Phase 2: Volume Wizard, GPU & device passthrough (0.2.0)

Backend:
- gpu_service: detect NVIDIA (nvidia-smi) + AMD/Intel (/dev/dri, sysfs);
  inject helpers (nvidia deploy.reservations, /dev/dri + groups + LIBVA)
- volume_service: list/orphaned/prune volumes; NFS/SMB/named/bind/tmpfs
  YAML generation (generate-yaml)
- device_service: USB/TTY/DRI detection + sandboxed host path browser
- compose_edit_service: server-side merge of volume/gpu/device fragments
- routers: volumes (+host paths), editor (services/add-volume/set-gpu/
  add-device/remove-device/set-privileged), system gpus+devices
- compose: bind-mount /dev:ro for detection

Frontend:
- split-pane StackEditor with helper panel (service picker + tabs)
- VolumeWizard (bind/named/nfs/smb/tmpfs) + HostPathBrowser
- GPUSelector, DevicePanel; api clients for volumes/editor/system

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/editor.py

@@ -0,0 +1,76 @@
+"""Editor helper endpoints — merge wizard fragments into compose YAML."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+
+from auth import get_current_user
+from models.user import User
+from services import compose_edit_service as edit
+
+router = APIRouter(prefix="/api/editor", tags=["editor"])
+
+
+class AddVolumeBody(BaseModel):
+    yaml: str
+    service: str
+    spec: dict
+
+
+class SetGpuBody(BaseModel):
+    yaml: str
+    service: str
+    config: dict
+
+
+class DeviceBody(BaseModel):
+    yaml: str
+    service: str
+    host_path: str
+    target: str | None = None
+
+
+class PrivilegedBody(BaseModel):
+    yaml: str
+    service: str
+    value: bool
+
+
+def _run(fn, *args) -> dict:
+    try:
+        return {"yaml": fn(*args)}
+    except edit.EditError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
+@router.post("/services")
+def services(body: dict, _user: User = Depends(get_current_user)) -> dict:
+    try:
+        return {"services": edit.list_services(body.get("yaml", ""))}
+    except edit.EditError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
+@router.post("/add-volume")
+def add_volume(body: AddVolumeBody, _user: User = Depends(get_current_user)) -> dict:
+    return _run(edit.add_volume, body.yaml, body.service, body.spec)
+
+
+@router.post("/set-gpu")
+def set_gpu(body: SetGpuBody, _user: User = Depends(get_current_user)) -> dict:
+    return _run(edit.set_gpu, body.yaml, body.service, body.config)
+
+
+@router.post("/add-device")
+def add_device(body: DeviceBody, _user: User = Depends(get_current_user)) -> dict:
+    return _run(edit.add_device, body.yaml, body.service, body.host_path, body.target)
+
+
+@router.post("/remove-device")
+def remove_device(body: DeviceBody, _user: User = Depends(get_current_user)) -> dict:
+    return _run(edit.remove_device, body.yaml, body.service, body.host_path)
+
+
+@router.post("/set-privileged")
+def set_privileged(body: PrivilegedBody, _user: User = Depends(get_current_user)) -> dict:
+    return _run(edit.set_privileged, body.yaml, body.service, body.value)

backend/routers/system.py

@@ -10,6 +10,7 @@ from auth import get_current_user
 from config import settings
 from docker_client import DockerError, get_client, safe_call
 from models.user import User
+from services import device_service, gpu_service
 
 router = APIRouter(prefix="/api/system", tags=["system"])
 
@@ -88,5 +89,17 @@ def system_info(_user: User = Depends(get_current_user)) -> dict:
         "uptime_seconds": _uptime(),
         "containers_running": containers_running,
         "containers_total": containers_total,
-        "gpus": [],  # populated in Phase 2
+        "gpus": [g.to_dict() for g in gpu_service.detect_gpus()],
     }
+
+
+@router.get("/gpus")
+def gpus(_user: User = Depends(get_current_user)) -> list[dict]:
+    """Re-detect GPUs live."""
+    return [g.to_dict() for g in gpu_service.detect_gpus()]
+
+
+@router.get("/devices")
+def devices(_user: User = Depends(get_current_user)) -> dict:
+    """List host USB / serial / DRI devices for passthrough."""
+    return device_service.detect_devices()

backend/routers/volumes.py

@@ -0,0 +1,97 @@
+"""Volume management, NFS/SMB YAML generation, and host path browser."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from sqlmodel import Session
+
+from auth import get_current_user, require_admin
+from database import get_session
+from models.user import User
+from services import audit_service, device_service, volume_service
+
+router = APIRouter(tags=["volumes"])
+
+
+def _ip(request: Request) -> str:
+    return request.client.host if request.client else "unknown"
+
+
+# --------------------------------------------------------------------------- #
+# Volumes
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/api/volumes")
+def list_volumes(_user: User = Depends(get_current_user)) -> list[dict]:
+    return volume_service.list_volumes()
+
+
+@router.get("/api/volumes/orphaned")
+def orphaned(_user: User = Depends(get_current_user)) -> list[dict]:
+    return volume_service.orphaned_volumes()
+
+
+@router.delete("/api/volumes/{name}")
+def delete_volume(
+    name: str,
+    request: Request,
+    force: bool = Query(False),
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    vols = {v["name"]: v for v in volume_service.list_volumes()}
+    if name in vols and vols[name]["in_use"] and not force:
+        raise HTTPException(
+            status_code=409,
+            detail={
+                "error": "volume_in_use",
+                "detail": f"Volume '{name}' is used by: {', '.join(vols[name]['used_by'])}",
+            },
+        )
+    volume_service.remove_volume(name, force=force)
+    audit_service.record(
+        session, user=user.username, action="volume.delete", target=name, ip=_ip(request)
+    )
+    return {"ok": True}
+
+
+@router.post("/api/volumes/prune")
+def prune(
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    result = volume_service.prune_volumes()
+    audit_service.record(
+        session, user=user.username, action="volume.prune", target="*",
+        detail=str(result.get("VolumesDeleted")), ip=_ip(request),
+    )
+    return result
+
+
+@router.post("/api/volumes/generate-yaml")
+def generate_yaml(
+    spec: dict,
+    _user: User = Depends(get_current_user),
+) -> dict:
+    try:
+        return {"yaml": volume_service.generate_yaml(spec)}
+    except (KeyError, ValueError) as exc:
+        raise HTTPException(status_code=400, detail=f"Invalid volume spec: {exc}") from exc
+
+
+# --------------------------------------------------------------------------- #
+# Host path browser
+# --------------------------------------------------------------------------- #
+
+
+@router.get("/api/host/paths")
+def host_paths(
+    path: str = Query("/"),
+    show_hidden: bool = Query(False),
+    _user: User = Depends(get_current_user),
+) -> dict:
+    try:
+        return device_service.browse(path, show_hidden)
+    except device_service.BrowseError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc