katalon-cli 0.3.2__tar.gz → 0.3.4__tar.gz

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: katalon-cli
-Version: 0.3.2
+Version: 0.3.4
 Summary: Installer & Updater CLI für Katalon Production-Instanzen
 Author: Karl Krägelin
 Author-email: Karl Krägelin <karlkraegelin@gmail.com>

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "katalon-cli"
-version = "0.3.2"
+version = "0.3.4"
 description = "Installer & Updater CLI für Katalon Production-Instanzen"
 readme = "README.md"
 requires-python = ">=3.12"

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "katalon-cli"
-version = "0.3.2"
+version = "0.3.4"
 description = "Installer & Updater CLI für Katalon Production-Instanzen"
 readme = "README.md"
 authors = [

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/src/katalon_cli/core/checks.py

@@ -9,6 +9,9 @@ from dataclasses import dataclass
 from pathlib import Path
 
 MIN_FREE_DISK_GB = 5
+# Elasticsearch verweigert Shard-Allokation ab 90 % (high watermark).
+MAX_USED_PERCENT = 90
+REAL_FS = {"ext2", "ext3", "ext4", "xfs", "btrfs", "zfs", "f2fs"}
 
 
 @dataclass
@@ -49,6 +52,32 @@ def check_disk_space(path: Path, min_gb: int = MIN_FREE_DISK_GB) -> CheckResult:
         "Diskspace", ok, f"{free_gb:.1f} GB frei (min. {min_gb} GB) in {path}"
     )
 
+def _mount_points(instance_dir: Path) -> list[Path]:
+    """Alle echten Dateisysteme des Hosts; ohne /proc/mounts Instanzverzeichnis und `/`."""
+    try:
+        lines = Path("/proc/mounts").read_text().splitlines()
+    except OSError:
+        return [instance_dir, Path("/")]
+    return [Path(f[1].replace("\\040", " ")) for f in map(str.split, lines) if f[2] in REAL_FS]
+
+
+def check_server_disk(instance_dir: Path, max_used: int = MAX_USED_PERCENT) -> CheckResult:
+    full = []
+    for mount in _mount_points(instance_dir):
+        try:
+            usage = shutil.disk_usage(mount)
+        except OSError:
+            continue
+        used = usage.used * 100 / (usage.used + usage.free)
+        if used >= max_used:
+            full.append(f"{mount} {used:.0f} %")
+    if full:
+        return CheckResult(
+            "Server-Disk", False, f"≥ {max_used} % belegt: {', '.join(full)} — Elasticsearch blockiert ab 90 %"
+        )
+    return CheckResult("Server-Disk", True, f"alle Dateisysteme < {max_used} % belegt")
+
+
 def check_openssl() -> CheckResult:
     if not shutil.which("openssl"):
         return CheckResult("OpenSSL", False, "nicht gefunden — für TLS-Modus 'standalone' erforderlich")

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/src/katalon_cli/core/docker.py

@@ -45,6 +45,12 @@ def compose(
     )
 
 
+def reload_nginx(instance_dir: Path) -> None:
+    """`up -d` erstellt nginx nicht neu, wenn nur die gemountete nginx.conf sich ändert."""
+    compose(instance_dir, "exec", "-T", "nginx", "nginx", "-t")
+    compose(instance_dir, "exec", "-T", "nginx", "nginx", "-s", "reload")
+
+
 def is_healthy(instance_dir: Path, service: str = "api") -> bool:
     result = compose(
         instance_dir, "ps", "--format", "json", service, check=False, capture=True

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/src/katalon_cli/main.py

@@ -689,6 +689,7 @@ def update(
 ):
     """Update auf neue Version — Backup zuerst, immer."""
     dir = instance_dir_or_raise(dir)
+    _require_disk(dir)
     state = InstallationState.load(dir)
     try:
         meta = release.get_release(target) if target else release.get_latest_release()
@@ -754,6 +755,7 @@ def update(
         ("Medienrechte prüfen", lambda: _ensure_media_permissions(dir)),
         # DB-Migration läuft automatisch im api-Container-Entrypoint beim Start.
         ("Container neu starten", lambda: docker.compose(dir, "up", "-d")),
+        ("nginx-Konfiguration neu laden", lambda: docker.reload_nginx(dir)),
     ]
 
     with Progress(SpinnerColumn(), TextColumn("[progress.description]{task.description}"), console=console) as progress:
@@ -843,10 +845,19 @@ def rollback(
 
     _ensure_media_permissions(dir)
     docker.compose(dir, "up", "-d")
+    docker.reload_nginx(dir)
     console.print("[green]✔[/] Rollback abgeschlossen.")
 
 
+def _require_disk(dir: Path) -> None:
+    result = checks.check_server_disk(dir)
+    if not result.ok:
+        console.print(f"[red]✖[/] {result.name}: {result.detail}")
+        raise typer.Exit(1)
+
+
 def _run_reindex(dir: Path, wait: bool = True) -> None:
+    _require_disk(dir)
     if not docker.is_healthy(dir, "api") or not docker.is_running(dir, "worker"):
         console.print("[red]✖[/] API oder Worker laufen nicht — erst `katalon start`.")
         raise typer.Exit(1)

{katalon_cli-0.3.2 → katalon_cli-0.3.4}/src/katalon_cli/templates/nginx.conf.j2

@@ -19,11 +19,15 @@ server {
 {% endif %}
     client_max_body_size 500m;
     absolute_redirect off;
+    server_tokens off;
     add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: https:; media-src 'self' blob: https:; connect-src 'self' https:; frame-src 'self' https://www.openstreetmap.org; worker-src 'self' blob:" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
 
     location /api/ {
         set $upstream_api api:8000;
@@ -97,6 +101,10 @@ server {
         add_header X-Content-Type-Options "nosniff" always;
         add_header X-Frame-Options "SAMEORIGIN" always;
         add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        # IIIF images are meant to be embedded by other sites; access is decided by auth_request.
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 
     location = /internal/media-authorize {