raijin-server 0.3.3__py3-none-any.whl → 0.3.4__py3-none-any.whl

raijin_server/modules/grafana.py

@@ -393,9 +393,18 @@ def run(ctx: ExecutionContext) -> None:
 
     admin_password = typer.prompt("Senha admin do Grafana", default="admin")
     
+    # NodePort para acesso via VPN (recomendado)
+    enable_nodeport = typer.confirm(
+        "Habilitar NodePort para acesso via VPN?",
+        default=True
+    )
+    nodeport_port = 30030
+    if enable_nodeport:
+        nodeport_port = int(typer.prompt("Porta NodePort", default="30030"))
+    
     # Ingress público não é recomendado para ferramentas de observabilidade
     enable_ingress = typer.confirm(
-        "Habilitar ingress público? (NÃO recomendado - use VPN + port-forward)",
+        "Habilitar ingress público? (NÃO recomendado - use VPN + NodePort)",
         default=False
     )
     
@@ -439,9 +448,16 @@ def run(ctx: ExecutionContext) -> None:
             persistence_yaml += f"""
   storageClassName: {storage_class}"""
     
+    service_type = "NodePort" if enable_nodeport else "ClusterIP"
     values_yaml = f"""adminPassword: {admin_password}
 service:
-  type: ClusterIP
+  type: {service_type}"""
+    
+    if enable_nodeport:
+        values_yaml += f"""
+  nodePort: {nodeport_port}"""
+    
+    values_yaml += f"""
 ingress:
   enabled: {str(enable_ingress).lower()}"""
     
@@ -540,15 +556,18 @@ dashboards:
     
     if enable_ingress:
         typer.echo(f"\nAcesse: https://{ingress_host}")
-    else:
-        typer.secho("\n🔒 Acesso Seguro via VPN + Port-Forward:", fg=typer.colors.CYAN, bold=True)
+    elif enable_nodeport:
+        typer.secho("\n🔒 Acesso via VPN + NodePort:", fg=typer.colors.CYAN, bold=True)
         typer.echo("\n1. Configure VPN (se ainda não tiver):")
         typer.echo("   sudo raijin vpn")
         typer.echo("\n2. Conecte via WireGuard no seu Windows/Mac")
-        typer.echo("\n3. Faça port-forward local:")
-        typer.echo("   kubectl -n observability port-forward svc/grafana 3000:80")
-        typer.echo("\n4. Acesse no navegador:")
-        typer.echo("   http://localhost:3000")
+        typer.echo("\n3. Acesse no navegador (IP da VPN):")
+        typer.echo(f"   http://<VPN_SERVER_IP>:{nodeport_port}")
+        typer.echo("\n   Exemplo: http://10.8.0.1:{}".format(nodeport_port))
+    else:
+        typer.secho("\n🔒 Acesso via Port-Forward:", fg=typer.colors.CYAN, bold=True)
+        typer.echo("\n  kubectl -n observability port-forward svc/grafana 3000:80")
+        typer.echo("\n  Acesse: http://localhost:3000")
     
     typer.echo("\nUsuario: admin")
     typer.echo(f"Senha: {admin_password}")

raijin_server/modules/loki.py

@@ -103,6 +103,15 @@ def run(ctx: ExecutionContext) -> None:
 
     retention_hours = typer.prompt("Retencao de logs em horas", default="168")
     persistence_size = typer.prompt("Tamanho do storage", default="20Gi")
+    
+    # NodePort para acesso via VPN
+    enable_nodeport = typer.confirm(
+        "Habilitar NodePort para acesso via VPN?",
+        default=True
+    )
+    nodeport_port = 30310
+    if enable_nodeport:
+        nodeport_port = int(typer.prompt("Porta NodePort", default="30310"))
 
     node_name = _detect_node_name(ctx)
 
@@ -147,6 +156,15 @@ promtail:
       memory: 256Mi
 """
 
+    # Adiciona NodePort se habilitado
+    if enable_nodeport:
+        values_yaml += f"""
+loki:
+  service:
+    type: NodePort
+    nodePort: {nodeport_port}
+"""
+
     values_path = Path("/tmp/raijin-loki-values.yaml")
     write_file(values_path, values_yaml, ctx)
 
@@ -167,7 +185,13 @@ promtail:
         _wait_for_loki_ready(ctx)
 
     typer.secho("\n✓ Loki Stack instalado com sucesso.", fg=typer.colors.GREEN, bold=True)
-    typer.echo("\nPara acessar Loki via port-forward:")
-    typer.echo("  kubectl -n observability port-forward svc/loki 3100:3100")
-    typer.echo("\nPara verificar logs:")
-    typer.echo("  curl http://localhost:3100/ready")
+    
+    if enable_nodeport:
+        typer.secho("\n🔒 Acesso via VPN + NodePort:", fg=typer.colors.CYAN, bold=True)
+        typer.echo(f"\n  curl http://<VPN_SERVER_IP>:{nodeport_port}/ready")
+        typer.echo(f"\n  Exemplo: curl http://10.8.0.1:{nodeport_port}/ready")
+    else:
+        typer.echo("\nPara acessar Loki via port-forward:")
+        typer.echo("  kubectl -n observability port-forward svc/loki 3100:3100")
+        typer.echo("\nPara verificar logs:")
+        typer.echo("  curl http://localhost:3100/ready")

raijin_server/modules/minio.py

@@ -449,6 +449,18 @@ def run(ctx: ExecutionContext) -> None:
     
     enable_console = typer.confirm("Habilitar Console Web?", default=True)
     
+    # NodePort para acesso via VPN
+    enable_nodeport = typer.confirm(
+        "Habilitar NodePort para acesso via VPN?",
+        default=True
+    )
+    api_nodeport = 30900
+    console_nodeport = 30901
+    if enable_nodeport:
+        api_nodeport = int(typer.prompt("Porta NodePort para API S3", default="30900"))
+        if enable_console:
+            console_nodeport = int(typer.prompt("Porta NodePort para Console", default="30901"))
+    
     node_name = _detect_node_name(ctx)
     
     values = [
@@ -486,13 +498,27 @@ def run(ctx: ExecutionContext) -> None:
     if is_distributed:
         values.append(f"replicas={replicas}")
     
-    # Console
-    if enable_console:
+    # Service type (NodePort ou ClusterIP)
+    if enable_nodeport:
         values.extend([
-            "consoleService.type=ClusterIP",
-            "consoleIngress.enabled=false",
+            "service.type=NodePort",
+            f"service.nodePort={api_nodeport}",
         ])
     
+    # Console
+    if enable_console:
+        if enable_nodeport:
+            values.extend([
+                "consoleService.type=NodePort",
+                f"consoleService.nodePort={console_nodeport}",
+                "consoleIngress.enabled=false",
+            ])
+        else:
+            values.extend([
+                "consoleService.type=ClusterIP",
+                "consoleIngress.enabled=false",
+            ])
+    
     helm_upgrade_install(
         release="minio",
         chart="minio",
@@ -514,14 +540,21 @@ def run(ctx: ExecutionContext) -> None:
     typer.echo(f"  Root Password: {root_password}")
     
     if enable_console:
-        typer.secho("\n🔒 Acesso Seguro ao MinIO Console via VPN:", fg=typer.colors.CYAN, bold=True)
-        typer.echo("\n1. Configure VPN (se ainda não tiver):")
-        typer.echo("   sudo raijin vpn")
-        typer.echo("\n2. Conecte via WireGuard")
-        typer.echo("\n3. Faça port-forward:")
-        typer.echo("   kubectl -n minio port-forward svc/minio-console 9001:9001")
-        typer.echo("\n4. Acesse no navegador:")
-        typer.echo("   http://localhost:9001")
-    
-    typer.echo("\nPara acessar a API S3 (port-forward):")
-    typer.echo("  kubectl -n minio port-forward svc/minio 9000:9000")
+        if enable_nodeport:
+            typer.secho("\n🔒 Acesso ao MinIO Console via VPN:", fg=typer.colors.CYAN, bold=True)
+            typer.echo("\n1. Configure VPN (se ainda não tiver):")
+            typer.echo("   sudo raijin vpn")
+            typer.echo("\n2. Conecte via WireGuard")
+            typer.echo("\n3. Acesse no navegador (IP da VPN):")
+            typer.echo(f"   http://<VPN_SERVER_IP>:{console_nodeport}")
+            typer.echo("\n   Exemplo: http://10.8.0.1:{}".format(console_nodeport))
+        else:
+            typer.secho("\n🔒 Acesso via Port-Forward:", fg=typer.colors.CYAN, bold=True)
+            typer.echo("\n  kubectl -n minio port-forward svc/minio-console 9001:9001")
+            typer.echo("\n  Acesse: http://localhost:9001")
+    
+    if enable_nodeport:
+        typer.echo(f"\nAPI S3 via VPN: http://<VPN_SERVER_IP>:{api_nodeport}")
+    else:
+        typer.echo("\nPara acessar a API S3 (port-forward):")
+        typer.echo("  kubectl -n minio port-forward svc/minio 9000:9000")

raijin_server/modules/prometheus.py

@@ -428,6 +428,17 @@ def run(ctx: ExecutionContext) -> None:
     enable_persistence = typer.confirm(
         "Habilitar PVC para Prometheus e Alertmanager?", default=bool(default_sc)
     )
+    
+    # NodePort para acesso via VPN
+    enable_nodeport = typer.confirm(
+        "Habilitar NodePort para acesso via VPN?",
+        default=True
+    )
+    prometheus_nodeport = 30090
+    alertmanager_nodeport = 30093
+    if enable_nodeport:
+        prometheus_nodeport = int(typer.prompt("Porta NodePort para Prometheus", default="30090"))
+        alertmanager_nodeport = int(typer.prompt("Porta NodePort para Alertmanager", default="30093"))
 
     # Se habilitou PVC, garante que existe StorageClass disponivel
     if enable_persistence:
@@ -442,31 +453,42 @@ def run(ctx: ExecutionContext) -> None:
         "prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false",
         "prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false",
         "defaultRules.create=true",
-        # Tolerations for control-plane nodes
+        # Tolerations for control-plane nodes - Prometheus
         "prometheus.prometheusSpec.tolerations[0].key=node-role.kubernetes.io/control-plane",
         "prometheus.prometheusSpec.tolerations[0].operator=Exists",
         "prometheus.prometheusSpec.tolerations[0].effect=NoSchedule",
         "prometheus.prometheusSpec.tolerations[1].key=node-role.kubernetes.io/master",
         "prometheus.prometheusSpec.tolerations[1].operator=Exists",
         "prometheus.prometheusSpec.tolerations[1].effect=NoSchedule",
+        # Tolerations - Alertmanager
         "alertmanager.alertmanagerSpec.tolerations[0].key=node-role.kubernetes.io/control-plane",
         "alertmanager.alertmanagerSpec.tolerations[0].operator=Exists",
         "alertmanager.alertmanagerSpec.tolerations[0].effect=NoSchedule",
         "alertmanager.alertmanagerSpec.tolerations[1].key=node-role.kubernetes.io/master",
         "alertmanager.alertmanagerSpec.tolerations[1].operator=Exists",
         "alertmanager.alertmanagerSpec.tolerations[1].effect=NoSchedule",
+        # Tolerations - Prometheus Operator
         "prometheusOperator.tolerations[0].key=node-role.kubernetes.io/control-plane",
         "prometheusOperator.tolerations[0].operator=Exists",
         "prometheusOperator.tolerations[0].effect=NoSchedule",
         "prometheusOperator.tolerations[1].key=node-role.kubernetes.io/master",
         "prometheusOperator.tolerations[1].operator=Exists",
         "prometheusOperator.tolerations[1].effect=NoSchedule",
+        # Tolerations - Admission Webhooks (Jobs que criam/atualizam webhooks)
+        "prometheusOperator.admissionWebhooks.patch.tolerations[0].key=node-role.kubernetes.io/control-plane",
+        "prometheusOperator.admissionWebhooks.patch.tolerations[0].operator=Exists",
+        "prometheusOperator.admissionWebhooks.patch.tolerations[0].effect=NoSchedule",
+        "prometheusOperator.admissionWebhooks.patch.tolerations[1].key=node-role.kubernetes.io/master",
+        "prometheusOperator.admissionWebhooks.patch.tolerations[1].operator=Exists",
+        "prometheusOperator.admissionWebhooks.patch.tolerations[1].effect=NoSchedule",
+        # Tolerations - kube-state-metrics
         "kube-state-metrics.tolerations[0].key=node-role.kubernetes.io/control-plane",
         "kube-state-metrics.tolerations[0].operator=Exists",
         "kube-state-metrics.tolerations[0].effect=NoSchedule",
         "kube-state-metrics.tolerations[1].key=node-role.kubernetes.io/master",
         "kube-state-metrics.tolerations[1].operator=Exists",
         "kube-state-metrics.tolerations[1].effect=NoSchedule",
+        # Tolerations - node-exporter
         "prometheus-node-exporter.tolerations[0].key=node-role.kubernetes.io/control-plane",
         "prometheus-node-exporter.tolerations[0].operator=Exists",
         "prometheus-node-exporter.tolerations[0].effect=NoSchedule",
@@ -477,8 +499,15 @@ def run(ctx: ExecutionContext) -> None:
         f"prometheus.prometheusSpec.nodeSelector.kubernetes\\.io/hostname={node_name}",
         f"alertmanager.alertmanagerSpec.nodeSelector.kubernetes\\.io/hostname={node_name}",
         f"prometheusOperator.nodeSelector.kubernetes\\.io/hostname={node_name}",
-    ]
-
+    ]    
+    # NodePort para acesso via VPN
+    if enable_nodeport:
+        values.extend([
+            "prometheus.service.type=NodePort",
+            f"prometheus.service.nodePort={prometheus_nodeport}",
+            "alertmanager.service.type=NodePort",
+            f"alertmanager.service.nodePort={alertmanager_nodeport}",
+        ])
     extra_args = ["--wait", "--timeout", "10m", "--atomic"]
 
     chart_version = typer.prompt(
@@ -531,7 +560,18 @@ def run(ctx: ExecutionContext) -> None:
         _wait_for_prometheus_ready(ctx, namespace)
 
     typer.secho("\n✓ kube-prometheus-stack instalado com sucesso.", fg=typer.colors.GREEN, bold=True)
-    typer.echo("\nPara acessar Prometheus via port-forward:")
-    typer.echo(f"  kubectl -n {namespace} port-forward svc/kube-prometheus-stack-prometheus 9090:9090")
-    typer.echo("\nPara acessar Alertmanager via port-forward:")
-    typer.echo(f"  kubectl -n {namespace} port-forward svc/kube-prometheus-stack-alertmanager 9093:9093")
+    
+    if enable_nodeport:
+        typer.secho("\n🔒 Acesso via VPN + NodePort:", fg=typer.colors.CYAN, bold=True)
+        typer.echo("\n1. Configure VPN: sudo raijin vpn")
+        typer.echo("2. Conecte via WireGuard")
+        typer.echo("\nPrometheus:")
+        typer.echo(f"   http://<VPN_SERVER_IP>:{prometheus_nodeport}")
+        typer.echo("\nAlertmanager:")
+        typer.echo(f"   http://<VPN_SERVER_IP>:{alertmanager_nodeport}")
+        typer.echo("\nExemplo: http://10.8.0.1:{} (Prometheus)".format(prometheus_nodeport))
+    else:
+        typer.echo("\nPara acessar Prometheus via port-forward:")
+        typer.echo(f"  kubectl -n {namespace} port-forward svc/kube-prometheus-stack-prometheus 9090:9090")
+        typer.echo("\nPara acessar Alertmanager via port-forward:")
+        typer.echo(f"  kubectl -n {namespace} port-forward svc/kube-prometheus-stack-alertmanager 9093:9093")

{raijin_server-0.3.3.dist-info → raijin_server-0.3.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: raijin-server
-Version: 0.3.3
+Version: 0.3.4
 Summary: CLI para automacao de setup e hardening de servidores Ubuntu Server.
 Home-page: https://example.com/raijin-server
 Author: Equipe Raijin

{raijin_server-0.3.3.dist-info → raijin_server-0.3.4.dist-info}/RECORD

@@ -13,7 +13,7 @@ raijin_server/modules/cert_manager.py,sha256=XkFlXJjiP4_9It_PJaFcVYMS-QKTzzFAt83
 raijin_server/modules/essentials.py,sha256=2xUXCyCQtFGd2DnCKV81N1R6bEJqH8zaet8mLovtQ1I,689
 raijin_server/modules/firewall.py,sha256=h6AISqiZeTinVT7BjmQIS872qRAFZJLg7meqlth3cfw,757
 raijin_server/modules/full_install.py,sha256=xiKe2GLuZ97c4YdTmhP-kwDVuJJ9Xq3dlgcLlqSPeYM,15518
-raijin_server/modules/grafana.py,sha256=r4U6FJZ9OeTk4d3LDJT0NbN8wumB3REMtd3E3PRL_oE,17383
+raijin_server/modules/grafana.py,sha256=8YbKG-UL19lwTkH1-ZxpUetOZd-CLI4_kPsuZblNaWI,18080
 raijin_server/modules/hardening.py,sha256=4hz3ifkMhPlXa2n7gPxN0gitQgzALZ-073vuU3LM4RI,1616
 raijin_server/modules/harness.py,sha256=uWTxTVJlY_VB6xi4ftMtTSaIb96HA8WJQS-RbyxU45M,5391
 raijin_server/modules/internal_dns.py,sha256=Jynngq0TEEUo3jkAR4m8F1ihF10rkQuKHVP-gZYyDFY,15191
@@ -21,13 +21,13 @@ raijin_server/modules/istio.py,sha256=o0K5-Fw4LRs-kbAVgwzYxHzEt_aPFJG8suqOqvg274
 raijin_server/modules/kafka.py,sha256=n7ZpLPWv6sKBJhdBiPe7VgeDB24YiCIOWvOQkWwt03Y,5664
 raijin_server/modules/kong.py,sha256=_w1VIkND6zZuUwIl_CNDxbwWdzaEdXZEO_Iqc1ngPwQ,13654
 raijin_server/modules/kubernetes.py,sha256=9E6zV0zGQWZW92NVpxwYctpi-4JDmi6YzF3tKRI4HlU,13343
-raijin_server/modules/loki.py,sha256=aNiUpnOFppZMXoQwYhn7IoPMzwUz4aHi6pbiqj1PRjc,5022
+raijin_server/modules/loki.py,sha256=fRoXNghwffW6afE_a3sKMhjPJ9DIWhGMTTPM-ltNr2E,5766
 raijin_server/modules/metallb.py,sha256=uUuklc_RsQ-W2qDVRMQAxQm9HKGEqso444b1IwBpM6w,8554
-raijin_server/modules/minio.py,sha256=QbladHGefZBZ8l3f9D7t45nwfwVcuAgHi78E4Ygi300,17614
+raijin_server/modules/minio.py,sha256=ZoxugJvvuGLzViDfEzrVCRZUevoiFwcEy0PNyn0My4w,18918
 raijin_server/modules/network.py,sha256=QRlYdcryCCPAWG3QQ_W7ld9gJgETI7H8gwntOU7UqFE,4818
 raijin_server/modules/observability_dashboards.py,sha256=fVz0WEOQrUTF5rJ__Nu_onyBuwL_exFmysWMmg8AE9w,7319
 raijin_server/modules/observability_ingress.py,sha256=S4MtJKahiZ1qSx0P71P3IhKvq4RY-g01Z4IogW3c1hs,7045
-raijin_server/modules/prometheus.py,sha256=y5sy_mH1YeQWTOt5CNqqj5JD92-GMxbWQaaZKwx505U,19728
+raijin_server/modules/prometheus.py,sha256=lyhaqLIfMl0GtQ2b2Hre7_A47HrHBB5gspmnWtwXZ4Y,21880
 raijin_server/modules/sanitize.py,sha256=_RnWn1DUuNrzx3NnKEbMvf5iicgjiN_ubwT59e0rYWY,6040
 raijin_server/modules/secrets.py,sha256=d4j12feQL8m_4-hYN5FfboQHvBc75TFeGno3OzrXokE,9266
 raijin_server/modules/ssh_hardening.py,sha256=Zd0dlylUBr01SkrI1CS05-0DB9xIto5rWH1bUVs80ow,5422
@@ -40,9 +40,9 @@ raijin_server/scripts/checklist.sh,sha256=j6E0Kmk1EfjLvKK1VpCqzXJAXI_7Bm67LK4ndy
 raijin_server/scripts/install.sh,sha256=Y1ickbQ4siQ0NIPs6UgrqUr8WWy7U0LHmaTQbEgavoI,3949
 raijin_server/scripts/log_size_metric.sh,sha256=Iv4SsX8AuCYRou-klYn32mX41xB6j0xJGLBO6riw4rU,1208
 raijin_server/scripts/pre-deploy-check.sh,sha256=XqMo7IMIpwUHF17YEmU0-cVmTDMoCGMBFnmS39FidI4,4912
-raijin_server-0.3.3.dist-info/licenses/LICENSE,sha256=kJsMCjOiRZE0AQNtxWqBa32z9kMAaF4EUxyHj3hKaJo,1105
-raijin_server-0.3.3.dist-info/METADATA,sha256=dtdbYJo209BpoUkIJ5PswDw_1ik5tyQxfFupiiTNRZE,8829
-raijin_server-0.3.3.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-raijin_server-0.3.3.dist-info/entry_points.txt,sha256=3ZvxDX4pvcjkIRsXAJ69wIfVmKa78LKo-C3QhqN2KVM,56
-raijin_server-0.3.3.dist-info/top_level.txt,sha256=Yz1xneCRtsZOzbPIcTAcrSxd-1p80pohMXYAZ74dpok,14
-raijin_server-0.3.3.dist-info/RECORD,,
+raijin_server-0.3.4.dist-info/licenses/LICENSE,sha256=kJsMCjOiRZE0AQNtxWqBa32z9kMAaF4EUxyHj3hKaJo,1105
+raijin_server-0.3.4.dist-info/METADATA,sha256=pwLU_oSjSgh599AadAEAoyH-UOVQBs9mhQZef-Bcnzk,8829
+raijin_server-0.3.4.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+raijin_server-0.3.4.dist-info/entry_points.txt,sha256=3ZvxDX4pvcjkIRsXAJ69wIfVmKa78LKo-C3QhqN2KVM,56
+raijin_server-0.3.4.dist-info/top_level.txt,sha256=Yz1xneCRtsZOzbPIcTAcrSxd-1p80pohMXYAZ74dpok,14
+raijin_server-0.3.4.dist-info/RECORD,,