saltext-opnsense 0.1.1.dev0__py3-none-any.whl

saltext/opnsense/__init__.py

@@ -0,0 +1,6 @@
+try:
+    from saltext.opnsense.version._version import __version__
+except Exception:
+    __version__ = "0.0.0.dev"
+
+__all__ = ["__version__"]

saltext/opnsense/grains/opnsense.py

@@ -0,0 +1,46 @@
+import logging
+
+log = logging.getLogger(__name__)
+
+__virtualname__ = "opnsense"
+
+
+def __virtual__():
+    if "__proxy__" not in globals():
+        return (False, "opnsense grains only run on proxy minions")
+    return __virtualname__
+
+
+def opnsense_grains():
+    grains = {}
+    try:
+        if "__salt__" in globals() and "opnsense.ping" in __salt__:
+            try:
+                if not __salt__["opnsense.ping"]():
+                    return grains
+            except Exception:
+                pass
+            try:
+                spec = __salt__["opnsense.spec"]()
+                if isinstance(spec, dict):
+                    mods = spec.get("modules", {})
+                    meta = spec.get("meta", {})
+                    grains["opnsense_api_modules"] = list(mods.keys()) if isinstance(mods, dict) else list(mods)
+                    grains["opnsense_spec_version"] = meta.get("core_ref", "25.7")
+            except Exception:
+                pass
+            try:
+                fw_status = __salt__["opnsense.call"]("core", "firmware", "status", data={}, method="POST")
+                if isinstance(fw_status, dict):
+                    grains["opnsense_version"] = fw_status.get("product_version") or fw_status.get("product_version_string")
+            except Exception:
+                pass
+            try:
+                alias_res = __salt__["opnsense.search"]("unbound", "settings", "host_alias", row_count=1)
+                if isinstance(alias_res, dict):
+                    grains["opnsense_unbound_alias_count"] = alias_res.get("total", 0)
+            except Exception:
+                pass
+    except Exception as exc:
+        log.debug("opnsense grains failed: %s", exc)
+    return grains

saltext/opnsense/modules/acmeclient.py

@@ -0,0 +1,171 @@
+import logging
+
+log = logging.getLogger(__name__)
+
+__virtualname__ = "opnsense_acmeclient"
+
+
+def __virtual__():
+    if "opnsense.search" in __salt__ or "opnsense.call" in __salt__:
+        return __virtualname__
+    return (False, "opnsense execution module not loaded")
+
+
+def _search(controller, type_name, search_phrase="", row_count=-1):
+    try:
+        fn = __salt__["opnsense.search"]
+        res = fn("acmeclient", controller, type_name, search_phrase=search_phrase, row_count=row_count)
+        if isinstance(res, dict):
+            return res.get("rows", [])
+        return []
+    except Exception as exc:
+        log.debug("acmeclient search %s/%s failed: %s", controller, type_name, exc)
+        return []
+
+
+def _sorted_dict(d):
+    return dict(sorted(d.items()))
+
+
+def list_accounts():
+    rows = _search("accounts", "account", row_count=-1)
+    result = {}
+    for r in rows:
+        name = r.get("name") or r.get("uuid") or ""
+        if not name:
+            continue
+        result[name] = {
+            "name": name,
+            "uuid": r.get("uuid"),
+            "email": r.get("email") or r.get("contact") or "",
+            "ca": r.get("ca") or r.get("directoryUrl") or "",
+            "enabled": r.get("enabled") in ("1", True, 1, None),
+            "raw": r,
+        }
+    return _sorted_dict(result)
+
+
+def list_accounts_pretty():
+    data = list_accounts()
+    lines = []
+    for name in sorted(data):
+        info = data[name]
+        lines.append(f"{name} [{info.get('ca')}] uuid={info.get('uuid','')[:8]}")
+    return lines
+
+
+def list_validations():
+    rows = _search("validations", "validation", row_count=-1)
+    result = {}
+    for r in rows:
+        name = r.get("name") or r.get("uuid") or ""
+        if not name:
+            continue
+        result[name] = {
+            "name": name,
+            "uuid": r.get("uuid"),
+            "method": r.get("method") or r.get("validation_type") or "",
+            "enabled": r.get("enabled") in ("1", True, 1, None),
+            "raw": r,
+        }
+    return _sorted_dict(result)
+
+
+def list_validations_pretty():
+    data = list_validations()
+    lines = []
+    for name in sorted(data):
+        info = data[name]
+        lines.append(f"{name} method={info.get('method')} uuid={info.get('uuid','')[:8]}")
+    return lines
+
+
+def list_actions():
+    rows = _search("actions", "action", row_count=-1)
+    result = {}
+    for r in rows:
+        name = r.get("name") or r.get("uuid") or ""
+        if not name:
+            continue
+        result[name] = {
+            "name": name,
+            "uuid": r.get("uuid"),
+            "type": r.get("type") or r.get("action_type") or "",
+            "enabled": r.get("enabled") in ("1", True, 1, None),
+            "raw": r,
+        }
+    return _sorted_dict(result)
+
+
+def list_actions_pretty():
+    data = list_actions()
+    lines = []
+    for name in sorted(data):
+        info = data[name]
+        lines.append(f"{name} type={info.get('type')} uuid={info.get('uuid','')[:8]}")
+    return lines
+
+
+def list_certificates():
+    rows = _search("certificates", "certificate", row_count=-1)
+    result = {}
+    for r in rows:
+        name = r.get("name") or r.get("common_name") or r.get("uuid") or ""
+        if not name:
+            continue
+        result[name] = {
+            "name": name,
+            "uuid": r.get("uuid"),
+            "common_name": r.get("common_name") or name,
+            "status": r.get("status") or r.get("last_status") or "",
+            "account": r.get("account") or "",
+            "enabled": r.get("enabled") in ("1", True, 1, None),
+            "raw": r,
+        }
+    return _sorted_dict(result)
+
+
+def list_certificates_simple():
+    return {k: v["status"] for k, v in list_certificates().items()}
+
+
+def list_certificates_pretty():
+    data = list_certificates()
+    lines = []
+    for name in sorted(data):
+        info = data[name]
+        lines.append(f"{name} status={info.get('status')} uuid={info.get('uuid','')[:8]}")
+    return lines
+
+
+def list_settings():
+    try:
+        res = __salt__["opnsense.call"]("acmeclient", "settings", "get", method="GET")
+        return res
+    except Exception as exc:
+        log.debug("acme settings get failed: %s", exc)
+        return {}
+
+
+def get_account(name):
+    accounts = list_accounts()
+    return accounts.get(name)
+
+
+def get_validation(name):
+    vals = list_validations()
+    return vals.get(name)
+
+
+def get_certificate(name):
+    certs = list_certificates()
+    return certs.get(name)
+
+
+def service_status():
+    try:
+        res = __salt__["opnsense.call"]("acmeclient", "service", "status", method="POST", data={})
+        return res
+    except Exception as exc:
+        log.debug("acme service status failed: %s", exc)
+        return {"error": str(exc)}

saltext/opnsense/modules/bind.py

@@ -0,0 +1,229 @@
+import logging
+
+log = logging.getLogger(__name__)
+
+__virtualname__ = "opnsense_bind"
+
+
+def __virtual__():
+    if "opnsense.search" in __salt__ or "opnsense.call" in __salt__:
+        return __virtualname__
+    return (False, "opnsense execution module not loaded")
+
+
+def _search(controller, type_name, search_phrase="", row_count=-1):
+    try:
+        fn = __salt__["opnsense.search"]
+        res = fn("bind", controller, type_name, search_phrase=search_phrase, row_count=row_count)
+        if isinstance(res, dict):
+            return res.get("rows", [])
+        return []
+    except Exception as exc:
+        log.debug("bind search %s/%s failed: %s", controller, type_name, exc)
+        return []
+
+
+def _search_domain_all():
+    all_rows = []
+    for c in ("domain",):
+        for t in ("primary_domain", "secondary_domain", "forward_domain", "master_domain", "slave_domain", "domain"):
+            try:
+                rows = _search(c, t, row_count=-1)
+                if rows:
+                    for r in rows:
+                        r["_bind_type"] = t
+                        r["_bind_controller"] = c
+                    all_rows.extend(rows)
+            except Exception:
+                continue
+    dedup = {}
+    for r in all_rows:
+        uuid = r.get("uuid")
+        if uuid and uuid not in dedup:
+            dedup[uuid] = r
+        elif not uuid:
+            key = r.get("domainname") or r.get("domain") or r.get("name")
+            if key and key not in dedup:
+                dedup[key] = r
+    return list(dedup.values())
+
+
+def list_domains(domain_type=None):
+    rows = _search_domain_all()
+    result = {}
+    for r in rows:
+        dname = r.get("domainname") or r.get("domain") or r.get("name") or ""
+        if not dname:
+            continue
+        btype = r.get("_bind_type", "primary_domain")
+        if domain_type and domain_type not in btype and domain_type != "all":
+            if domain_type == "primary" and "primary" not in btype:
+                continue
+            if domain_type == "secondary" and "secondary" not in btype:
+                continue
+            if domain_type == "forward" and "forward" not in btype:
+                continue
+        result[dname] = {
+            "domainname": dname,
+            "type": btype,
+            "uuid": r.get("uuid"),
+            "description": r.get("description", ""),
+            "enabled": r.get("enabled") in ("1", True, 1, None),
+            "raw": r,
+        }
+    return dict(sorted(result.items()))
+
+
+def list_domains_simple():
+    return {k: v["uuid"] for k, v in list_domains().items()}
+
+
+def list_domains_pretty(domain_type=None):
+    data = list_domains(domain_type=domain_type)
+    lines = []
+    for dname in sorted(data):
+        info = data[dname]
+        en = "enabled" if info.get("enabled") else "disabled"
+        lines.append(f"{dname} [{info.get('type')}] ({en}) {info.get('uuid','')[:8]}")
+    return lines
+
+
+def _resolve_domain_uuid(domain):
+    if not domain:
+        return None
+    try:
+        from saltext.opnsense.utils.common import is_uuid
+    except Exception:
+        import re
+
+        def is_uuid(v):
+            return bool(re.match(r"^[0-9a-fA-F]{8}-", str(v)))
+
+    if is_uuid(domain):
+        return domain
+    domains = list_domains()
+    if domain in domains:
+        return domains[domain]["uuid"]
+    for rows in [_search_domain_all()]:
+        for r in rows:
+            if r.get("domainname") == domain:
+                return r.get("uuid")
+    return None
+
+
+def list_records(domain=None, domain_filter=None, record_type=None, name=None):
+    if domain is None and domain_filter is not None:
+        domain = domain_filter
+    rows = _search("record", "record", row_count=-1)
+    domain_uuid_filter = None
+    domain_name_filter = None
+    if domain:
+        domain_uuid_filter = _resolve_domain_uuid(domain)
+        if domain_uuid_filter:
+            domains_map = {v["uuid"]: k for k, v in list_domains().items() if v.get("uuid")}
+            domain_name_filter = domains_map.get(domain_uuid_filter, domain)
+            if domain_name_filter is None or domain_name_filter == domain_uuid_filter:
+                domain_name_filter = domain if "." in str(domain) else None
+        else:
+            domain_uuid_filter = domain if domain and len(domain) > 20 else None
+            domain_name_filter = domain if "." in str(domain) else None
+
+    result = {}
+    for r in rows:
+        r_domain = r.get("domain") or r.get("domain_uuid") or ""
+        r_name = r.get("name") or ""
+        r_type = r.get("type") or ""
+        r_value = r.get("value") or r.get("server") or ""
+
+        if domain_uuid_filter:
+            if r_domain != domain_uuid_filter and r_domain != domain:
+                if domain_uuid_filter and r_domain != domain_uuid_filter:
+                    continue
+        if record_type and r_type != record_type:
+            continue
+        if name and r_name != name:
+            continue
+
+        key = f"{r_name}.{domain_name_filter or r_domain}" if r_name else r.get("uuid", "")
+        if not key:
+            key = r.get("uuid", "")
+
+        result[key] = {
+            "name": r_name,
+            "domain": domain_name_filter or r_domain,
+            "domain_uuid": r_domain,
+            "type": r_type,
+            "value": r_value,
+            "ttl": r.get("ttl", ""),
+            "uuid": r.get("uuid"),
+            "description": r.get("description", ""),
+            "enabled": r.get("enabled") in ("1", True, 1, None),
+            "raw": r,
+        }
+    return dict(sorted(result.items()))
+
+
+def list_records_simple(domain=None, domain_filter=None):
+    if domain is None and domain_filter is not None:
+        domain = domain_filter
+    return list_records(domain=domain)
+
+
+def list_records_pretty(domain=None, domain_filter=None, record_type=None):
+    if domain is None and domain_filter is not None:
+        domain = domain_filter
+    data = list_records(domain=domain, record_type=record_type)
+    lines = []
+    for key in sorted(data):
+        info = data[key]
+        lines.append(f"{info.get('name')} {info.get('type')} {info.get('value')}")
+    return lines
+
+
+def list_records_as_strings(domain=None, domain_filter=None):
+    return list_records_pretty(domain=domain, domain_filter=domain_filter)
+
+
+def list_acls():
+    rows = _search("acl", "acl", row_count=-1)
+    result = {}
+    for r in rows:
+        name = r.get("name") or r.get("uuid") or ""
+        result[name] = {
+            "name": name,
+            "uuid": r.get("uuid"),
+            "description": r.get("description", ""),
+            "enabled": r.get("enabled") in ("1", True, 1),
+            "raw": r,
+        }
+    return dict(sorted(result.items()))
+
+
+def list_acls_pretty():
+    data = list_acls()
+    lines = []
+    for name in sorted(data):
+        info = data[name]
+        lines.append(f"{name} ({'enabled' if info.get('enabled') else 'disabled'}) {info.get('uuid','')[:8]}")
+    return lines
+
+
+def get_domain(name):
+    domains = list_domains()
+    return domains.get(name)
+
+
+def get_record(name, domain=None):
+    records = list_records(domain=domain, name=name)
+    for k, v in records.items():
+        if v["name"] == name:
+            return v
+    return None
+
+
+def resolve_domain(name_or_uuid):
+    return _resolve_domain_uuid(name_or_uuid)
+
+
+def get_domain_uuid(name_or_uuid):
+    return _resolve_domain_uuid(name_or_uuid)

saltext/opnsense/modules/dns.py

@@ -0,0 +1,181 @@
+import logging
+
+log = logging.getLogger(__name__)
+
+__virtualname__ = "opnsense_dns"
+
+
+def __virtual__():
+    if "opnsense.search" in __salt__ or "opnsense_unbound.list_aliases" in __salt__:
+        return __virtualname__
+    if "opnsense.search" in __salt__:
+        return __virtualname__
+    return (False, "opnsense execution module not loaded")
+
+
+def _pillar_aliases():
+    try:
+        pillar = __pillar__ or {}
+        op = pillar.get("opnsense", {}) if isinstance(pillar, dict) else {}
+        return op.get("aliases", {}), op.get("purge_aliases", {}), op.get("cluster_parent", {})
+    except Exception:
+        return {}, {}, {}
+
+
+def list_aliases(domain=None, parent=None):
+    """
+    List DNS aliases as dict fqdn -> info.
+
+    Delightful alternative to raw search. Returns sorted dict keyed by FQDN.
+
+    Example:
+        salt opnsense-router opnsense_dns.list_aliases
+        salt opnsense-router opnsense_dns.list_aliases domain=example.com
+        salt opnsense-router opnsense_dns.list_aliases parent=cluster.example.com
+    """
+    try:
+        fn = __salt__["opnsense_unbound.list_aliases"]
+        return fn(domain=domain, parent=parent)
+    except Exception:
+        try:
+            fn = __salt__["opnsense.search"]
+            res = fn("unbound", "settings", "host_alias", row_count=-1)
+            rows = res.get("rows", []) if isinstance(res, dict) else []
+            result = {}
+            for r in rows:
+                hn = r.get("hostname")
+                dom = r.get("domain")
+                if not hn or not dom:
+                    continue
+                if domain and dom != domain:
+                    continue
+                fqdn = f"{hn}.{dom}"
+                result[fqdn] = r.get("host")
+            return result
+        except Exception as exc:
+            log.debug("dns list_aliases failed: %s", exc)
+            return {}
+
+
+def list_aliases_detailed(domain=None, parent=None):
+    """
+    Alias to list_aliases returning full info dict.
+
+    Example:
+        salt opnsense-router opnsense_dns.list_aliases_detailed
+    """
+    try:
+        fn = __salt__["opnsense_unbound.list_aliases"]
+        return fn(domain=domain, parent=parent)
+    except Exception:
+        return list_aliases(domain=domain, parent=parent)
+
+
+def list_aliases_simple(domain=None, parent=None):
+    """
+    Simple mapping fqdn -> parent FQDN. Great for CLI --out=table.
+
+    Example:
+        salt opnsense-router opnsense_dns.list_aliases_simple --out=table
+        salt opnsense-router opnsense_dns.list_aliases_simple domain=example.com
+    """
+    try:
+        fn = __salt__["opnsense_unbound.list_aliases_simple"]
+        return fn(domain=domain, parent=parent)
+    except Exception:
+        try:
+            fn = __salt__["opnsense_unbound.list_aliases"]
+            data = fn(domain=domain, parent=parent)
+            return {fqdn: info.get("parent") if isinstance(info, dict) else info for fqdn, info in data.items()}
+        except Exception:
+            data = list_aliases(domain=domain, parent=parent)
+            return {fqdn: info.get("parent") if isinstance(info, dict) else str(info) for fqdn, info in data.items()}
+
+
+def list_aliases_pretty(domain=None, parent=None):
+    """
+    Pretty list of "fqdn -> parent (enabled)" for human output. Works with --out=table.
+
+    Example:
+        salt opnsense-router opnsense_dns.list_aliases_pretty --out=table
+        salt opnsense-router opnsense_dns.list_aliases_pretty domain=example.com --out=table
+    """
+    try:
+        fn = __salt__["opnsense_unbound.list_aliases_pretty"]
+        return fn(domain=domain, parent=parent)
+    except Exception:
+        pass
+    try:
+        fn = __salt__["opnsense_unbound.list_aliases"]
+        data = fn(domain=domain, parent=parent)
+    except Exception:
+        data = list_aliases(domain=domain, parent=parent)
+    lines = []
+    for fqdn in sorted(data):
+        info = data[fqdn]
+        if isinstance(info, dict):
+            parent_f = info.get("parent", "")
+            en = "enabled" if info.get("enabled") else "disabled" if "enabled" in info else "enabled"
+            lines.append(f"{fqdn} -> {parent_f} ({en})")
+        else:
+            lines.append(f"{fqdn} -> {info}")
+    return lines
+
+
+def list_aliases_simple_pretty(domain=None, parent=None):
+    """
+    Alias to list_aliases_pretty for backward compat.
+    """
+    return list_aliases_pretty(domain=domain, parent=parent)
+
+
+def list_pillar_aliases():
+    aliases, purge, parent = _pillar_aliases()
+    return {
+        "aliases": aliases,
+        "purge_aliases": purge,
+        "cluster_parent": parent,
+    }
+
+
+def resolve_parent(parent=None):
+    if parent:
+        try:
+            fn = __salt__["opnsense_unbound.resolve_parent"]
+            return fn(parent)
+        except Exception:
+            return None
+    _, _, cp = _pillar_aliases()
+    if isinstance(cp, dict) and cp.get("uuid"):
+        return cp["uuid"]
+    if isinstance(cp, dict) and cp.get("hostname"):
+        try:
+            fn = __salt__["opnsense_unbound.resolve_parent"]
+            fqdn = f"{cp['hostname']}.{cp.get('domain','example.com')}"
+            return fn(fqdn)
+        except Exception:
+            return None
+    return None
+
+
+def managed_preview(parent=None, aliases=None, purge=None):
+    aliases_p, purge_p, parent_p = _pillar_aliases()
+    if aliases is None:
+        aliases = aliases_p
+    if purge is None:
+        purge = purge_p
+    if parent is None:
+        if isinstance(parent_p, dict) and parent_p.get("hostname"):
+            parent = f"{parent_p['hostname']}.{parent_p.get('domain','example.com')}"
+        else:
+            parent = parent_p
+    live = list_aliases()
+    desired_fqdns = {f"{h}.{dom}" for dom, hosts in (aliases or {}).items() for h in (hosts or [])}
+    purge_fqdns = {f"{h}.{dom}" for dom, hosts in (purge or {}).items() for h in (hosts or [])}
+    return {
+        "parent": parent,
+        "desired": sorted(desired_fqdns),
+        "purge": sorted(purge_fqdns),
+        "live_count": len(live),
+        "live": live,
+    }