alchemite-setup 0.1.0__tar.gz

alchemite_setup-0.1.0/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: alchemite-setup
+Version: 0.1.0
+Summary: A script that configures and installs an Alchemite Cluster
+Requires-Python: >=3.12
+Requires-Dist: pyyaml>=6.0.3
+Requires-Dist: bcrypt>=5.0.0
+Requires-Dist: pyjwt>=2.10.1
+Requires-Dist: requests>=2.32.5
+Requires-Dist: parsy>=2.2
+Requires-Dist: pyhelm3>=0.4.0
+Requires-Dist: ruff>=0.14.9
+Requires-Dist: docker>=7.1.0
+Requires-Dist: tqdm>=4.67.1
+Requires-Dist: python-keycloak>=7.0.2

alchemite_setup-0.1.0/pyproject.toml

@@ -0,0 +1,109 @@
+[project]
+name = "alchemite-setup"
+version = "0.1.0"
+description = "A script that configures and installs an Alchemite Cluster"
+requires-python = ">=3.12"
+dependencies = [
+    "pyyaml>=6.0.3",
+    "bcrypt>=5.0.0",
+    "pyjwt>=2.10.1",
+    "requests>=2.32.5",
+    "parsy>=2.2",
+    "pyhelm3>=0.4.0",
+    "ruff>=0.14.9",
+    "docker>=7.1.0",
+    "tqdm>=4.67.1",
+    "python-keycloak>=7.0.2",
+]
+
+[project.scripts]
+alchemite-setup = "alchemite_setup.cli:main"
+
+[tool.uv]
+package = true
+
+[tool.ruff]
+line-length = 80
+exclude = [
+    ".direnv",
+    ".eggs",
+    ".git",
+    ".hg",
+    ".mypy_cache",
+    ".nox",
+    ".tox",
+    ".venv",
+    "venv",
+    ".svn",
+    "_build",
+    "buck-out",
+    "build",
+    "dist",
+    "packages/apiserver/alembic/versions",
+    "packages/apiserver/apiserver/models",
+    "packages/apiserver/apiserver/util.py",
+    "packages/apiserver/apiserver/typing_utils.py",
+    "typings",
+]
+
+[tool.ruff.lint]
+# Enable a comprehensive set of errors
+# See https://docs.astral.sh/ruff/rules/ for details on what these are
+select = ["E", "F", "W", "N", "I", "UP", "PLC", "PLE", "PLW", "PTH", "ANN", "RUF"]
+ignore = ["E501", "RUF100", "PLC0414", "ANN002", "ANN003", "ANN401"]
+
+[tool.ruff.lint.per-file-ignores]
+# Don't require full typing on tests
+"*/tests/*" = ["ANN"]
+
+[tool.ruff.format]
+# Like Black, use double quotes for strings.
+quote-style = "double"
+
+# Like Black, indent with spaces, rather than tabs.
+indent-style = "space"
+
+# Like Black, respect magic trailing commas.
+skip-magic-trailing-comma = false
+
+# Like Black, automatically detect the appropriate line ending.
+line-ending = "auto"
+
+# Enable auto-formatting of code examples in docstrings. Markdown,
+# reStructuredText code/literal blocks and doctests are all supported.
+#
+# This is currently disabled by default, but it is planned for this
+# to be opt-out in the future.
+docstring-code-format = true
+
+# Set the line length limit used when formatting code snippets in
+# docstrings.
+#
+# This only has an effect when the `docstring-code-format` setting is
+# enabled.
+docstring-code-line-length = "dynamic"
+
+[dependency-groups]
+dev = [
+    "pytest-asyncio>=1.3.0",
+    "pytest>=9.0.2",
+    "pyright>=1.1.408",
+    "ruff>=0.14.9",
+]
+
+[tool.ruff.lint.isort]
+known-first-party = ["alchemite_setup"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+
+[tool.pyright]
+exclude = [
+    ".git",
+    "**/node_modules",
+    "**/__pycache__",
+    "**/.eggs",
+    "**/build",
+    "**/setup.py",
+    "**/tests/**"
+]

alchemite_setup-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

alchemite_setup-0.1.0/src/alchemite_setup/__main__.py

@@ -0,0 +1,3 @@
+from alchemite_setup.cli import main
+
+main()

alchemite_setup-0.1.0/src/alchemite_setup/cli.py

@@ -0,0 +1,151 @@
+import asyncio
+import logging
+import sys
+from argparse import ArgumentParser
+
+from alchemite_setup.exception import Abort
+from alchemite_setup.install import deploy, prepare
+from alchemite_setup.versions import VERSION_SANITIZERS
+
+
+def generate_cli() -> ArgumentParser:
+    parser = ArgumentParser(
+        prog="uvx alchemite_setup",
+        description="An installation script for self-hosted alchemite installations",
+    )
+    parser.add_argument(
+        "--config-path",
+        action="store",
+        default="./intellegens_config",
+        help="The directory used to store or load the deployment configuration",
+    )
+    parser.add_argument(
+        "--log-level",
+        action="store",
+        default="INFO",
+        help="The log level to use for this script",
+        choices=["DEBUG", "INFO", "WARNING", "ERROR"],
+    )
+
+    subparsers = parser.add_subparsers(dest="command")
+    # prepare arguments
+    prep_parser = subparsers.add_parser(
+        "prepare",
+        help="Prepare for deployment",
+        description="Prepare for new deployment, or update existing configuration for application update",
+    )
+    prep_parser.add_argument(
+        "--rehost-images",
+        action="store",
+        help="Instructs the script to rehost the images to an alternative repository",
+        metavar="repository_name",
+    )
+    prep_parser.add_argument(
+        "--rotate",
+        action="store_true",
+        help="Rotate the config secret values. This may require additional steps to deploy successfully",
+    )
+
+    prep_parser.add_argument(
+        "--oligo",
+        action="store_true",
+        help="Enable oligonucleotide features in the cluster",
+    )
+
+    for i in VERSION_SANITIZERS.keys():
+        prep_parser.add_argument(
+            f"--{i}-version",
+            action="store",
+            default="latest",
+            help=f"Specify the version of {i} to install",
+        )
+
+    prep_parser.add_argument(
+        "--pull-secret",
+        action="store",
+        help="The image pull secret to use when the cluster is starting pods",
+    )
+
+    prep_parser.add_argument(
+        "--domain",
+        action="store",
+        help="The domain that the application will be hosted on",
+    )
+
+    # deploy arguments
+    dep_parser = subparsers.add_parser(
+        "deploy",
+        help="Deploy alchemite",
+        description="Use a prepared configuration to deploy a new version of alchemite",
+    )
+
+    dep_parser.add_argument("--dry-run", action="store_true")
+
+    dep_parser.add_argument(
+        "--namespace",
+        action="store",
+        help="The namespace to deploy Alchemite application charts into",
+    )
+
+    dep_parser.add_argument("--atomic", action="store_true")
+
+    return parser
+
+
+def clean_domain(domain: str | None) -> str | None:
+    if domain is None:
+        return None
+    domain = domain.strip().strip("/")
+    if "://" in domain:
+        _, domain = domain.rsplit("/", 1)
+    return domain
+
+
+async def amain() -> None:
+    parser = generate_cli()
+    args = parser.parse_args()
+    logging.basicConfig(
+        level=args.log_level, stream=sys.stderr, format="%(message)s"
+    )
+
+    # Suppress helm command errors
+    logging.getLogger("pyhelm3.command").setLevel(logging.ERROR)
+    if args.log_level == "INFO":
+        # A few httpx logs are at info that I'd prefer be at DEBUG, so suppress
+        logging.getLogger("httpx").setLevel(logging.WARNING)
+
+    command = args.command
+    if command == "prepare":
+        versions = {
+            i: getattr(args, f"{i.replace('-', '_')}_version")
+            for i in VERSION_SANITIZERS.keys()
+        }
+        await prepare(
+            raw_config_path=args.config_path,
+            rotate_secrets=args.rotate,
+            enable_oligo=args.oligo,
+            rehost_images=args.rehost_images,
+            desired_versions=versions,
+            pull_secret=args.pull_secret,
+            domain=clean_domain(args.domain),
+        )
+    if command == "deploy":
+        await deploy(
+            raw_config_path=args.config_path,
+            dry_run=args.dry_run,
+            namespace=args.namespace,
+            atomic=args.atomic,
+        )
+
+
+def main() -> None:
+    try:
+        asyncio.run(amain())
+    except Abort as e:
+        logging.error(e)
+        logging.shutdown()
+        exit(1)
+
+
+if __name__ == "__main__":
+    main()

alchemite_setup-0.1.0/src/alchemite_setup/exception.py

@@ -0,0 +1,2 @@
+class Abort(BaseException):
+    pass

alchemite_setup-0.1.0/src/alchemite_setup/gensecrets.py

@@ -0,0 +1,140 @@
+import base64
+import json
+import secrets
+import string
+from json import JSONDecodeError
+from pathlib import Path
+
+import bcrypt
+import yaml
+
+from alchemite_setup.exception import Abort
+from alchemite_setup.helm import API_SECRET_PATH, AUM_SECRET_PATH, LICENCE_PATH
+
+DEFAULT_PASSWORD_CHARSET = (
+    string.ascii_letters + string.digits + "!#%&'()*+,-./:;<=>?[]^_`{|}~"
+)
+
+
+def generate_password(
+    length: int = 30, charset: str = DEFAULT_PASSWORD_CHARSET
+) -> str:
+    return "".join(secrets.choice(charset) for i in range(length))
+
+
+def secrets_exist(values_dir: Path) -> bool:
+    return all(
+        (values_dir / file).exists()
+        for file in [LICENCE_PATH, API_SECRET_PATH, AUM_SECRET_PATH]
+    )
+
+
+def validate_licence(licence: str) -> bool:
+    # Check that the licence is likely to work once deployed.
+    # This does NOT validate the signature, that is left to the application itself
+    try:
+        data = json.loads(licence)
+    except JSONDecodeError:
+        data_segments = licence.split(".")
+        if len(data_segments) != 3:
+            return False
+        try:
+            data = json.loads(
+                base64.urlsafe_b64decode(f"{data_segments[1]}====")
+            )
+        except JSONDecodeError:
+            return False
+
+    if not isinstance(data, dict):
+        return False
+
+    for k in ["e", "p", "t", "u", "v", "w"]:
+        if k not in data:
+            return False
+
+    if data["v"] not in [1, 2]:
+        return False
+
+    if "__all__" not in data["p"]:
+        if "apiserver" not in data["p"]:
+            return False
+
+        # Installs now also require ichnite for the smiles extension
+        if "ichnite_beta" not in data["p"]:
+            return False
+
+    return True
+
+
+def create_licence_secret(values_dir: Path) -> None:
+    licence = input("Enter Intellegens licence: ")
+
+    if not validate_licence(licence):
+        cont = input(
+            "Licence looks to be invalid. Are you sure you wish to continue? (y/n)"
+        )
+        if len(cont) == 0 or cont[0] != "y":
+            raise Abort("Abort due to user request")
+
+    with (values_dir / LICENCE_PATH).open("w") as f:
+        yaml.dump({"licence": licence}, f, sort_keys=False)
+
+
+def create_api_secrets(values_dir: Path, postgres_pw: str) -> None:
+    keycloak_pw = generate_password()
+    opensearch_service_pw = generate_password()
+    opensearch_admin_pw = generate_password()
+    hashed_opensearch_service_pw = bcrypt.hashpw(
+        opensearch_service_pw.encode("ascii"), bcrypt.gensalt(prefix=b"2a")
+    ).decode()
+    hashed_opensearch_admin_pw = bcrypt.hashpw(
+        opensearch_admin_pw.encode("ascii"), bcrypt.gensalt(prefix=b"2a")
+    ).decode()
+    data = {
+        "postgresql": {"postgresqlPassword": postgres_pw},
+        "keycloak": {"username": "intellegensadmin", "password": keycloak_pw},
+        "opensearch": {
+            "alchemiteSecrets": {
+                "adminPasswordHashed": hashed_opensearch_admin_pw,
+                "serviceAccountPasswordHashed": hashed_opensearch_service_pw,
+                "serviceAccountPassword": opensearch_service_pw,
+            }
+        },
+    }
+
+    with (values_dir / API_SECRET_PATH).open("w") as f:
+        yaml.dump(data, f, sort_keys=False)
+
+
+def create_aum_secrets(values_dir: Path, postgres_pw: str) -> None:
+    keycloak_pw = generate_password()
+
+    data = {
+        "keycloak": {
+            "username": "aum-service-account",
+            "password": keycloak_pw,
+        },
+        "sql": {
+            "aum": {
+                "password": postgres_pw,
+            }
+        },
+    }
+
+    with (values_dir / AUM_SECRET_PATH).open("w") as f:
+        yaml.dump(data, f, sort_keys=False)
+
+
+def create_secrets(config_path: Path) -> None:
+    create_licence_secret(config_path)
+
+    postgres_pw = generate_password()
+    create_api_secrets(config_path, postgres_pw)
+    create_aum_secrets(config_path, postgres_pw)
+
+
+if __name__ == "__main__":
+    output_path = Path("../local/intellegensconfig")
+    output_path.mkdir(parents=True, exist_ok=True)
+
+    create_secrets(output_path)