controller v0.73.0: DR recipe — emit secret-free customer+apps half in hub report
DR recipe slice (controller half), grounded in SPIKE-dr-recipe-2026-06-16. The
controller emitter is the BOUNDARY enforcement point: v1 ships an explicit
allowlist {catalog_ref, enabled, storage_bindings} and reads NOTHING from
AppConfig.Env, so no ENC:/token/password can leak. storage_bindings parsed from
the compose (${HDD_PATH}/${USERDATA_PATH} volume binds -> {container_path,
drive, subpath}).
Load-bearing tests: TestBuildAppRecipe_NoSecrets (synthetic-secret app -> none
leak) + TestBuildAppRecipe_AllowlistIsLoadBearing (red-proof companion) +
TestAppStorageBindings + TestBuildDRRecipeAppHalf. Red-proofed live: forcing the
emitter to dump Env makes the boundary test fail. recipe_version=1.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,161 @@
|
||||
package report
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
|
||||
)
|
||||
|
||||
// readComposeFile is the production composeReader: best-effort read of a stack's docker-compose.yml
|
||||
// (an unreadable file yields "" → no storage bindings for that app, never a failure).
|
||||
func readComposeFile(path string) string {
|
||||
data, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return string(data)
|
||||
}
|
||||
|
||||
// DR recipe — the controller (customer + apps) HALF of the secret-free reconstruction recipe
|
||||
// (SPIKE-dr-recipe-2026-06-16). The recipe is the non-secret re-provision plan that complements escrow
|
||||
// (keys) + PBS/restic (bytes). This emitter is THE BOUNDARY ENFORCEMENT POINT: the controller is the
|
||||
// component that distinguishes secret from non-secret deploy fields (it encrypts ENC: secrets in
|
||||
// app.yaml), so v1 ships ONLY an explicit allowlist — {catalog_ref, enabled, storage_bindings} — and
|
||||
// NEVER touches AppConfig.Env. A new field cannot leak a secret because it is excluded by default
|
||||
// (allowlist, not denylist). TestBuildAppRecipe_NoSecrets is the load-bearing proof.
|
||||
//
|
||||
// recipe_version=1; read is ignore-unknown (forward-compat). The hub assembles this half with the
|
||||
// agent's storage/guest/PBS half into one customer recipe keyed by customer + recipe_version.
|
||||
const DRRecipeVersion = 1
|
||||
|
||||
// DRRecipeAppHalf is the controller-emitted half.
|
||||
type DRRecipeAppHalf struct {
|
||||
RecipeVersion int `json:"recipe_version"`
|
||||
Customer DRCustomer `json:"customer"`
|
||||
Apps []AppRecipe `json:"apps"`
|
||||
}
|
||||
|
||||
// DRCustomer is the customer identity — public identifiers only.
|
||||
type DRCustomer struct {
|
||||
ID string `json:"id"`
|
||||
Display string `json:"display"`
|
||||
Domain string `json:"domain"`
|
||||
}
|
||||
|
||||
// AppRecipe is the v1 per-app allowlist. NOTHING from AppConfig.Env is emitted — the three fields below
|
||||
// are the entire surface, so no env secret (ENC: value, token, password) can ride along.
|
||||
type AppRecipe struct {
|
||||
CatalogRef string `json:"catalog_ref"`
|
||||
Enabled bool `json:"enabled"`
|
||||
StorageBindings []StorageBinding `json:"storage_bindings"`
|
||||
}
|
||||
|
||||
// StorageBinding names WHERE an app's data lives on a user-data drive: the container mount target, the
|
||||
// drive name, and the path under the drive. Identifiers/paths only — e.g. romm.library → felhom-flash
|
||||
// : userdata/roms. The hub correlates `drive` to the agent half's durable-id.
|
||||
type StorageBinding struct {
|
||||
ContainerPath string `json:"container_path"`
|
||||
Drive string `json:"drive"`
|
||||
Subpath string `json:"subpath"`
|
||||
}
|
||||
|
||||
// BuildDRRecipeAppHalf assembles the controller half: customer identity + an AppRecipe per DEPLOYED,
|
||||
// non-protected stack. composeReader returns a stack's docker-compose.yml content (seam: tests inject a
|
||||
// fake; production passes os.ReadFile-backed). Pure given the reader → unit-tested directly.
|
||||
func BuildDRRecipeAppHalf(custID, custName, domain string, all []stacks.Stack, composeReader func(path string) string) *DRRecipeAppHalf {
|
||||
half := &DRRecipeAppHalf{
|
||||
RecipeVersion: DRRecipeVersion,
|
||||
Customer: DRCustomer{ID: custID, Display: custName, Domain: domain},
|
||||
Apps: []AppRecipe{},
|
||||
}
|
||||
for _, s := range all {
|
||||
if s.Protected || !s.Deployed {
|
||||
continue
|
||||
}
|
||||
var composeYAML string
|
||||
if composeReader != nil && s.ComposePath != "" {
|
||||
composeYAML = composeReader(s.ComposePath)
|
||||
}
|
||||
half.Apps = append(half.Apps, buildAppRecipe(s, composeYAML))
|
||||
}
|
||||
return half
|
||||
}
|
||||
|
||||
// buildAppRecipe constructs ONE app's recipe from the allowlist ONLY. This function deliberately reads
|
||||
// NOTHING from s.AppConfig.Env — that is the boundary. catalog_ref = the catalog slug (falls back to the
|
||||
// stack name for an orphaned app); storage_bindings parsed from the compose against the app's HDD_PATH.
|
||||
func buildAppRecipe(s stacks.Stack, composeYAML string) AppRecipe {
|
||||
catalogRef := s.Meta.Slug
|
||||
if catalogRef == "" {
|
||||
catalogRef = s.Name
|
||||
}
|
||||
var hddPath string
|
||||
if s.AppConfig != nil {
|
||||
hddPath = s.AppConfig.Env["HDD_PATH"] // a path identifier, NOT a secret (secrets are ENC: in Env)
|
||||
}
|
||||
return AppRecipe{
|
||||
CatalogRef: catalogRef,
|
||||
Enabled: s.Deployed,
|
||||
StorageBindings: appStorageBindings(composeYAML, hddPath),
|
||||
}
|
||||
}
|
||||
|
||||
// appStorageBindings parses a docker-compose.yml for volume binds that land on the app's user-data drive
|
||||
// (under HDD_PATH, or its USERDATA_PATH=<HDD_PATH>/userdata sibling) and returns {container_path, drive,
|
||||
// subpath}. Pure (operates on the compose text), so it is unit-tested without files. The drive name is
|
||||
// the basename of HDD_PATH (e.g. /mnt/felhom-drives/felhom-flash → "felhom-flash").
|
||||
func appStorageBindings(composeYAML, hddPath string) []StorageBinding {
|
||||
if hddPath == "" || composeYAML == "" {
|
||||
return []StorageBinding{}
|
||||
}
|
||||
cleanHDD := filepath.ToSlash(filepath.Clean(hddPath))
|
||||
userdata := cleanHDD + "/userdata"
|
||||
drive := filepath.Base(cleanHDD)
|
||||
|
||||
bindings := []StorageBinding{}
|
||||
seen := map[string]bool{}
|
||||
scanner := bufio.NewScanner(strings.NewReader(composeYAML))
|
||||
inVolumes := false
|
||||
for scanner.Scan() {
|
||||
line := strings.TrimSpace(scanner.Text())
|
||||
if strings.HasPrefix(line, "volumes:") {
|
||||
inVolumes = true
|
||||
continue
|
||||
}
|
||||
if inVolumes && !strings.HasPrefix(line, "-") && !strings.HasPrefix(line, "#") && line != "" {
|
||||
inVolumes = false
|
||||
}
|
||||
if !inVolumes || !strings.HasPrefix(line, "- ") {
|
||||
continue
|
||||
}
|
||||
mountStr := strings.Trim(strings.TrimPrefix(line, "- "), "\"'")
|
||||
parts := strings.SplitN(mountStr, ":", 3)
|
||||
if len(parts) < 2 {
|
||||
continue
|
||||
}
|
||||
host := parts[0]
|
||||
host = strings.ReplaceAll(host, "${USERDATA_PATH}", userdata)
|
||||
host = strings.ReplaceAll(host, "${HDD_PATH}", cleanHDD)
|
||||
// Also tolerate the un-braced $VAR form.
|
||||
host = strings.ReplaceAll(host, "$USERDATA_PATH", userdata)
|
||||
host = strings.ReplaceAll(host, "$HDD_PATH", cleanHDD)
|
||||
host = filepath.ToSlash(filepath.Clean(host))
|
||||
|
||||
if host != cleanHDD && !strings.HasPrefix(host, cleanHDD+"/") {
|
||||
continue // not on this drive
|
||||
}
|
||||
subpath := strings.TrimPrefix(host, cleanHDD)
|
||||
subpath = strings.TrimPrefix(subpath, "/")
|
||||
container := parts[1]
|
||||
key := container + "\x00" + subpath
|
||||
if seen[key] {
|
||||
continue
|
||||
}
|
||||
seen[key] = true
|
||||
bindings = append(bindings, StorageBinding{ContainerPath: container, Drive: drive, Subpath: subpath})
|
||||
}
|
||||
return bindings
|
||||
}
|
||||
Reference in New Issue
Block a user