@le-space/rootfs 0.3.11 → 0.3.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/uc-go-peer/rootfs/uc-go-peer-configure.sh

@@ -74,7 +74,14 @@ https://${proxy_hostname} {
             disable_http_challenge
         }
     }
-    reverse_proxy http://127.0.0.1:${WS_BACKEND_PORT}
+
+    handle_path /bootstrap/* {
+        reverse_proxy http://127.0.0.1:80
+    }
+
+    handle {
+        reverse_proxy http://127.0.0.1:${WS_BACKEND_PORT}
+    }
 }
 EOF
 }

package/reference/uc-go-peer/rootfs/uc-go-peer-setup-server.py

@@ -6,7 +6,9 @@ import subprocess
 import threading
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from urllib.parse import urlsplit
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlencode, urlsplit
+from urllib.request import urlopen
 
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/uc-go-peer")
@@ -16,6 +18,12 @@ DESCRIBE_SCRIPT = "/usr/local/sbin/uc-go-peer-describe.py"
 BOOTSTRAP_SERVICE = os.environ.get("BOOTSTRAP_SERVICE", "uc-go-peer-bootstrap.service")
 METADATA_FILE = os.environ.get("METADATA_FILE", "/run/uc-go-peer-setup-metadata.json")
 METADATA_ERROR_FILE = os.environ.get("METADATA_ERROR_FILE", "/run/uc-go-peer-setup-metadata.error")
+AUTHORIZED_KEYS_FILE = os.environ.get("AUTHORIZED_KEYS_FILE", "/root/.ssh/authorized_keys")
+ALEPH_API_HOST = os.environ.get("ALEPH_API_HOST", "https://api2.aleph.im")
+BOOTSTRAP_CONFIG_KEY = os.environ.get("BOOTSTRAP_CONFIG_KEY", "vm-bootstrap-config")
+BOOTSTRAP_CONFIG_POLL_SECONDS = float(os.environ.get("BOOTSTRAP_CONFIG_POLL_SECONDS", "5"))
+
+CONFIGURE_LOCK = threading.Lock()
 
 
 def _cors_headers(handler: BaseHTTPRequestHandler) -> None:
@@ -46,6 +54,142 @@ def _validate_proxy_hostname(value: object) -> str | None:
     return parsed.hostname
 
 
+def _extract_guest_bootstrap_locator() -> tuple[str | None, str | None]:
+    try:
+        with open(AUTHORIZED_KEYS_FILE, encoding="utf-8") as handle:
+            for raw_line in handle:
+                line = raw_line.strip()
+                if not line or line.startswith("#"):
+                    continue
+                for part in line.split():
+                    if part.startswith("aleph-bootstrap-config:"):
+                        _, owner_address, deployment_token = part.split(":", 2)
+                        owner_address = owner_address.strip().lower()
+                        deployment_token = deployment_token.strip()
+                        if owner_address and deployment_token:
+                            return owner_address, deployment_token
+    except (FileNotFoundError, ValueError):
+        return None, None
+
+    return None, None
+
+
+def _clear_metadata_state() -> None:
+    for path in (METADATA_FILE, METADATA_ERROR_FILE):
+        try:
+            os.remove(path)
+        except FileNotFoundError:
+            pass
+
+
+def _start_metadata_generation() -> None:
+    _clear_metadata_state()
+    threading.Thread(target=_generate_metadata_files, daemon=True).start()
+
+
+def _build_configure_args(record: dict) -> list[str]:
+    runtime = record.get("runtime") if isinstance(record.get("runtime"), dict) else {}
+    bootstrap = record.get("bootstrap") if isinstance(record.get("bootstrap"), dict) else {}
+    public_ipv4 = str(runtime.get("publicIpv4") or "").strip()
+    if not public_ipv4:
+        raise ValueError("bootstrap config missing runtime.publicIpv4")
+
+    mapped_ports = runtime.get("mappedPorts") if isinstance(runtime.get("mappedPorts"), dict) else {}
+    relay_tcp = mapped_ports.get("9095") if isinstance(mapped_ports.get("9095"), dict) else {}
+    relay_ws = mapped_ports.get("9097") if isinstance(mapped_ports.get("9097"), dict) else {}
+    relay_udp = mapped_ports.get("9095") if isinstance(mapped_ports.get("9095"), dict) else {}
+
+    args = [CONFIGURE_SCRIPT, "--public-ipv4", public_ipv4]
+
+    public_ipv6 = str(runtime.get("publicIpv6") or "").strip()
+    if public_ipv6:
+        args.extend(["--public-ipv6", public_ipv6])
+
+    proxy_hostname = _validate_proxy_hostname(runtime.get("proxyUrl"))
+    if proxy_hostname:
+        args.extend(["--proxy-hostname", proxy_hostname])
+
+    relay_tcp_host = relay_tcp.get("host")
+    relay_ws_host = relay_ws.get("host")
+    relay_udp_host = relay_udp.get("host") if relay_udp.get("udp") is True else None
+
+    if isinstance(relay_tcp_host, int) and relay_tcp_host > 0:
+        args.extend(["--tcp-port", str(relay_tcp_host)])
+    if isinstance(relay_ws_host, int) and relay_ws_host > 0:
+        args.extend(["--ws-port", str(relay_ws_host)])
+    if isinstance(relay_udp_host, int) and relay_udp_host > 0:
+        args.extend(["--udp-port", str(relay_udp_host)])
+
+    registration_id = str(bootstrap.get("registrationId") or "").strip()
+    if registration_id:
+        args.extend(["--bootstrap-registration-id", registration_id])
+    owner_auth = str(bootstrap.get("ownerAuthorizationBase64") or "").strip()
+    if owner_auth:
+        args.extend(["--bootstrap-owner-authorization-b64", owner_auth])
+
+    return args
+
+
+def _run_configure_process(args: list[str]) -> tuple[bool, str]:
+    with CONFIGURE_LOCK:
+        if os.path.exists(READY_FILE):
+            return True, "ready"
+        try:
+            result = subprocess.run(args, check=True, capture_output=True, text=True)
+        except subprocess.CalledProcessError as error:
+            return False, error.stderr.strip() or error.stdout.strip() or str(error)
+
+        _start_metadata_generation()
+        return True, result.stdout.strip()
+
+
+def _load_vm_bootstrap_record() -> tuple[str | None, str | None, dict | None]:
+    owner_address, deployment_token = _extract_guest_bootstrap_locator()
+    if not owner_address or not deployment_token:
+        return owner_address, deployment_token, None
+
+    request_url = (
+        f"{ALEPH_API_HOST.rstrip('/')}/api/v0/aggregates/{owner_address}.json?"
+        f"{urlencode({'keys': BOOTSTRAP_CONFIG_KEY})}"
+    )
+
+    try:
+        with urlopen(request_url, timeout=10) as response:
+            payload = json.loads(response.read().decode("utf-8") or "{}")
+    except HTTPError as error:
+        if error.code == 404:
+            return owner_address, deployment_token, None
+        return owner_address, deployment_token, None
+    except (URLError, json.JSONDecodeError, TimeoutError):
+        return owner_address, deployment_token, None
+
+    aggregate = payload.get("data", {}).get(BOOTSTRAP_CONFIG_KEY, {})
+    if not isinstance(aggregate, dict):
+        return owner_address, deployment_token, None
+
+    record = aggregate.get(deployment_token)
+    return owner_address, deployment_token, record if isinstance(record, dict) else None
+
+
+def _poll_bootstrap_config_loop() -> None:
+    while not os.path.exists(READY_FILE):
+        _, deployment_token, record = _load_vm_bootstrap_record()
+        if deployment_token and isinstance(record, dict):
+            status = str(record.get("status") or "").strip().lower()
+            if status != "pending":
+                time.sleep(BOOTSTRAP_CONFIG_POLL_SECONDS)
+                continue
+            try:
+                args = _build_configure_args(record)
+            except ValueError:
+                time.sleep(BOOTSTRAP_CONFIG_POLL_SECONDS)
+                continue
+            ok, _ = _run_configure_process(args)
+            if ok:
+                return
+        time.sleep(BOOTSTRAP_CONFIG_POLL_SECONDS)
+
+
 class Handler(BaseHTTPRequestHandler):
     server_version = "UcGoPeerSetup/1.0"
 
@@ -184,26 +328,22 @@ class Handler(BaseHTTPRequestHandler):
             self._send_json(400, {"status": "bad-request", "error": str(error)})
             return
 
-        try:
-            result = subprocess.run(args, check=True, capture_output=True, text=True)
-        except subprocess.CalledProcessError as error:
+        ok, output = _run_configure_process(args)
+        if not ok:
             self._send_json(
                 500,
                 {
                     "status": "error",
-                    "error": error.stderr.strip() or error.stdout.strip() or str(error),
+                    "error": output or "configure failed",
                 },
             )
             return
 
-        _clear_metadata_state()
-        threading.Thread(target=_generate_metadata_files, daemon=True).start()
-
         self._send_json(
             200,
             {
                 "status": "configured",
-                "stdout": result.stdout.strip(),
+                "stdout": output,
                 "metadata_pending": True,
             },
         )
@@ -215,14 +355,6 @@ def _stop_bootstrap_service() -> None:
     subprocess.run(["systemctl", "stop", BOOTSTRAP_SERVICE], check=False)
 
 
-def _clear_metadata_state() -> None:
-    for path in (METADATA_FILE, METADATA_ERROR_FILE):
-        try:
-            os.remove(path)
-        except FileNotFoundError:
-            pass
-
-
 def _generate_metadata_files() -> None:
     try:
         describe = subprocess.run(
@@ -240,6 +372,7 @@ def _generate_metadata_files() -> None:
 
 
 def main() -> None:
+    threading.Thread(target=_poll_bootstrap_config_loop, daemon=True).start()
     server = ThreadingHTTPServer(("0.0.0.0", 80), Handler)
     server.serve_forever()