katalon-cli 0.4.0__tar.gz → 0.5.1__tar.gz

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: katalon-cli
-Version: 0.4.0
+Version: 0.5.1
 Summary: Installer & Updater CLI für Katalon Production-Instanzen
 Author: Karl Krägelin
 Author-email: Karl Krägelin <karlkraegelin@gmail.com>

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "katalon-cli"
-version = "0.4.0"
+version = "0.5.1"
 description = "Installer & Updater CLI für Katalon Production-Instanzen"
 readme = "README.md"
 requires-python = ">=3.12"

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "katalon-cli"
-version = "0.4.0"
+version = "0.5.1"
 description = "Installer & Updater CLI für Katalon Production-Instanzen"
 readme = "README.md"
 authors = [

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/src/katalon_cli/core/checks.py

@@ -8,10 +8,11 @@ import subprocess
 from dataclasses import dataclass
 from pathlib import Path
 
+from . import docker
+
 MIN_FREE_DISK_GB = 5
 # Elasticsearch verweigert Shard-Allokation ab 90 % (high watermark).
 MAX_USED_PERCENT = 90
-REAL_FS = {"ext2", "ext3", "ext4", "xfs", "btrfs", "zfs", "f2fs"}
 
 
 @dataclass
@@ -52,30 +53,25 @@ def check_disk_space(path: Path, min_gb: int = MIN_FREE_DISK_GB) -> CheckResult:
         "Diskspace", ok, f"{free_gb:.1f} GB frei (min. {min_gb} GB) in {path}"
     )
 
-def _mount_points(instance_dir: Path) -> list[Path]:
-    """Alle echten Dateisysteme des Hosts; ohne /proc/mounts Instanzverzeichnis und `/`."""
-    try:
-        lines = Path("/proc/mounts").read_text().splitlines()
-    except OSError:
-        return [instance_dir, Path("/")]
-    return [Path(f[1].replace("\\040", " ")) for f in map(str.split, lines) if f[2] in REAL_FS]
+ES_DATA_PATH = "/usr/share/elasticsearch/data"
 
 
 def check_server_disk(instance_dir: Path, max_used: int = MAX_USED_PERCENT) -> CheckResult:
-    full = []
-    for mount in _mount_points(instance_dir):
-        try:
-            usage = shutil.disk_usage(mount)
-        except OSError:
-            continue
-        used = usage.used * 100 / (usage.used + usage.free)
-        if used >= max_used:
-            full.append(f"{mount} {used:.0f} %")
-    if full:
+    """Belegung des Dateisystems mit dem Elasticsearch-Datenpfad, gemessen im Container (auch Docker Desktop)."""
+    if not docker.is_running(instance_dir, "elasticsearch"):
+        return CheckResult("Server-Disk", True, "Elasticsearch läuft nicht — Prüfung übersprungen")
+    result = docker.compose(
+        instance_dir, "exec", "-T", "elasticsearch", "df", "-Pk", ES_DATA_PATH, check=False, capture=True
+    )
+    try:
+        used = int(result.stdout.splitlines()[-1].split()[4].rstrip("%"))
+    except (IndexError, ValueError):
+        return CheckResult("Server-Disk", True, "Belegung nicht lesbar — Prüfung übersprungen")
+    if used >= max_used:
         return CheckResult(
-            "Server-Disk", False, f"≥ {max_used} % belegt: {', '.join(full)} — Elasticsearch blockiert ab 90 %"
+            "Server-Disk", False, f"Elasticsearch-Daten {used} % belegt (≥ {max_used} %) — Elasticsearch blockiert ab 90 %"
         )
-    return CheckResult("Server-Disk", True, f"alle Dateisysteme < {max_used} % belegt")
+    return CheckResult("Server-Disk", True, f"Elasticsearch-Daten {used} % belegt (< {max_used} %)")
 
 
 def check_openssl() -> CheckResult:

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/src/katalon_cli/main.py

@@ -77,6 +77,7 @@ OPTIONAL_ENV_BLOCK = f"""
 # SMTP_FROM=
 # CORS_ORIGINS=["http://localhost"]
 # MAX_UPLOAD_SIZE_MB=200
+# ATTACHMENT_MAX_UPLOAD_MB=200
 """
 
 

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/src/katalon_cli/templates/compose.yaml.j2

@@ -109,6 +109,7 @@ services:
       CANTALOUPE_URL: ${CANTALOUPE_URL:-http://cantaloupe:8182}
       CANTALOUPE_PUBLIC_URL: ${CANTALOUPE_PUBLIC_URL:-http://localhost}
       MEDIA_ROOT: /var/lib/katalon/media
+      ATTACHMENT_MAX_UPLOAD_MB: ${ATTACHMENT_MAX_UPLOAD_MB:-200}
       FIRST_RUN_CREDENTIALS_PATH: ${FIRST_RUN_CREDENTIALS_PATH:-/var/lib/katalon/first-run-credentials.txt}
       DEBUG: "false"
     volumes:
@@ -136,6 +137,7 @@ services:
       CANTALOUPE_URL: ${CANTALOUPE_URL:-http://cantaloupe:8182}
       CANTALOUPE_PUBLIC_URL: ${CANTALOUPE_PUBLIC_URL:-http://localhost}
       MEDIA_ROOT: /var/lib/katalon/media
+      ATTACHMENT_MAX_UPLOAD_MB: ${ATTACHMENT_MAX_UPLOAD_MB:-200}
     volumes:
       - ${MEDIA_ROOT:-./media}:/var/lib/katalon/media
     depends_on:

{katalon_cli-0.4.0 → katalon_cli-0.5.1}/src/katalon_cli/templates/nginx.conf.j2

@@ -38,6 +38,25 @@ server {
         proxy_set_header X-Forwarded-Proto {{ '$http_x_forwarded_proto' if tls_mode == 'caddy' else '$scheme' }};
     }
 
+    # Attachment and media files bring their own CSP per content type from the API (sandbox for image/audio/video,
+    # PDF-capable for PDF). The server-level page CSP (object-src 'none') blocks the browser PDF viewer,
+    # so this location omits CSP and X-Content-Type-Options, which the API sets itself.
+    # An add_header here drops the server-level ones: the remaining headers are repeated.
+    location ~ "^/(portal/)?v1/(attachments/[0-9a-fA-F-]{36}/(file|stream)|objects/[0-9a-fA-F-]{36}/media/[0-9a-fA-F-]{36}/(file|stream)|media/[0-9a-fA-F-]{36}/(file|download))$" {
+        set $upstream_api api:8000;
+        proxy_pass http://$upstream_api;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto {{ '$http_x_forwarded_proto' if tls_mode == 'caddy' else '$scheme' }};
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+    }
+
     location /v1/ {
         set $upstream_api api:8000;
         proxy_pass http://$upstream_api;