||||
setMetricsCollectionInterval: (value: number) => {
|
||||
update((current) => {
|
||||
const newSettings = { ...current, metricsCollectionInterval: value };
|
||||
saveSettings({ metricsCollectionInterval: value });
|
||||
return newSettings;
|
||||
});
|
||||
},
|
||||
setExternalStackPaths: (value: string[]) => {
|
||||
update((current) => {
|
||||
const newSettings = { ...current, externalStackPaths: value };
|
||||
saveSettings({ externalStackPaths: value });
|
||||
return newSettings;
|
||||
});
|
||||
},
|
||||
setPrimaryStackLocation: (value: string | null) => {
|
||||
update((current) => {
|
||||
const newSettings = { ...current, primaryStackLocation: value };
|
||||
saveSettings({ primaryStackLocation: value });
|
||||
return newSettings;
|
||||
});
|
||||
},
|
||||
// Manual refresh from database
|
||||
refresh: loadSettings
|
||||
};
|
||||
|
||||
+4
-1
@@ -34,6 +34,7 @@ export interface ImageInfo {
|
||||
size: number;
|
||||
virtualSize: number;
|
||||
labels: Record<string, string>;
|
||||
containers: number; // Number of containers using this image
|
||||
}
|
||||
|
||||
export interface VolumeUsage {
|
||||
@@ -90,7 +91,9 @@ export interface ContainerStats {
|
||||
id: string;
|
||||
name: string;
|
||||
cpuPercent: number;
|
||||
memoryUsage: number;
|
||||
memoryUsage: number; // Actual usage (total - cache), same as docker stats
|
||||
memoryRaw: number; // Raw total usage before cache subtraction
|
||||
memoryCache: number; // File cache (inactive_file)
|
||||
memoryLimit: number;
|
||||
memoryPercent: number;
|
||||
networkRx: number;
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
/**
|
||||
* Clean PEM content by removing whitespace artifacts from copy/paste.
|
||||
* Bun's TLS is strict about PEM format - it fails when certificates have
|
||||
* leading/trailing spaces on lines or extra blank lines.
|
||||
*
|
||||
* @param pem - The PEM content to clean
|
||||
* @returns Cleaned PEM content with trimmed lines and no empty lines, or null if empty
|
||||
*/
|
||||
export function cleanPem(pem: string | null | undefined): string | null {
|
||||
if (!pem) return null;
|
||||
|
||||
const cleaned = pem
|
||||
.split('\n')
|
||||
.map((line) => line.trim())
|
||||
.filter((line) => line.length > 0)
|
||||
.join('\n');
|
||||
|
||||
return cleaned.length > 0 ? cleaned : null;
|
||||
}
|
||||
@@ -12,7 +12,7 @@
|
||||
import { SidebarProvider, SidebarTrigger } from '$lib/components/ui/sidebar';
|
||||
import { startStatsCollection, stopStatsCollection } from '$lib/stores/stats';
|
||||
import { connectSSE, disconnectSSE } from '$lib/stores/events';
|
||||
import { currentEnvironment } from '$lib/stores/environment';
|
||||
import { currentEnvironment, environments } from '$lib/stores/environment';
|
||||
import { licenseStore, daysUntilExpiry } from '$lib/stores/license';
|
||||
import { authStore } from '$lib/stores/auth';
|
||||
import { themeStore, applyTheme } from '$lib/stores/theme';
|
||||
@@ -51,6 +51,18 @@
|
||||
}
|
||||
});
|
||||
|
||||
// Refresh environments when user becomes authenticated
|
||||
// This handles OIDC callback where login happens server-side
|
||||
let wasAuthenticated = $state(false);
|
||||
$effect(() => {
|
||||
if (!$authStore.loading && $authStore.authenticated && !wasAuthenticated) {
|
||||
environments.refresh();
|
||||
}
|
||||
if (!$authStore.loading) {
|
||||
wasAuthenticated = $authStore.authenticated;
|
||||
}
|
||||
});
|
||||
|
||||
onMount(() => {
|
||||
// Apply theme from localStorage immediately (for flash-free loading)
|
||||
applyTheme(themeStore.get());
|
||||
|
||||
+69
-31
@@ -12,6 +12,7 @@
|
||||
import DraggableGrid, { type GridItemLayout } from './dashboard/DraggableGrid.svelte';
|
||||
import { dashboardPreferences, dashboardData, GRID_COLS, GRID_ROW_HEIGHT, type TileItem } from '$lib/stores/dashboard';
|
||||
import { currentEnvironment } from '$lib/stores/environment';
|
||||
import { IsMobile } from '$lib/hooks/is-mobile.svelte';
|
||||
import type { EnvironmentStats } from './api/dashboard/stats/+server';
|
||||
import { getLabelColor, getLabelBgColor } from '$lib/utils/label-colors';
|
||||
|
||||
@@ -43,6 +44,8 @@
|
||||
let initialLoading = $state(true);
|
||||
let refreshing = $state(false);
|
||||
let prefsLoaded = $state(false);
|
||||
const mobileWatcher = new IsMobile();
|
||||
const isMobile = $derived.by(() => mobileWatcher.current);
|
||||
|
||||
// Label filtering - load from localStorage
|
||||
let filterLabels = $state<string[]>([]);
|
||||
@@ -113,6 +116,9 @@
|
||||
return tileLabels.some(label => filterLabels.includes(label));
|
||||
});
|
||||
});
|
||||
const orderedGridItems = $derived.by(() => {
|
||||
return [...filteredGridItems].sort((a, b) => (a.y - b.y) || (a.x - b.x));
|
||||
});
|
||||
|
||||
// AbortController for SSE stream cleanup
|
||||
let abortController: AbortController | null = null;
|
||||
@@ -335,7 +341,7 @@
|
||||
connectionType: env.connectionType || 'socket',
|
||||
labels: env.labels || [],
|
||||
scannerEnabled: false,
|
||||
online: false,
|
||||
online: undefined, // undefined = connecting, false = offline, true = online
|
||||
containers: { total: 0, running: 0, stopped: 0, paused: 0, restarting: 0, unhealthy: 0 },
|
||||
images: { total: 0, totalSize: 0 },
|
||||
volumes: { total: 0, totalSize: 0 },
|
||||
@@ -965,36 +971,68 @@
|
||||
</Button>
|
||||
</div>
|
||||
{:else}
|
||||
<!-- Custom Draggable Grid -->
|
||||
<DraggableGrid
|
||||
items={filteredGridItems}
|
||||
cols={GRID_COLS}
|
||||
rowHeight={GRID_ROW_HEIGHT}
|
||||
gap={10}
|
||||
minW={1}
|
||||
maxW={2}
|
||||
minH={1}
|
||||
maxH={4}
|
||||
onchange={handleGridChange}
|
||||
onitemclick={handleTileClick}
|
||||
>
|
||||
{#snippet children({ item })}
|
||||
{@const tile = getTileById(item.id)}
|
||||
{#if tile}
|
||||
{#if tile.loading && !tile.stats}
|
||||
<!-- Show skeleton while loading -->
|
||||
<EnvironmentTileSkeleton
|
||||
name={tile.info?.name}
|
||||
host={tile.info?.host}
|
||||
width={item.w}
|
||||
height={item.h}
|
||||
/>
|
||||
{:else if tile.stats}
|
||||
<!-- Show actual tile with data -->
|
||||
<EnvironmentTile stats={tile.stats} width={item.w} height={item.h} oneventsclick={() => handleEventsClick(tile.stats!.id)} />
|
||||
{#if isMobile}
|
||||
<div class="flex flex-col gap-3">
|
||||
{#each orderedGridItems as item (item.id)}
|
||||
{@const tile = getTileById(item.id)}
|
||||
{#if tile}
|
||||
{#if tile.loading && !tile.stats}
|
||||
<!-- Show skeleton while loading -->
|
||||
<div class="w-full">
|
||||
<EnvironmentTileSkeleton
|
||||
name={tile.info?.name}
|
||||
host={tile.info?.host}
|
||||
width={2}
|
||||
height={Math.max(item.h, 2)}
|
||||
/>
|
||||
</div>
|
||||
{:else if tile.stats}
|
||||
<!-- Show actual tile with data -->
|
||||
<div class="w-full cursor-pointer" onclick={() => handleTileClick(tile.stats!.id)}>
|
||||
<EnvironmentTile
|
||||
stats={tile.stats}
|
||||
width={2}
|
||||
height={Math.max(item.h, 2)}
|
||||
oneventsclick={() => handleEventsClick(tile.stats!.id)}
|
||||
showStacksBreakdown={false}
|
||||
/>
|
||||
</div>
|
||||
{/if}
|
||||
{/if}
|
||||
{/if}
|
||||
{/snippet}
|
||||
</DraggableGrid>
|
||||
{/each}
|
||||
</div>
|
||||
{:else}
|
||||
<!-- Custom Draggable Grid -->
|
||||
<DraggableGrid
|
||||
items={filteredGridItems}
|
||||
cols={GRID_COLS}
|
||||
rowHeight={GRID_ROW_HEIGHT}
|
||||
gap={10}
|
||||
minW={1}
|
||||
maxW={2}
|
||||
minH={1}
|
||||
maxH={4}
|
||||
onchange={handleGridChange}
|
||||
onitemclick={handleTileClick}
|
||||
>
|
||||
{#snippet children({ item })}
|
||||
{@const tile = getTileById(item.id)}
|
||||
{#if tile}
|
||||
{#if tile.loading && !tile.stats}
|
||||
<!-- Show skeleton while loading -->
|
||||
<EnvironmentTileSkeleton
|
||||
name={tile.info?.name}
|
||||
host={tile.info?.host}
|
||||
width={item.w}
|
||||
height={item.h}
|
||||
/>
|
||||
{:else if tile.stats}
|
||||
<!-- Show actual tile with data -->
|
||||
<EnvironmentTile stats={tile.stats} width={item.w} height={item.h} oneventsclick={() => handleEventsClick(tile.stats!.id)} />
|
||||
{/if}
|
||||
{/if}
|
||||
{/snippet}
|
||||
</DraggableGrid>
|
||||
{/if}
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
@@ -30,7 +30,9 @@
|
||||
Loader2,
|
||||
FileX,
|
||||
Heart,
|
||||
Search
|
||||
Search,
|
||||
Wifi,
|
||||
Radio
|
||||
} from 'lucide-svelte';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import { currentEnvironment, environments as environmentsStore } from '$lib/stores/environment';
|
||||
@@ -38,7 +40,7 @@
|
||||
import { canAccess } from '$lib/stores/auth';
|
||||
import ConfirmPopover from '$lib/components/ConfirmPopover.svelte';
|
||||
import { toast } from 'svelte-sonner';
|
||||
import { formatDateTime } from '$lib/stores/settings';
|
||||
import { formatDateTime, appSettings } from '$lib/stores/settings';
|
||||
import { NoEnvironment } from '$lib/components/ui/empty-state';
|
||||
import { DataGrid } from '$lib/components/data-grid';
|
||||
|
||||
@@ -68,6 +70,7 @@
|
||||
|
||||
// State
|
||||
let events = $state<ContainerEvent[]>([]);
|
||||
let eventIds = $state<Set<number>>(new Set()); // Fast duplicate check
|
||||
let total = $state(0);
|
||||
let loading = $state(false);
|
||||
let loadingMore = $state(false);
|
||||
@@ -246,6 +249,7 @@
|
||||
toast.success('Activity log cleared');
|
||||
// Reset and reload
|
||||
events = [];
|
||||
eventIds = new Set();
|
||||
total = 0;
|
||||
hasMore = true;
|
||||
fetchEvents(false);
|
||||
@@ -301,13 +305,24 @@
|
||||
}
|
||||
const data = await response.json();
|
||||
|
||||
// Update total first so hasMore calculation is correct
|
||||
total = data.total;
|
||||
|
||||
if (append) {
|
||||
events = [...events, ...data.events];
|
||||
// Use push() for O(k) append instead of spread for O(n) copy
|
||||
events.push(...data.events);
|
||||
events = events; // Trigger Svelte reactivity
|
||||
hasMore = events.length < total;
|
||||
// Update eventIds Set with new events
|
||||
for (const evt of data.events) {
|
||||
eventIds.add(evt.id);
|
||||
}
|
||||
} else {
|
||||
events = data.events;
|
||||
hasMore = events.length < total;
|
||||
// Reset eventIds Set
|
||||
eventIds = new Set(data.events.map((evt: ContainerEvent) => evt.id));
|
||||
}
|
||||
total = data.total;
|
||||
hasMore = events.length < total;
|
||||
dataFetched = true;
|
||||
|
||||
loading = false;
|
||||
@@ -503,14 +518,19 @@
|
||||
if (eventDate > filterToDate) return;
|
||||
}
|
||||
|
||||
// Add to beginning of events (prepend new events)
|
||||
if (!events.some(event => event.id === newEvent.id)) {
|
||||
events = [newEvent, ...events];
|
||||
// Add to beginning of events (prepend new events) - use Set for fast duplicate check
|
||||
if (!eventIds.has(newEvent.id)) {
|
||||
eventIds.add(newEvent.id);
|
||||
// Use unshift() for in-place mutation instead of spread for O(n) copy
|
||||
events.unshift(newEvent);
|
||||
events = events; // Trigger Svelte reactivity
|
||||
total = total + 1;
|
||||
|
||||
// Add container to list if not already there
|
||||
if (newEvent.containerName && !containers.includes(newEvent.containerName)) {
|
||||
containers = [...containers, newEvent.containerName].sort();
|
||||
containers.push(newEvent.containerName);
|
||||
containers.sort();
|
||||
containers = containers; // Trigger Svelte reactivity
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
@@ -625,7 +645,20 @@
|
||||
<div class="flex-1 min-h-0 flex flex-col gap-3 overflow-hidden">
|
||||
<!-- Header with inline filters -->
|
||||
<div class="shrink-0 flex flex-wrap justify-between items-center gap-3">
|
||||
<PageHeader icon={Activity} title="Activity" count={visibleEnd > 0 ? `${visibleStart}-${visibleEnd}` : undefined} total={total > 0 ? total : undefined} countClass="min-w-32" />
|
||||
<div class="flex items-center gap-3">
|
||||
<PageHeader icon={Activity} title="Activity" count={visibleEnd > 0 ? `${visibleStart}-${visibleEnd}` : undefined} total={total > 0 ? total : undefined} countClass="min-w-32" />
|
||||
<Badge variant="outline" class="gap-1.5 {($appSettings.eventCollectionMode || 'stream') === 'stream' ? 'text-green-500 border-green-500/50' : 'text-amber-500 border-amber-500/50'}">
|
||||
{#if ($appSettings.eventCollectionMode || 'stream') === 'stream'}
|
||||
<Wifi class="w-3 h-3" />
|
||||
<span>Stream</span>
|
||||
{:else if ($appSettings.eventCollectionMode || 'stream') === 'poll'}
|
||||
<Radio class="w-3 h-3" />
|
||||
<span>Poll</span><span class="text-[10px] opacity-70">({($appSettings.eventPollInterval || 60000) / 1000}s)</span>
|
||||
{:else}
|
||||
<span class="text-muted-foreground">Off</span>
|
||||
{/if}
|
||||
</Badge>
|
||||
</div>
|
||||
<div class="flex flex-wrap items-center gap-2">
|
||||
<!-- Container name search -->
|
||||
<div class="relative">
|
||||
@@ -839,22 +872,19 @@
|
||||
Loading...
|
||||
</div>
|
||||
{/snippet}
|
||||
{#snippet footer()}
|
||||
{#if loadingMore}
|
||||
<div class="flex items-center justify-center py-2 text-muted-foreground">
|
||||
<Loader2 class="w-4 h-4 animate-spin mr-2" />
|
||||
Loading more...
|
||||
</div>
|
||||
{:else if !hasMore && events.length > 0}
|
||||
<div class="text-center py-2 text-sm text-muted-foreground">
|
||||
End of results ({total.toLocaleString()} events)
|
||||
</div>
|
||||
{/if}
|
||||
{/snippet}
|
||||
</DataGrid>
|
||||
|
||||
<!-- Loading more indicator -->
|
||||
{#if loadingMore}
|
||||
<div class="flex items-center justify-center py-2 text-muted-foreground border-t">
|
||||
<Loader2 class="w-4 h-4 animate-spin mr-2" />
|
||||
Loading more...
|
||||
</div>
|
||||
{/if}
|
||||
|
||||
<!-- End of results -->
|
||||
{#if !hasMore && events.length > 0}
|
||||
<div class="text-center py-2 text-sm text-muted-foreground border-t">
|
||||
End of results ({total.toLocaleString()} events)
|
||||
</div>
|
||||
{/if}
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
|
||||
@@ -285,11 +285,19 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
|
||||
const inspectUrl = `${config.type}://${config.host}:${config.port}${inspectPath}`;
|
||||
const inspectHeaders: Record<string, string> = {};
|
||||
if (config.hawserToken) inspectHeaders['X-Hawser-Token'] = config.hawserToken;
|
||||
inspectResponse = await fetch(inspectUrl, {
|
||||
headers: inspectHeaders,
|
||||
// @ts-ignore
|
||||
tls: config.type === 'https' ? { ca: config.ca, cert: config.cert, key: config.key } : undefined
|
||||
});
|
||||
const fetchOpts: any = { headers: inspectHeaders };
|
||||
if (config.type === 'https') {
|
||||
fetchOpts.tls = {
|
||||
sessionTimeout: 0, // Disable TLS session caching for mTLS
|
||||
servername: config.host,
|
||||
rejectUnauthorized: true
|
||||
};
|
||||
if (config.ca) fetchOpts.tls.ca = [config.ca];
|
||||
if (config.cert) fetchOpts.tls.cert = [config.cert];
|
||||
if (config.key) fetchOpts.tls.key = config.key;
|
||||
fetchOpts.keepalive = false;
|
||||
}
|
||||
inspectResponse = await fetch(inspectUrl, fetchOpts);
|
||||
}
|
||||
|
||||
if (inspectResponse.ok) {
|
||||
@@ -341,12 +349,22 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
|
||||
const logsUrl = `${config.type}://${config.host}:${config.port}${logsPath}`;
|
||||
const logsHeaders: Record<string, string> = {};
|
||||
if (config.hawserToken) logsHeaders['X-Hawser-Token'] = config.hawserToken;
|
||||
response = await fetch(logsUrl, {
|
||||
const fetchOpts: any = {
|
||||
headers: logsHeaders,
|
||||
signal: abortController?.signal,
|
||||
// @ts-ignore
|
||||
tls: config.type === 'https' ? { ca: config.ca, cert: config.cert, key: config.key } : undefined
|
||||
});
|
||||
signal: abortController?.signal
|
||||
};
|
||||
if (config.type === 'https') {
|
||||
fetchOpts.tls = {
|
||||
sessionTimeout: 0, // Disable TLS session caching for mTLS
|
||||
servername: config.host,
|
||||
rejectUnauthorized: true
|
||||
};
|
||||
if (config.ca) fetchOpts.tls.ca = [config.ca];
|
||||
if (config.cert) fetchOpts.tls.cert = [config.cert];
|
||||
if (config.key) fetchOpts.tls.key = config.key;
|
||||
fetchOpts.keepalive = false;
|
||||
}
|
||||
response = await fetch(logsUrl, fetchOpts);
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { json } from '@sveltejs/kit';
|
||||
import type { RequestHandler } from './$types';
|
||||
import { getContainerStats } from '$lib/server/docker';
|
||||
import { getContainerStats, EnvironmentNotFoundError } from '$lib/server/docker';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { hasEnvironments } from '$lib/server/db';
|
||||
|
||||
@@ -47,6 +47,28 @@ function calculateBlockIO(stats: any): { read: number; write: number } {
|
||||
return { read, write };
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculate memory usage the same way Docker CLI does.
|
||||
* Docker subtracts cache (inactive_file) from total usage to show actual memory consumption.
|
||||
* - cgroup v2: subtract inactive_file from stats
|
||||
* - cgroup v1: subtract total_inactive_file from stats
|
||||
* See: https://docs.docker.com/engine/containers/runmetrics/
|
||||
*
|
||||
* Returns: { usage: actual memory (minus cache), raw: total usage, cache: file cache }
|
||||
*/
|
||||
function calculateMemoryUsage(memoryStats: any): { usage: number; raw: number; cache: number } {
|
||||
const raw = memoryStats?.usage || 0;
|
||||
const stats = memoryStats?.stats || {};
|
||||
|
||||
// cgroup v2 uses 'inactive_file', cgroup v1 uses 'total_inactive_file'
|
||||
const cache = stats.inactive_file ?? stats.total_inactive_file ?? 0;
|
||||
|
||||
// Only subtract cache if it's less than raw usage (sanity check)
|
||||
const usage = (cache > 0 && cache < raw) ? raw - cache : raw;
|
||||
|
||||
return { usage, raw, cache };
|
||||
}
|
||||
|
||||
export const GET: RequestHandler = async ({ params, url, cookies }) => {
|
||||
const auth = await authorize(cookies);
|
||||
|
||||
@@ -67,15 +89,17 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
|
||||
const stats = await getContainerStats(params.id, envIdNum) as any;
|
||||
|
||||
const cpuPercent = calculateCpuPercent(stats);
|
||||
const memoryUsage = stats.memory_stats?.usage || 0;
|
||||
const memory = calculateMemoryUsage(stats.memory_stats);
|
||||
const memoryLimit = stats.memory_stats?.limit || 1;
|
||||
const memoryPercent = (memoryUsage / memoryLimit) * 100;
|
||||
const memoryPercent = (memory.usage / memoryLimit) * 100;
|
||||
const networkIO = calculateNetworkIO(stats);
|
||||
const blockIO = calculateBlockIO(stats);
|
||||
|
||||
return json({
|
||||
cpuPercent: Math.round(cpuPercent * 100) / 100,
|
||||
memoryUsage,
|
||||
memoryUsage: memory.usage,
|
||||
memoryRaw: memory.raw,
|
||||
memoryCache: memory.cache,
|
||||
memoryLimit,
|
||||
memoryPercent: Math.round(memoryPercent * 100) / 100,
|
||||
networkRx: networkIO.rx,
|
||||
@@ -85,6 +109,10 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
|
||||
timestamp: Date.now()
|
||||
});
|
||||
} catch (error: any) {
|
||||
// Return 404 for deleted environments so client can clear stale cache
|
||||
if (error instanceof EnvironmentNotFoundError) {
|
||||
return json({ error: 'Environment not found' }, { status: 404 });
|
||||
}
|
||||
console.error('Failed to get container stats:', error);
|
||||
return json({ error: error.message || 'Failed to get stats' }, { status: 500 });
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import { json } from '@sveltejs/kit';
|
||||
import type { RequestHandler } from './$types';
|
||||
import { listContainers, getContainerStats } from '$lib/server/docker';
|
||||
import { listContainers, getContainerStats, EnvironmentNotFoundError } from '$lib/server/docker';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { hasEnvironments } from '$lib/server/db';
|
||||
import type { ContainerStats } from '$lib/types';
|
||||
@@ -48,6 +48,28 @@ function calculateBlockIO(stats: any): { read: number; write: number } {
|
||||
return { read, write };
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculate memory usage the same way Docker CLI does.
|
||||
* Docker subtracts cache (inactive_file) from total usage to show actual memory consumption.
|
||||
* - cgroup v2: subtract inactive_file from stats
|
||||
* - cgroup v1: subtract total_inactive_file from stats
|
||||
* See: https://docs.docker.com/engine/containers/runmetrics/
|
||||
*
|
||||
* Returns: { usage: actual memory (minus cache), raw: total usage, cache: file cache }
|
||||
*/
|
||||
function calculateMemoryUsage(memoryStats: any): { usage: number; raw: number; cache: number } {
|
||||
const raw = memoryStats?.usage || 0;
|
||||
const stats = memoryStats?.stats || {};
|
||||
|
||||
// cgroup v2 uses 'inactive_file', cgroup v1 uses 'total_inactive_file'
|
||||
const cache = stats.inactive_file ?? stats.total_inactive_file ?? 0;
|
||||
|
||||
// Only subtract cache if it's less than raw usage (sanity check)
|
||||
const usage = (cache > 0 && cache < raw) ? raw - cache : raw;
|
||||
|
||||
return { usage, raw, cache };
|
||||
}
|
||||
|
||||
// Helper to add timeout to promises
|
||||
function withTimeout<T>(promise: Promise<T>, ms: number, fallback: T): Promise<T> {
|
||||
return Promise.race([
|
||||
@@ -112,10 +134,10 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
|
||||
if (!stats) return null;
|
||||
|
||||
const cpuPercent = calculateCpuPercent(stats);
|
||||
// Use raw memory usage (total memory attributed to container)
|
||||
const memoryUsage = stats.memory_stats?.usage || 0;
|
||||
// Calculate memory usage the same way Docker CLI does (excludes cache)
|
||||
const memory = calculateMemoryUsage(stats.memory_stats);
|
||||
const memoryLimit = stats.memory_stats?.limit || 1;
|
||||
const memoryPercent = (memoryUsage / memoryLimit) * 100;
|
||||
const memoryPercent = (memory.usage / memoryLimit) * 100;
|
||||
const networkIO = calculateNetworkIO(stats);
|
||||
const blockIO = calculateBlockIO(stats);
|
||||
|
||||
@@ -123,7 +145,9 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
|
||||
id: container.id,
|
||||
name: container.name,
|
||||
cpuPercent: Math.round(cpuPercent * 100) / 100,
|
||||
memoryUsage,
|
||||
memoryUsage: memory.usage,
|
||||
memoryRaw: memory.raw,
|
||||
memoryCache: memory.cache,
|
||||
memoryLimit,
|
||||
memoryPercent: Math.round(memoryPercent * 100) / 100,
|
||||
networkRx: networkIO.rx,
|
||||
@@ -142,6 +166,10 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
|
||||
|
||||
return json(validStats);
|
||||
} catch (error: any) {
|
||||
// Return 404 for deleted environments so client can clear stale cache
|
||||
if (error instanceof EnvironmentNotFoundError) {
|
||||
return json({ error: 'Environment not found' }, { status: 404 });
|
||||
}
|
||||
console.error('Failed to get container stats:', error);
|
||||
return json([], { status: 200 }); // Return empty array instead of error
|
||||
}
|
||||
|
||||
@@ -52,7 +52,7 @@ export interface EnvironmentStats {
|
||||
updateCheckAutoUpdate: boolean;
|
||||
labels?: string[];
|
||||
connectionType: 'socket' | 'direct' | 'hawser-standard' | 'hawser-edge';
|
||||
online: boolean;
|
||||
online?: boolean; // undefined = connecting, false = offline, true = online
|
||||
error?: string;
|
||||
containers: {
|
||||
total: number;
|
||||
|
||||
@@ -12,7 +12,6 @@ import {
|
||||
listContainers,
|
||||
listImages,
|
||||
listNetworks,
|
||||
getDockerInfo,
|
||||
getContainerStats,
|
||||
getDiskUsage
|
||||
} from '$lib/server/docker';
|
||||
@@ -95,6 +94,28 @@ function calculateCpuPercent(stats: any): number {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculate memory usage the same way Docker CLI does.
|
||||
* Docker subtracts cache (inactive_file) from total usage to show actual memory consumption.
|
||||
* - cgroup v2: subtract inactive_file from stats
|
||||
* - cgroup v1: subtract total_inactive_file from stats
|
||||
* See: https://docs.docker.com/engine/containers/runmetrics/
|
||||
*/
|
||||
function calculateMemoryUsage(memoryStats: any): number {
|
||||
const usage = memoryStats?.usage || 0;
|
||||
const stats = memoryStats?.stats || {};
|
||||
|
||||
// cgroup v2 uses 'inactive_file', cgroup v1 uses 'total_inactive_file'
|
||||
const cache = stats.inactive_file ?? stats.total_inactive_file ?? 0;
|
||||
|
||||
// Only subtract cache if it's less than usage (sanity check)
|
||||
if (cache > 0 && cache < usage) {
|
||||
return usage - cache;
|
||||
}
|
||||
|
||||
return usage;
|
||||
}
|
||||
|
||||
// Progressive stats loading - returns stats object and emits partial updates via callback
|
||||
async function getEnvironmentStatsProgressive(
|
||||
env: any,
|
||||
@@ -150,23 +171,9 @@ async function getEnvironmentStatsProgressive(
|
||||
envStats.updateCheckAutoUpdate = updateCheckSettings.autoUpdate;
|
||||
}
|
||||
|
||||
// Check if Docker is accessible (with 5 second timeout)
|
||||
const dockerInfo = await withTimeout(getDockerInfo(env.id), 5000, null);
|
||||
if (!dockerInfo) {
|
||||
envStats.error = 'Connection timeout or Docker not accessible';
|
||||
envStats.loading = undefined; // Clear loading states on error
|
||||
// Send offline status to client
|
||||
onPartialUpdate({
|
||||
id: env.id,
|
||||
online: false,
|
||||
error: envStats.error,
|
||||
loading: undefined
|
||||
});
|
||||
return envStats;
|
||||
}
|
||||
envStats.online = true;
|
||||
|
||||
// Get all database stats in parallel for better performance
|
||||
// NOTE: We do NOT block on getDockerInfo() here - slow environments would block all others
|
||||
// Instead, we determine online status from whether listContainers succeeds
|
||||
const [latestMetrics, eventStats, recentEventsResult, metricsHistory] = await Promise.all([
|
||||
getLatestHostMetrics(env.id),
|
||||
getContainerEventStats(env.id),
|
||||
@@ -204,10 +211,9 @@ async function getEnvironmentStatsProgressive(
|
||||
}));
|
||||
}
|
||||
|
||||
// Send initial update with DB data and online status
|
||||
// Send initial update with DB data (online status determined later by Docker API success)
|
||||
onPartialUpdate({
|
||||
id: env.id,
|
||||
online: true,
|
||||
metrics: envStats.metrics,
|
||||
events: envStats.events,
|
||||
recentEvents: envStats.recentEvents,
|
||||
@@ -223,9 +229,22 @@ async function getEnvironmentStatsProgressive(
|
||||
return size && size > 0 ? size : 0;
|
||||
};
|
||||
|
||||
// PHASE 1: Containers (usually fast)
|
||||
const containersPromise = withTimeout(listContainers(true, env.id).catch(() => []), 10000, [])
|
||||
// Track if Docker API is accessible - determined by listContainers success
|
||||
let dockerApiAccessible = false;
|
||||
let dockerApiError: string | null = null;
|
||||
|
||||
// PHASE 1: Containers (usually fast) - this determines online status
|
||||
// Use 10s timeout - this is the critical path that determines if env is online
|
||||
const containersPromise = withTimeout(listContainers(true, env.id), 10000, null)
|
||||
.then(async (containers) => {
|
||||
// Timeout returns null
|
||||
if (containers === null) {
|
||||
throw new Error('Connection timeout');
|
||||
}
|
||||
// If we got here, Docker API is accessible
|
||||
dockerApiAccessible = true;
|
||||
envStats.online = true;
|
||||
|
||||
envStats.containers.total = containers.length;
|
||||
envStats.containers.running = containers.filter((c: any) => c.state === 'running').length;
|
||||
envStats.containers.stopped = containers.filter((c: any) => c.state === 'exited').length;
|
||||
@@ -236,11 +255,39 @@ async function getEnvironmentStatsProgressive(
|
||||
|
||||
onPartialUpdate({
|
||||
id: env.id,
|
||||
online: true,
|
||||
containers: { ...envStats.containers },
|
||||
loading: { ...envStats.loading! }
|
||||
});
|
||||
|
||||
return containers;
|
||||
})
|
||||
.catch((error) => {
|
||||
// Docker API failed - mark as offline
|
||||
dockerApiAccessible = false;
|
||||
const errorStr = String(error);
|
||||
if (errorStr.includes('not connected') || errorStr.includes('Edge agent')) {
|
||||
dockerApiError = 'Agent not connected';
|
||||
} else if (errorStr.includes('FailedToOpenSocket') || errorStr.includes('ECONNREFUSED')) {
|
||||
dockerApiError = 'Docker socket not accessible';
|
||||
} else if (errorStr.includes('ECONNRESET') || errorStr.includes('connection was closed')) {
|
||||
dockerApiError = 'Connection lost';
|
||||
} else if (errorStr.includes('timeout') || errorStr.includes('Timeout')) {
|
||||
dockerApiError = 'Connection timeout';
|
||||
} else {
|
||||
dockerApiError = 'Connection error';
|
||||
}
|
||||
envStats.error = dockerApiError;
|
||||
envStats.loading!.containers = false;
|
||||
|
||||
onPartialUpdate({
|
||||
id: env.id,
|
||||
online: false,
|
||||
error: dockerApiError,
|
||||
loading: { ...envStats.loading! }
|
||||
});
|
||||
|
||||
return [] as any[];
|
||||
});
|
||||
|
||||
// PHASE 2: Images, Networks, Stacks (medium speed) - run in parallel
|
||||
@@ -339,7 +386,7 @@ async function getEnvironmentStatsProgressive(
|
||||
if (!stats) return null;
|
||||
|
||||
const cpuPercent = calculateCpuPercent(stats);
|
||||
const memoryUsage = stats.memory_stats?.usage || 0;
|
||||
const memoryUsage = calculateMemoryUsage(stats.memory_stats);
|
||||
const memoryLimit = stats.memory_stats?.limit || 1;
|
||||
const memoryPercent = (memoryUsage / memoryLimit) * 100;
|
||||
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
import { json } from '@sveltejs/kit';
|
||||
import type { RequestHandler } from './$types';
|
||||
import { getEnvironments, createEnvironment, assignUserRole, getRoleByName, getEnvironmentPublicIps, setEnvironmentPublicIp, getEnvUpdateCheckSettings, getEnvironmentTimezone, type Environment } from '$lib/server/db';
|
||||
import { getEnvironments, getEnvironmentByName, createEnvironment, assignUserRole, getRoleByName, getEnvironmentPublicIps, setEnvironmentPublicIp, getEnvUpdateCheckSettings, getEnvironmentTimezone, type Environment } from '$lib/server/db';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { refreshSubprocessEnvironments } from '$lib/server/subprocess-manager';
|
||||
import { serializeLabels, parseLabels, MAX_LABELS } from '$lib/utils/label-colors';
|
||||
import { cleanPem } from '$lib/utils/pem';
|
||||
|
||||
export const GET: RequestHandler = async ({ cookies }) => {
|
||||
const auth = await authorize(cookies);
|
||||
@@ -69,6 +70,12 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
return json({ error: 'Name is required' }, { status: 400 });
|
||||
}
|
||||
|
||||
// Check if environment with this name already exists
|
||||
const existing = await getEnvironmentByName(data.name);
|
||||
if (existing) {
|
||||
return json({ error: 'An environment with this name already exists' }, { status: 409 });
|
||||
}
|
||||
|
||||
// Host is required for direct and hawser-standard connections
|
||||
const connectionType = data.connectionType || 'socket';
|
||||
if ((connectionType === 'direct' || connectionType === 'hawser-standard') && !data.host) {
|
||||
@@ -83,9 +90,9 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
host: data.host,
|
||||
port: data.port || 2375,
|
||||
protocol: data.protocol || 'http',
|
||||
tlsCa: data.tlsCa,
|
||||
tlsCert: data.tlsCert,
|
||||
tlsKey: data.tlsKey,
|
||||
tlsCa: cleanPem(data.tlsCa),
|
||||
tlsCert: cleanPem(data.tlsCert),
|
||||
tlsKey: cleanPem(data.tlsKey),
|
||||
tlsSkipVerify: data.tlsSkipVerify || false,
|
||||
icon: data.icon || 'globe',
|
||||
socketPath: data.socketPath || '/var/run/docker.sock',
|
||||
@@ -124,7 +131,6 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
return json(env);
|
||||
} catch (error) {
|
||||
console.error('Failed to create environment:', error);
|
||||
const message = error instanceof Error ? error.message : 'Failed to create environment';
|
||||
return json({ error: message }, { status: 500 });
|
||||
return json({ error: 'Failed to create environment' }, { status: 500 });
|
||||
}
|
||||
};
|
||||
|
||||
@@ -6,6 +6,7 @@ import { deleteGitStackFiles } from '$lib/server/git';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { refreshSubprocessEnvironments } from '$lib/server/subprocess-manager';
|
||||
import { serializeLabels, parseLabels, MAX_LABELS } from '$lib/utils/label-colors';
|
||||
import { cleanPem } from '$lib/utils/pem';
|
||||
import { unregisterSchedule } from '$lib/server/scheduler';
|
||||
import { closeEdgeConnection } from '$lib/server/hawser';
|
||||
|
||||
@@ -62,9 +63,9 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
|
||||
host: data.host,
|
||||
port: data.port,
|
||||
protocol: data.protocol,
|
||||
tlsCa: data.tlsCa,
|
||||
tlsCert: data.tlsCert,
|
||||
tlsKey: data.tlsKey,
|
||||
tlsCa: cleanPem(data.tlsCa),
|
||||
tlsCert: cleanPem(data.tlsCert),
|
||||
tlsKey: cleanPem(data.tlsKey),
|
||||
tlsSkipVerify: data.tlsSkipVerify,
|
||||
icon: data.icon,
|
||||
socketPath: data.socketPath,
|
||||
|
||||
@@ -60,50 +60,54 @@ export const POST: RequestHandler = async ({ request }) => {
|
||||
headers['X-Hawser-Token'] = config.hawserToken;
|
||||
}
|
||||
|
||||
// For HTTPS with custom CA or skip verification, use subprocess to avoid Vite dev server TLS issues
|
||||
if (protocol === 'https' && (config.tlsCa || config.tlsSkipVerify)) {
|
||||
const fs = await import('node:fs');
|
||||
let tempCaPath = '';
|
||||
// For HTTPS with custom CA, client certs, or skip verification, use subprocess to avoid Vite dev server TLS issues
|
||||
if (protocol === 'https' && (config.tlsCa || config.tlsCert || config.tlsSkipVerify)) {
|
||||
// Clean PEM content (remove extra whitespace)
|
||||
const cleanPem = (pem: string) => pem
|
||||
.split('\n')
|
||||
.map((line) => line.trim())
|
||||
.filter((line) => line.length > 0)
|
||||
.join('\n');
|
||||
|
||||
// Clean the certificate - remove leading/trailing whitespace from each line
|
||||
let cleanedCa = '';
|
||||
if (config.tlsCa && !config.tlsSkipVerify) {
|
||||
cleanedCa = config.tlsCa
|
||||
.split('\n')
|
||||
.map((line) => line.trim())
|
||||
.filter((line) => line.length > 0)
|
||||
.join('\n');
|
||||
|
||||
tempCaPath = `/tmp/dockhand-ca-${Date.now()}.pem`;
|
||||
fs.writeFileSync(tempCaPath, cleanedCa);
|
||||
}
|
||||
|
||||
// Build Bun script that runs outside Vite's process (Vite interferes with TLS)
|
||||
const tlsConfig = config.tlsSkipVerify
|
||||
? `tls: { rejectUnauthorized: false }`
|
||||
: `tls: { ca: await Bun.file('${tempCaPath}').text() }`;
|
||||
// Pass config as base64-encoded JSON to avoid escaping issues
|
||||
const tlsConfig = {
|
||||
url: `https://${host}:${port}/info`,
|
||||
headers,
|
||||
tlsSkipVerify: config.tlsSkipVerify || false,
|
||||
ca: config.tlsCa && !config.tlsSkipVerify ? cleanPem(config.tlsCa) : null,
|
||||
cert: config.tlsCert ? cleanPem(config.tlsCert) : null,
|
||||
key: config.tlsKey ? cleanPem(config.tlsKey) : null,
|
||||
host
|
||||
};
|
||||
const configBase64 = Buffer.from(JSON.stringify(tlsConfig)).toString('base64');
|
||||
|
||||
// Inline script with config embedded (bun -e doesn't pass argv correctly)
|
||||
const scriptContent = `
|
||||
const response = await fetch('https://${host}:${port}/info', {
|
||||
headers: ${JSON.stringify(headers)},
|
||||
${tlsConfig}
|
||||
});
|
||||
const body = await response.text();
|
||||
console.log(JSON.stringify({ status: response.status, body }));
|
||||
const config = JSON.parse(Buffer.from('${configBase64}', 'base64').toString());
|
||||
try {
|
||||
const tls = {
|
||||
sessionTimeout: 0,
|
||||
servername: config.host,
|
||||
rejectUnauthorized: !config.tlsSkipVerify
|
||||
};
|
||||
if (config.ca) tls.ca = [config.ca];
|
||||
if (config.cert) tls.cert = [config.cert];
|
||||
if (config.key) tls.key = config.key;
|
||||
const response = await fetch(config.url, {
|
||||
headers: config.headers,
|
||||
tls,
|
||||
keepalive: false
|
||||
});
|
||||
const body = await response.text();
|
||||
console.log(JSON.stringify({ status: response.status, body }));
|
||||
} catch (e) {
|
||||
console.log(JSON.stringify({ error: e.message }));
|
||||
}
|
||||
`;
|
||||
const scriptPath = `/tmp/dockhand-test-${Date.now()}.ts`;
|
||||
fs.writeFileSync(scriptPath, scriptContent);
|
||||
|
||||
const proc = Bun.spawn(['bun', scriptPath], { stdout: 'pipe', stderr: 'pipe' });
|
||||
const proc = Bun.spawn(['bun', '-e', scriptContent], { stdout: 'pipe', stderr: 'pipe' });
|
||||
const output = await new Response(proc.stdout).text();
|
||||
const stderr = await new Response(proc.stderr).text();
|
||||
|
||||
// Cleanup temp files
|
||||
if (tempCaPath) {
|
||||
try { fs.unlinkSync(tempCaPath); } catch {}
|
||||
}
|
||||
try { fs.unlinkSync(scriptPath); } catch {}
|
||||
|
||||
if (!output.trim()) {
|
||||
throw new Error(stderr || 'Empty response from TLS test subprocess');
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import type { RequestHandler } from './$types';
|
||||
import { getDockerEvents } from '$lib/server/docker';
|
||||
import { getDockerEvents, EnvironmentNotFoundError } from '$lib/server/docker';
|
||||
import { getEnvironment } from '$lib/server/db';
|
||||
|
||||
export const GET: RequestHandler = async ({ url }) => {
|
||||
@@ -118,8 +118,13 @@ export const GET: RequestHandler = async ({ url }) => {
|
||||
|
||||
processEvents();
|
||||
} catch (error: any) {
|
||||
console.error('Failed to connect to Docker events:', error);
|
||||
sendEvent('error', { message: error.message || 'Failed to connect to Docker' });
|
||||
if (error instanceof EnvironmentNotFoundError) {
|
||||
// Expected error when environment doesn't exist - don't spam logs
|
||||
sendEvent('error', { message: 'Environment not found' });
|
||||
} else {
|
||||
console.error('Failed to connect to Docker events:', error);
|
||||
sendEvent('error', { message: error.message || 'Failed to connect to Docker' });
|
||||
}
|
||||
clearInterval(heartbeatInterval);
|
||||
controller.close();
|
||||
}
|
||||
|
||||
@@ -11,7 +11,10 @@ import {
|
||||
import { deployGitStack } from '$lib/server/git';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { registerSchedule } from '$lib/server/scheduler';
|
||||
import crypto from 'node:crypto';
|
||||
import { secureRandomBytes } from '$lib/server/crypto-fallback';
|
||||
|
||||
// Stack name validation: must start with alphanumeric, can contain alphanumeric, hyphens, underscores
|
||||
const STACK_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
|
||||
|
||||
export const GET: RequestHandler = async ({ url, cookies }) => {
|
||||
const auth = await authorize(cookies);
|
||||
@@ -49,6 +52,11 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
return json({ error: 'Stack name is required' }, { status: 400 });
|
||||
}
|
||||
|
||||
const trimmedStackName = data.stackName.trim();
|
||||
if (!STACK_NAME_REGEX.test(trimmedStackName)) {
|
||||
return json({ error: 'Stack name must start with a letter or number, and contain only letters, numbers, hyphens, and underscores' }, { status: 400 });
|
||||
}
|
||||
|
||||
// Either repositoryId or new repo details (url, branch) must be provided
|
||||
let repositoryId = data.repositoryId;
|
||||
|
||||
@@ -94,11 +102,11 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
// Generate webhook secret if webhook is enabled
|
||||
let webhookSecret = data.webhookSecret;
|
||||
if (data.webhookEnabled && !webhookSecret) {
|
||||
webhookSecret = crypto.randomBytes(32).toString('hex');
|
||||
webhookSecret = secureRandomBytes(32).toString('hex');
|
||||
}
|
||||
|
||||
const gitStack = await createGitStack({
|
||||
stackName: data.stackName,
|
||||
stackName: trimmedStackName,
|
||||
environmentId: data.environmentId || null,
|
||||
repositoryId: repositoryId,
|
||||
composePath: data.composePath || 'docker-compose.yml',
|
||||
@@ -112,7 +120,7 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
|
||||
// Create stack_sources entry so the stack appears in the list immediately
|
||||
await upsertStackSource({
|
||||
stackName: data.stackName,
|
||||
stackName: trimmedStackName,
|
||||
environmentId: data.environmentId || null,
|
||||
sourceType: 'git',
|
||||
gitRepositoryId: repositoryId,
|
||||
|
||||
@@ -1,10 +1,13 @@
|
||||
import { json } from '@sveltejs/kit';
|
||||
import type { RequestHandler } from './$types';
|
||||
import { getGitStack, updateGitStack, deleteGitStack } from '$lib/server/db';
|
||||
import { getGitStack, updateGitStack, deleteGitStack, deleteStackSource, updateStackSourceName } from '$lib/server/db';
|
||||
import { deleteGitStackFiles, deployGitStack } from '$lib/server/git';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { registerSchedule, unregisterSchedule } from '$lib/server/scheduler';
|
||||
|
||||
// Stack name validation: must start with alphanumeric, can contain alphanumeric, hyphens, underscores
|
||||
const STACK_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
|
||||
|
||||
export const GET: RequestHandler = async ({ params, cookies }) => {
|
||||
const auth = await authorize(cookies);
|
||||
|
||||
@@ -43,6 +46,20 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
|
||||
}
|
||||
|
||||
const data = await request.json();
|
||||
|
||||
// Validate stack name if it's being changed
|
||||
if (data.stackName !== undefined) {
|
||||
const trimmedStackName = data.stackName.trim();
|
||||
if (!trimmedStackName) {
|
||||
return json({ error: 'Stack name is required' }, { status: 400 });
|
||||
}
|
||||
if (!STACK_NAME_REGEX.test(trimmedStackName)) {
|
||||
return json({ error: 'Stack name must start with a letter or number, and contain only letters, numbers, hyphens, and underscores' }, { status: 400 });
|
||||
}
|
||||
data.stackName = trimmedStackName;
|
||||
}
|
||||
|
||||
const oldStackName = existing.stackName;
|
||||
const updated = await updateGitStack(id, {
|
||||
stackName: data.stackName,
|
||||
composePath: data.composePath,
|
||||
@@ -54,6 +71,11 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
|
||||
webhookSecret: data.webhookSecret
|
||||
});
|
||||
|
||||
// If stack name changed, update the stack_sources record too
|
||||
if (data.stackName && data.stackName !== oldStackName) {
|
||||
await updateStackSourceName(oldStackName, data.stackName, existing.environmentId);
|
||||
}
|
||||
|
||||
// Register or unregister schedule with croner
|
||||
if (updated.autoUpdate && updated.autoUpdateCron) {
|
||||
await registerSchedule(id, 'git_stack_sync', updated.environmentId);
|
||||
@@ -101,6 +123,9 @@ export const DELETE: RequestHandler = async ({ params, cookies }) => {
|
||||
// Delete git files first
|
||||
deleteGitStackFiles(id);
|
||||
|
||||
// Delete the stack_sources record to free up the stack name
|
||||
await deleteStackSource(existing.stackName, existing.environmentId);
|
||||
|
||||
// Delete from database
|
||||
await deleteGitStack(id);
|
||||
|
||||
|
||||
@@ -16,7 +16,16 @@ function isDockerHub(url: string): boolean {
|
||||
lower.includes('registry.hub.docker.com');
|
||||
}
|
||||
|
||||
async function fetchDockerHubTags(imageName: string): Promise<TagInfo[]> {
|
||||
interface PaginatedTags {
|
||||
tags: TagInfo[];
|
||||
total: number;
|
||||
page: number;
|
||||
pageSize: number;
|
||||
hasNext: boolean;
|
||||
hasPrev: boolean;
|
||||
}
|
||||
|
||||
async function fetchDockerHubTags(imageName: string, page: number = 1, pageSize: number = 20): Promise<PaginatedTags> {
|
||||
// Docker Hub uses a different API
|
||||
// For official images: https://hub.docker.com/v2/repositories/library/<image>/tags
|
||||
// For user images: https://hub.docker.com/v2/repositories/<user>/<image>/tags
|
||||
@@ -27,7 +36,7 @@ async function fetchDockerHubTags(imageName: string): Promise<TagInfo[]> {
|
||||
repoPath = `library/${imageName}`;
|
||||
}
|
||||
|
||||
const url = `https://hub.docker.com/v2/repositories/${repoPath}/tags?page_size=100&ordering=last_updated`;
|
||||
const url = `https://hub.docker.com/v2/repositories/${repoPath}/tags?page_size=${pageSize}&page=${page}&ordering=last_updated`;
|
||||
|
||||
const response = await fetch(url, {
|
||||
headers: {
|
||||
@@ -45,12 +54,21 @@ async function fetchDockerHubTags(imageName: string): Promise<TagInfo[]> {
|
||||
const data = await response.json();
|
||||
const results = data.results || [];
|
||||
|
||||
return results.map((tag: any) => ({
|
||||
const tags = results.map((tag: any) => ({
|
||||
name: tag.name,
|
||||
size: tag.full_size || tag.images?.[0]?.size,
|
||||
lastUpdated: tag.last_updated || tag.tag_last_pushed,
|
||||
digest: tag.images?.[0]?.digest
|
||||
}));
|
||||
|
||||
return {
|
||||
tags,
|
||||
total: data.count || 0,
|
||||
page,
|
||||
pageSize,
|
||||
hasNext: !!data.next,
|
||||
hasPrev: !!data.previous
|
||||
};
|
||||
}
|
||||
|
||||
async function fetchRegistryTags(registry: any, imageName: string): Promise<TagInfo[]> {
|
||||
@@ -104,16 +122,18 @@ export const GET: RequestHandler = async ({ url }) => {
|
||||
try {
|
||||
const registryId = url.searchParams.get('registry');
|
||||
const imageName = url.searchParams.get('image');
|
||||
const page = parseInt(url.searchParams.get('page') || '1');
|
||||
const pageSize = parseInt(url.searchParams.get('pageSize') || '20');
|
||||
|
||||
if (!imageName) {
|
||||
return json({ error: 'Image name is required' }, { status: 400 });
|
||||
}
|
||||
|
||||
let tags: TagInfo[];
|
||||
let result: PaginatedTags;
|
||||
|
||||
if (!registryId) {
|
||||
// No registry specified, assume Docker Hub
|
||||
tags = await fetchDockerHubTags(imageName);
|
||||
result = await fetchDockerHubTags(imageName, page, pageSize);
|
||||
} else {
|
||||
const registry = await getRegistry(parseInt(registryId));
|
||||
if (!registry) {
|
||||
@@ -121,13 +141,22 @@ export const GET: RequestHandler = async ({ url }) => {
|
||||
}
|
||||
|
||||
if (isDockerHub(registry.url)) {
|
||||
tags = await fetchDockerHubTags(imageName);
|
||||
result = await fetchDockerHubTags(imageName, page, pageSize);
|
||||
} else {
|
||||
tags = await fetchRegistryTags(registry, imageName);
|
||||
// V2 registries don't support pagination well, return all tags
|
||||
const tags = await fetchRegistryTags(registry, imageName);
|
||||
result = {
|
||||
tags,
|
||||
total: tags.length,
|
||||
page: 1,
|
||||
pageSize: tags.length,
|
||||
hasNext: false,
|
||||
hasPrev: false
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
return json(tags);
|
||||
return json(result);
|
||||
} catch (error: any) {
|
||||
console.error('Error fetching tags:', error);
|
||||
|
||||
|
||||
@@ -15,14 +15,26 @@ import {
|
||||
getEventCleanupEnabled,
|
||||
setEventCleanupEnabled,
|
||||
getDefaultTimezone,
|
||||
setDefaultTimezone
|
||||
setDefaultTimezone,
|
||||
getEventCollectionMode,
|
||||
setEventCollectionMode,
|
||||
getEventPollInterval,
|
||||
setEventPollInterval,
|
||||
getMetricsCollectionInterval,
|
||||
setMetricsCollectionInterval,
|
||||
getExternalStackPaths,
|
||||
setExternalStackPaths,
|
||||
getPrimaryStackLocation,
|
||||
setPrimaryStackLocation
|
||||
} from '$lib/server/db';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
import { refreshSystemJobs } from '$lib/server/scheduler';
|
||||
import { sendToEventSubprocess, sendToMetricsSubprocess, type UpdateIntervalCommand } from '$lib/server/subprocess-manager';
|
||||
|
||||
export type TimeFormat = '12h' | '24h';
|
||||
export type DateFormat = 'MM/DD/YYYY' | 'DD/MM/YYYY' | 'YYYY-MM-DD' | 'DD.MM.YYYY';
|
||||
export type DownloadFormat = 'tar' | 'tar.gz';
|
||||
export type EventCollectionMode = 'stream' | 'poll';
|
||||
|
||||
export interface GeneralSettings {
|
||||
confirmDestructive: boolean;
|
||||
@@ -41,6 +53,10 @@ export interface GeneralSettings {
|
||||
eventCleanupEnabled: boolean;
|
||||
logBufferSizeKb: number;
|
||||
defaultTimezone: string;
|
||||
// Background monitoring settings
|
||||
eventCollectionMode: EventCollectionMode;
|
||||
eventPollInterval: number;
|
||||
metricsCollectionInterval: number;
|
||||
// Theme settings (for when auth is disabled)
|
||||
lightTheme: string;
|
||||
darkTheme: string;
|
||||
@@ -48,6 +64,10 @@ export interface GeneralSettings {
|
||||
fontSize: string;
|
||||
gridFontSize: string;
|
||||
terminalFont: string;
|
||||
// External stack paths
|
||||
externalStackPaths: string[];
|
||||
// Primary stack location
|
||||
primaryStackLocation: string | null;
|
||||
}
|
||||
|
||||
const DEFAULT_SETTINGS: Omit<GeneralSettings, 'scheduleRetentionDays' | 'eventRetentionDays' | 'scheduleCleanupCron' | 'eventCleanupCron' | 'scheduleCleanupEnabled' | 'eventCleanupEnabled'> = {
|
||||
@@ -61,6 +81,9 @@ const DEFAULT_SETTINGS: Omit<GeneralSettings, 'scheduleRetentionDays' | 'eventRe
|
||||
defaultTrivyArgs: 'image --format json {image}',
|
||||
logBufferSizeKb: 500,
|
||||
defaultTimezone: 'UTC',
|
||||
eventCollectionMode: 'stream',
|
||||
eventPollInterval: 60000,
|
||||
metricsCollectionInterval: 30000,
|
||||
lightTheme: 'default',
|
||||
darkTheme: 'default',
|
||||
font: 'system',
|
||||
@@ -104,12 +127,17 @@ export const GET: RequestHandler = async ({ cookies }) => {
|
||||
eventCleanupEnabled,
|
||||
logBufferSizeKb,
|
||||
defaultTimezone,
|
||||
eventCollectionMode,
|
||||
eventPollInterval,
|
||||
metricsCollectionInterval,
|
||||
lightTheme,
|
||||
darkTheme,
|
||||
font,
|
||||
fontSize,
|
||||
gridFontSize,
|
||||
terminalFont
|
||||
terminalFont,
|
||||
externalStackPaths,
|
||||
primaryStackLocation
|
||||
] = await Promise.all([
|
||||
getSetting('confirm_destructive'),
|
||||
getSetting('show_stopped_containers'),
|
||||
@@ -127,12 +155,17 @@ export const GET: RequestHandler = async ({ cookies }) => {
|
||||
getEventCleanupEnabled(),
|
||||
getSetting('log_buffer_size_kb'),
|
||||
getDefaultTimezone(),
|
||||
getEventCollectionMode(),
|
||||
getEventPollInterval(),
|
||||
getMetricsCollectionInterval(),
|
||||
getSetting('theme_light'),
|
||||
getSetting('theme_dark'),
|
||||
getSetting('theme_font'),
|
||||
getSetting('theme_font_size'),
|
||||
getSetting('theme_grid_font_size'),
|
||||
getSetting('theme_terminal_font')
|
||||
getSetting('theme_terminal_font'),
|
||||
getExternalStackPaths(),
|
||||
getPrimaryStackLocation()
|
||||
]);
|
||||
|
||||
const settings: GeneralSettings = {
|
||||
@@ -152,12 +185,17 @@ export const GET: RequestHandler = async ({ cookies }) => {
|
||||
eventCleanupEnabled,
|
||||
logBufferSizeKb: logBufferSizeKb ?? DEFAULT_SETTINGS.logBufferSizeKb,
|
||||
defaultTimezone: defaultTimezone ?? DEFAULT_SETTINGS.defaultTimezone,
|
||||
eventCollectionMode: (eventCollectionMode ?? DEFAULT_SETTINGS.eventCollectionMode) as EventCollectionMode,
|
||||
eventPollInterval: eventPollInterval ?? DEFAULT_SETTINGS.eventPollInterval,
|
||||
metricsCollectionInterval: metricsCollectionInterval ?? DEFAULT_SETTINGS.metricsCollectionInterval,
|
||||
lightTheme: lightTheme ?? DEFAULT_SETTINGS.lightTheme,
|
||||
darkTheme: darkTheme ?? DEFAULT_SETTINGS.darkTheme,
|
||||
font: font ?? DEFAULT_SETTINGS.font,
|
||||
fontSize: fontSize ?? DEFAULT_SETTINGS.fontSize,
|
||||
gridFontSize: gridFontSize ?? DEFAULT_SETTINGS.gridFontSize,
|
||||
terminalFont: terminalFont ?? DEFAULT_SETTINGS.terminalFont
|
||||
terminalFont: terminalFont ?? DEFAULT_SETTINGS.terminalFont,
|
||||
externalStackPaths,
|
||||
primaryStackLocation
|
||||
};
|
||||
|
||||
return json(settings);
|
||||
@@ -175,7 +213,7 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
|
||||
try {
|
||||
const body = await request.json();
|
||||
const { confirmDestructive, showStoppedContainers, highlightUpdates, timeFormat, dateFormat, downloadFormat, defaultGrypeArgs, defaultTrivyArgs, scheduleRetentionDays, eventRetentionDays, scheduleCleanupCron, eventCleanupCron, scheduleCleanupEnabled, eventCleanupEnabled, logBufferSizeKb, defaultTimezone, lightTheme, darkTheme, font, fontSize, gridFontSize, terminalFont } = body;
|
||||
const { confirmDestructive, showStoppedContainers, highlightUpdates, timeFormat, dateFormat, downloadFormat, defaultGrypeArgs, defaultTrivyArgs, scheduleRetentionDays, eventRetentionDays, scheduleCleanupCron, eventCleanupCron, scheduleCleanupEnabled, eventCleanupEnabled, logBufferSizeKb, defaultTimezone, eventCollectionMode, eventPollInterval, metricsCollectionInterval, lightTheme, darkTheme, font, fontSize, gridFontSize, terminalFont, externalStackPaths, primaryStackLocation } = body;
|
||||
|
||||
if (confirmDestructive !== undefined) {
|
||||
await setSetting('confirm_destructive', confirmDestructive);
|
||||
@@ -228,6 +266,25 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
// Refresh system jobs to use the new timezone
|
||||
await refreshSystemJobs();
|
||||
}
|
||||
if (eventCollectionMode !== undefined && (eventCollectionMode === 'stream' || eventCollectionMode === 'poll')) {
|
||||
await setEventCollectionMode(eventCollectionMode);
|
||||
// Notify event subprocess to refresh collectors with new mode
|
||||
sendToEventSubprocess({ type: 'refresh_environments' });
|
||||
}
|
||||
if (eventPollInterval !== undefined && typeof eventPollInterval === 'number') {
|
||||
// Validate: 30s - 300s (30 seconds to 5 minutes)
|
||||
const validatedInterval = Math.max(30000, Math.min(300000, eventPollInterval));
|
||||
await setEventPollInterval(validatedInterval);
|
||||
// Notify event subprocess to refresh collectors with new interval
|
||||
sendToEventSubprocess({ type: 'refresh_environments' });
|
||||
}
|
||||
if (metricsCollectionInterval !== undefined && typeof metricsCollectionInterval === 'number') {
|
||||
// Validate: 10s - 300s (10 seconds to 5 minutes)
|
||||
const validatedInterval = Math.max(10000, Math.min(300000, metricsCollectionInterval));
|
||||
await setMetricsCollectionInterval(validatedInterval);
|
||||
// Notify metrics subprocess to update its collection interval
|
||||
sendToMetricsSubprocess({ type: 'update_interval', intervalMs: validatedInterval });
|
||||
}
|
||||
if (lightTheme !== undefined && VALID_LIGHT_THEMES.includes(lightTheme)) {
|
||||
await setSetting('theme_light', lightTheme);
|
||||
}
|
||||
@@ -246,6 +303,20 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
if (terminalFont !== undefined && VALID_TERMINAL_FONTS.includes(terminalFont)) {
|
||||
await setSetting('theme_terminal_font', terminalFont);
|
||||
}
|
||||
if (externalStackPaths !== undefined && Array.isArray(externalStackPaths)) {
|
||||
// Filter to valid non-empty strings
|
||||
const validPaths = externalStackPaths.filter((p: unknown) => typeof p === 'string' && p.trim());
|
||||
await setExternalStackPaths(validPaths);
|
||||
}
|
||||
if (primaryStackLocation !== undefined) {
|
||||
// Accept string or null
|
||||
if (primaryStackLocation === null || (typeof primaryStackLocation === 'string' && primaryStackLocation.trim())) {
|
||||
await setPrimaryStackLocation(primaryStackLocation);
|
||||
} else if (primaryStackLocation === '') {
|
||||
// Empty string means clear the setting
|
||||
await setPrimaryStackLocation(null);
|
||||
}
|
||||
}
|
||||
|
||||
// Fetch all settings in parallel for the response
|
||||
const [
|
||||
@@ -265,12 +336,17 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
eventCleanupEnabledVal,
|
||||
logBufferSizeKbVal,
|
||||
defaultTimezoneVal,
|
||||
eventCollectionModeVal,
|
||||
eventPollIntervalVal,
|
||||
metricsCollectionIntervalVal,
|
||||
lightThemeVal,
|
||||
darkThemeVal,
|
||||
fontVal,
|
||||
fontSizeVal,
|
||||
gridFontSizeVal,
|
||||
terminalFontVal
|
||||
terminalFontVal,
|
||||
externalStackPathsVal,
|
||||
primaryStackLocationVal
|
||||
] = await Promise.all([
|
||||
getSetting('confirm_destructive'),
|
||||
getSetting('show_stopped_containers'),
|
||||
@@ -288,12 +364,17 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
getEventCleanupEnabled(),
|
||||
getSetting('log_buffer_size_kb'),
|
||||
getDefaultTimezone(),
|
||||
getEventCollectionMode(),
|
||||
getEventPollInterval(),
|
||||
getMetricsCollectionInterval(),
|
||||
getSetting('theme_light'),
|
||||
getSetting('theme_dark'),
|
||||
getSetting('theme_font'),
|
||||
getSetting('theme_font_size'),
|
||||
getSetting('theme_grid_font_size'),
|
||||
getSetting('theme_terminal_font')
|
||||
getSetting('theme_terminal_font'),
|
||||
getExternalStackPaths(),
|
||||
getPrimaryStackLocation()
|
||||
]);
|
||||
|
||||
const settings: GeneralSettings = {
|
||||
@@ -313,12 +394,17 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
|
||||
eventCleanupEnabled: eventCleanupEnabledVal,
|
||||
logBufferSizeKb: logBufferSizeKbVal ?? DEFAULT_SETTINGS.logBufferSizeKb,
|
||||
defaultTimezone: defaultTimezoneVal ?? DEFAULT_SETTINGS.defaultTimezone,
|
||||
eventCollectionMode: (eventCollectionModeVal ?? DEFAULT_SETTINGS.eventCollectionMode) as EventCollectionMode,
|
||||
eventPollInterval: eventPollIntervalVal ?? DEFAULT_SETTINGS.eventPollInterval,
|
||||
metricsCollectionInterval: metricsCollectionIntervalVal ?? DEFAULT_SETTINGS.metricsCollectionInterval,
|
||||
lightTheme: lightThemeVal ?? DEFAULT_SETTINGS.lightTheme,
|
||||
darkTheme: darkThemeVal ?? DEFAULT_SETTINGS.darkTheme,
|
||||
font: fontVal ?? DEFAULT_SETTINGS.font,
|
||||
fontSize: fontSizeVal ?? DEFAULT_SETTINGS.fontSize,
|
||||
gridFontSize: gridFontSizeVal ?? DEFAULT_SETTINGS.gridFontSize,
|
||||
terminalFont: terminalFontVal ?? DEFAULT_SETTINGS.terminalFont
|
||||
terminalFont: terminalFontVal ?? DEFAULT_SETTINGS.terminalFont,
|
||||
externalStackPaths: externalStackPathsVal,
|
||||
primaryStackLocation: primaryStackLocationVal
|
||||
};
|
||||
|
||||
return json(settings);
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { json } from '@sveltejs/kit';
|
||||
import { listComposeStacks, deployStack, saveStackComposeFile, saveStackEnvVars } from '$lib/server/stacks';
|
||||
import { listComposeStacks, deployStack, saveStackComposeFile, saveStackEnvVars, writeRawStackEnvFile, saveStackEnvVarsToDb } from '$lib/server/stacks';
|
||||
import { EnvironmentNotFoundError } from '$lib/server/docker';
|
||||
import { upsertStackSource, getStackSources } from '$lib/server/db';
|
||||
import { authorize } from '$lib/server/authorize';
|
||||
@@ -35,11 +35,9 @@ export const GET: RequestHandler = async ({ url, cookies }) => {
|
||||
const existingNames = new Set(stacks.map((s) => s.name));
|
||||
|
||||
for (const source of stackSources) {
|
||||
// Only add internal/git stacks that aren't already in the list
|
||||
if (
|
||||
!existingNames.has(source.stackName) &&
|
||||
(source.sourceType === 'internal' || source.sourceType === 'git')
|
||||
) {
|
||||
// Add stacks from database that aren't already in the Docker list
|
||||
// This includes internal, git, and external (adopted) stacks that are currently down
|
||||
if (!existingNames.has(source.stackName)) {
|
||||
stacks.push({
|
||||
name: source.stackName,
|
||||
containers: [],
|
||||
@@ -78,7 +76,7 @@ export const POST: RequestHandler = async ({ request, url, cookies }) => {
|
||||
|
||||
try {
|
||||
const body = await request.json();
|
||||
const { name, compose, start, envVars } = body;
|
||||
const { name, compose, start, envVars, rawEnvContent, composePath, envPath } = body;
|
||||
|
||||
if (!name || typeof name !== 'string') {
|
||||
return json({ error: 'Stack name is required' }, { status: 400 });
|
||||
@@ -90,50 +88,86 @@ export const POST: RequestHandler = async ({ request, url, cookies }) => {
|
||||
|
||||
// If start is false, only create the compose file without deploying
|
||||
if (start === false) {
|
||||
const result = await saveStackComposeFile(name, compose, true);
|
||||
const result = await saveStackComposeFile(name, compose, true, envIdNum, {
|
||||
composePath: composePath || undefined,
|
||||
envPath: envPath || undefined
|
||||
});
|
||||
if (!result.success) {
|
||||
return json({ error: result.error }, { status: 400 });
|
||||
}
|
||||
|
||||
// Save environment variables if provided (to both DB and .env file)
|
||||
// Save environment variables
|
||||
// - rawEnvContent: non-secret vars with comments → .env file
|
||||
// - envVars: ALL vars → DB (secrets stored for shell injection, non-secrets for metadata)
|
||||
if (rawEnvContent) {
|
||||
// Write raw content to .env file (should NOT contain secrets)
|
||||
await writeRawStackEnvFile(name, rawEnvContent, envIdNum, envPath || undefined);
|
||||
}
|
||||
// Save ALL vars to DB (secrets for shell injection at runtime)
|
||||
if (envVars && Array.isArray(envVars) && envVars.length > 0) {
|
||||
await saveStackEnvVars(name, envVars, envIdNum);
|
||||
await saveStackEnvVarsToDb(name, envVars, envIdNum);
|
||||
}
|
||||
// Fallback: if no rawEnvContent, generate .env from non-secret vars
|
||||
if (!rawEnvContent && envVars && Array.isArray(envVars) && envVars.length > 0) {
|
||||
await saveStackEnvVars(name, envVars, envIdNum, envPath || undefined);
|
||||
}
|
||||
|
||||
// Record the stack as internally created
|
||||
// Record the stack as internally created with custom paths if provided
|
||||
await upsertStackSource({
|
||||
stackName: name,
|
||||
environmentId: envIdNum,
|
||||
sourceType: 'internal'
|
||||
sourceType: 'internal',
|
||||
composePath: composePath || undefined,
|
||||
envPath: envPath || undefined
|
||||
});
|
||||
|
||||
return json({ success: true, started: false });
|
||||
}
|
||||
|
||||
// Save environment variables BEFORE deploying so they're available during start
|
||||
if (envVars && Array.isArray(envVars) && envVars.length > 0) {
|
||||
if (rawEnvContent || (envVars && Array.isArray(envVars) && envVars.length > 0)) {
|
||||
// First ensure the stack directory exists by saving compose file
|
||||
await saveStackComposeFile(name, compose, true);
|
||||
// Save to both DB and .env file
|
||||
await saveStackEnvVars(name, envVars, envIdNum);
|
||||
await saveStackComposeFile(name, compose, true, envIdNum, {
|
||||
composePath: composePath || undefined,
|
||||
envPath: envPath || undefined
|
||||
});
|
||||
|
||||
// - rawEnvContent: non-secret vars with comments → .env file
|
||||
// - envVars: ALL vars → DB (secrets stored for shell injection, non-secrets for metadata)
|
||||
if (rawEnvContent) {
|
||||
// Write raw content to .env file (should NOT contain secrets)
|
||||
await writeRawStackEnvFile(name, rawEnvContent, envIdNum, envPath || undefined);
|
||||
}
|
||||
// Save ALL vars to DB (secrets for shell injection at runtime)
|
||||
if (envVars && Array.isArray(envVars) && envVars.length > 0) {
|
||||
await saveStackEnvVarsToDb(name, envVars, envIdNum);
|
||||
}
|
||||
// Fallback: if no rawEnvContent, generate .env from non-secret vars
|
||||
if (!rawEnvContent && envVars && Array.isArray(envVars) && envVars.length > 0) {
|
||||
await saveStackEnvVars(name, envVars, envIdNum, envPath || undefined);
|
||||
}
|
||||
}
|
||||
|
||||
// Deploy and start the stack
|
||||
const result = await deployStack({
|
||||
name,
|
||||
compose,
|
||||
envId: envIdNum
|
||||
envId: envIdNum,
|
||||
composePath: composePath || undefined,
|
||||
envPath: envPath || undefined
|
||||
});
|
||||
|
||||
if (!result.success) {
|
||||
return json({ error: result.error, output: result.output }, { status: 400 });
|
||||
}
|
||||
|
||||
// Record the stack as internally created
|
||||
// Record the stack as internally created with custom paths if provided
|
||||
await upsertStackSource({
|
||||
stackName: name,
|
||||
environmentId: envIdNum,
|
||||
sourceType: 'internal'
|
||||
sourceType: 'internal',
|
||||
composePath: composePath || undefined,
|
||||
envPath: envPath || undefined
|
||||
});
|
||||
|
||||
return json({ success: true, started: true, output: result.output });
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user