mantis-cli 22.1.0__tar.gz → 22.3.0__tar.gz

{mantis_cli-22.1.0 → mantis_cli-22.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: mantis_cli
-Version: 22.1.0
+Version: 22.3.0
 Summary: Management command to build and deploy webapps, especially based on Django
 Home-page: https://github.com/PragmaticMates/mantis-cli
 Author: Erik Telepovský
@@ -9,7 +9,6 @@ Maintainer: Pragmatic Mates
 Maintainer-email: info@pragmaticmates.com
 License: GNU General Public License (GPL)
 Keywords: management deployment docker command
-Platform: UNKNOWN
 Classifier: Programming Language :: Python
 Classifier: Operating System :: OS Independent
 Classifier: Environment :: Web Environment
@@ -19,6 +18,27 @@ Classifier: License :: OSI Approved :: GNU General Public License (GPL)
 Classifier: Development Status :: 5 - Production/Stable
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: cffi
+Requires-Dist: click
+Requires-Dist: cryptography
+Requires-Dist: pycryptodome
+Requires-Dist: pydantic
+Requires-Dist: PyYAML
+Requires-Dist: rich
+Requires-Dist: typer
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: summary
 
 # mantis-cli
 
@@ -69,6 +89,10 @@ You can use ``<MANTIS>`` variable in your paths if needed as a relative referenc
 | project_path             | string | path to folder with project files on remote server           |
 | connection               | string | single connection string (use instead of connections)        |
 | connections              | dict   | definition of your connections for each environment          |
+| tunnel                   | dict   | SSH tunnel settings                                          |
+| tunnel.enabled           | bool   | share a single SSH connection for the whole run (null = auto)|
+| tunnel.remote_socket     | string | path to the docker socket on the server                      |
+| tunnel.ssh_options       | array  | extra options passed to the ssh command                      |
 
 TODO:
 - default values
@@ -144,6 +168,70 @@ Environment files are looked up directly in the `environment.folder` instead of
 
 **Note:** You cannot define both `connection` and `connections` in the same config file.
 
+#### SSH tunnel
+
+With a plain `ssh://` connection, Docker opens a **separate SSH connection for every
+command** mantis runs. A single deployment issues dozens of them, and `compose pull` fans
+out over all services at once. That burst runs into sshd's `MaxStartups`, which drops
+connections beyond its threshold:
+
+```
+kex_exchange_identification: read: Connection reset by peer
+```
+
+It is also slow when the connection goes through a `ProxyCommand` (Cloudflare Access,
+bastion hosts, ...), because each connection spawns its own proxy process.
+
+The tunnel makes mantis open **one** SSH connection per run, forwarding the remote docker
+socket to a local one and pointing every docker command at it.
+
+Docker itself offers no way to pass `ssh` options (`ControlMaster` and friends), so this
+is handled entirely by mantis — no `~/.ssh/config` changes are needed, and connection
+details keep coming from your `ssh://` connection string. Unlike `ControlMaster`
+multiplexing, forwarded channels are not counted against sshd's `MaxSessions`, so no
+server-side configuration is required either.
+
+`tunnel.enabled` decides how much mantis verifies before trusting it:
+
+| value | behaviour |
+|-------|-----------|
+| unset (default) | detect per run: tunnel, and keep it only if the docker daemon answers through it |
+| `true` | tunnel without detecting, for a server already known to support it |
+| `false` | never tunnel |
+
+```json
+"tunnel": {
+    "enabled": true
+}
+```
+
+Detection costs one extra round-trip per run and cannot be skipped by opening the forward
+alone: `ssh -L` to a unix socket succeeds even when nothing listens on the far end, so a
+tunnel only proves itself once the daemon has replied. Set `enabled` explicitly once
+`check-tunnel` (below) confirms a server, and that round-trip goes away.
+
+Requirements on the server: the connecting user must be able to read the docker socket
+(typically membership in the `docker` group), and `AllowStreamLocalForwarding` must not
+be disabled — it defaults to `yes`. Whenever the tunnel cannot be used, mantis warns and
+falls back to a connection per docker command, so deployments keep working either way.
+
+The check ignores `tunnel.enabled`, so it answers "would this work" rather than "is this
+on" — use it before setting `enabled` to `true`:
+
+```bash
+mantis -e production check-tunnel
+```
+
+It opens the tunnel, asks the remote docker daemon for its version and closes it again,
+exiting non-zero on failure. A refused forward and an unreachable socket are reported
+separately, since they need different fixes (`sshd_config` versus group membership).
+
+Pass `--no-tunnel` to disable it for a single run:
+
+```bash
+mantis -e production --no-tunnel deploy
+```
+
 ### Encryption
 
 If you plan to use encryption and decryption of your environment files, you need to create encryption key.
@@ -257,18 +345,18 @@ Run `mantis --help` to see all available commands with their descriptions.
 
 | Command / Shortcut                    | Description                                               |
 |---------------------------------------|-----------------------------------------------------------|
-| logs [CONTAINER] / l                  | Prints logs of containers                                 |
+| logs [CONTAINER\|SERVICE] / l          | Prints logs of containers                                 |
 | networks / n                          | Prints docker networks                                    |
-| healthcheck [CONTAINER] / hc          | Execute health-check of container                         |
+| healthcheck [CONTAINER\|SERVICE] / hc  | Execute health-check of container                         |
 | stop [CONTAINERS...]                  | Stops containers                                          |
 | start [CONTAINERS...]                 | Starts containers                                         |
 | kill [CONTAINERS...]                  | Kills containers                                          |
 | remove [CONTAINERS...] [--force]      | Removes containers                                        |
 | rename CONTAINER NEW_NAME             | Rename container                                          |
-| bash CONTAINER                        | Runs bash in container                                    |
-| sh CONTAINER                          | Runs sh in container                                      |
-| exec CONTAINER COMMAND...             | Executes command in container                             |
-| exec-it CONTAINER COMMAND...          | Executes command in container (interactive)               |
+| bash CONTAINER\|SERVICE               | Runs bash in container                                    |
+| sh CONTAINER\|SERVICE                 | Runs sh in container                                      |
+| exec CONTAINER\|SERVICE COMMAND...    | Executes command in container                             |
+| exec-it CONTAINER\|SERVICE COMMAND... | Executes command in container (interactive)               |
 | get-container-name SERVICE            | Gets container name for service                           |
 | remove-suffixes [PREFIX]              | Removes numerical suffixes from container names           |
 
@@ -323,6 +411,7 @@ Run `mantis --help` to see all available commands with their descriptions.
 | contexts                              | Prints all docker contexts                                |
 | create-context                        | Creates docker context                                    |
 | ssh                                   | Connects to remote host via SSH                           |
+| check-tunnel                          | Checks if the docker socket can be tunnelled over SSH     |
 
 **Django extension:**
 
@@ -451,6 +540,38 @@ If you need to follow logs of a specific container, you can do it by passing con
 mantis -e <ENVIRONMENT> logs <container-name>
 ```
 
+#### Container or service name
+
+Commands taking a container (`logs`, `healthcheck`, `bash`, `sh`, `exec`, `exec-it`) also accept a
+plain service name and mantis finds its container(s) for you, including scaled ones with numerical
+suffixes and services declaring their own `container_name`:
+
+```bash
+mantis -e production logs app   # reads logs of <project>-app container
+mantis -e production bash app   # same container, no need to type the project prefix
+```
+
+A name which is not a service is still matched against container names without their project
+prefix, which covers services numbered in the compose file:
+
+```bash
+mantis -e production logs htmltopdf  # reads <project>-htmltopdf-1 and <project>-htmltopdf-2
+```
+
+An exact container name always takes precedence: if a container literally named `app` exists,
+`logs app` reads that one instead of `<project>-app`. Names matching no container at all are
+passed to docker as they are.
+
+`logs` follows all matching containers at once, prefixing every line with a container name:
+
+```
+itfitness-htmltopdf-1 | POST /generate-pdf 200 3355.969 ms - 837045
+itfitness-htmltopdf-2 | POST /generate-pdf 200 889.662 ms - 747746
+```
+
+Commands which can only operate on one container (`bash`, `sh`, `exec`, `exec-it`, `healthcheck`)
+use the first match and warn about the rest.
+
 ### 5. Another useful commands
 
 Sometimes, instead of calling whole deployment process, you just need to call compose commands directly:
@@ -490,4 +611,3 @@ Works as follows:
 ## Release notes
 
 Mantis uses semantic versioning. See more in [changelog](https://github.com/PragmaticMates/mantis-cli/blob/master/CHANGES.md).
-

mantis_cli-22.1.0/mantis_cli.egg-info/PKG-INFO → mantis_cli-22.3.0/README.md

@@ -1,25 +1,3 @@
-Metadata-Version: 2.1
-Name: mantis-cli
-Version: 22.1.0
-Summary: Management command to build and deploy webapps, especially based on Django
-Home-page: https://github.com/PragmaticMates/mantis-cli
-Author: Erik Telepovský
-Author-email: info@pragmaticmates.com
-Maintainer: Pragmatic Mates
-Maintainer-email: info@pragmaticmates.com
-License: GNU General Public License (GPL)
-Keywords: management deployment docker command
-Platform: UNKNOWN
-Classifier: Programming Language :: Python
-Classifier: Operating System :: OS Independent
-Classifier: Environment :: Web Environment
-Classifier: Intended Audience :: Developers
-Classifier: Framework :: Django
-Classifier: License :: OSI Approved :: GNU General Public License (GPL)
-Classifier: Development Status :: 5 - Production/Stable
-Description-Content-Type: text/markdown
-License-File: LICENSE
-
 # mantis-cli
 
 Mantis is a CLI (command line interface) tool designed as a wrapper upon docker and docker compose commands for your project.
@@ -69,6 +47,10 @@ You can use ``<MANTIS>`` variable in your paths if needed as a relative referenc
 | project_path             | string | path to folder with project files on remote server           |
 | connection               | string | single connection string (use instead of connections)        |
 | connections              | dict   | definition of your connections for each environment          |
+| tunnel                   | dict   | SSH tunnel settings                                          |
+| tunnel.enabled           | bool   | share a single SSH connection for the whole run (null = auto)|
+| tunnel.remote_socket     | string | path to the docker socket on the server                      |
+| tunnel.ssh_options       | array  | extra options passed to the ssh command                      |
 
 TODO:
 - default values
@@ -144,6 +126,70 @@ Environment files are looked up directly in the `environment.folder` instead of
 
 **Note:** You cannot define both `connection` and `connections` in the same config file.
 
+#### SSH tunnel
+
+With a plain `ssh://` connection, Docker opens a **separate SSH connection for every
+command** mantis runs. A single deployment issues dozens of them, and `compose pull` fans
+out over all services at once. That burst runs into sshd's `MaxStartups`, which drops
+connections beyond its threshold:
+
+```
+kex_exchange_identification: read: Connection reset by peer
+```
+
+It is also slow when the connection goes through a `ProxyCommand` (Cloudflare Access,
+bastion hosts, ...), because each connection spawns its own proxy process.
+
+The tunnel makes mantis open **one** SSH connection per run, forwarding the remote docker
+socket to a local one and pointing every docker command at it.
+
+Docker itself offers no way to pass `ssh` options (`ControlMaster` and friends), so this
+is handled entirely by mantis — no `~/.ssh/config` changes are needed, and connection
+details keep coming from your `ssh://` connection string. Unlike `ControlMaster`
+multiplexing, forwarded channels are not counted against sshd's `MaxSessions`, so no
+server-side configuration is required either.
+
+`tunnel.enabled` decides how much mantis verifies before trusting it:
+
+| value | behaviour |
+|-------|-----------|
+| unset (default) | detect per run: tunnel, and keep it only if the docker daemon answers through it |
+| `true` | tunnel without detecting, for a server already known to support it |
+| `false` | never tunnel |
+
+```json
+"tunnel": {
+    "enabled": true
+}
+```
+
+Detection costs one extra round-trip per run and cannot be skipped by opening the forward
+alone: `ssh -L` to a unix socket succeeds even when nothing listens on the far end, so a
+tunnel only proves itself once the daemon has replied. Set `enabled` explicitly once
+`check-tunnel` (below) confirms a server, and that round-trip goes away.
+
+Requirements on the server: the connecting user must be able to read the docker socket
+(typically membership in the `docker` group), and `AllowStreamLocalForwarding` must not
+be disabled — it defaults to `yes`. Whenever the tunnel cannot be used, mantis warns and
+falls back to a connection per docker command, so deployments keep working either way.
+
+The check ignores `tunnel.enabled`, so it answers "would this work" rather than "is this
+on" — use it before setting `enabled` to `true`:
+
+```bash
+mantis -e production check-tunnel
+```
+
+It opens the tunnel, asks the remote docker daemon for its version and closes it again,
+exiting non-zero on failure. A refused forward and an unreachable socket are reported
+separately, since they need different fixes (`sshd_config` versus group membership).
+
+Pass `--no-tunnel` to disable it for a single run:
+
+```bash
+mantis -e production --no-tunnel deploy
+```
+
 ### Encryption
 
 If you plan to use encryption and decryption of your environment files, you need to create encryption key.
@@ -257,18 +303,18 @@ Run `mantis --help` to see all available commands with their descriptions.
 
 | Command / Shortcut                    | Description                                               |
 |---------------------------------------|-----------------------------------------------------------|
-| logs [CONTAINER] / l                  | Prints logs of containers                                 |
+| logs [CONTAINER\|SERVICE] / l          | Prints logs of containers                                 |
 | networks / n                          | Prints docker networks                                    |
-| healthcheck [CONTAINER] / hc          | Execute health-check of container                         |
+| healthcheck [CONTAINER\|SERVICE] / hc  | Execute health-check of container                         |
 | stop [CONTAINERS...]                  | Stops containers                                          |
 | start [CONTAINERS...]                 | Starts containers                                         |
 | kill [CONTAINERS...]                  | Kills containers                                          |
 | remove [CONTAINERS...] [--force]      | Removes containers                                        |
 | rename CONTAINER NEW_NAME             | Rename container                                          |
-| bash CONTAINER                        | Runs bash in container                                    |
-| sh CONTAINER                          | Runs sh in container                                      |
-| exec CONTAINER COMMAND...             | Executes command in container                             |
-| exec-it CONTAINER COMMAND...          | Executes command in container (interactive)               |
+| bash CONTAINER\|SERVICE               | Runs bash in container                                    |
+| sh CONTAINER\|SERVICE                 | Runs sh in container                                      |
+| exec CONTAINER\|SERVICE COMMAND...    | Executes command in container                             |
+| exec-it CONTAINER\|SERVICE COMMAND... | Executes command in container (interactive)               |
 | get-container-name SERVICE            | Gets container name for service                           |
 | remove-suffixes [PREFIX]              | Removes numerical suffixes from container names           |
 
@@ -323,6 +369,7 @@ Run `mantis --help` to see all available commands with their descriptions.
 | contexts                              | Prints all docker contexts                                |
 | create-context                        | Creates docker context                                    |
 | ssh                                   | Connects to remote host via SSH                           |
+| check-tunnel                          | Checks if the docker socket can be tunnelled over SSH     |
 
 **Django extension:**
 
@@ -451,6 +498,38 @@ If you need to follow logs of a specific container, you can do it by passing con
 mantis -e <ENVIRONMENT> logs <container-name>
 ```
 
+#### Container or service name
+
+Commands taking a container (`logs`, `healthcheck`, `bash`, `sh`, `exec`, `exec-it`) also accept a
+plain service name and mantis finds its container(s) for you, including scaled ones with numerical
+suffixes and services declaring their own `container_name`:
+
+```bash
+mantis -e production logs app   # reads logs of <project>-app container
+mantis -e production bash app   # same container, no need to type the project prefix
+```
+
+A name which is not a service is still matched against container names without their project
+prefix, which covers services numbered in the compose file:
+
+```bash
+mantis -e production logs htmltopdf  # reads <project>-htmltopdf-1 and <project>-htmltopdf-2
+```
+
+An exact container name always takes precedence: if a container literally named `app` exists,
+`logs app` reads that one instead of `<project>-app`. Names matching no container at all are
+passed to docker as they are.
+
+`logs` follows all matching containers at once, prefixing every line with a container name:
+
+```
+itfitness-htmltopdf-1 | POST /generate-pdf 200 3355.969 ms - 837045
+itfitness-htmltopdf-2 | POST /generate-pdf 200 889.662 ms - 747746
+```
+
+Commands which can only operate on one container (`bash`, `sh`, `exec`, `exec-it`, `healthcheck`)
+use the first match and warn about the rest.
+
 ### 5. Another useful commands
 
 Sometimes, instead of calling whole deployment process, you just need to call compose commands directly:
@@ -489,5 +568,4 @@ Works as follows:
 
 ## Release notes
 
-Mantis uses semantic versioning. See more in [changelog](https://github.com/PragmaticMates/mantis-cli/blob/master/CHANGES.md).
-
+Mantis uses semantic versioning. See more in [changelog](https://github.com/PragmaticMates/mantis-cli/blob/master/CHANGES.md).

mantis_cli-22.3.0/mantis/__init__.py

@@ -0,0 +1 @@
+VERSION = '22.3.0'

{mantis_cli-22.1.0 → mantis_cli-22.3.0}/mantis/app.py

@@ -191,6 +191,7 @@ def main(
     environment: Optional[str] = typer.Option(None, "--env", "-e", help="Environment ID"),
     mode: str = typer.Option("remote", "--mode", "-m", help="Execution mode: remote, ssh, host"),
     dry_run: bool = typer.Option(False, "--dry-run", "-n", help="Show commands without executing"),
+    no_tunnel: bool = typer.Option(False, "--no-tunnel", help="Do not tunnel the remote docker socket over a single SSH connection"),
     version: bool = typer.Option(False, "--version", "-v", callback=version_callback, is_eager=True, help="Show version and exit"),
 ):
     """Mantis CLI - Docker deployment tool."""
@@ -216,4 +217,4 @@ def main(
 
     state._mode = mode
     state._dry_run = dry_run
-    state._manager = get_manager(environment, mode, dry_run=dry_run, commands=commands)
+    state._manager = get_manager(environment, mode, dry_run=dry_run, commands=commands, use_tunnel=not no_tunnel)

{mantis_cli-22.1.0 → mantis_cli-22.3.0}/mantis/command_line.py

@@ -99,6 +99,7 @@ def parse_global_options(global_opts: List[str]) -> dict:
         'env': None,
         'mode': 'remote',
         'dry_run': False,
+        'use_tunnel': True,
     }
 
     i = 0
@@ -113,6 +114,9 @@ def parse_global_options(global_opts: List[str]) -> dict:
         elif opt in ('-n', '--dry-run'):
             result['dry_run'] = True
             i += 1
+        elif opt == '--no-tunnel':
+            result['use_tunnel'] = False
+            i += 1
         else:
             i += 1
 
@@ -185,7 +189,7 @@ def run():
     all_commands = [group[0] for group in cmd_groups if group]
     state._mode = opts['mode']
     state._dry_run = opts['dry_run']
-    state._manager = get_manager(opts['env'], opts['mode'], dry_run=opts['dry_run'], commands=all_commands)
+    state._manager = get_manager(opts['env'], opts['mode'], dry_run=opts['dry_run'], commands=all_commands, use_tunnel=opts['use_tunnel'])
 
     # Get Click app from Typer
     click_app = typer.main.get_command(app)

{mantis_cli-22.1.0 → mantis_cli-22.3.0}/mantis/commands/connection.py

@@ -1,4 +1,6 @@
-"""Connection commands: contexts, create-context, ssh."""
+"""Connection commands: contexts, create-context, ssh, check-tunnel."""
+import typer
+
 from mantis.app import command, state
 
 
@@ -18,3 +20,10 @@ def create_context():
 def ssh_cmd():
     """Connects to remote host via SSH"""
     state.ssh()
+
+
+@command(name="check-tunnel", panel="Connections")
+def check_tunnel():
+    """Checks if the docker socket can be tunnelled over SSH"""
+    if not state.check_tunnel():
+        raise typer.Exit(code=1)

{mantis_cli-22.1.0 → mantis_cli-22.3.0}/mantis/commands/containers.py

@@ -8,7 +8,7 @@ from mantis.app import command, state
 
 @command(shortcut="l", panel="Containers")
 def logs(
-    container: Optional[str] = typer.Argument(None, help="Container name"),
+    container: Optional[str] = typer.Argument(None, help="Container or service name"),
 ):
     """Prints logs of containers"""
     state.logs(container)
@@ -22,7 +22,7 @@ def networks():
 
 @command(shortcut="hc", panel="Containers")
 def healthcheck(
-    container: Optional[str] = typer.Argument(None, help="Container name"),
+    container: Optional[str] = typer.Argument(None, help="Container or service name"),
 ):
     """Execute health-check of container"""
     state.healthcheck(container)
@@ -72,7 +72,7 @@ def rename(
 
 @command(panel="Containers")
 def bash(
-    container: str = typer.Argument(..., help="Container name"),
+    container: str = typer.Argument(..., help="Container or service name"),
 ):
     """Runs bash in container"""
     state.bash(container)
@@ -80,7 +80,7 @@ def bash(
 
 @command(panel="Containers")
 def sh(
-    container: str = typer.Argument(..., help="Container name"),
+    container: str = typer.Argument(..., help="Container or service name"),
 ):
     """Runs sh in container"""
     state.sh(container)
@@ -88,7 +88,7 @@ def sh(
 
 @command(name="exec", panel="Containers")
 def exec_cmd(
-    container: str = typer.Argument(..., help="Container name"),
+    container: str = typer.Argument(..., help="Container or service name"),
     cmd: List[str] = typer.Argument(..., help="Command to execute"),
 ):
     """Executes command in container"""
@@ -97,7 +97,7 @@ def exec_cmd(
 
 @command(name="exec-it", panel="Containers")
 def exec_it(
-    container: str = typer.Argument(..., help="Container name"),
+    container: str = typer.Argument(..., help="Container or service name"),
     cmd: List[str] = typer.Argument(..., help="Command to execute"),
 ):
     """Executes command in container (interactive)"""