ducoterra
cffbac5771
All green. Report:
**Verified / implemented (final pass of `15_agent_mtls`)**
- Wrote `data/logs/verify-15-tls-e2e.py`: a real `host_agent.py --cert-bundle` + a real dashboard process over a scratch DB (`HOST_TARGETS=loop=https://…`) — **27/27 PASS**, transcript `verify-15-tls-e2e.out`, notes `data/logs/NOTES-tls-rollout.md`.
- Read-only checks against the running dev store: 5 `certs.*` rows byte-identical across a restart; served bundle == the `meta` row (1430 B); 0 events containing `-----BEGIN`; unsigned `/certs`→`303 ?next=`, unsigned `/api/certs`→`401`, signed-in `200`; screenshots `data/logs/15-final-{certs,system}.png`.
- Docs (step 6, full review): README — added *Protecting an agent, host by host* (the rollout task-07 left out), a `tests/test_certs.py`/TLS-matrix/sandbox-installer paragraph, and fixed two stale “the one write endpoint in the app” claims (`NUT_ALLOW_ACTIONS`, Battery-test buttons). AGENTS.md — test count 1424→1427, bundle-fetch command in *Commands*, a Testing-policy bullet on structurally pinning a key-holding module, fleet transport bullet (token mode is now the compatibility path), gap 11 final state.
**Tests / lint (full suite 100% green)**
- `uv run pytest` → **1427 passed, 15 skipped**, exit 0 · `bash .agents/validate.sh` → **exit 0** (coverage **98.94%** vs 94% floor, `certs.py` 100%; ruff “All checks passed”; pyright 0 errors; `node --check` clean; hygiene clean)
- `uv run pytest -m live --live` → **11 passed / 0 failed** · `./scripts/dev-server.sh status` → all 9 sources `ok`
- `uv pip list --outdated` → empty after bumping `fastapi 0.152.0 → 0.153.0` (`uv.lock` only); full suite re-run green.
**Completion criteria**
- Fresh-DB root CA, idempotent: ✅ (tests + live store hashes) · agent TLS matrix incl. wrong-CA/certless 403/`/health` CA-only/revoked 403 + live denylist re-read: ✅
- `https` `host:`/`disks:` `ok` + revoked says “agent certificate revoked” with no dial: ✅ on loopback (real agent + real dashboard) and spy-pinned hermetically; **not** on the fleet (below)
- Signed-in `/certs` + rotate/revoke/root-rotate + byte-identical bundle download: ✅ · installer bundle/unit/`--status` over TLS: ✅ (0640, see deviation)
- `pytest`/`validate.sh`/`--outdated`: ✅ · token-mode byte-identical, engine/UPS untouched, public surface unchanged (route walk): ✅
- **Live fleet TLS (deskwork+gateway flip): NOT done** — no live changes. It needs root on hosts without the installer grant (`deskwork`), has no both-ways-working window (`http://` dashboard vs https-only agent), and would deploy the agent from this not-yet-committed tree. Exact procedure recorded in README + `data/logs/NOTES-tls-rollout.md`.
**Deviations**: bundle mode `0640 root:dashboards-agent` instead of the task file’s `0600` (the agent re-reads its own bundle for the denylist; 0600 breaks the unit — already recorded in AGENTS.md); the loopback dashboard substitutes for the fleet flip. Incidental: a stray `pkill` of mine killed the dev server mid-pass; restarted and verified healthy.
**Next pending phase**: `.agents/phases/todo/16_agent_smart_pass_budget` (then `17_installer_device_filter`).
89 lines
3.1 KiB
TOML
89 lines
3.1 KiB
TOML
[project]
|
|
name = "dashboards"
|
|
version = "0.1.0"
|
|
description = "Homelab dashboards on one domain: system resources, LLM engines, and UPS battery health"
|
|
readme = "README.md"
|
|
# 3.14 is what the Containerfile, the venv, and the fleet agent's tests run on. The floor
|
|
# is deliberately hard: 3.13 would resolve a different lock and CI would test a stack nobody
|
|
# deploys.
|
|
requires-python = ">=3.14"
|
|
# Deliberately small. Everything we collect is either our own agent's JSON (stdlib only,
|
|
# see agent/host_agent.py) or an upstream Prometheus exposition parsed by our own parser
|
|
# (src/dashboards/prom.py). No prometheus_client, no Grafana, no CDN, no bundler.
|
|
dependencies = [
|
|
"fastapi>=0.143.3",
|
|
"httpx>=0.28.1",
|
|
"uvicorn[standard]>=0.54.0",
|
|
"pydantic>=2.14.1",
|
|
"python-dotenv>=1.2.4",
|
|
# Phase 15: the dashboard mints its own root CA and signs the agent certs (`certs.py`).
|
|
# Dashboard-side ONLY — `agent/host_agent.py` stays stdlib and loads the PEMs with `ssl`.
|
|
# Wheels exist for every platform we build on, and it is the only sane way to issue X.509.
|
|
"cryptography>=50.0.2",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest>=9.1.1",
|
|
"pytest-cov>=7.1.0",
|
|
"pytest-asyncio>=1.4.0",
|
|
"ruff>=0.17.1",
|
|
"pyright>=1.1.414",
|
|
"debugpy>=1.8.22",
|
|
]
|
|
|
|
# Installed editable by `uv sync` (src layout), so `uv run dashboards` and
|
|
# `uv run uvicorn dashboards.app:app` both work without PYTHONPATH gymnastics.
|
|
[build-system]
|
|
requires = ["hatchling>=1.27"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project.scripts]
|
|
dashboards = "dashboards.__main__:main"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/dashboards"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
addopts = "-q --strict-markers"
|
|
markers = [
|
|
# `-m live --live` runs them; without --live they SKIP, so `uv run pytest` stays
|
|
# network-free. See tests/test_live_fleet.py for the env vars each one needs.
|
|
"live: needs real hardware (fleet hosts, LLM engines, or upsd) — opt in with --live",
|
|
# `-m store_perf --store-perf` runs them: the phase-14 timing measurements over the seeded
|
|
# production-shaped store (tests/store_perf.py). The seed itself runs in the default suite;
|
|
# only the multi-minute measurement passes are behind this flag. Underscored because Python
|
|
# decorators cannot carry a hyphen; the CLI flag stays `--store-perf`.
|
|
"store_perf: measures the seeded store's hot paths — opt in with --store-perf",
|
|
]
|
|
# auto: async tests run without a decorator on every single one
|
|
asyncio_mode = "auto"
|
|
filterwarnings = ["error::DeprecationWarning"]
|
|
|
|
[tool.coverage.run]
|
|
source = ["src/dashboards"]
|
|
omit = ["tests/*"]
|
|
|
|
[tool.coverage.report]
|
|
show_missing = true
|
|
skip_covered = false
|
|
|
|
[tool.ruff]
|
|
line-length = 110
|
|
target-version = "py314"
|
|
src = ["src", "tests", "agent"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "W", "I", "UP", "B", "C4", "SIM", "RUF", "BLE", "PLC"]
|
|
ignore = ["E501"]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
# FastAPI's dependency injection is a call in a default argument; that is the API, not a bug.
|
|
"src/dashboards/api.py" = ["B008"]
|
|
|
|
[tool.pyright]
|
|
include = ["src", "tests"]
|
|
pythonVersion = "3.14"
|
|
typeCheckingMode = "standard"
|