ducoterra
a08e693698
**Phase 10 final pass — repo green; live criteria blocked off-repo.**
- Verified: `gateway` runs `dashboards-agent` (active/enabled, `10.1.1.27:9120` → `/health` 200, `/snapshot` 401 no-token / 200 bearer on-host, token matches `/etc/dashboards-agent.token`); `driveripper`/`deskwork` inactive, `sudo -n` → "a password is required", `:9120` empty.
- New measurement (transient runtime rule on gateway `firewall-cmd --add-port=9120/tcp`, **reverted** — runtime+permanent port lists verified back to the original set, no rich rules): laptop still gets no SYN through, while `:22`/`:80` on the same address answer in ms ⇒ the block is the lab gateway `10.2.0.1` port filter, not this app/host firewall/agent. No other live change made (no sudoers, no upsd, no UPS command).
- Tests/lint (exact): `bash .agents/validate.sh` → **EXIT 0** — `uv run pytest --cov --cov-fail-under=94` **793 passed, 11 skipped, coverage 98.33 %**; `ruff check src tests agent` clean; `pyright` 0 errors; `node --check` clean; hygiene clean; `uv pip list --outdated` empty (bumped fastapi 0.143.3→0.143.5, `uv.lock` only).
- `uv run pytest -m live --live` (`.env.dev` sourced): **4 passed, 1 skipped, 6 failed** — all six are `:9120`/`:3051` connect timeouts; zero parse/contract failures.
- Dev server restarted on current code: engines `ok`; 3×`host` + 3×`disks` + `nut` `DOWN` with real reasons (designed degradation, stub rows intact, no credential leakage).
- Completion criteria: screenshots ✓ (`data/logs/phase10-{index,system,disks,llm,ups}-live.png`); tunnel-vocabulary grep ✓ outside `.agents/` history (PLAN.md locked line, phase overviews, past reports; fixtures/`uv.lock` hits are digit substrings — `tests/test_deploy_scripts.py` guards operational files); no page-payload change ✓ (contract tests). **Not met, operator-side:** agents on all three hosts, `LIST UPS` from the laptop, `dev-server.sh status` all-ok, live suite green.
- Fixed in this pass: `sources/nut.py` unreachable-upsd message no longer prints a bare `(TimeoutError: )` (now `(timed out after 4s)` / `(ConnectionRefusedError: …)`), pinned by a new test + extended refused-port test.
- Docs: README verified consistent (every env var in `config.py` documented, routes/flags/`--with-llm`/pager sizes checked) — no changes needed. AGENTS.md fixed 4 inconsistencies: per-host sudo reality (gateway grants `NOPASSWD ALL`, which is why it installed without `agent-sudoers`; driveripper scoped; deskwork unrelated), the now-proven firewall finding, `/system` table typo ("agent per host"), gap-4 DB/WAL sizes + test count. `.env.example` `upsd.users` sample now one `instcmds` per line (it contradicted README and the in-app copy). `.env.dev` (gitignored) comment corrected to match the evidence.
- Flagged, untouched (locked): `.agents/PLAN.md` L92–95 still says upsd is "forwarded to `127.0.0.1:3494` in dev" — false after this phase; evidence + exact operator commands appended to `data/logs/NOTES-verify.md` §11.
- Next pending phase: `11_admin_login`.
84 lines
2.7 KiB
Bash
Executable File
84 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Local development server: start|stop|status|restart|logs
|
|
#
|
|
# ./scripts/dev-server.sh restart # reads .env.dev if present, runs on DASH_PORT
|
|
#
|
|
# The server keeps running after this shell exits (nohup + pidfile) so you can browse it
|
|
# while an agent works. Logs: data/logs/dev.log
|
|
set -uo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$ROOT"
|
|
PIDFILE="$ROOT/data/dev-server.pid"
|
|
LOG="$ROOT/data/logs/dev.log"
|
|
mkdir -p "$ROOT/data/logs"
|
|
|
|
running() { [ -f "$PIDFILE" ] && kill -0 "$(cat "$PIDFILE")" 2>/dev/null; }
|
|
|
|
start() {
|
|
if running; then
|
|
echo "already running (pid $(cat "$PIDFILE")) — http://127.0.0.1:${DASH_PORT:-8090}"
|
|
return 0
|
|
fi
|
|
if [ -f "$ROOT/.env.dev" ]; then
|
|
set -a; . "$ROOT/.env.dev"; set +a
|
|
echo "loaded .env.dev"
|
|
fi
|
|
PORT="${DASH_PORT:-8090}"
|
|
nohup .venv/bin/dashboards >"$LOG" 2>&1 &
|
|
echo $! >"$PIDFILE"
|
|
sleep 3
|
|
if running && curl -sf -o /dev/null "http://127.0.0.1:${PORT}/api/health"; then
|
|
echo "started pid $(cat "$PIDFILE") — http://127.0.0.1:${PORT}"
|
|
else
|
|
echo "FAILED to start; last lines of $LOG:"
|
|
tail -20 "$LOG"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
stop() {
|
|
if running; then
|
|
local pid
|
|
pid="$(cat "$PIDFILE")"
|
|
kill "$pid" 2>/dev/null
|
|
# Wait for the process to actually go away before handing the pidfile back. A bare
|
|
# `sleep 1` was not enough: uvicorn's graceful shutdown waits for in-flight requests,
|
|
# so `restart` with a browser open started the new server while the old one still
|
|
# held the SQLite file — the dying process then logged `database is locked` for a poll
|
|
# it had already fetched, which the app correctly turned into a red store-error event.
|
|
# Two servers on one DB is the one way this script can fabricate an incident, so the
|
|
# wait is bounded rather than optimistic, and SIGKILL is the last resort.
|
|
local i=0
|
|
while kill -0 "$pid" 2>/dev/null; do
|
|
i=$((i + 1))
|
|
if [ "$i" -gt 60 ]; then
|
|
echo "pid $pid ignored SIGTERM after 20s; sending SIGKILL"
|
|
kill -9 "$pid" 2>/dev/null
|
|
break
|
|
fi
|
|
sleep 0.25
|
|
done
|
|
echo "stopped"
|
|
else
|
|
echo "not running"
|
|
fi
|
|
rm -f "$PIDFILE"
|
|
}
|
|
|
|
case "${1:-start}" in
|
|
start) start ;;
|
|
stop) stop ;;
|
|
restart) stop; start ;;
|
|
status)
|
|
if running; then
|
|
echo "running pid $(cat "$PIDFILE")"
|
|
curl -s "http://127.0.0.1:${DASH_PORT:-8090}/api/health" \
|
|
| .venv/bin/python -c "import json,sys; d=json.load(sys.stdin); print('status:', d['status']); [print(' ', s['key'], 'ok' if s['ok'] else 'DOWN', (s['error'] or '')[:90]) for s in d['sources']]"
|
|
else
|
|
echo "not running"
|
|
fi ;;
|
|
logs) tail -n 40 "$LOG" ;;
|
|
*) echo "usage: $0 start|stop|restart|status|logs"; exit 2 ;;
|
|
esac
|