feat: CPU/RAM limits per stage, NPM access list (global + per-project)

Resource limits: - Add cpu_limit (cores) and memory_limit (MB) fields to Stage model - Pass limits to Docker container via NanoCPUs and Memory in HostConfig - Add CPU/Memory fields to stage creation form in project detail - 0 = unlimited (default) NPM access list: - Add npm_access_list_id to Settings (global default) and Project (per-project override) - Per-project overrides global when > 0 - NPM provider passes access_list_id when configuring proxy hosts - Add GET /api/settings/npm-access-lists endpoint to list NPM access lists - Add access list picker on NPM settings page (global) - Add access list ID field on project edit form (per-project) - DB migrations for all new columns
2026-04-05 12:44:26 +03:00
parent c6d20ca26e
commit 7550fe9e32
12 changed files with 217 additions and 38 deletions
@@ -10,6 +10,7 @@ import type {
 	InspectResult,
 	Instance,
 	NpmCertificate,
+	NpmAccessList,
 	ProxyRoute,
 	Project,
 	ProjectDetail,
@@ -282,6 +283,10 @@ export function listNpmCertificates(): Promise<NpmCertificate[]> {
 	return get<NpmCertificate[]>('/api/settings/npm-certificates');
 }

+export function listNpmAccessLists(): Promise<NpmAccessList[]> {
+	return get<NpmAccessList[]>('/api/settings/npm-access-lists');
+}
+
 // ── DNS ────────────────────────────────────────────────────────────

 export function testDnsConnection(provider: string, token: string, zoneId: string): Promise<{ success: boolean; error?: string }> {
@@ -103,6 +103,12 @@
    "maxInstances": "Max Instances",
    "autoDeployLabel": "Auto Deploy",
    "enableProxy": "Enable Proxy",
+    "accessListId": "NPM Access List ID",
+    "accessListIdHelp": "Per-project override. 0 = use global default from NPM settings.",
+    "cpuLimit": "CPU Limit (cores)",
+    "cpuLimitHelp": "e.g., 0.5, 1, 2. Leave 0 for unlimited",
+    "memoryLimit": "Memory Limit (MB)",
+    "memoryLimitHelp": "e.g., 256, 512, 1024. Leave 0 for unlimited",
    "npmProxy": "NPM Proxy",
    "creating": "Creating...",
    "createStage": "Create Stage",
@@ -376,7 +382,13 @@
    "saveFailedConnection": "Cannot save \u2014 connection test failed",
    "remoteMode": "Remote NPM",
    "remoteModeHelp": "Enable when NPM runs on a different machine than Docker. Forwards to Server IP with published host ports.",
-    "remoteModeWarning": "Requires Server IP in General settings. Ports are auto-mapped to random host ports."
+    "remoteModeWarning": "Requires Server IP in General settings. Ports are auto-mapped to random host ports.",
+    "accessList": "Default Access List",
+    "accessListHelp": "NPM access list for HTTP authentication on proxy hosts. Can be overridden per project.",
+    "noAccessList": "None (public)",
+    "selectAccessList": "Select an access list",
+    "noAccessLists": "No access lists found in NPM",
+    "accessListLoadFailed": "Failed to load access lists"
  },
  "settingsCredentials": {
    "title": "Credentials",
@@ -103,6 +103,12 @@
    "maxInstances": "Макс. экземпляров",
    "autoDeployLabel": "Авто-деплой",
    "enableProxy": "Включить прокси",
+    "accessListId": "ID списка доступа NPM",
+    "accessListIdHelp": "Переопределение для проекта. 0 = использовать глобальное из настроек NPM.",
+    "cpuLimit": "Лимит CPU (ядра)",
+    "cpuLimitHelp": "напр., 0.5, 1, 2. Оставьте 0 для без ограничений",
+    "memoryLimit": "Лимит памяти (МБ)",
+    "memoryLimitHelp": "напр., 256, 512, 1024. Оставьте 0 для без ограничений",
    "npmProxy": "NPM прокси",
    "creating": "Создание...",
    "createStage": "Создать стадию",
@@ -376,7 +382,13 @@
    "saveFailedConnection": "Невозможно сохранить — проверка соединения не пройдена",
    "remoteMode": "Удалённый NPM",
    "remoteModeHelp": "Включите, если NPM работает на другой машине. Перенаправление на IP сервера с опубликованными портами.",
-    "remoteModeWarning": "Требуется IP сервера в общих настройках. Порты автоматически привязываются к случайным портам хоста."
+    "remoteModeWarning": "Требуется IP сервера в общих настройках. Порты автоматически привязываются к случайным портам хоста.",
+    "accessList": "Список доступа по умолчанию",
+    "accessListHelp": "Список доступа NPM для HTTP-аутентификации на прокси-хостах. Можно переопределить для каждого проекта.",
+    "noAccessList": "Нет (публичный)",
+    "selectAccessList": "Выберите список доступа",
+    "noAccessLists": "Списки доступа в NPM не найдены",
+    "accessListLoadFailed": "Не удалось загрузить списки доступа"
  },
  "settingsCredentials": {
    "title": "Учётные данные",
@@ -9,6 +9,7 @@ export interface Project {
 	healthcheck: string;
 	env: string;
 	volumes: string;
+	npm_access_list_id: number;
 	created_at: string;
 	updated_at: string;
 }
@@ -24,6 +25,8 @@ export interface Stage {
 	enable_proxy: boolean;
 	promote_from: string;
 	subdomain: string;
+	cpu_limit: number;
+	memory_limit: number;
 	created_at: string;
 	updated_at: string;
 }
@@ -107,6 +110,7 @@ export interface Settings {
 	/** Sent on PUT to update the password; never returned by GET. */
 	npm_password?: string;
 	npm_remote: boolean;
+	npm_access_list_id: number;
 	polling_interval: string;
 	base_volume_path: string;
 	ssl_certificate_id: number;
@@ -258,6 +262,12 @@ export interface ProxyHealth {
 	error?: string;
 }

+/** An NPM access list for proxy authentication. */
+export interface NpmAccessList {
+	id: number;
+	name: string;
+}
+
 /** A proxy route managed by a deployed instance. */
 export interface ProxyRoute {
 	instance_id: string;
@@ -35,6 +35,8 @@
 	let stageAutoDeploy = $state(true);
 	let stageEnableProxy = $state(true);
 	let stageMaxInstances = $state('1');
+	let stageCpuLimit = $state('');
+	let stageMemoryLimit = $state('');
 	let addingStage = $state(false);

 	async function handleAddStage() {
@@ -47,9 +49,11 @@
 				auto_deploy: stageAutoDeploy,
 				enable_proxy: stageEnableProxy,
 				max_instances: parseInt(stageMaxInstances) || 1,
+				cpu_limit: parseFloat(stageCpuLimit) || 0,
+				memory_limit: parseInt(stageMemoryLimit) || 0,
 			});
 			toasts.success($t('projectDetail.stageCreated', { name: stageName }));
-			stageName = ''; stageTagPattern = '*'; stageAutoDeploy = true; stageEnableProxy = true; stageMaxInstances = '1';
+			stageName = ''; stageTagPattern = '*'; stageAutoDeploy = true; stageEnableProxy = true; stageMaxInstances = '1'; stageCpuLimit = ''; stageMemoryLimit = '';
 			showAddStage = false;
 			await loadProject();
 		} catch (e) {
@@ -65,6 +69,7 @@
 	let editImage = $state('');
 	let editPort = $state('');
 	let editHealthcheck = $state('');
+	let editAccessListId = $state('');
 	let saving = $state(false);

 	function startEditing() {
@@ -73,6 +78,7 @@
 		editImage = project.image;
 		editPort = String(project.port || '');
 		editHealthcheck = project.healthcheck || '';
+		editAccessListId = String(project.npm_access_list_id || '0');
 		editing = true;
 	}

@@ -85,6 +91,7 @@
 				image: editImage.trim(),
 				port: parseInt(editPort) || 0,
 				healthcheck: editHealthcheck.trim(),
+				npm_access_list_id: parseInt(editAccessListId) || 0,
 			});
 			toasts.success($t('projectDetail.projectUpdated'));
 			editing = false;
@@ -281,6 +288,7 @@
 					<FormField label={$t('projectDetail.imageLabel')} name="editImage" bind:value={editImage} />
 					<FormField label={$t('projectDetail.portLabel')} name="editPort" type="number" bind:value={editPort} />
 					<FormField label={$t('projectDetail.healthcheckLabel')} name="editHealthcheck" bind:value={editHealthcheck} placeholder="/api/health" />
+					<FormField label={$t('projectDetail.accessListId')} name="editAccessListId" type="number" bind:value={editAccessListId} placeholder="0" helpText={$t('projectDetail.accessListIdHelp')} />
 				</div>
 				<div class="mt-4 flex items-center gap-2 justify-end">
 					<button
@@ -349,23 +357,29 @@

 			{#if showAddStage}
 				<div class="mt-3 rounded-xl border border-[var(--border-primary)] bg-[var(--surface-card)] p-4 animate-scale-in">
-					<div class="grid grid-cols-2 gap-3 sm:grid-cols-5">
+					<div class="grid grid-cols-2 gap-3 sm:grid-cols-4">
 						<FormField label={$t('projectDetail.nameLabel')} name="stageName" bind:value={stageName} placeholder="dev" />
 						<FormField label={$t('projectDetail.tagPattern')} name="stagePattern" bind:value={stageTagPattern} placeholder="dev-*" helpText={$t('projectDetail.tagPatternHelp')} />
 						<FormField label={$t('projectDetail.maxInstances')} name="stageMax" type="number" bind:value={stageMaxInstances} />
-						<div class="flex flex-col gap-1.5">
-							<label class="text-sm font-medium text-[var(--text-primary)]">{$t('projectDetail.autoDeployLabel')}</label>
-							<div class="flex items-center h-[38px]">
-								<ToggleSwitch bind:checked={stageAutoDeploy} label={$t('projectDetail.autoDeployLabel')} />
-							</div>
-						</div>
-						<div class="flex flex-col gap-1.5">
-							<label class="text-sm font-medium text-[var(--text-primary)]">{$t('projectDetail.enableProxy')}</label>
-							<div class="flex items-center h-[38px]">
-								<ToggleSwitch bind:checked={stageEnableProxy} label={$t('projectDetail.enableProxy')} />
+						<div class="flex gap-4 items-end">
+							<div class="flex flex-col gap-1.5">
+								<label class="text-sm font-medium text-[var(--text-primary)]">{$t('projectDetail.autoDeployLabel')}</label>
+								<div class="flex items-center h-[38px]">
+									<ToggleSwitch bind:checked={stageAutoDeploy} label={$t('projectDetail.autoDeployLabel')} />
+								</div>
+							</div>
+							<div class="flex flex-col gap-1.5">
+								<label class="text-sm font-medium text-[var(--text-primary)]">{$t('projectDetail.enableProxy')}</label>
+								<div class="flex items-center h-[38px]">
+									<ToggleSwitch bind:checked={stageEnableProxy} label={$t('projectDetail.enableProxy')} />
+								</div>
 							</div>
 						</div>
 					</div>
+					<div class="mt-3 grid grid-cols-2 gap-3 sm:grid-cols-4">
+						<FormField label={$t('projectDetail.cpuLimit')} name="stageCpu" type="number" bind:value={stageCpuLimit} placeholder="0" helpText={$t('projectDetail.cpuLimitHelp')} />
+						<FormField label={$t('projectDetail.memoryLimit')} name="stageMem" type="number" bind:value={stageMemoryLimit} placeholder="0" helpText={$t('projectDetail.memoryLimitHelp')} />
+					</div>
 					<div class="mt-3 flex justify-end">
 						<button
 							type="button"
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { getSettings, updateSettings, listNpmCertificates, testNpmConnection } from '$lib/api';
+	import { getSettings, updateSettings, listNpmCertificates, listNpmAccessLists, testNpmConnection } from '$lib/api';
 	import type { EntityPickerItem } from '$lib/types';
 	import FormField from '$lib/components/FormField.svelte';
 	import ToggleSwitch from '$lib/components/ToggleSwitch.svelte';
@@ -26,6 +26,12 @@
 	let certPickerItems = $state<EntityPickerItem[]>([]);
 	let loadingCerts = $state(false);

+	let accessListId = $state(0);
+	let accessListName = $state('');
+	let accessListPickerOpen = $state(false);
+	let accessListPickerItems = $state<EntityPickerItem[]>([]);
+	let loadingAccessLists = $state(false);
+
 	function validateNpmForm(): boolean {
 		const newErrors: Record<string, string> = {};
 		if (!npmUrl.trim()) { newErrors.npmUrl = $t('validation.required', { field: 'NPM URL' }); } else { try { new URL(npmUrl.trim()); } catch { newErrors.npmUrl = $t('validation.invalidUrl'); } }
@@ -45,7 +51,9 @@
 			npmPassword = '';
 			sslCertificateId = settings.ssl_certificate_id ?? 0;
 			npmRemote = settings.npm_remote ?? false;
+			accessListId = settings.npm_access_list_id ?? 0;
 			if (sslCertificateId > 0) sslCertName = `Certificate #${sslCertificateId}`;
+			if (accessListId > 0) accessListName = `Access List #${accessListId}`;
 		} catch (err) { toasts.error(err instanceof Error ? err.message : $t('settingsCredentials.loadFailed')); } finally { loading = false; }
 	}

@@ -121,6 +129,36 @@

 	function clearCertificate() { sslCertificateId = 0; sslCertName = ''; saveCertificate(0); }

+	async function openAccessListPicker() {
+		loadingAccessLists = true;
+		try {
+			const lists = await listNpmAccessLists();
+			if (lists.length === 0) { toasts.info($t('settingsNpm.noAccessLists')); return; }
+			accessListPickerItems = lists.map((al): EntityPickerItem => ({
+				value: String(al.id),
+				label: al.name || `Access List #${al.id}`,
+			}));
+			accessListPickerOpen = true;
+		} catch (err) {
+			toasts.error(err instanceof Error ? err.message : $t('settingsNpm.accessListLoadFailed'));
+		} finally { loadingAccessLists = false; }
+	}
+
+	async function saveAccessList(id: number) {
+		try { await updateSettings({ npm_access_list_id: id } as any); toasts.success($t('settingsCredentials.saved')); }
+		catch (err) { toasts.error(err instanceof Error ? err.message : $t('settingsCredentials.saveFailed')); }
+	}
+
+	function handleAccessListSelect(value: string) {
+		accessListId = parseInt(value, 10);
+		const item = accessListPickerItems.find((i) => i.value === value);
+		accessListName = item?.label ?? '';
+		accessListPickerOpen = false;
+		saveAccessList(accessListId);
+	}
+
+	function clearAccessList() { accessListId = 0; accessListName = ''; saveAccessList(0); }
+
 	async function resolveCertName() {
 		if (sslCertificateId <= 0) return;
 		try {
@@ -255,6 +293,36 @@
 				</div>
 			</div>
 		</div>
+
+		<!-- Default Access List -->
+		<div class="rounded-xl border border-[var(--border-primary)] bg-[var(--surface-card)] p-6 shadow-[var(--shadow-sm)]">
+			<div class="flex items-start gap-3">
+				<div class="flex-1">
+					<h3 class="text-sm font-semibold text-[var(--text-primary)]">{$t('settingsNpm.accessList')}</h3>
+					<p class="mt-0.5 text-xs text-[var(--text-tertiary)]">{$t('settingsNpm.accessListHelp')}</p>
+					<div class="mt-3 flex items-center gap-2">
+						<button type="button" onclick={openAccessListPicker} disabled={loadingAccessLists}
+							class="inline-flex items-center gap-2 rounded-lg border border-[var(--border-primary)] px-3 py-2 text-sm text-[var(--text-secondary)] hover:bg-[var(--surface-card-hover)] transition-colors disabled:opacity-50">
+							<IconShield size={16} />
+							{#if loadingAccessLists}
+								{$t('common.loading')}
+							{:else if accessListId > 0 && accessListName}
+								{accessListName}
+							{:else}
+								{$t('settingsNpm.noAccessList')}
+							{/if}
+						</button>
+						{#if accessListId > 0}
+							<button type="button" onclick={clearAccessList}
+								class="inline-flex items-center gap-1 rounded-lg border border-[var(--border-primary)] px-2 py-2 text-sm text-[var(--text-tertiary)] hover:text-[var(--color-danger)] hover:bg-[var(--surface-card-hover)] transition-colors"
+								title={$t('settingsGeneral.clearCertificate')}>
+								<IconX size={14} />
+							</button>
+						{/if}
+					</div>
+				</div>
+			</div>
+		</div>
 	{/if}
 </div>

@@ -266,3 +334,12 @@
 	onselect={handleCertSelect}
 	onclose={() => { certPickerOpen = false; }}
 />
+
+<EntityPicker
+	bind:open={accessListPickerOpen}
+	items={accessListPickerItems}
+	current={String(accessListId)}
+	title={$t('settingsNpm.selectAccessList')}
+	onselect={handleAccessListSelect}
+	onclose={() => { accessListPickerOpen = false; }}
+/>