be6ad15efc
Security: apply AdminOnly middleware to mutating routes, require ENCRYPTION_KEY and ADMIN_PASSWORD (no insecure defaults), restrict CORS to same-origin, fix OIDC token delivery via cookie instead of URL query param, add rate limiting on login, add MaxBytesReader, validate volume paths against traversal, add security headers, validate user roles, add Secure flag to OIDC cookie. Performance: set SQLite MaxOpenConns(1) to prevent SQLITE_BUSY, add FK indexes on 8 columns, track notifier goroutines with WaitGroup for graceful shutdown, use GetRegistryByName instead of GetAllRegistries in deployer, pass basePath param to avoid redundant settings query, return empty slices from store to remove reflection. Quality: refactor TriggerDeploy to delegate to runDeploy (~100 lines removed), consolidate duplicated utilities (extractPort, boolToInt, now, isTerminalStatus) into shared exports, migrate all log.Printf to slog structured logging, use consistent webhook response envelope, remove dead code (parseEnvVars, duplicate auth types). UX: clean up NPM proxy on instance removal via API, add README with quickstart guide, add .env.example, require ADMIN_PASSWORD in docker-compose, document staging-net prerequisite.
169 lines
4.4 KiB
Go
169 lines
4.4 KiB
Go
package api
|
|
|
|
import (
|
|
"log/slog"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/alexei/docker-watcher/internal/docker"
|
|
"github.com/alexei/docker-watcher/internal/store"
|
|
)
|
|
|
|
// listDeploys handles GET /api/deploys.
|
|
func (s *Server) listDeploys(w http.ResponseWriter, r *http.Request) {
|
|
limitStr := r.URL.Query().Get("limit")
|
|
limit := 50
|
|
if limitStr != "" {
|
|
if parsed, err := strconv.Atoi(limitStr); err == nil && parsed > 0 {
|
|
limit = parsed
|
|
}
|
|
}
|
|
|
|
deploys, err := s.store.GetRecentDeploys(limit)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to list deploys: "+err.Error())
|
|
return
|
|
}
|
|
respondJSON(w, http.StatusOK, deploys)
|
|
}
|
|
|
|
// NOTE: getDeployLogs has been replaced by streamDeployLogs in sse.go.
|
|
// The new handler supports both SSE streaming and JSON fallback via Accept header.
|
|
|
|
// inspectRequest is the expected JSON body for POST /api/deploy/inspect.
|
|
type inspectRequest struct {
|
|
Image string `json:"image"`
|
|
}
|
|
|
|
// inspectResponse is the response body for POST /api/deploy/inspect.
|
|
type inspectResponse struct {
|
|
Image string `json:"image"`
|
|
Port int `json:"port"`
|
|
Healthcheck string `json:"healthcheck"`
|
|
}
|
|
|
|
// inspectImage handles POST /api/deploy/inspect.
|
|
// Pulls the image and inspects it for EXPOSE ports and healthcheck config.
|
|
func (s *Server) inspectImage(w http.ResponseWriter, r *http.Request) {
|
|
var req inspectRequest
|
|
if !decodeJSON(w, r, &req) {
|
|
return
|
|
}
|
|
|
|
if req.Image == "" {
|
|
respondError(w, http.StatusBadRequest, "image is required")
|
|
return
|
|
}
|
|
|
|
ctx := r.Context()
|
|
|
|
// Pull the image first so it's available locally for inspection.
|
|
// Split image:tag for the pull call.
|
|
imageRef, tag := splitImageTag(req.Image)
|
|
if err := s.docker.PullImage(ctx, imageRef, tag, ""); err != nil {
|
|
slog.Warn("pull image for inspect", "image", req.Image, "error", err)
|
|
// Try to inspect anyway in case the image is already local.
|
|
}
|
|
|
|
info, err := s.docker.InspectImage(ctx, req.Image)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to inspect image: "+err.Error())
|
|
return
|
|
}
|
|
|
|
port := docker.ExtractPort(info.ExposedPorts)
|
|
|
|
respondJSON(w, http.StatusOK, inspectResponse{
|
|
Image: req.Image,
|
|
Port: port,
|
|
Healthcheck: info.Healthcheck,
|
|
})
|
|
}
|
|
|
|
// quickDeployRequest is the expected JSON body for POST /api/deploy/quick.
|
|
type quickDeployRequest struct {
|
|
Name string `json:"name"`
|
|
Image string `json:"image"`
|
|
Tag string `json:"tag"`
|
|
Registry string `json:"registry"`
|
|
Port int `json:"port"`
|
|
}
|
|
|
|
// quickDeploy handles POST /api/deploy/quick.
|
|
// Creates a project, a default stage, and triggers a deploy in one call.
|
|
func (s *Server) quickDeploy(w http.ResponseWriter, r *http.Request) {
|
|
var req quickDeployRequest
|
|
if !decodeJSON(w, r, &req) {
|
|
return
|
|
}
|
|
|
|
if req.Image == "" {
|
|
respondError(w, http.StatusBadRequest, "image is required")
|
|
return
|
|
}
|
|
if req.Tag == "" {
|
|
req.Tag = "latest"
|
|
}
|
|
if req.Name == "" {
|
|
// Derive name from image.
|
|
parts := strings.Split(req.Image, "/")
|
|
req.Name = parts[len(parts)-1]
|
|
}
|
|
|
|
// Create project.
|
|
project, err := s.store.CreateProject(store.Project{
|
|
Name: req.Name,
|
|
Image: req.Image,
|
|
Registry: req.Registry,
|
|
Port: req.Port,
|
|
Env: "{}",
|
|
Volumes: "{}",
|
|
})
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to create project: "+err.Error())
|
|
return
|
|
}
|
|
|
|
// Create default stage.
|
|
stage, err := s.store.CreateStage(store.Stage{
|
|
ProjectID: project.ID,
|
|
Name: "dev",
|
|
TagPattern: "*",
|
|
AutoDeploy: true,
|
|
MaxInstances: 1,
|
|
})
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to create stage: "+err.Error())
|
|
return
|
|
}
|
|
|
|
// Trigger deploy asynchronously.
|
|
deployID, err := s.deployer.AsyncTriggerDeploy(r.Context(), project.ID, stage.ID, req.Tag)
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, "failed to trigger deploy: "+err.Error())
|
|
return
|
|
}
|
|
|
|
respondJSON(w, http.StatusAccepted, map[string]any{
|
|
"project": project,
|
|
"stage": stage,
|
|
"tag": req.Tag,
|
|
"deploy_id": deployID,
|
|
"status": "deploying",
|
|
})
|
|
}
|
|
|
|
// splitImageTag splits "image:tag" into image and tag parts.
|
|
// Returns the full string and empty tag if no colon separator is found.
|
|
func splitImageTag(ref string) (string, string) {
|
|
if idx := strings.LastIndex(ref, ":"); idx != -1 {
|
|
afterColon := ref[idx+1:]
|
|
if !strings.Contains(afterColon, "/") {
|
|
return ref[:idx], afterColon
|
|
}
|
|
}
|
|
return ref, ""
|
|
}
|
|
|