arcsecond 3.9.0__tar.gz → 3.10.2__tar.gz

{arcsecond-3.9.0 → arcsecond-3.10.2}/.github/workflows/pythonpublish.yml

@@ -1,22 +1,23 @@
 name: Upload Python Package to Pypi
 
 on:
-  release:
-    types: [ published ]
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      id-token: write
+      contents: write   # needed to create the GitHub release for the tag
+      id-token: write   # needed for PyPI trusted publishing (OIDC)
 
     steps:
-      - name: Validate release tag and version (X.Y.Z and matches pyproject)
+      - name: Validate tag format (X.Y.Z)
         shell: bash
         run: |
-          TAG="${{ github.event.release.tag_name }}"
-          echo "Release tag: $TAG"
+          TAG="${GITHUB_REF_NAME}"
+          echo "Pushed tag: $TAG"
           if ! [[ "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "Tag must be X.Y.Z (e.g. 1.2.3). Got: $TAG"
             exit 1
@@ -24,27 +25,25 @@ jobs:
 
       - uses: actions/checkout@v5
 
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
       - name: Validate pyproject.toml version matches tag
         run: |
           python - <<'PY'
-          import pathlib
-          import tomllib
-
-          tag = "${{ github.event.release.tag_name }}"
+          import os, pathlib, tomllib
 
+          tag = os.environ["GITHUB_REF_NAME"]
           data = tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
           py_ver = data["project"]["version"]
 
           print(f"pyproject.toml version: {py_ver}")
           if py_ver != tag:
-            raise SystemExit(f"Version mismatch: tag={tag} but pyproject.toml={py_ver}")
+              raise SystemExit(f"Version mismatch: tag={tag} but pyproject.toml={py_ver}")
           PY
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.12'
-
       - name: Build distributions
         run: |
           python -m pip install --upgrade pip
@@ -55,3 +54,17 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist
+
+      - name: Create GitHub release for tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists, skipping."
+          else
+            gh release create "$TAG" \
+              --title "$TAG" \
+              --generate-notes \
+              dist/*
+          fi

{arcsecond-3.9.0 → arcsecond-3.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arcsecond
-Version: 3.9.0
+Version: 3.10.2
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-3.9.0 → arcsecond-3.10.2}/arcsecond/cli.py

@@ -10,7 +10,7 @@ from arcsecond.cloud import (
     upload_data,
 )
 from arcsecond.hosting import setup
-from arcsecond.webcam import commands as webcam
+from arcsecond.imagesources import commands as imagesources
 
 from . import __version__
 from .options import State
@@ -61,5 +61,7 @@ main.add_command(upload_data)
 # Allow to try arcsecond by installing a local version
 main.add_command(setup)
 
-# Native webcam proxy — lets Docker containers reach USB webcams on the host.
-main.add_command(webcam.webcam)
+# Native live-image proxy — exposes USB webcams and all-sky cameras to
+# Arcsecond.local Docker containers via host.docker.internal.
+main.add_command(imagesources.webcam)
+main.add_command(imagesources.allsky)

{arcsecond-3.9.0 → arcsecond-3.10.2}/arcsecond/hosting/docker/docker-compose.yml

@@ -8,8 +8,12 @@ services:
     image: postgres:16
     container_name: arcsecond-db
     restart: unless-stopped
+    # Bind to localhost only — the backend container reaches the DB over the
+    # internal Docker network (hostname `arcsecond-db`), and operators can
+    # still run `psql -h localhost` / `pg_dump` from the host. Anything on the
+    # LAN is firewalled out.
     ports:
-      - "5432:5432"
+      - "127.0.0.1:5432:5432"
     volumes:
       - arcsecond_postgres_data:/var/lib/postgresql/data
     env_file:
@@ -21,8 +25,10 @@ services:
     image: redis:7.4
     container_name: arcsecond-broker
     restart: unless-stopped
+    # Localhost-only as well — Redis with no auth on a LAN-exposed port is a
+    # well-known foot-gun. Backend reaches it over the Docker network.
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
 
   # Arcsecond backend (REST APIs). Can be used for API calls and external pipelines, scripts etc.
   backend:
@@ -96,15 +102,8 @@ services:
   platesolver:
     image: ghcr.io/arcsecond-io/arcsecond-service-platesolver-astrometry:latest
     container_name: arcsecond-platesolver
+    restart: unless-stopped
     ports: [ "8900:8900" ]
-    volumes:
-      # Leave /data as is, it's a path inside the container, not in the host machine.
-      # SHARED_DATA_PATH must be a path of your host machine, specified in the .env file.
-      - type: bind
-        source: ${SHARED_DATA_PATH}
-        target: /data
-        bind:
-          create_host_path: true
 
   # Arcsecond webapp.
   web:

{arcsecond-3.9.0 → arcsecond-3.10.2}/arcsecond/hosting/local.py

@@ -5,12 +5,14 @@ from pathlib import Path
 import click
 
 from arcsecond.options import basic_options
-from .utils import _get_encryption_key, _get_random_secret_key
+from .utils import _get_encryption_key, _get_random_postgres_password, _get_random_secret_key
 
 ENV_FILENAME = ".env"
 
+# Stable across installs — operators connect with this username when running
+# manual psql / pg_dump commands. The actual security boundary is the password
+# (generated per-install) and the network exposure (localhost-only).
 POSTGRES_USER = "arcsecond_docker"
-POSTGRES_PASSWORD = "arcsecond_docker"
 POSTGRES_DB = "arcsecond_docker"
 
 
@@ -39,7 +41,11 @@ def _required_env_values():
         "FIELD_ENCRYPTION_KEY": _get_encryption_key(),
         "SHARED_DATA_PATH": prompt_shared_data_path(),
         "POSTGRES_USER": POSTGRES_USER,
-        "POSTGRES_PASSWORD": POSTGRES_PASSWORD,
+        # Per-install random; never overwritten on repeat runs (see write_env_file).
+        # Postgres only reads this on first container boot to bootstrap the role,
+        # so the .env value and the live DB password must stay in sync — that's
+        # why we never regenerate it after the .env exists.
+        "POSTGRES_PASSWORD": _get_random_postgres_password(),
         "POSTGRES_DB": POSTGRES_DB,
     }
 
@@ -104,7 +110,16 @@ def write_env_file():
 
 def write_docker_compose_file() -> Path:
     """
-    Copy the packaged docker-compose.yml to the current directory.
+    Materialise the packaged docker-compose.yml in the current directory.
+
+    Three cases:
+      1. No file present → write the packaged version as docker-compose.yml.
+      2. File present and identical to the packaged version → no-op.
+      3. File present but different → leave the operator's file untouched
+         (it may carry local customisations) and drop the packaged
+         version next to it as docker-compose.latest.yml so they can
+         diff and merge intentionally.
+
     Works from any CWD and when installed from a wheel/sdist.
     """
     dest = Path.cwd() / "docker-compose.yml"
@@ -125,8 +140,12 @@ def write_docker_compose_file() -> Path:
         print("docker-compose.yml is already up to date.")
         return dest
 
-    dest.write_bytes(expected_content)
-    print("docker-compose.yml has been updated to the latest version.")
+    latest = dest.with_name("docker-compose.latest.yml")
+    latest.write_bytes(expected_content)
+    print(
+        "docker-compose.yml differs from the packaged version; "
+        f"leaving it untouched and writing the latest packaged copy to: {latest}"
+    )
     return dest
 
 

arcsecond-3.10.2/arcsecond/hosting/utils.py

@@ -0,0 +1,24 @@
+import base64
+import os
+import secrets
+
+
+def _get_random_secret_key():
+    # No '%' to avoid interpolation surprises
+    chars = "abcdefghijklmnopqrstuvwxyz0123456789!@#$^&*(-_=+)"
+    return "".join(secrets.choice(chars) for _ in range(50))
+
+
+def _get_encryption_key():
+    return base64.urlsafe_b64encode(os.urandom(32)).decode('UTF8')
+
+
+def _get_random_postgres_password():
+    """Generate a strong, shell- and URL-safe Postgres password.
+
+    Uses URL-safe base64 (``[A-Za-z0-9_-]``) so the value never needs
+    quoting in the .env file or any future connection string. 32 random
+    bytes → 43 chars, ~256 bits of entropy. Trailing '=' padding is
+    stripped because it triggers shell parsing weirdness in some setups.
+    """
+    return base64.urlsafe_b64encode(os.urandom(32)).decode('UTF8').rstrip('=')

arcsecond-3.10.2/arcsecond/imagesources/commands.py

@@ -0,0 +1,175 @@
+"""
+Click command groups: ``arcsecond webcam`` and ``arcsecond allsky``.
+
+Both groups talk to the same proxy. ``webcam`` is kept for backward
+compatibility; ``allsky`` is the new entry point for fisheye / all-sky
+cameras whose driver software writes JPEGs to disk.
+"""
+
+import logging
+
+import click
+
+from .registry import AllskyOverride
+from .sources.filewatch import detect_allsky
+from .sources.opencv import detect_webcams
+
+logger = logging.getLogger(__name__)
+
+
+def _check_aiohttp():
+    try:
+        import aiohttp  # noqa: F401
+    except ImportError:
+        click.echo(
+            click.style("Error: ", fg='red') +
+            "aiohttp is not installed.\n"
+            "Run:  pip install 'arcsecond[webcam]'"
+        )
+        raise SystemExit(1)
+
+
+def _check_cv2():
+    try:
+        import cv2  # noqa: F401
+    except ImportError:
+        click.echo(
+            click.style("Error: ", fg='red') +
+            "opencv-python-headless is not installed.\n"
+            "Run:  pip install 'arcsecond[webcam]'"
+        )
+        raise SystemExit(1)
+
+
+def _parse_allsky_overrides(values: tuple[str, ...]) -> list[AllskyOverride]:
+    overrides: list[AllskyOverride] = []
+    for v in values:
+        if '=' not in v:
+            raise click.BadParameter(f"--allsky must be id=path, got {v!r}")
+        sid, _, path = v.partition('=')
+        sid, path = sid.strip(), path.strip()
+        if not sid or not path:
+            raise click.BadParameter(f"--allsky must be id=path, got {v!r}")
+        overrides.append(AllskyOverride(id=sid, path=path))
+    return overrides
+
+
+def _run_proxy(host: str, port: int, log_level: str, allsky_overrides):
+    _check_aiohttp()
+
+    logging.basicConfig(
+        level=getattr(logging, log_level.upper()),
+        format='%(asctime)s  %(levelname)-8s  %(name)s  %(message)s',
+    )
+
+    click.echo(
+        click.style("Arcsecond live-image proxy", bold=True) +
+        f" listening on {host}:{port}\n"
+        f"  Detection  →  http://{host}:{port}/detect\n"
+        f"  Streaming  →  ws://{host}:{port}/stream/{{id}}\n\n"
+        "Set in your .env file:\n"
+        f"  LIVE_IMAGE_PROXY_URL=http://host.docker.internal:{port}\n\n"
+        "Press Ctrl-C to stop."
+    )
+
+    from .proxy import run
+    run(host=host, port=port, allsky_overrides=allsky_overrides)
+
+
+# ---------------------------------------------------------------------------
+# Shared options
+# ---------------------------------------------------------------------------
+
+_start_options = [
+    click.option('--port', default=8765, show_default=True, help="TCP port to listen on."),
+    click.option('--host', default='0.0.0.0', show_default=True, help="Interface to bind."),
+    click.option('--log-level', default='INFO', show_default=True,
+                 type=click.Choice(['DEBUG', 'INFO', 'WARNING', 'ERROR'], case_sensitive=False),
+                 help="Logging verbosity."),
+    click.option('--allsky', 'allsky', multiple=True, metavar='ID=PATH',
+                 help="Register an all-sky source. PATH may be a file or a glob. "
+                      "Repeat for multiple cameras. If omitted, well-known paths "
+                      "are auto-discovered."),
+]
+
+
+def _add_options(options):
+    def _wrap(fn):
+        for opt in reversed(options):
+            fn = opt(fn)
+        return fn
+    return _wrap
+
+
+# ---------------------------------------------------------------------------
+# `arcsecond webcam` group  (kept for backward compatibility)
+# ---------------------------------------------------------------------------
+
+@click.group(help="Manage the native live-image proxy (USB webcams + all-sky).")
+def webcam():
+    pass
+
+
+@webcam.command(name='detect', help="Scan for locally attached webcams and print their details.")
+def webcam_detect_cmd():
+    _check_cv2()
+    cams = detect_webcams()
+    if not cams:
+        click.echo("No webcams detected.")
+        return
+    click.echo(f"Found {len(cams)} webcam(s):\n")
+    for c in cams:
+        e = c.extra or {}
+        click.echo(f"  {c.id}  {e.get('width')}×{e.get('height')}  {e.get('fps', 0):.1f} fps")
+
+
+@webcam.command(name='start', help=(
+    "Start the live-image proxy server.\n\n"
+    "Exposes:\n\n"
+    "  GET  /detect              — list available sources (JSON)\n\n"
+    "  WS   /stream/{id}         — JPEG frame stream\n\n"
+    "Source ids are e.g. webcam:0, allsky:roof. Bare numeric ids "
+    "(/stream/0) are accepted for backward compatibility.\n\n"
+    "Set LIVE_IMAGE_PROXY_URL=http://host.docker.internal:<PORT> in your "
+    ".env so the backend can reach the proxy."
+))
+@_add_options(_start_options)
+def webcam_start_cmd(port, host, log_level, allsky):
+    overrides = _parse_allsky_overrides(allsky)
+    _run_proxy(host, port, log_level, overrides)
+
+
+# ---------------------------------------------------------------------------
+# `arcsecond allsky` group  (new)
+# ---------------------------------------------------------------------------
+
+@click.group(help="Manage all-sky camera image sources.")
+def allsky():
+    pass
+
+
+@allsky.command(name='detect', help=(
+    "Auto-discover all-sky sources at well-known paths "
+    "(Thomas Jacquin's allsky, indi-allsky)."
+))
+def allsky_detect_cmd():
+    found = detect_allsky()
+    if not found:
+        click.echo("No all-sky sources discovered at well-known paths.")
+        click.echo("\nIf your software writes images elsewhere, register a custom path with:\n")
+        click.echo("  arcsecond allsky start --allsky <id>=<path-to-jpeg-or-glob>")
+        return
+    click.echo(f"Found {len(found)} all-sky source(s):\n")
+    for s in found:
+        click.echo(f"  {s.id}  →  {(s.extra or {}).get('path')}")
+
+
+@allsky.command(name='start', help=(
+    "Start the live-image proxy server (same proxy as `arcsecond webcam start`).\n\n"
+    "Use --allsky id=path to register custom all-sky paths in addition to "
+    "auto-discovered ones."
+))
+@_add_options(_start_options)
+def allsky_start_cmd(port, host, log_level, allsky):
+    overrides = _parse_allsky_overrides(allsky)
+    _run_proxy(host, port, log_level, overrides)

arcsecond-3.10.2/arcsecond/imagesources/proxy.py

@@ -0,0 +1,145 @@
+"""
+Live-image proxy server for the Arcsecond CLI.
+
+Why this exists
+---------------
+The Arcsecond backend runs inside Docker Desktop (Windows / macOS), which does
+not forward USB devices — and may not have access to host filesystem paths
+where all-sky software writes images. This small aiohttp server runs
+**natively** on the host and exposes:
+
+    GET  /detect             → JSON list of available sources
+    WS   /stream/{id}        → continuous JPEG-frame stream (base64-in-JSON)
+
+Source ids look like ``webcam:0`` or ``allsky:roof``. For backward
+compatibility, a bare numeric id (``/stream/0``) is treated as ``webcam:0``.
+
+The backend reads the ``LIVE_IMAGE_PROXY_URL`` environment variable
+(``WEBCAM_PROXY_URL`` is accepted as a deprecated fallback). When set, it
+delegates detection and streaming to this proxy.
+
+Start with:
+    arcsecond webcam start          # webcams only (legacy)
+    arcsecond imagesources start    # webcams + all-sky
+"""
+
+import asyncio
+import base64
+import json
+import logging
+from dataclasses import asdict
+from typing import Optional
+
+from .registry import AllskyOverride, Registry
+
+logger = logging.getLogger(__name__)
+
+
+# ---------------------------------------------------------------------------
+# aiohttp request handlers
+# ---------------------------------------------------------------------------
+
+async def handle_health(request):
+    from aiohttp import web
+    return web.json_response({'status': 'ok'})
+
+
+async def handle_detect(request):
+    from aiohttp import web
+    registry: Registry = request.app['registry']
+    loop = asyncio.get_running_loop()
+    infos = await loop.run_in_executor(None, registry.detect)
+    return web.json_response([asdict(i) for i in infos])
+
+
+async def handle_stream(request):
+    from aiohttp import web
+
+    registry: Registry = request.app['registry']
+    source_id = request.match_info['id']
+
+    ws = web.WebSocketResponse()
+    await ws.prepare(request)
+
+    try:
+        acquired = await registry.acquire(source_id)
+    except KeyError as e:
+        logger.error("Live-image proxy: %s", e)
+        await ws.send_str(json.dumps({'type': 'error', 'message': str(e)}))
+        await ws.close()
+        return ws
+    except Exception as e:
+        logger.error("Live-image proxy: cannot open %s: %s", source_id, e)
+        await ws.send_str(json.dumps({'type': 'error', 'message': str(e)}))
+        await ws.close()
+        return ws
+
+    logger.info(
+        "Live-image proxy: client connected to stream %s (refcount=%d)",
+        source_id, acquired.refcount,
+    )
+
+    # Tolerate a few transient read failures before giving up. ~2 s at the
+    # source's poll rate covers most one-off DirectShow hiccups.
+    max_consecutive_failures = max(1, int(2.0 / max(acquired.poll_interval, 0.01)))
+    consecutive_failures = 0
+
+    try:
+        while not ws.closed:
+            try:
+                jpeg: Optional[bytes] = await acquired.read()
+            except Exception as e:
+                consecutive_failures += 1
+                if consecutive_failures >= max_consecutive_failures:
+                    msg = f"frame read failed for {source_id}: {e}"
+                    logger.warning(
+                        "Live-image proxy: %s (after %d attempts)",
+                        msg, consecutive_failures,
+                    )
+                    await ws.send_str(json.dumps({'type': 'error', 'message': msg}))
+                    break
+                await asyncio.sleep(acquired.poll_interval)
+                continue
+
+            consecutive_failures = 0
+            if jpeg is not None:
+                b64 = base64.b64encode(jpeg).decode('ascii')
+                await ws.send_str(json.dumps({
+                    'type': 'frame',
+                    'format': 'jpeg/base64',
+                    'data': b64,
+                }))
+            await asyncio.sleep(acquired.poll_interval)
+    except (ConnectionResetError, ConnectionError):
+        pass
+    finally:
+        remaining = await acquired.release()
+        logger.info(
+            "Live-image proxy: client disconnected from %s (refcount=%d).",
+            source_id, remaining,
+        )
+
+    return ws
+
+
+# ---------------------------------------------------------------------------
+# Server entry-point
+# ---------------------------------------------------------------------------
+
+def run(
+    host: str = '0.0.0.0',
+    port: int = 8765,
+    allsky_overrides: Optional[list[AllskyOverride]] = None,
+):
+    """Build and run the aiohttp application (blocking)."""
+    from aiohttp import web
+
+    app = web.Application()
+    app['registry'] = Registry(allsky_overrides=allsky_overrides)
+
+    app.router.add_get('/health', handle_health)
+    app.router.add_get('/detect', handle_detect)
+    app.router.add_get('/stream/{id}', handle_stream)
+
+    logger.info("Live-image proxy starting on %s:%d", host, port)
+    web.run_app(app, host=host, port=port, print=lambda msg: logger.info(msg))