mystack-rig 1.0.0__tar.gz

mystack_rig-1.0.0/.coveragerc

@@ -0,0 +1,12 @@
+[run]
+source = src
+omit =
+    # Entry trampoline only
+    src/cli/__main__.py
+
+[report]
+fail_under = 90
+exclude_lines =
+    pragma: no cover
+    if __name__ == .__main__.:
+    if TYPE_CHECKING:

mystack_rig-1.0.0/.flake8

@@ -0,0 +1,5 @@
+[flake8]
+max-line-length = 120
+extend-ignore = E501,W293,W291,E302,E305,E306,F401,F841,E128,E402,F541,E502
+per-file-ignores =
+    tests/*: F401,F841,W293,E501,E306,E128,E302

mystack_rig-1.0.0/.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Release
+
+# Publishes to PyPI only when a version tag is pushed.
+# v1.2.3 and 1.2.3 both publish mystack-rig 1.2.3.
+# Create a repository Actions secret named PYPI_API_TOKEN
+# (a PyPI API token, including the pypi- prefix). The token is not printed.
+
+on:
+  push:
+    tags:
+      - "*"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install build twine pytest pytest-cov mypy
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
+      - name: Type check
+        run: mypy src/ --ignore-missing-imports
+
+      - name: Run unit tests
+        run: |
+          pytest tests/ -v -m "not e2e" --cov=src --cov-report=term-missing --cov-report=xml --cov-fail-under=90 --ignore=tests/test_real_e2e_integration.py --ignore=tests/test_real_e2e_storage.py --ignore=tests/test_hetzner_storage.py
+
+      - name: Derive version from the release tag
+        id: version
+        run: |
+          version="$(python scripts/pypi_version.py "$GITHUB_REF_NAME")"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Release version: $version (from tag $GITHUB_REF_NAME)"
+
+      - name: Build sdist and wheel
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ steps.version.outputs.version }}
+        run: python -m build
+
+      - name: Require the built archives to match the tag
+        run: python scripts/pypi_version.py --check-dist dist "$GITHUB_REF_NAME"
+
+      - name: Check package metadata
+        run: python -m twine check dist/*
+
+      - name: Require the PyPI API token secret
+        env:
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -z "$TWINE_PASSWORD" ]; then
+            echo "Create a GitHub Actions secret named PYPI_API_TOKEN with a PyPI API token (include the pypi- prefix)."
+            exit 1
+          fi
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: python -m twine upload --non-interactive dist/*

mystack_rig-1.0.0/.github/workflows/tests.yml

@@ -0,0 +1,169 @@
+name: Tests
+
+on:
+  push:
+    branches: [master, develop]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE*'
+      - '.editorconfig'
+  pull_request:
+    branches: [master, develop]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE*'
+      - '.editorconfig'
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install flake8 pytest
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
+      - name: Lint with flake8
+        run: |
+          flake8 src/ tests/ --count --show-source --statistics
+
+  type-check:
+    name: Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install mypy
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
+      - name: Type check with mypy
+        run: |
+          mypy src/ --ignore-missing-imports
+
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    # OIDC upload when Codecov GitHub App is linked; token used when present.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install pytest pytest-cov
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
+      - name: Run unit tests
+        run: |
+          pytest tests/ -v -m "not e2e" --cov=src --cov-report=term-missing --cov-report=xml --cov-fail-under=90 --ignore=tests/test_real_e2e_integration.py --ignore=tests/test_real_e2e_storage.py --ignore=tests/test_hetzner_storage.py
+
+      - name: Report coverage
+        if: always()
+        run: python scripts/coverage_badge.py >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload coverage to Codecov
+        if: always()
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
+          files: ./coverage.xml
+          flags: unit-tests
+          name: unit-tests
+          # Do not fail Unit Tests on upload/auth issues (pytest is the gate).
+          fail_ci_if_error: false
+          verbose: true
+
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    needs: unit-tests
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+
+      - name: Run integration tests
+        run: |
+          pytest tests/test_remote_dev.py -v -k "not e2e"
+
+  e2e-tests:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    needs: unit-tests
+    timeout-minutes: 45
+    env:
+      HETZNER_CLOUD_API_TOKEN: ${{ secrets.HETZNER_CLOUD_API_TOKEN }}
+      HETZNER_S3_ACCESS_KEY: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
+      HETZNER_S3_SECRET_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
+      S3_ENDPOINT_URL: https://fsn1.your-objectstorage.com
+      RIG_GITHUB_PAT: ${{ secrets.RIG_GITHUB_PAT }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          sudo apt-get update
+          sudo apt-get install -y wireguard-tools
+
+      - name: Run E2E tests
+        run: |
+          # wg-quick needs root. Preserve PATH so the runner's pytest and ansible stay visible.
+          sudo env \
+            PATH="$PATH" \
+            HETZNER_CLOUD_API_TOKEN="$HETZNER_CLOUD_API_TOKEN" \
+            HETZNER_S3_ACCESS_KEY="$HETZNER_S3_ACCESS_KEY" \
+            HETZNER_S3_SECRET_KEY="$HETZNER_S3_SECRET_KEY" \
+            S3_ENDPOINT_URL="$S3_ENDPOINT_URL" \
+            RIG_GITHUB_PAT="$RIG_GITHUB_PAT" \
+            python -m pytest tests/ -v -m e2e --tb=short

mystack_rig-1.0.0/.gitignore

@@ -0,0 +1,105 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+env/
+venv/
+ENV/
+.venv/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+env/
+.venv/bin/
+.venv/lib/
+.venv/include/
+
+# IDEs
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+.project
+.pydevproject
+.settings/
+
+# Testing
+.pytest_cache/
+.coverage
+coverage.xml
+htmlcov/
+.tox/
+.nox/
+*.cover
+
+# Documentation
+docs/_build/
+docs/_static/
+docs/_templates/
+
+# Temporary files
+/tmp/
+*.tmp
+*.temp
+*.log
+*.log.*
+*.swp
+*.swo
+
+# YAML temp files (used for state storage)
+state.yml
+*.yml.tmp
+*.yaml.tmp
+
+# Environment variables
+.env
+.env.local
+.env.*.local
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# Rig specific
+.rig/.vault_password
+.rig/credentials/
+.rig/secrets/
+
+# >>> rig managed
+.rig/collections/
+.rig/roles/
+.rig/inventory.yml
+.rig/*.retry
+# <<< rig managed

mystack_rig-1.0.0/.rig/playbooks/README.md

@@ -0,0 +1,45 @@
+# Ansible Playbooks
+
+This directory contains Ansible playbooks for provisioning remote development environments.
+
+## Available Playbooks
+
+### WireGuard VPN Gateway
+- **File**: `vpn-gateway.yml`
+- **Purpose**: Provisions a remote VM with WireGuard as a VPN gateway
+- **Usage**: Creates a VPN gateway that allows secure access to development services
+
+## Structure
+
+```
+.rig/playbooks/
+├── vpn-gateway.yml    # WireGuard VPN gateway provisioning
+└── README.md          # This file
+```
+
+## How It Works
+
+The WireGuard VPN gateway playbook:
+1. Installs WireGuard tools on the remote VM
+2. Generates WireGuard key pair
+3. Creates WireGuard interface configuration
+4. Enables IP forwarding and masquerading
+5. Starts the WireGuard service
+
+## Configuration
+
+The playbook uses the following variables (can be overridden):
+- `vpn_gateway_ip`: VPN gateway IP address (default: 10.0.0.1/24)
+- `vpn_gateway_port`: WireGuard listen port (default: 51820)
+- `wg_interface_name`: WireGuard interface name (default: wg0)
+
+## Usage
+
+```bash
+ansible-playbook .rig/playbooks/vpn-gateway.yml -i <inventory> --private-key ~/.ssh/id_rsa
+```
+
+## See Also
+
+- [VPN CLI Commands](../src/cli/vpn.py) - Management commands for VPN tunnels
+- [VPN E2E Tests](../tests/test_real_e2e_vpn_tunnel.py) - End-to-end VPN tunnel verification

mystack_rig-1.0.0/.rig/playbooks/vpn-gateway.yml

@@ -0,0 +1,75 @@
+---
+- name: Configure WireGuard VPN Gateway
+  hosts: remote_vm
+  become: yes
+  vars:
+    vpn_gateway_ip: "10.0.0.1/24"
+    vpn_gateway_port: 51820
+    wg_interface_name: "wg0"
+    
+  tasks:
+    - name: Wait for cloud-init to finish
+      command: cloud-init status --wait
+      changed_when: false
+      failed_when: false
+
+    - name: Install WireGuard tools
+      apt:
+        name:
+          - wireguard
+          - wireguard-tools
+        state: present
+        update_cache: yes
+      register: wg_install
+      retries: 12
+      delay: 10
+      until: wg_install is success
+
+    - name: Generate WireGuard private key
+      shell: wg genkey
+      register: wg_private_key
+      changed_when: false
+
+    - name: Generate WireGuard public key
+      shell: echo "{{ wg_private_key.stdout }}" | wg pubkey
+      register: wg_public_key
+      changed_when: false
+
+    - name: Create WireGuard configuration directory
+      file:
+        path: /etc/wireguard
+        state: directory
+        mode: '0700'
+
+    - name: Generate WireGuard configuration
+      copy:
+        dest: /etc/wireguard/{{ wg_interface_name }}.conf
+        content: |
+          [Interface]
+          Address = {{ vpn_gateway_ip }}
+          ListenPort = {{ vpn_gateway_port }}
+          PrivateKey = {{ wg_private_key.stdout }}
+          PostUp = iptables -A FORWARD -i {{ wg_interface_name }} -j ACCEPT; iptables -A FORWARD -o {{ wg_interface_name }} -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+          PostDown = iptables -D FORWARD -i {{ wg_interface_name }} -j ACCEPT; iptables -D FORWARD -o {{ wg_interface_name }} -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+        mode: '0600'
+
+    - name: Enable IP forwarding
+      sysctl:
+        name: net.ipv4.ip_forward
+        value: "1"
+        state: present
+        reload: yes
+
+    - name: Start and enable WireGuard service
+      systemd:
+        name: "wg-quick@{{ wg_interface_name }}"
+        state: started
+        enabled: yes
+
+    - name: Output VPN public key
+      debug:
+        msg: "VPN Gateway Public Key: {{ wg_public_key.stdout }}"
+
+    - name: Output VPN endpoint
+      debug:
+        msg: "VPN Gateway Endpoint: {{ ansible_default_ipv4.address }}:{{ vpn_gateway_port }}"

mystack_rig-1.0.0/CLI_STORAGE_SUMMARY.md

@@ -0,0 +1,170 @@
+# CLI-Only Solution with Hetzner S3-Compatible Storage
+
+## Overview
+
+This document describes the implementation of a CLI-only solution focused on Hetzner S3-compatible object storage using Hetzner Cloud Token authentication. The solution provides a command-line interface for managing storage operations without requiring explicit S3 credentials.
+
+## Implementation Details
+
+### 1. Core Components
+
+#### Storage Manager Module
+- **File**: `src/cli/storage.py`
+- **Purpose**: Manages all S3-compatible storage operations
+- **Features**:
+  - Bucket creation/deletion
+  - File upload/download functionality
+  - Object listing and deletion
+  - Configuration via environment variables
+  - Default Hetzner endpoint (`fsn1`)
+
+#### Main CLI Entry Point
+- **File**: `src/cli/main.py`
+- **Purpose**: Command-line interface router
+- **Commands**:
+  - `storage create-bucket`: Create a new storage bucket
+  - `storage list-buckets`: List all storage buckets
+  - `storage upload`: Upload a file to storage
+  - `storage download`: Download a file from storage
+  - `storage list-objects`: List objects in a bucket
+  - `storage delete-object`: Delete an object from storage
+  - `storage delete-bucket`: Delete a storage bucket
+
+#### Configuration Manager
+- **File**: `src/cli/config.py`
+- **Purpose**: Manages CLI configuration
+- **Features**:
+  - Loads configuration from file or defaults
+  - Supports environment variable overrides
+  - Manages configuration persistence
+
+### 2. Storage Capabilities
+
+The solution provides comprehensive storage management for Hetzner S3-compatible storage:
+
+1. **Bucket Management**
+   - Create buckets
+   - List buckets
+   - Delete buckets
+
+2. **Object Management**
+   - Upload files with custom object names
+   - Download files
+   - List objects in buckets
+   - Delete individual objects
+
+3. **Authentication**
+   - Uses Hetzner Cloud Token for authentication
+   - Default endpoint: `https://fsn1.yourdomain.com`
+   - Temporary S3 credentials generated by Hetzner
+
+### 3. Credential Management
+
+#### Hetzner Cloud Token Authentication
+- **Primary Authentication**: Uses Hetzner Cloud API token for authentication
+- **Token Requirement**: Required for all operations
+- **Security**: Tokens are never stored permanently, only used for authentication
+
+#### S3 Credential Handling
+- **Generation Process**: Hetzner generates temporary S3 credentials on demand
+- **Exposure**: S3 credentials are displayed only once during generation
+- **Security**: Generated credentials are handled by Hetzner's secure infrastructure
+- **Replacement**: When credentials expire, new ones are generated automatically
+
+### 4. Configuration
+
+#### Environment Variables
+```bash
+export HZ_TOKEN="your-hetzner-cloud-token"
+export S3_ENDPOINT_URL="https://fsn1.yourdomain.com"  # Optional override
+```
+
+#### Configuration File (`config.yaml`)
+```yaml
+hz_token: "your-hetzner-cloud-token"
+s3_endpoint_url: "https://fsn1.yourdomain.com"
+```
+
+### 5. Usage Examples
+
+#### List Buckets
+```bash
+python3 src/cli/main.py storage list-buckets
+```
+
+#### Create Bucket
+```bash
+python3 src/cli/main.py storage create-bucket --name my-bucket
+```
+
+#### Upload File
+```bash
+python3 src/cli/main.py storage upload \
+  --bucket my-bucket \
+  --file ./local-file.txt \
+  --object-name remote-file.txt
+```
+
+#### Download File
+```bash
+python3 src/cli/main.py storage download \
+  --bucket my-bucket \
+  --object remote-file.txt \
+  --file ./downloaded-file.txt
+```
+
+#### List Objects
+```bash
+python3 src/cli/main.py storage list-objects \
+  --bucket my-bucket \
+  --prefix "subdirectory/"
+```
+
+### 6. Benefits of This Approach
+
+1. **Secure Authentication**: Uses Hetzner Cloud Token instead of static credentials
+2. **Automatic Credential Management**: Hetzner generates temporary S3 credentials
+3. **Standard Endpoint**: Defaults to `fsn1` region for Hetzner compatibility
+4. **Minimal Dependencies**: Lightweight implementation focused on storage operations
+5. **S3 Compatibility**: Works with Hetzner and other S3-compatible services
+6. **Credential Security**: S3 credentials shown only once, never permanently stored
+
+### 7. Integration with Existing Project
+
+The solution maintains compatibility with the existing project structure:
+- Uses the same package structure (`src/cli/`)
+- Maintains existing configuration system
+- Integrates seamlessly with existing dependencies
+- Follows the same naming conventions
+
+### 8. Security Features
+
+1. **Token-Based Authentication**: Uses Hetzner Cloud tokens instead of permanent credentials
+2. **Temporary Credentials**: S3 credentials are generated temporarily by Hetzner
+3. **Secure Environment Variables**: Stores tokens in environment variables
+4. **HTTPS Only**: All operations use secure connections
+5. **Credential Masking**: Tokens displayed securely with masking
+6. **Auto-Renewal**: Automatic credential renewal when needed
+
+## Deployment
+
+### Installation
+```bash
+pip install .
+```
+
+### Development Setup
+```bash
+# Install dependencies
+pip install -r requirements.txt
+
+# Run tests
+python -m pytest tests/
+
+# Run linter
+pylint src/
+```
+
+## License
+
+MIT

mystack_rig-1.0.0/Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt setup.py README.md ./
+COPY src ./src
+
+RUN pip install --no-cache-dir -r requirements.txt \
+    && pip install --no-cache-dir .
+
+ENTRYPOINT ["rig"]
+CMD ["--help"]