coda-node 0.1.0__py3-none-any.whl

coda_node/server/cli.py

@@ -0,0 +1,360 @@
+"""Command-line interface for the Coda node runtime.
+
+Provides the ``coda`` (and ``coda-node``) entry points with
+subcommands:
+
+* ``start`` -- launch the FastAPI server with optional ``--token`` for
+  first-time node provisioning. Use ``--daemon`` to run in the
+  background.
+* ``stop`` -- stop the daemon if running in background mode.
+* ``status`` -- show daemon status and basic runtime info.
+* ``doctor`` -- print diagnostic information about the local
+  environment (OpenVPN, VPN interface, Redis, executor).
+* ``reset`` -- wipe persisted credentials, VPN profiles, and stop any
+  managed OpenVPN daemon.
+* ``stop-vpn`` -- stop the managed OpenVPN process without resetting
+  other state.
+* ``logs`` -- show recent daemon log output.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import logging
+import os
+import shutil
+import tempfile
+from pathlib import Path
+
+import uvicorn
+
+from coda_node.server.config import (
+    PERSISTED_CONFIG_PATH,
+    PERSISTED_PRIVATE_KEY_PATH,
+    Settings,
+)
+from coda_node.server.daemon import (
+    DAEMON_LOG_PATH,
+    DAEMON_PID_PATH,
+    daemon_status,
+    is_daemon_running,
+    start_daemon,
+    stop_daemon,
+    tail_daemon_log,
+)
+from coda_node.vpn import (
+    OPENVPN_LOG_PATH,
+    OPENVPN_PID_PATH,
+    detect_tun_interface,
+    kill_openvpn_daemon,
+)
+
+__all__ = ["main"]
+
+_BANNER_WIDTH = 48
+
+
+_logging_configured = False
+
+
+def _configure_logging() -> None:
+    """Set up root logger with a human-readable format at INFO level.
+
+    Guarded so that repeated CLI entry (e.g. test harnesses calling
+    ``main()`` multiple times) does not add duplicate handlers.
+    """
+    global _logging_configured
+    if _logging_configured:
+        return
+    logging.basicConfig(
+        level=logging.INFO,
+        format="%(asctime)s %(levelname)s %(name)s: %(message)s",
+    )
+    _logging_configured = True
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    """Build the ``coda`` CLI argument parser with all subcommands."""
+    start_parent = argparse.ArgumentParser(add_help=False)
+    start_parent.add_argument("-H", "--host")
+    start_parent.add_argument("-p", "--port", type=int)
+    start_parent.add_argument("-t", "--token", dest="node_token")
+    start_parent.add_argument(
+        "-d",
+        "--daemon",
+        action="store_true",
+        help="Run the server as a background daemon",
+    )
+
+    parser = argparse.ArgumentParser(prog="coda")
+    parser.add_argument(
+        "--reset",
+        action="store_true",
+        help="Clear persisted runtime state and VPN artifacts",
+    )
+    subparsers = parser.add_subparsers(dest="command", required=False)
+
+    subparsers.add_parser(
+        "start", parents=[start_parent], help="Run the FastAPI server"
+    )
+    subparsers.add_parser("stop", help="Stop the background daemon")
+    subparsers.add_parser("status", help="Show daemon status")
+    subparsers.add_parser("doctor", help="Print basic runtime checks")
+    subparsers.add_parser(
+        "reset", help="Clear persisted runtime state and VPN artifacts"
+    )
+    subparsers.add_parser("stop-vpn", help="Stop the managed OpenVPN process")
+
+    logs_parser = subparsers.add_parser("logs", help="Show recent daemon log output")
+    logs_parser.add_argument(
+        "-n",
+        "--lines",
+        type=int,
+        default=50,
+        help="Number of lines to show (default: 50)",
+    )
+
+    return parser
+
+
+def _apply_overrides(args: argparse.Namespace) -> None:
+    """Push CLI flags into environment variables before Settings loads."""
+    host = getattr(args, "host", None)
+    port = getattr(args, "port", None)
+    node_token = getattr(args, "node_token", None)
+
+    if host:
+        os.environ["CODA_HOST"] = host
+    if port is not None:
+        os.environ["CODA_PORT"] = str(port)
+    if node_token:
+        os.environ["CODA_NODE_TOKEN"] = node_token
+
+
+def _print_banner(title: str, rows: list[tuple[str, str]]) -> None:
+    """Print a bordered banner with a title and key-value rows."""
+    print()
+    print(f"  ┌{'─' * (_BANNER_WIDTH - 2)}┐")
+    print(f"  │{title:^{_BANNER_WIDTH - 2}}│")
+    print(f"  └{'─' * (_BANNER_WIDTH - 2)}┘")
+    print()
+    for label, value in rows:
+        print(f"  {label:<14}{value}")
+    print()
+    print(f"  {'─' * _BANNER_WIDTH}")
+    print()
+
+
+def _print_status(label: str, value: str) -> None:
+    """Print a single diagnostic status row."""
+    print(f"  {'→':<2} {label:<14}{value}")
+
+
+def _start_mode(token: str) -> str:
+    """Return the display name for the startup mode."""
+    return "token" if token else "env"
+
+
+def _read_reset_paths() -> list[Path]:
+    """Collect all file paths that should be removed during a reset."""
+    paths = {
+        PERSISTED_CONFIG_PATH,
+        PERSISTED_PRIVATE_KEY_PATH,
+        OPENVPN_PID_PATH,
+        OPENVPN_LOG_PATH,
+        DAEMON_PID_PATH,
+        DAEMON_LOG_PATH,
+        Path(f"{tempfile.gettempdir()}/coda-node.ovpn"),
+    }
+    if PERSISTED_CONFIG_PATH.exists():
+        try:
+            data = json.loads(PERSISTED_CONFIG_PATH.read_text())
+        except (OSError, json.JSONDecodeError):
+            data = {}
+        if isinstance(data, dict):
+            for key in ("jwt_private_key_path", "node_vpn_profile_path"):
+                value = data.get(key)
+                if isinstance(value, str) and value:
+                    paths.add(Path(value))
+    return sorted(paths)
+
+
+def _reset() -> int:
+    """Stop the daemon and VPN, and remove all persisted runtime files."""
+    print("Resetting persisted Coda runtime state...")
+
+    # Stop the daemon if running
+    daemon_stopped = stop_daemon()
+    print("  Stopped Coda daemon" if daemon_stopped else "  No Coda daemon running")
+
+    # Stop OpenVPN
+    vpn_killed = kill_openvpn_daemon()
+    print(
+        "  Stopped managed OpenVPN daemon"
+        if vpn_killed
+        else "  No managed VPN process found"
+    )
+
+    removed_any = False
+    for path in _read_reset_paths():
+        if path.exists():
+            path.unlink()
+            removed_any = True
+            print(f"  ✓ Removed {path}")
+        else:
+            print(f"  - Not found {path}")
+
+    if not removed_any:
+        print("  No persisted runtime files found")
+    return 0
+
+
+def _doctor() -> int:
+    """Print diagnostic information about the runtime environment."""
+    settings = Settings()
+    openvpn_bin = shutil.which("openvpn") or shutil.which("openvpn.exe")
+    iface = detect_tun_interface(settings.vpn_interface_hint)
+    pid_exists = Path(OPENVPN_PID_PATH).exists()
+
+    _print_banner(
+        "C O D A  ·  D O C T O R",
+        [
+            ("WEBAPP", settings.webapp_url),
+            ("CONNECT", settings.connect_url),
+            ("REDIS", settings.redis_url or "not set"),
+        ],
+    )
+    _print_status("EXECUTOR", settings.executor_factory or "NoopExecutor")
+    _print_status("OPENVPN", openvpn_bin or "not found")
+    _print_status("VPN IFACE", iface or "not detected")
+    _print_status("VPN PID", "present" if pid_exists else "absent")
+    return 0
+
+
+def main() -> None:
+    """Entry point for the ``coda`` / ``coda-node`` CLI.
+
+    Parses arguments, dispatches to the appropriate subcommand, and
+    raises :class:`SystemExit` with the subcommand's return code.
+    """
+    _configure_logging()
+    parser = _build_parser()
+    args = parser.parse_args()
+
+    if args.reset or args.command == "reset":
+        raise SystemExit(_reset())
+
+    if args.command == "start":
+        _apply_overrides(args)
+        settings = Settings()
+        daemon_mode = getattr(args, "daemon", False)
+
+        if daemon_mode:
+            if is_daemon_running():
+                status = daemon_status()
+                print(f"Daemon already running (PID {status['pid']})")
+                raise SystemExit(1)
+
+            _print_banner(
+                "C O D A  ·  D A E M O N",
+                [
+                    ("WEBAPP", settings.webapp_url),
+                    ("ENDPOINT", f"{settings.host}:{settings.port}"),
+                    ("MODE", _start_mode(settings.node_token)),
+                ],
+            )
+            try:
+                pid = start_daemon(
+                    host=settings.host,
+                    port=settings.port,
+                    token=settings.node_token or None,
+                )
+                print(f"  Started daemon (PID {pid})")
+                print(f"  Log file: {DAEMON_LOG_PATH}")
+                print()
+                print("  Use 'coda stop' to stop the daemon")
+                print("  Use 'coda status' to check daemon status")
+                print("  Use 'coda logs' to view log output")
+            except RuntimeError as exc:
+                print(f"  Failed to start daemon: {exc}")
+                raise SystemExit(1) from None
+            return
+
+        _print_banner(
+            "C O D A  ·  N O D E",
+            [
+                ("WEBAPP", settings.webapp_url),
+                ("ENDPOINT", f"{settings.host}:{settings.port}"),
+                ("MODE", _start_mode(settings.node_token)),
+            ],
+        )
+        uvicorn.run(
+            "coda_node.server.app:app",
+            host=settings.host,
+            port=settings.port,
+            reload=False,
+            log_level="warning",
+        )
+        return
+
+    if args.command == "stop":
+        if not is_daemon_running():
+            print("No daemon is running")
+            raise SystemExit(1)
+        status = daemon_status()
+        print(f"Stopping daemon (PID {status['pid']})...")
+        stopped = stop_daemon()
+        if stopped:
+            print("  Daemon stopped")
+            raise SystemExit(0)
+        else:
+            print("  Failed to stop daemon")
+            raise SystemExit(1)
+
+    if args.command == "status":
+        status = daemon_status()
+        _print_banner(
+            "C O D A  ·  S T A T U S",
+            [
+                ("DAEMON", "running" if status["running"] else "stopped"),
+                ("PID", str(status["pid"]) if status["pid"] else "-"),
+                ("PID FILE", str(DAEMON_PID_PATH)),
+            ],
+        )
+        _print_status("LOG FILE", str(DAEMON_LOG_PATH))
+        _print_status("LOG EXISTS", "yes" if status["log_exists"] else "no")
+
+        # Also show VPN status if available
+        try:
+            settings = Settings()
+            iface = detect_tun_interface(settings.vpn_interface_hint)
+            _print_status("VPN IFACE", iface or "not detected")
+        except Exception:
+            _print_status("VPN IFACE", "unknown")
+
+        raise SystemExit(0 if status["running"] else 1)
+
+    if args.command == "logs":
+        lines = getattr(args, "lines", 50)
+        log_output = tail_daemon_log(lines)
+        if not log_output:
+            print(f"No log file found at {DAEMON_LOG_PATH}")
+            raise SystemExit(1)
+        print(log_output)
+        raise SystemExit(0)
+
+    if args.command == "doctor":
+        raise SystemExit(_doctor())
+
+    if args.command == "stop-vpn":
+        killed = kill_openvpn_daemon()
+        print("Stopping Coda VPN service...")
+        print(
+            "  ✓ Stopped managed OpenVPN daemon"
+            if killed
+            else "  No managed VPN process found"
+        )
+        raise SystemExit(0 if killed else 1)
+
+    parser.error("a command is required")

coda_node/server/config.py

@@ -0,0 +1,300 @@
+"""Runtime configuration for the Coda node server.
+
+Configuration is resolved in three layers (highest priority first):
+
+1. **Environment variables** prefixed with ``CODA_`` (e.g.
+   ``CODA_REDIS_URL``).
+2. **Persisted runtime config** written to ``/tmp/coda.config`` after a
+   successful node provisioning, so later restarts can reconnect
+   without a fresh token.
+3. **Hardcoded defaults** defined on :class:`Settings`.
+
+The persisted private key is stored separately at
+``/tmp/coda-private-key`` with ``0600`` permissions on POSIX systems.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import stat
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from pydantic import model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+from coda_node.errors import ConfigError
+
+logger = logging.getLogger(__name__)
+_EXECUTOR_FACTORY_RE = re.compile(r"^executor_factory\s*:\s*(.+?)\s*$")
+
+__all__ = [
+    "PERSISTED_CONFIG_PATH",
+    "PERSISTED_PRIVATE_KEY_PATH",
+    "Settings",
+    "load_persisted_runtime_config",
+]
+
+_RUNTIME_DIR = Path(tempfile.gettempdir())
+PERSISTED_CONFIG_PATH = _RUNTIME_DIR / "coda.config"
+PERSISTED_PRIVATE_KEY_PATH = _RUNTIME_DIR / "coda-private-key"
+
+
+def _read_secure_text(path: Path) -> str:
+    """Read a file after verifying it has ``0600`` permissions on POSIX."""
+    if not path.exists():
+        return ""
+    if os.name != "nt":
+        mode = stat.S_IMODE(path.stat().st_mode)
+        if mode != 0o600:
+            raise ConfigError(f"{path} must have permissions 0600")
+    return path.read_text()
+
+
+def load_persisted_runtime_config() -> dict[str, Any]:
+    """Load previously persisted runtime state from disk.
+
+    Reads the JSON config at :data:`PERSISTED_CONFIG_PATH` and the
+    private key at the path recorded inside it (or the default
+    :data:`PERSISTED_PRIVATE_KEY_PATH`).  Both files must have ``0600``
+    permissions on POSIX systems or a :class:`ValueError` is raised.
+
+    Returns:
+        A dictionary of setting overrides, or an empty dict if no
+        persisted config exists.
+
+    Raises:
+        ConfigError: If the config file exists but has wrong permissions
+            or does not contain a JSON object.
+    """
+    if not PERSISTED_CONFIG_PATH.exists():
+        return {}
+
+    raw_config = _read_secure_text(PERSISTED_CONFIG_PATH)
+    if not raw_config.strip():
+        return {}
+
+    data = json.loads(raw_config)
+    if not isinstance(data, dict):
+        raise ConfigError(f"{PERSISTED_CONFIG_PATH} must contain a JSON object")
+
+    private_key_path = Path(
+        str(data.get("jwt_private_key_path") or PERSISTED_PRIVATE_KEY_PATH)
+    )
+    private_key = _read_secure_text(private_key_path)
+
+    persisted: dict[str, Any] = {}
+    for key in (
+        "qpu_id",
+        "qpu_display_name",
+        "native_gate_set",
+        "num_qubits",
+        "jwt_key_id",
+        "redis_url",
+        "webapp_url",
+        "connect_path",
+        "heartbeat_path",
+        "webhook_path",
+        "vpn_required",
+        "vpn_check_interval_sec",
+        "vpn_interface_hint",
+        "vpn_probe_targets",
+        "node_auto_vpn",
+        "node_vpn_profile_path",
+        "node_machine_fingerprint",
+    ):
+        if key in data:
+            persisted[key] = data[key]
+
+    if private_key:
+        persisted["jwt_private_key"] = private_key
+
+    return persisted
+
+
+def _strip_inline_yaml_comment(value: str) -> str:
+    """Remove trailing comments from a simple scalar YAML value."""
+    in_single = False
+    in_double = False
+    for idx, char in enumerate(value):
+        if char == "'" and not in_double:
+            in_single = not in_single
+        elif char == '"' and not in_single:
+            in_double = not in_double
+        elif char == "#" and not in_single and not in_double:
+            return value[:idx].rstrip()
+    return value.strip()
+
+
+def _load_executor_factory_from_device_config(path: str) -> str:
+    """Read an optional top-level ``executor_factory`` scalar from device YAML."""
+    try:
+        for raw_line in Path(path).read_text().splitlines():
+            if raw_line.startswith((" ", "\t")):
+                continue
+            match = _EXECUTOR_FACTORY_RE.match(raw_line.strip())
+            if not match:
+                continue
+            value = _strip_inline_yaml_comment(match.group(1))
+            if len(value) >= 2 and value[0] == value[-1] and value[0] in {"'", '"'}:
+                value = value[1:-1]
+            return value.strip()
+    except OSError:
+        logger.warning(
+            "Failed to read device config while resolving executor factory: %s", path
+        )
+    return ""
+
+
+class Settings(BaseSettings):
+    """Coda-connected node configuration.
+
+    All fields can be set via ``CODA_``-prefixed environment variables
+    (e.g. ``CODA_QPU_ID``, ``CODA_REDIS_URL``).  When no node
+    token is provided, the model validator automatically loads any
+    previously persisted runtime config so the node can reconnect with
+    its stored JWT credentials.
+
+    The model uses ``validate_assignment=True`` so that mutations made
+    by :func:`~coda_node.vpn.service.apply_node_bundle` are
+    validated against field types.
+    """
+
+    qpu_id: str = ""
+    qpu_display_name: str = ""
+    native_gate_set: str = "cz"
+    num_qubits: int = 5
+
+    redis_url: str = ""
+
+    jwt_private_key: str = ""
+    jwt_key_id: str = ""
+
+    webapp_url: str = "https://coda.conductorquantum.com"
+    webhook_path: str = "/api/internal/qpu/webhook"
+    connect_path: str = "/api/internal/qpu/connect"
+    heartbeat_path: str = "/api/internal/qpu/heartbeat"
+
+    host: str = "0.0.0.0"
+    port: int = 8080
+
+    vpn_required: bool = True
+    vpn_check_interval_sec: int = 10
+    vpn_probe_targets: list[str] = []
+    vpn_interface_hint: str | None = None
+    allow_degraded_startup: bool = False
+
+    node_token: str = ""
+    node_timeout_sec: int = 15
+    node_machine_fingerprint: str = ""
+    node_auto_vpn: bool = True
+    node_vpn_profile_path: str = f"{tempfile.gettempdir()}/coda-node.ovpn"
+
+    node_connect_headers: dict[str, str] = {}
+    node_connect_retries: int = 3
+    shutdown_drain_timeout_sec: int = 30
+    heartbeat_interval_sec: int = 30
+
+    executor_factory: str = ""
+    device_config: str = ""
+    advertised_provider: str = "coda"
+
+    @model_validator(mode="before")
+    @classmethod
+    def merge_persisted_runtime_config(cls, data: Any) -> Any:
+        """Apply persisted runtime config before field validation.
+
+        This preserves the intended precedence order without mutating the model
+        during validation, which would otherwise re-enter assignment validation.
+        """
+        if not isinstance(data, dict):
+            return data
+        if data.get("node_token"):
+            return data
+
+        merged = dict(data)
+        persisted = load_persisted_runtime_config()
+        for key, value in persisted.items():
+            current = merged.get(key)
+            if key not in merged or current in ("", None, []):
+                merged[key] = value
+        return merged
+
+    @model_validator(mode="after")
+    def apply_default_device_config(self) -> Settings:
+        """Use ``./site/device.yaml`` when no explicit device config is set."""
+        if not self.device_config:
+            default_path = Path("site/device.yaml")
+            if default_path.exists():
+                logger.info("Using default device config: %s", default_path)
+                self.device_config = default_path.as_posix()
+        return self
+
+    @model_validator(mode="after")
+    def apply_device_config_executor_factory(self) -> Settings:
+        """Use ``executor_factory`` from the device config when env/config omit it."""
+        if self.executor_factory or not self.device_config:
+            return self
+
+        resolved = _load_executor_factory_from_device_config(self.device_config)
+        if resolved:
+            logger.info(
+                "Using executor factory from device config %s: %s",
+                self.device_config,
+                resolved,
+            )
+            self.executor_factory = resolved
+        return self
+
+    @model_validator(mode="after")
+    def check_jwt_or_node_token(self) -> Settings:
+        """Require JWT credentials unless node will supply them."""
+
+        if not self.node_token:
+            if not self.jwt_private_key:
+                raise ValueError(
+                    "CODA_JWT_PRIVATE_KEY must be set "
+                    "(or provide CODA_NODE_TOKEN for auto-provisioning)"
+                )
+            if not self.jwt_key_id:
+                raise ValueError(
+                    "CODA_JWT_KEY_ID must be set "
+                    "(or provide CODA_NODE_TOKEN for auto-provisioning)"
+                )
+        return self
+
+    @property
+    def callback_url(self) -> str:
+        """Full URL for webhook delivery."""
+        return f"{self.webapp_url}{self.webhook_path}"
+
+    @property
+    def connect_url(self) -> str:
+        """Full URL for the node connect endpoint."""
+        return f"{self.webapp_url}{self.connect_path}"
+
+    @property
+    def heartbeat_url(self) -> str:
+        """Full URL for heartbeat reporting."""
+        return f"{self.webapp_url}{self.heartbeat_path}"
+
+    @property
+    def vpn_probe_urls(self) -> list[str]:
+        """URLs to probe for VPN connectivity.
+
+        Returns explicit targets when configured, the health endpoint as
+        a fallback when VPN is required, or an empty list when VPN is
+        not required (HTTPS mode) to avoid probing endpoints that only
+        accept POST.
+        """
+        if self.vpn_probe_targets:
+            return list(self.vpn_probe_targets)
+        if not self.vpn_required:
+            return []
+        return [f"{self.webapp_url}/api/internal/qpu/health"]
+
+    model_config = SettingsConfigDict(env_prefix="CODA_", validate_assignment=True)