portacode 1.3.32__py3-none-any.whl → 1.4.11.dev0__py3-none-any.whl

portacode/connection/handlers/proxmox_infra.py

@@ -0,0 +1,307 @@
+"""Proxmox infrastructure configuration handler."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import shutil
+import stat
+import subprocess
+import sys
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Dict, Iterable, List, Tuple
+
+import platformdirs
+
+from .base import SyncHandler
+
+logger = logging.getLogger(__name__)
+
+CONFIG_DIR = Path(platformdirs.user_config_dir("portacode"))
+CONFIG_PATH = CONFIG_DIR / "proxmox_infra.json"
+
+DEFAULT_HOST = "localhost"
+DEFAULT_NODE_NAME = os.uname().nodename.split(".", 1)[0]
+DEFAULT_BRIDGE = "vmbr1"
+SUBNET_CIDR = "10.10.0.1/24"
+BRIDGE_IP = SUBNET_CIDR.split("/", 1)[0]
+DHCP_START = "10.10.0.100"
+DHCP_END = "10.10.0.200"
+DNS_SERVER = "1.1.1.1"
+IFACES_PATH = Path("/etc/network/interfaces")
+SYSCTL_PATH = Path("/etc/sysctl.d/99-portacode-forward.conf")
+UNIT_DIR = Path("/etc/systemd/system")
+
+
+def _call_subprocess(cmd: List[str], **kwargs: Any) -> subprocess.CompletedProcess[str]:
+    env = os.environ.copy()
+    env.setdefault("DEBIAN_FRONTEND", "noninteractive")
+    return subprocess.run(cmd, env=env, text=True, capture_output=True, **kwargs)
+
+
+def _ensure_proxmoxer() -> Any:
+    try:
+        from proxmoxer import ProxmoxAPI  # noqa: F401
+    except ModuleNotFoundError as exc:
+        python = sys.executable
+        logger.info("Proxmoxer missing; installing via pip")
+        try:
+            _call_subprocess([python, "-m", "pip", "install", "proxmoxer"], check=True)
+        except subprocess.CalledProcessError as pip_exc:
+            msg = pip_exc.stderr or pip_exc.stdout or str(pip_exc)
+            raise RuntimeError(f"Failed to install proxmoxer: {msg}") from pip_exc
+        from proxmoxer import ProxmoxAPI  # noqa: F401
+    from proxmoxer import ProxmoxAPI
+    return ProxmoxAPI
+
+
+def _parse_token(token_identifier: str) -> Tuple[str, str]:
+    identifier = token_identifier.strip()
+    if "!" not in identifier or "@" not in identifier:
+        raise ValueError("Expected API token in the form user@realm!tokenid")
+    user_part, token_name = identifier.split("!", 1)
+    user = user_part.strip()
+    token_name = token_name.strip()
+    if "@" not in user:
+        raise ValueError("API token missing user realm (user@realm)")
+    if not token_name:
+        raise ValueError("Token identifier missing token name")
+    return user, token_name
+
+
+def _save_config(data: Dict[str, Any]) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    tmp_path = CONFIG_PATH.with_suffix(".tmp")
+    tmp_path.write_text(json.dumps(data, indent=2), encoding="utf-8")
+    os.replace(tmp_path, CONFIG_PATH)
+    os.chmod(CONFIG_PATH, stat.S_IRUSR | stat.S_IWUSR)
+
+
+def _load_config() -> Dict[str, Any]:
+    if not CONFIG_PATH.exists():
+        return {}
+    try:
+        return json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+    except json.JSONDecodeError as exc:
+        logger.warning("Failed to parse Proxmox infra config: %s", exc)
+        return {}
+
+
+def _pick_node(client: Any) -> str:
+    nodes = client.nodes().get()
+    for node in nodes:
+        if node.get("node") == DEFAULT_NODE_NAME:
+            return DEFAULT_NODE_NAME
+    return nodes[0].get("node") if nodes else DEFAULT_NODE_NAME
+
+
+def _list_templates(client: Any, node: str, storages: Iterable[Dict[str, Any]]) -> List[str]:
+    templates: List[str] = []
+    for storage in storages:
+        storage_name = storage.get("storage")
+        if not storage_name:
+            continue
+        try:
+            items = client.nodes(node).storage(storage_name).content.get()
+        except Exception:
+            continue
+        for item in items:
+            if item.get("content") == "vztmpl" and item.get("volid"):
+                templates.append(item["volid"])
+    return templates
+
+
+def _pick_storage(storages: Iterable[Dict[str, Any]]) -> str:
+    candidates = [s for s in storages if "rootdir" in s.get("content", "") and s.get("avail", 0) > 0]
+    if not candidates:
+        candidates = [s for s in storages if "rootdir" in s.get("content", "")]
+    if not candidates:
+        return ""
+    candidates.sort(key=lambda entry: entry.get("avail", 0), reverse=True)
+    return candidates[0].get("storage", "")
+
+
+def _write_bridge_config(bridge: str) -> None:
+    begin = f"# Portacode INFRA BEGIN {bridge}"
+    end = f"# Portacode INFRA END {bridge}"
+    current = IFACES_PATH.read_text(encoding="utf-8") if IFACES_PATH.exists() else ""
+    if begin in current:
+        return
+    block = f"""
+{begin}
+auto {bridge}
+iface {bridge} inet static
+    address {SUBNET_CIDR}
+    bridge-ports none
+    bridge-stp off
+    bridge-fd 0
+{end}
+
+"""
+    mode = "a" if IFACES_PATH.exists() else "w"
+    with open(IFACES_PATH, mode, encoding="utf-8") as fh:
+        if current and not current.endswith("\n"):
+            fh.write("\n")
+        fh.write(block)
+
+
+def _ensure_sysctl() -> None:
+    SYSCTL_PATH.write_text("net.ipv4.ip_forward=1\n", encoding="utf-8")
+    _call_subprocess(["/sbin/sysctl", "-w", "net.ipv4.ip_forward=1"], check=True)
+
+
+def _write_units(bridge: str) -> None:
+    nat_name = f"portacode-{bridge}-nat.service"
+    dns_name = f"portacode-{bridge}-dnsmasq.service"
+    nat = UNIT_DIR / nat_name
+    dns = UNIT_DIR / dns_name
+    nat.write_text(f"""[Unit]
+Description=Portacode NAT for {bridge}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/iptables -t nat -A POSTROUTING -s {BRIDGE_IP}/24 -o vmbr0 -j MASQUERADE
+ExecStart=/usr/sbin/iptables -A FORWARD -i {bridge} -o vmbr0 -j ACCEPT
+ExecStart=/usr/sbin/iptables -A FORWARD -i vmbr0 -o {bridge} -m state --state RELATED,ESTABLISHED -j ACCEPT
+ExecStop=/usr/sbin/iptables -t nat -D POSTROUTING -s {BRIDGE_IP}/24 -o vmbr0 -j MASQUERADE
+ExecStop=/usr/sbin/iptables -D FORWARD -i {bridge} -o vmbr0 -j ACCEPT
+ExecStop=/usr/sbin/iptables -D FORWARD -i vmbr0 -o {bridge} -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+[Install]
+WantedBy=multi-user.target
+""", encoding="utf-8")
+    dns.write_text(f"""[Unit]
+Description=Portacode dnsmasq for {bridge}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/sbin/dnsmasq --keep-in-foreground --interface={bridge} --bind-interfaces --listen-address={BRIDGE_IP} \
+  --port=0 --dhcp-range={DHCP_START},{DHCP_END},12h \
+  --dhcp-option=option:router,{BRIDGE_IP} \
+  --dhcp-option=option:dns-server,{DNS_SERVER} \
+  --conf-file=/dev/null --pid-file=/run/portacode_dnsmasq.pid --dhcp-leasefile=/var/lib/misc/portacode_dnsmasq.leases
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+""", encoding="utf-8")
+
+
+def _ensure_bridge(bridge: str = DEFAULT_BRIDGE) -> Dict[str, Any]:
+    if os.geteuid() != 0:
+        raise PermissionError("Bridge setup requires root privileges")
+    if not shutil.which("dnsmasq"):
+        apt = shutil.which("apt-get")
+        if not apt:
+            raise RuntimeError("dnsmasq is missing and apt-get unavailable to install it")
+        _call_subprocess([apt, "update"], check=True)
+        _call_subprocess([apt, "install", "-y", "dnsmasq"], check=True)
+    _write_bridge_config(bridge)
+    _ensure_sysctl()
+    _write_units(bridge)
+    _call_subprocess(["/bin/systemctl", "daemon-reload"], check=True)
+    nat_service = f"portacode-{bridge}-nat.service"
+    dns_service = f"portacode-{bridge}-dnsmasq.service"
+    _call_subprocess(["/bin/systemctl", "enable", "--now", nat_service, dns_service], check=True)
+    _call_subprocess(["/sbin/ifup", bridge], check=False)
+    return {"applied": True, "bridge": bridge, "message": f"Bridge {bridge} configured"}
+
+
+def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
+    if not config:
+        return {"configured": False}
+    network = config.get("network", {})
+    return {
+        "configured": True,
+        "host": config.get("host"),
+        "node": config.get("node"),
+        "user": config.get("user"),
+        "token_name": config.get("token_name"),
+        "default_storage": config.get("default_storage"),
+        "templates": config.get("templates") or [],
+        "last_verified": config.get("last_verified"),
+        "network": {
+            "applied": network.get("applied", False),
+            "message": network.get("message"),
+            "bridge": network.get("bridge", DEFAULT_BRIDGE),
+        },
+    }
+
+
+def configure_infrastructure(token_identifier: str, token_value: str, verify_ssl: bool = False) -> Dict[str, Any]:
+    ProxmoxAPI = _ensure_proxmoxer()
+    user, token_name = _parse_token(token_identifier)
+    client = ProxmoxAPI(
+        DEFAULT_HOST,
+        user=user,
+        token_name=token_name,
+        token_value=token_value,
+        verify_ssl=verify_ssl,
+        timeout=30,
+    )
+    node = _pick_node(client)
+    status = client.nodes(node).status.get()
+    storages = client.nodes(node).storage.get()
+    default_storage = _pick_storage(storages)
+    templates = _list_templates(client, node, storages)
+    network: Dict[str, Any] = {}
+    try:
+        network = _ensure_bridge()
+    except PermissionError as exc:
+        network = {"applied": False, "message": str(exc), "bridge": DEFAULT_BRIDGE}
+        logger.warning("Bridge setup skipped: %s", exc)
+    except Exception as exc:  # pragma: no cover - best effort
+        network = {"applied": False, "message": str(exc), "bridge": DEFAULT_BRIDGE}
+        logger.warning("Bridge setup failed: %s", exc)
+    config = {
+        "host": DEFAULT_HOST,
+        "node": node,
+        "user": user,
+        "token_name": token_name,
+        "token_value": token_value,
+        "verify_ssl": verify_ssl,
+        "default_storage": default_storage,
+        "templates": templates,
+        "last_verified": datetime.utcnow().isoformat() + "Z",
+        "network": network,
+        "node_status": status,
+    }
+    _save_config(config)
+    snapshot = build_snapshot(config)
+    snapshot["node_status"] = status
+    return snapshot
+
+
+def get_infra_snapshot() -> Dict[str, Any]:
+    config = _load_config()
+    snapshot = build_snapshot(config)
+    if config.get("node_status"):
+        snapshot["node_status"] = config["node_status"]
+    return snapshot
+
+
+class ConfigureProxmoxInfraHandler(SyncHandler):
+    @property
+    def command_name(self) -> str:
+        return "setup_proxmox_infra"
+
+    def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
+        token_identifier = message.get("token_identifier")
+        token_value = message.get("token_value")
+        verify_ssl = bool(message.get("verify_ssl"))
+        if not token_identifier or not token_value:
+            raise ValueError("token_identifier and token_value are required")
+        snapshot = configure_infrastructure(token_identifier, token_value, verify_ssl=verify_ssl)
+        return {
+            "event": "proxmox_infra_configured",
+            "success": True,
+            "message": "Proxmox infrastructure configured",
+            "infra": snapshot,
+        }