cancan-microstack 0.0.1__py3-none-any.whl

cancan_microstack/services/opsbffsrv/infrastructure/caddy/ip_geo_locator.py

@@ -0,0 +1,176 @@
+"""
+IP 地理位置查询模块
+使用 GeoLite2 数据库进行 IP 地址地理定位
+"""
+from typing import (
+    Optional,
+    Dict,
+    Any,
+)
+from decimal import Decimal
+import os
+import geoip2.database
+import geoip2.errors
+
+from linglong_web.utils import logger
+
+
+class IPGeoLocator:
+    """IP 地理位置查询器"""
+
+    def __init__(self, db_path: Optional[str] = None):
+        """
+        初始化 IP 地理位置查询器
+        
+        Args:
+            db_path: GeoLite2 数据库文件路径（可选，默认自动检测）
+        """
+        self.db_path = db_path or self._auto_detect_db_path()
+        self._reader: Optional[geoip2.database.Reader] = None
+        self._initialize_reader()
+
+    def _auto_detect_db_path(self) -> str:
+        """
+        自动检测 GeoIP 数据库路径
+        
+        优先级：
+        1. /usr/share/GeoIP/GeoLite2-City.mmdb (in-pod, Docker 容器内)
+        2. {PROJECT_ROOT}/builds/caddy/geoip/GeoLite2-City.mmdb (out-pod, 本地开发)
+        """
+        # 优先使用容器内路径（in-pod）
+        container_path = "/usr/share/GeoIP/GeoLite2-City.mmdb"
+        if os.path.exists(container_path):
+            return container_path
+
+        # 使用项目路径（out-pod）
+        # 获取项目根目录：当前文件是 src/service/opsbffsrv/infrastructure/caddy/ip_geo_locator.py
+        # 向上 6 层到达项目根目录
+        from pathlib import Path
+        project_root = Path(__file__).resolve().parents[5]
+        project_path = os.path.join(
+            str(project_root),
+            "builds/caddy/geoip/GeoLite2-City.mmdb"
+        )
+        return project_path
+
+    def _initialize_reader(self):
+        """初始化数据库读取器"""
+        try:
+            if not os.path.exists(self.db_path):
+                logger.warning(f"GeoIP database file not found: {self.db_path} (IP geolocation will be disabled)")
+                self._reader = None
+                return
+
+            self._reader = geoip2.database.Reader(self.db_path)
+            logger.info(f"GeoIP database initialized: {self.db_path}")
+        except Exception as e:
+            logger.warning(f"Failed to initialize GeoIP database: {e} (IP geolocation will be disabled)")
+            self._reader = None
+
+    def lookup(self, ip_address: str) -> Dict[str, Any]:
+        """
+        查询 IP 地址的地理位置信息
+        
+        Args:
+            ip_address: IP 地址
+            
+        Returns:
+            地理位置信息字典
+        """
+        if not self._reader:
+            logger.warning("GeoIP reader not initialized")
+            return self._empty_result()
+
+        try:
+            response = self._reader.city(ip_address)
+
+            return {
+                "country": response.country.names.get('zh-CN') or response.country.names.get('en'),
+                "country_code": response.country.iso_code,
+                "region": response.subdivisions.most_specific.names.get(
+                    'zh-CN') or response.subdivisions.most_specific.names.get('en') if response.subdivisions else None,
+                "city": response.city.names.get('zh-CN') or response.city.names.get('en'),
+                "latitude": Decimal(str(response.location.latitude)) if response.location.latitude else None,
+                "longitude": Decimal(str(response.location.longitude)) if response.location.longitude else None,
+                "timezone": response.location.time_zone,
+                "isp": None,  # GeoLite2-City 不包含 ISP 信息，需要 GeoLite2-ASN
+            }
+        except geoip2.errors.AddressNotFoundError:
+            logger.debug(f"IP address not found in GeoIP database: {ip_address}")
+            return self._empty_result()
+        except Exception as e:
+            logger.error(f"Error looking up IP {ip_address}: {e}", exc_info=True)
+            return self._empty_result()
+
+    def lookup_with_asn(self, ip_address: str, asn_db_path: str = "/usr/share/GeoIP/GeoLite2-ASN.mmdb") -> Dict[
+        str, Any]:
+        """
+        查询 IP 地址的地理位置和 ISP 信息
+        
+        Args:
+            ip_address: IP 地址
+            asn_db_path: GeoLite2-ASN 数据库路径
+            
+        Returns:
+            包含 ISP 信息的地理位置字典
+        """
+        # 获取基础地理信息
+        geo_info = self.lookup(ip_address)
+
+        # 获取 ISP 信息
+        try:
+            with geoip2.database.Reader(asn_db_path) as asn_reader:
+                response = asn_reader.asn(ip_address)
+                geo_info["isp"] = response.autonomous_system_organization
+        except geoip2.errors.AddressNotFoundError:
+            logger.debug(f"ASN information not found for IP: {ip_address}")
+        except Exception as e:
+            logger.error(f"Error looking up ASN for IP {ip_address}: {e}", exc_info=True)
+
+        return geo_info
+
+    def _empty_result(self) -> Dict[str, Any]:
+        """
+        返回空结果
+        
+        Returns:
+            空的地理位置信息字典
+        """
+        return {
+            "country": None,
+            "country_code": None,
+            "region": None,
+            "city": None,
+            "latitude": None,
+            "longitude": None,
+            "timezone": None,
+            "isp": None,
+        }
+
+    def is_private_ip(self, ip_address: str) -> bool:
+        """
+        判断是否为私有 IP 地址
+        
+        Args:
+            ip_address: IP 地址
+            
+        Returns:
+            是否为私有 IP
+        """
+        try:
+            import ipaddress
+            ip = ipaddress.ip_address(ip_address)
+            return ip.is_private
+        except Exception as e:
+            logger.error(f"Error checking if IP is private: {e}", exc_info=True)
+            return False
+
+    def close(self):
+        """关闭数据库连接"""
+        if self._reader:
+            self._reader.close()
+            logger.info("GeoIP reader closed")
+
+
+# 全局实例
+ip_geo_locator = IPGeoLocator()

cancan_microstack/services/opsbffsrv/infrastructure/db/model/admin_user_tbl.py

@@ -0,0 +1,33 @@
+"""admin_user_tbl ORM 模型 / ORM model for admin_user_tbl."""
+from sqlalchemy import (
+    BigInteger,
+    Boolean,
+    Column,
+    SmallInteger,
+    String,
+    Text,
+    TIMESTAMP,
+)
+from sqlalchemy.sql import func
+
+from linglong_web import TableBase
+
+
+class AdminUserTbl(TableBase):
+    __tablename__ = "admin_user_tbl"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    username = Column(String(50), nullable=False, unique=True)
+    password_hash = Column(String(255), nullable=False)
+    totp_secret_encrypted = Column(Text, nullable=True)
+    totp_bound = Column(Boolean, default=False)
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {"extend_existing": True},
+    )
+
+    def __repr__(self) -> str:
+        return f"AdminUserTbl(id={self.id}, username={self.username})"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/caddy_access_log_tbl.py

@@ -0,0 +1,90 @@
+"""
+Caddy 访问日志表 ORM 模型
+"""
+from sqlalchemy import (
+    Column,
+    Integer,
+    BigInteger,
+    String,
+    Text,
+    Boolean,
+    SmallInteger,
+    TIMESTAMP,
+    DECIMAL,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.sql import func
+from linglong_web import TableBase
+
+
+class CaddyAccessLogTbl(TableBase):
+    """Caddy 访问日志表（包含 IP 地理位置信息）"""
+    __tablename__ = 'caddy_access_log_tbl'
+
+    # 主键（使用 BIGINT）
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+
+    # 请求基本信息
+    request_id = Column(String(50), nullable=False)
+    timestamp = Column(TIMESTAMP(timezone=True), nullable=False, default=func.current_timestamp())
+
+    # 客户端信息
+    client_ip = Column(String(50), nullable=False)
+    client_port = Column(Integer)
+    user_agent = Column(Text)
+    referer = Column(Text)
+
+    # IP 地理位置信息
+    country = Column(String(100))
+    country_code = Column(String(10))
+    region = Column(String(100))
+    city = Column(String(100))
+    latitude = Column(DECIMAL(10, 8))
+    longitude = Column(DECIMAL(11, 8))
+    timezone = Column(String(50))
+    isp = Column(String(200))
+
+    # 请求信息
+    method = Column(String(10), nullable=False)
+    protocol = Column(String(20))
+    host = Column(String(255))
+    path = Column(Text, nullable=False)
+    query_string = Column(Text)
+
+    # 路由和服务信息
+    matched_route = Column(String(100))
+    upstream_service = Column(String(100))
+    upstream_host = Column(String(100))
+    upstream_port = Column(Integer)
+
+    # 响应信息
+    status_code = Column(Integer, nullable=False)
+    response_size = Column(BigInteger)
+    response_time = Column(Integer)
+
+    # WAF 信息
+    waf_action = Column(String(50))
+    waf_rule_id = Column(String(100))
+    waf_score = Column(Integer)
+
+    # 限流信息
+    rate_limited = Column(Boolean, default=False)
+    rate_limit_rule = Column(String(100))
+
+    # TLS 信息
+    tls_version = Column(String(20))
+    tls_cipher = Column(String(100))
+
+    # 元数据
+    log_metadata = Column(JSONB, default={})
+
+    # 标准字段
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"CaddyAccessLogTbl(id={self.id}, client_ip={self.client_ip}, path={self.path}, status={self.status_code})"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/caddy_certificate_tbl.py

@@ -0,0 +1,65 @@
+"""
+Caddy HTTPS 证书管理表 ORM 模型
+"""
+from sqlalchemy import (
+    Column,
+    Integer,
+    String,
+    Text,
+    Boolean,
+    SmallInteger,
+    TIMESTAMP,
+    ARRAY,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.sql import func
+from linglong_web import TableBase
+
+
+class CaddyCertificateTbl(TableBase):
+    """Caddy HTTPS 证书管理表"""
+    __tablename__ = 'caddy_certificate_tbl'
+
+    # 主键
+    id = Column(Integer, primary_key=True, autoincrement=True)
+
+    # 域名信息
+    domain = Column(String(255), nullable=False, unique=True)
+    alt_domains = Column(ARRAY(Text))
+
+    # 证书信息
+    certificate_pem = Column(Text)
+    private_key_pem = Column(Text)
+    issuer = Column(String(255))
+
+    # 证书时间
+    issued_at = Column(TIMESTAMP(timezone=True))
+    expires_at = Column(TIMESTAMP(timezone=True))
+    auto_renew = Column(Boolean, default=True)
+    renew_before_days = Column(Integer, default=30)
+
+    # 证书状态
+    status = Column(String(50), default='pending')
+    last_renew_attempt = Column(TIMESTAMP(timezone=True))
+    last_renew_success = Column(TIMESTAMP(timezone=True))
+    renew_error = Column(Text)
+
+    # ACME 配置
+    acme_provider = Column(String(100), default='letsencrypt')
+    acme_email = Column(String(255))
+    acme_challenge_type = Column(String(50), default='http-01')
+
+    # 元数据
+    certificate_metadata = Column(JSONB, default={})
+
+    # 标准字段
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"CaddyCertificateTbl(id={self.id}, domain={self.domain}, status={self.status})"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/caddy_rate_limit_tbl.py

@@ -0,0 +1,69 @@
+"""
+Caddy 限流配置表 ORM 模型
+"""
+from sqlalchemy import (
+    Column,
+    Integer,
+    String,
+    Text,
+    Boolean,
+    SmallInteger,
+    TIMESTAMP,
+    ARRAY,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.sql import func
+from linglong_web import TableBase
+
+
+class CaddyRateLimitTbl(TableBase):
+    """Caddy 限流配置表"""
+    __tablename__ = 'caddy_rate_limit_tbl'
+
+    # 主键
+    id = Column(Integer, primary_key=True, autoincrement=True)
+
+    # 限流规则基本信息
+    rule_name = Column(String(100), nullable=False, unique=True)
+    description = Column(Text)
+
+    # 匹配条件
+    match_type = Column(String(50), nullable=False)
+    match_pattern = Column(String(500))
+    match_domain = Column(String(255))
+
+    # 限流配置
+    limit_type = Column(String(50), nullable=False, default='request')
+    limit_value = Column(Integer, nullable=False)
+    limit_window = Column(Integer, nullable=False, default=60)
+    limit_key = Column(String(50), default='ip')
+
+    # 突发流量配置
+    burst_size = Column(Integer, default=0)
+
+    # 响应配置
+    block_status_code = Column(Integer, default=429)
+    block_message = Column(String(500), default='Too Many Requests')
+
+    # 白名单/黑名单
+    whitelist_ips = Column(ARRAY(Text))
+    blacklist_ips = Column(ARRAY(Text))
+
+    # 状态和优先级
+    is_enabled = Column(Boolean, default=True)
+    priority = Column(Integer, default=100)
+
+    # 元数据
+    rule_metadata = Column(JSONB, default={})
+
+    # 标准字段
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"CaddyRateLimitTbl(id={self.id}, rule_name={self.rule_name}, limit_value={self.limit_value}/{self.limit_window}s)"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/caddy_route_tbl.py

@@ -0,0 +1,66 @@
+"""
+Caddy 路由配置表 ORM 模型
+"""
+from sqlalchemy import (
+    Column,
+    Integer,
+    String,
+    Text,
+    Boolean,
+    SmallInteger,
+    TIMESTAMP,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.sql import func
+from linglong_web import TableBase
+
+
+class CaddyRouteTbl(TableBase):
+    """Caddy 路由配置表"""
+    __tablename__ = 'caddy_route_tbl'
+
+    # 主键
+    id = Column(Integer, primary_key=True, autoincrement=True)
+
+    # 路由基本信息
+    route_name = Column(String(100), nullable=False, unique=True)
+    domain = Column(String(255), nullable=False)
+    path_pattern = Column(String(500), nullable=False)
+
+    # 上游服务配置
+    upstream_service = Column(String(100), nullable=False)
+    upstream_host = Column(String(100), nullable=False)
+    upstream_port = Column(Integer, nullable=False)
+
+    # 路由选项
+    strip_path_prefix = Column(String(200))
+    add_path_prefix = Column(String(200))
+    enable_https = Column(Boolean, default=True)
+    force_https = Column(Boolean, default=True)
+
+    # WAF 配置
+    enable_waf = Column(Boolean, default=True)
+    waf_rule_set = Column(String(50), default='default')
+
+    # 负载均衡配置
+    load_balance_strategy = Column(String(50), default='round_robin')
+    health_check_path = Column(String(200))
+    health_check_interval = Column(Integer, default=30)
+
+    # 状态和元数据
+    is_enabled = Column(Boolean, default=True)
+    priority = Column(Integer, default=100)
+    route_metadata = Column(JSONB, default={})
+    description = Column(Text)
+
+    # 标准字段
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"CaddyRouteTbl(id={self.id}, route_name={self.route_name}, upstream_service={self.upstream_service})"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/caddy_stats_tbl.py

@@ -0,0 +1,78 @@
+"""
+Caddy 统计数据表 ORM 模型
+"""
+from sqlalchemy import (
+    Column,
+    Integer,
+    BigInteger,
+    String,
+    SmallInteger,
+    TIMESTAMP,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.sql import func
+from linglong_web import TableBase
+
+
+class CaddyStatsTbl(TableBase):
+    """Caddy 统计数据表（聚合统计）"""
+    __tablename__ = 'caddy_stats_tbl'
+
+    # 主键
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+
+    # 时间维度
+    stat_time = Column(TIMESTAMP(timezone=True), nullable=False)
+    stat_period = Column(String(20), nullable=False)
+
+    # 维度信息
+    dimension_type = Column(String(50), nullable=False)
+    dimension_value = Column(String(255))
+
+    # 请求统计
+    total_requests = Column(BigInteger, default=0)
+    success_requests = Column(BigInteger, default=0)
+    client_error_requests = Column(BigInteger, default=0)
+    server_error_requests = Column(BigInteger, default=0)
+
+    # 流量统计
+    total_bytes_sent = Column(BigInteger, default=0)
+    total_bytes_received = Column(BigInteger, default=0)
+
+    # 性能统计
+    avg_response_time = Column(Integer)
+    min_response_time = Column(Integer)
+    max_response_time = Column(Integer)
+    p50_response_time = Column(Integer)
+    p95_response_time = Column(Integer)
+    p99_response_time = Column(Integer)
+
+    # WAF 统计
+    waf_blocked_requests = Column(BigInteger, default=0)
+    waf_logged_requests = Column(BigInteger, default=0)
+
+    # 限流统计
+    rate_limited_requests = Column(BigInteger, default=0)
+
+    # TLS 统计
+    tls_requests = Column(BigInteger, default=0)
+    non_tls_requests = Column(BigInteger, default=0)
+
+    # 唯一访客统计
+    unique_ips = Column(Integer, default=0)
+    unique_user_agents = Column(Integer, default=0)
+
+    # 元数据
+    stats_metadata = Column(JSONB, default={})
+
+    # 标准字段
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"CaddyStatsTbl(id={self.id}, period={self.stat_period}, dimension={self.dimension_type}, requests={self.total_requests})"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/service_action_log_tbl.py

@@ -0,0 +1,44 @@
+"""
+服务行为日志表 ORM 模型
+"""
+from sqlalchemy import (
+    Column,
+    Integer,
+    String,
+    Text,
+    SmallInteger,
+    TIMESTAMP,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.sql import func
+from linglong_web import TableBase
+
+
+class ServiceActionLogTbl(TableBase):
+    """服务行为日志表"""
+    __tablename__ = 'service_action_log_tbl'
+
+    # 主键
+    id = Column(Integer, primary_key=True, autoincrement=True)
+
+    # 业务字段
+    service_name = Column(String(100), nullable=False)
+    instance_id = Column(String(50))
+    action_type = Column(String(50), nullable=False)
+    action_status = Column(String(20), nullable=False)
+    action_detail = Column(JSONB, default={})
+    error_message = Column(Text)
+    triggered_by = Column(String(50), default='system')
+    action_metadata = Column(JSONB, default={})
+
+    # 标准字段
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"ServiceActionLogTbl(id={self.id}, service={self.service_name}, action={self.action_type}, status={self.action_status})"

cancan_microstack/services/opsbffsrv/infrastructure/db/model/service_config_tbl.py

@@ -0,0 +1,30 @@
+from sqlalchemy import (
+    Column,
+    Integer,
+    String,
+    Text,
+    SmallInteger,
+    TIMESTAMP,
+)
+from sqlalchemy.sql import func
+
+from linglong_web import TableBase
+
+
+class ServiceConfigTbl(TableBase):
+    __tablename__ = 'service_config_tbl'
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    service_name = Column(String, nullable=False)
+    conf_key = Column(String, nullable=False)
+    conf_value = Column(Text)
+    flag = Column(SmallInteger, default=0)
+    created_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp())
+    update_time = Column(TIMESTAMP(timezone=True), default=func.current_timestamp(), onupdate=func.current_timestamp())
+
+    __table_args__ = (
+        {'extend_existing': True},
+    )
+
+    def __repr__(self):
+        return f"ServiceConfigTbl(id={self.id}, service_name={self.service_name}, key={self.key})"