observal-cli 1.9.2__tar.gz → 1.9.4__tar.gz

observal_cli-1.9.4/.env.example

@@ -0,0 +1,89 @@
+# SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+# =============================================================================
+# Observal v1.0 — Environment Configuration (Boot-Time Only)
+#
+# Copy this file to .env and fill in values for your deployment.
+# SECURITY: never commit your real .env to version control.
+#
+# NOTE: As of v1.0, only boot-time infrastructure vars live here.
+# All runtime settings (eval models, security policies, SAML, retention, etc.)
+# are configured via the Settings page in the admin UI (super admin only).
+#
+# No incremental upgrade from pre-1.0 is supported. See:
+# https://docs.observal.dev/upgrade/1.0
+# =============================================================================
+
+
+# -----------------------------------------------------------------------------
+# Infrastructure — required for every deployment
+# -----------------------------------------------------------------------------
+
+DATABASE_URL=postgresql+asyncpg://postgres:postgres@observal-db:5432/observal
+CLICKHOUSE_URL=clickhouse://default:clickhouse@observal-clickhouse:8123/observal
+REDIS_URL=redis://observal-redis:6379
+
+
+# -----------------------------------------------------------------------------
+# Security
+# -----------------------------------------------------------------------------
+
+# Generate a unique secret:  python3 -c "import secrets; print(secrets.token_hex(32))"
+# REQUIRED in production: min 32 chars, random.
+SECRET_KEY=change-me-to-a-random-string
+
+
+# -----------------------------------------------------------------------------
+# Enterprise License
+# Required for ee/ features (insights, exec dashboard, SAML SSO, SCIM).
+# Leave blank for open-source core only.
+# -----------------------------------------------------------------------------
+
+OBSERVAL_LICENSE_KEY=
+
+
+
+# -----------------------------------------------------------------------------
+# JWT Key Management
+# EC signing key pair generated automatically on first start.
+# -----------------------------------------------------------------------------
+
+JWT_KEY_DIR=~/.observal/keys
+# JWT_KEY_PASSWORD=            # optional password to encrypt the private key at rest
+JWT_SIGNING_ALGORITHM=ES256
+
+
+# -----------------------------------------------------------------------------
+# Container credentials (docker-compose only — not read by the app)
+# Must match DATABASE_URL / CLICKHOUSE_URL above.
+# -----------------------------------------------------------------------------
+
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+CLICKHOUSE_USER=default
+CLICKHOUSE_PASSWORD=clickhouse
+
+
+# -----------------------------------------------------------------------------
+# Logging (boot-time — configured before DB is available)
+# -----------------------------------------------------------------------------
+
+LOG_LEVEL=INFO
+LOG_FORMAT=json
+
+
+# -----------------------------------------------------------------------------
+# Demo accounts (seeded on first startup when no real users exist)
+# SECURITY: change all passwords before exposing to any non-local environment.
+# -----------------------------------------------------------------------------
+
+SEED_DEMO_ACCOUNTS=true
+DEMO_SUPER_ADMIN_EMAIL=super@demo.example
+DEMO_SUPER_ADMIN_PASSWORD=super-changeme
+DEMO_ADMIN_EMAIL=admin@demo.example
+DEMO_ADMIN_PASSWORD=admin-changeme
+DEMO_REVIEWER_EMAIL=reviewer@demo.example
+DEMO_REVIEWER_PASSWORD=reviewer-changeme
+DEMO_USER_EMAIL=user@demo.example
+DEMO_USER_PASSWORD=user-changeme

observal_cli-1.9.4/.github/ISSUE_TEMPLATE/bug_report_form.yml

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2026 Naraen Rammoorthi <naraen13@gmail.com>
+# SPDX-FileCopyrightText: 2026 Shaan Narendran <shaannaren06@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: 🐞 Bug
+description: File a bug
+type: "Bug"
+labels:  ["Needs Triage"]
+
+body:
+
+  - type: checkboxes
+    id: contact
+    attributes:
+      label: Checked for duplicates?
+      description: Quickly search our [issues](https://github.com/Observal/Observal/issues) to see if a similar issue exists
+      options:
+        - label: This issue is not a duplicate
+          required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: What are the steps to reproduce this bug?
+      description: Briefly explain what you did which caused this bug to occur
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-behaviour
+    attributes:
+      label: Expected behaviour
+      description: Briefly describe what happened, and what should have happened
+    validations:
+      required: true
+
+  - type: textarea
+    id: support_bundle
+    attributes:
+      label: Support bundle
+      description: |
+        Please attach a support bundle to help us diagnose the issue.
+        Generate one with `observal support bundle` and attach the resulting `.tar.gz` file.
+        You can review its contents before sharing with `observal support inspect <bundle.tar.gz>`.
+      placeholder: Drag and drop the .tar.gz file here, or paste the output of `observal support inspect`
+
+  - type: textarea
+    id: extra_info
+    attributes:
+      label: (Optional) Anything else you want to share?
+      placeholder: List any extra information

observal_cli-1.9.4/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2026 Apoorv Garg <apoorvgarg.21@gmail.com>
+# SPDX-FileCopyrightText: 2026 Shaan Narendran <shaannaren06@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+blank_issues_enabled: true
+contact_links:
+  - name: Github Discussions
+    url: https://github.com/Observal/Observal/discussions
+    about: Post on the forums for questions, support and feature requests!

observal_cli-1.9.4/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,41 @@
+# SPDX-FileCopyrightText: 2026 Shaan Narendran <shaannaren06@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: 💡 Feature Request
+description: Suggest an idea for this project
+title: "[FEATURE] "
+labels: ["accepted"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Have a quick idea or want to gauge interest first?**
+        Consider starting a conversation in our [GitHub Discussions](https://github.com/Observal/Observal/discussions) before filing a formal feature request.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Is your feature request related to a problem? Please describe.
+      description: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Describe the solution you'd like
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Describe alternatives you've considered
+      description: A clear and concise description of any alternative solutions or features you've considered.
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: Additional context
+      description: Add any other context or screenshots about the feature request here.

observal_cli-1.9.4/.github/vex/observal.vex.json

@@ -0,0 +1,43 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/Observal/Observal/blob/main/.github/vex/observal.vex.json",
+  "author": "Observal Security <contact@observal.io>",
+  "timestamp": "2026-05-31T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "@id": "https://github.com/pypa/advisory-database/blob/main/vulns/PYSEC-2025-183.yaml",
+        "name": "PYSEC-2025-183"
+      },
+      "products": [
+        {
+          "@id": "pkg:pypi/observal-server",
+          "subcomponents": [
+            {"@id": "pkg:pypi/starlette"}
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "Observal does not use the affected Starlette multipart form parsing path that triggers this vulnerability. All file uploads are handled via dedicated streaming endpoints with size limits enforced at the nginx layer."
+    },
+    {
+      "vulnerability": {
+        "@id": "https://github.com/pypa/advisory-database/blob/main/vulns/PYSEC-2026-161.yaml",
+        "name": "PYSEC-2026-161"
+      },
+      "products": [
+        {
+          "@id": "pkg:pypi/observal-server",
+          "subcomponents": [
+            {"@id": "pkg:pypi/starlette"}
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "The affected code path requires specific Host header manipulation that is blocked by Observal's nginx reverse proxy configuration (see docker/nginx.conf header validation rules)."
+    }
+  ]
+}

observal_cli-1.9.4/.github/workflows/badge-ghcr-pulls.yml

@@ -0,0 +1,103 @@
+# SPDX-FileCopyrightText: 2026 Hari Srinivasan <harisrini21@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+# Fetches combined GHCR pull counts for observal-api and observal-web by
+# scraping the public package pages (no auth needed — the count is in the HTML).
+# Writes a shields.io endpoint JSON to a Gist so the README badge stays live.
+#
+# One-time setup required:
+#   1. Create a public Gist with a file named ghcr-pulls.json
+#   2. Generate a PAT with scope: gist only
+#   3. Add two repo secrets:
+#        BADGE_GIST_ID    — the Gist ID (alphanumeric hash in the URL)
+#        BADGE_GIST_TOKEN — the PAT created above
+
+name: Update GHCR pulls badge
+
+on:
+  schedule:
+    - cron: "0 3 * * *" # daily at 03:00 UTC
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  update:
+    name: Fetch counts and update Gist
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch pull counts from GHCR
+        id: counts
+        run: |
+          python3 - <<'PY'
+          import os, re, urllib.request
+
+          def scrape_count(package):
+              url = f"https://github.com/orgs/Observal/packages/container/package/{package}"
+              req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
+              with urllib.request.urlopen(req) as resp:
+                  html = resp.read().decode()
+              match = re.search(r'Total downloads[^<]*</span>\s*<h3 title="(\d+)"', html)
+              return int(match.group(1)) if match else 0
+
+          api_count = scrape_count("observal-api")
+          web_count = scrape_count("observal-web")
+          total = api_count + web_count
+
+          print(f"observal-api: {api_count}")
+          print(f"observal-web: {web_count}")
+          print(f"Total: {total}")
+
+          if total >= 1_000_000:
+              label = f"{total / 1_000_000:.1f}M"
+          elif total >= 1_000:
+              label = f"{total / 1_000:.1f}k"
+          else:
+              label = str(total)
+
+          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
+              f.write(f"label={label}\n")
+              f.write(f"total={total}\n")
+          PY
+
+      - name: Write shields.io JSON to Gist
+        env:
+          GIST_TOKEN: ${{ secrets.BADGE_GIST_TOKEN }}
+          GIST_ID: ${{ secrets.BADGE_GIST_ID }}
+          LABEL: ${{ steps.counts.outputs.label }}
+        run: |
+          python3 - <<'PY'
+          import os, json, urllib.request
+
+          payload = {
+              "files": {
+                  "ghcr-pulls.json": {
+                      "content": json.dumps({
+                          "schemaVersion": 1,
+                          "label": "GHCR pulls",
+                          "message": os.environ["LABEL"],
+                          "color": "0db7ed",
+                          "namedLogo": "docker",
+                          "logoColor": "white",
+                      })
+                  }
+              }
+          }
+
+          req = urllib.request.Request(
+              f"https://api.github.com/gists/{os.environ['GIST_ID']}",
+              data=json.dumps(payload).encode(),
+              headers={
+                  "Authorization": f"token {os.environ['GIST_TOKEN']}",
+                  "Accept": "application/vnd.github+json",
+                  "X-GitHub-Api-Version": "2022-11-28",
+              },
+              method="PATCH",
+          )
+
+          with urllib.request.urlopen(req) as resp:
+              print(f"Gist updated: HTTP {resp.status}")
+          PY

observal_cli-1.9.4/.github/workflows/deploy.yml

@@ -0,0 +1,66 @@
+# SPDX-FileCopyrightText: 2026 Lokesh Selvam <lokeshselvam7025@gmail.com>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+name: Deploy to EC2
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-ec2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    if: github.repository == 'Observal/Observal'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Deploy to EC2
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ubuntu
+          key: ${{ secrets.EC2_SSH_KEY }}
+          script: |
+            set -e
+            cd ~/Observal
+            git fetch origin main
+            git reset --hard origin/main
+
+            cd docker
+            docker compose -f docker-compose.yml -f docker-compose.production.yml up -d --build --remove-orphans
+
+            # Phase 1: Wait for API container to be alive (bypasses nginx).
+            # Uses direct container exec because curl through nginx fails
+            # when nginx caches a stale upstream IP from the old container.
+            echo "Waiting for API container to start..."
+            for i in $(seq 1 60); do
+              if docker compose exec -T observal-api python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/livez')" 2>/dev/null; then
+                echo "API process is alive"
+                break
+              fi
+              echo "Waiting for API process... ($i/60)"
+              sleep 5
+            done
+
+            # Nginx caches upstream container IPs — after rebuild the API
+            # gets a new IP but nginx still routes to the old one.
+            docker compose -f docker-compose.yml -f docker-compose.production.yml restart observal-lb
+            sleep 3
+
+            # Phase 2: Verify health through nginx (the path clients use)
+            for i in $(seq 1 30); do
+              if curl -sf https://localhost/health -k > /dev/null 2>&1; then
+                echo "API is healthy (full stack verified)"
+                exit 0
+              fi
+              echo "Waiting for health check... ($i/30)"
+              sleep 5
+            done
+
+            echo "API failed health check"
+            docker compose logs observal-api observal-init observal-lb observal-db observal-clickhouse --tail 20
+            exit 1