flowmesh-cli-stack 0.1.8rc1__tar.gz → 0.1.10rc1__tar.gz

{flowmesh_cli_stack-0.1.8rc1/src/flowmesh_cli_stack.egg-info → flowmesh_cli_stack-0.1.10rc1}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: flowmesh-cli-stack
-Version: 0.1.8rc1
+Version: 0.1.10rc1
 Summary: FlowMesh CLI stack commands
 License-Expression: Apache-2.0
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: flowmesh-cli==0.1.8rc1
-Requires-Dist: flowmesh-sdk-stack==0.1.8rc1
+Requires-Dist: flowmesh-cli==0.1.10rc1
+Requires-Dist: flowmesh-sdk-stack==0.1.10rc1
 Requires-Dist: docker>=7.1.0
 Requires-Dist: packaging>=24
 Requires-Dist: pyyaml>=6.0.2

{flowmesh_cli_stack-0.1.8rc1 → flowmesh_cli_stack-0.1.10rc1}/pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "flowmesh-cli-stack"
-version = "0.1.8rc1"
+version = "0.1.10rc1"
 description = "FlowMesh CLI stack commands"
 readme = "README.md"
 requires-python = ">=3.12"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 dependencies = [
-    "flowmesh-cli==0.1.8rc1",
-    "flowmesh-sdk-stack==0.1.8rc1",
+    "flowmesh-cli==0.1.10rc1",
+    "flowmesh-sdk-stack==0.1.10rc1",
     "docker>=7.1.0",
     "packaging>=24",
     "pyyaml>=6.0.2",

{flowmesh_cli_stack-0.1.8rc1 → flowmesh_cli_stack-0.1.10rc1}/src/flowmesh_cli_stack/assets/.env.example

@@ -43,6 +43,10 @@ SUPERVISOR_GRPC_KEEPALIVE_PERMIT_WITHOUT_CALLS=true
 SUPERVISOR_GRPC_MIN_RECV_PING_INTERVAL_MS=60000
 SUPERVISOR_GRPC_KEEPALIVE_TIME_MS=300000
 SUPERVISOR_GRPC_KEEPALIVE_TIMEOUT_MS=10000
+# Shared secret admitting `external` workers (empty disables them).
+EXTERNAL_WORKER_TOKEN=
+# File holding the secret; wins over EXTERNAL_WORKER_TOKEN.
+EXTERNAL_WORKER_TOKEN_FILE=
 
 # ==== Redis Connectivity ====
 REDIS_CONTROL_URL=redis://localhost:6379/0
@@ -85,7 +89,7 @@ SERVER_PORT_FORWARD_PORT_END=32100
 
 # ==== SSH Task Support ====
 ENABLE_SERVER_SSH_PROXY=true
-ENABLE_SERVER_SSH_CONNECTION_AUDIT=true
+ENABLE_SERVER_SSH_CONNECTION_REGISTRY=true
 
 # ==== Serve Task Support ====
 ENABLE_SERVER_SERVE_PROXY=true
@@ -105,7 +109,19 @@ SSH_MAX_PIDS=
 # Whether to apply requested GPU limits to SSH tasks.
 # If false, SSH tasks are allocated all available GPUs
 # regardless of their resource requests.
-ENABLE_SSH_GPU_LIMIT=false
+ENABLE_SSH_GPU_LIMIT=true
+# Whether a non-root worker may serve SSH sessions,
+# which run as the worker and can read its credentials.
+ENABLE_UNISOLATED_SSH_SESSION=false
+# Sandbox an SSH session runs in. 'docker' creates a
+# sibling container; 'process' runs sshd inside the
+# worker. 'auto' picks docker, falling back to process
+# on a root worker.
+SSH_SESSION_BACKEND=auto
+# Address a direct-mode session is advertised at.
+# Defaults to the worker's tailnet address, else its
+# FQDN.
+SSH_DIRECT_HOST=
 
 # ==== General Settings ====
 TZ=Asia/Singapore
@@ -128,6 +144,8 @@ ENABLE_WORKER_WATCHDOG=true
 WORKER_DEATH_CHECK_INTERVAL=30
 WORKER_DEATH_GRACE_SEC=60
 WORKER_REHYDRATION_GRACE_SEC=120
+ENABLE_WORKER_REAPER=true
+WORKER_REAP_GRACE_SEC=900
 
 # ==== Server Heartbeat ====
 SERVER_HEARTBEAT_INTERVAL=30

{flowmesh_cli_stack-0.1.8rc1 → flowmesh_cli_stack-0.1.10rc1}/src/flowmesh_cli_stack/env_schema.py

@@ -1,6 +1,7 @@
 """Stack env schema."""
 
 from flowmesh.models.nodes import NodeRole
+from flowmesh_stack.env import parse_bool
 from flowmesh_stack.env_schema import (
     EnvSchema,
     EnvSection,
@@ -10,6 +11,24 @@ from flowmesh_stack.env_schema import (
     require_if_true,
 )
 
+
+def _warn_reaper_without_watchdog(
+    env: dict[str, str], errors: list[str], warnings: list[str]
+) -> None:
+    """Warn when the stale-worker reaper is enabled while the watchdog is off.
+
+    The reaper runs on the watchdog thread, so it never fires without it. An
+    unset or unparsable ENABLE_WORKER_WATCHDOG keeps its own default and is
+    left alone, so only an explicit false value warns.
+    """
+    if parse_bool(env.get("ENABLE_WORKER_REAPER", "")) and (
+        parse_bool(env.get("ENABLE_WORKER_WATCHDOG", "")) is False
+    ):
+        warnings.append(
+            "ENABLE_WORKER_REAPER has no effect while ENABLE_WORKER_WATCHDOG is false"
+        )
+
+
 STACK_ENV_SCHEMA = EnvSchema(
     name="stack",
     header=[
@@ -147,6 +166,17 @@ STACK_ENV_SCHEMA = EnvSchema(
                     var_type=EnvVarType.INT,
                     min_value=0,
                 ),
+                EnvVar(
+                    "EXTERNAL_WORKER_TOKEN",
+                    description="Shared secret admitting `external` workers "
+                    "(empty disables them).",
+                ),
+                EnvVar(
+                    "EXTERNAL_WORKER_TOKEN_FILE",
+                    description="File holding the secret; wins over "
+                    "EXTERNAL_WORKER_TOKEN.",
+                    var_type=EnvVarType.FILE_PATH,
+                ),
             ],
         ),
         EnvSection(
@@ -292,7 +322,7 @@ STACK_ENV_SCHEMA = EnvSchema(
             vars=[
                 EnvVar("ENABLE_SERVER_SSH_PROXY", "true", var_type=EnvVarType.BOOL),
                 EnvVar(
-                    "ENABLE_SERVER_SSH_CONNECTION_AUDIT",
+                    "ENABLE_SERVER_SSH_CONNECTION_REGISTRY",
                     "true",
                     var_type=EnvVarType.BOOL,
                 ),
@@ -325,7 +355,7 @@ STACK_ENV_SCHEMA = EnvSchema(
                 EnvVar("SSH_MAX_PIDS", var_type=EnvVarType.INT, min_value=1),
                 EnvVar(
                     "ENABLE_SSH_GPU_LIMIT",
-                    "false",
+                    "true",
                     var_type=EnvVarType.BOOL,
                     description=[
                         "Whether to apply requested GPU limits to SSH tasks.",
@@ -333,6 +363,35 @@ STACK_ENV_SCHEMA = EnvSchema(
                         "regardless of their resource requests.",
                     ],
                 ),
+                EnvVar(
+                    "ENABLE_UNISOLATED_SSH_SESSION",
+                    "false",
+                    var_type=EnvVarType.BOOL,
+                    description=[
+                        "Whether a non-root worker may serve SSH sessions,",
+                        "which run as the worker and can read its credentials.",
+                    ],
+                ),
+                EnvVar(
+                    "SSH_SESSION_BACKEND",
+                    "auto",
+                    var_type=EnvVarType.ENUM,
+                    choices={"auto", "docker", "process"},
+                    description=[
+                        "Sandbox an SSH session runs in. 'docker' creates a",
+                        "sibling container; 'process' runs sshd inside the",
+                        "worker. 'auto' picks docker, falling back to process",
+                        "on a root worker.",
+                    ],
+                ),
+                EnvVar(
+                    "SSH_DIRECT_HOST",
+                    description=[
+                        "Address a direct-mode session is advertised at.",
+                        "Defaults to the worker's tailnet address, else its",
+                        "FQDN.",
+                    ],
+                ),
             ],
         ),
         EnvSection(
@@ -427,6 +486,17 @@ STACK_ENV_SCHEMA = EnvSchema(
                     var_type=EnvVarType.INT,
                     min_value=0,
                 ),
+                EnvVar(
+                    "ENABLE_WORKER_REAPER",
+                    "true",
+                    var_type=EnvVarType.BOOL,
+                ),
+                EnvVar(
+                    "WORKER_REAP_GRACE_SEC",
+                    "900",
+                    var_type=EnvVarType.INT,
+                    min_value=0,
+                ),
             ],
         ),
         EnvSection(
@@ -693,6 +763,7 @@ STACK_ENV_SCHEMA = EnvSchema(
             ],
             errors,
         ),
+        _warn_reaper_without_watchdog,
     ],
 )
 

{flowmesh_cli_stack-0.1.8rc1 → flowmesh_cli_stack-0.1.10rc1/src/flowmesh_cli_stack.egg-info}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: flowmesh-cli-stack
-Version: 0.1.8rc1
+Version: 0.1.10rc1
 Summary: FlowMesh CLI stack commands
 License-Expression: Apache-2.0
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: flowmesh-cli==0.1.8rc1
-Requires-Dist: flowmesh-sdk-stack==0.1.8rc1
+Requires-Dist: flowmesh-cli==0.1.10rc1
+Requires-Dist: flowmesh-sdk-stack==0.1.10rc1
 Requires-Dist: docker>=7.1.0
 Requires-Dist: packaging>=24
 Requires-Dist: pyyaml>=6.0.2

flowmesh_cli_stack-0.1.10rc1/src/flowmesh_cli_stack.egg-info/requires.txt

@@ -0,0 +1,5 @@
+flowmesh-cli==0.1.10rc1
+flowmesh-sdk-stack==0.1.10rc1
+docker>=7.1.0
+packaging>=24
+pyyaml>=6.0.2

flowmesh_cli_stack-0.1.8rc1/src/flowmesh_cli_stack.egg-info/requires.txt

@@ -1,5 +0,0 @@
-flowmesh-cli==0.1.8rc1
-flowmesh-sdk-stack==0.1.8rc1
-docker>=7.1.0
-packaging>=24
-pyyaml>=6.0.2