3 Commits

Include renames

Author	SHA1	Message	Date
menzeljandClaude Opus 5.5	d6cebb3371	Fix what a review of the whole app found, end to end (0.67.1) ... A pass over every feature against a real Docker daemon, then clicking through the UI as admin and read-only user, on a desktop and a phone. Security. /ws/deploy ran compose up for the read-only role; it is admin-only now. A container's inspect view, a stack's compose file (POSTGRES_PASSWORD: hunter2) and the viewer's .env tab no longer show credentials to that role. Git branch and URL values that git would read as options (-x, ext::) are refused. SFTP host keys are checked: pinned on first use or entered by hand (key line or SHA256 fingerprint), a different key is refused before the password is sent. A backup name from the API can no longer reach outside the destination folder. The file browser refuses to move or rename a browse root, as delete did. Docker lifecycle. Closing the deploy console released the stack lock while compose was still running and logged rc=None as success; deploys and updates are now background runs that hold the lock to the end, report the real exit code and can be re-attached to. Every closed log view left a `compose logs -f` behind. A dozen open tabs exhausted the default thread pool and hung the API; event and exec streams have their own threads. Auto-update and the update endpoint ignored failed pulls. A deleted git stack was recreated and started by the next webhook or poll; deleting a stack now drops its git source, auto-update policy and schedule entries. Deleting no longer walks into mounted shares, is refused while a backup runs, and removes the containers even when the compose file is broken. Stack folders compose has to normalise (Nextcloud -> nextcloud) work everywhere and group correctly on the volumes, networks and images pages. Detection. Host port conflicts read the container's own network namespace; /proc/1/net is read instead. Images referenced as docker.io/… were never update-checked; local builds no longer report "needs credentials". NVIDIA GPUs are read from the driver's procfs. The backup dialog's "path mismatch" warning came from mountinfo's filesystem-relative root and fired for any stacks folder on its own disk, ZFS dataset or btrfs subvolume; the host path now comes from Docker's mounts. Backups and destinations. The download ignored the folder/volume selection (axios sent binds[]). Restoring under a new name kept the old one. A report header past nginx's buffer turned a good backup into a 502. SFTP/S3 errors were bare 500s and "Test" did not try to write. A destination used by a schedule could be deleted. Backup file names are in the schedule's or the browser's time zone instead of UTC. Editor and converter. `docker run` conversion produced invalid compose for --network host, named volumes and -dit; --gpus and --mount were dropped; a multi-line command pasted into the one-line field became `image: ' '` (now a textarea, and flattened continuations are read). Validation failed for env_file stacks. The editor overwrote unsaved edits on every container event, lost them on a stray click (now asks), threw when closing the diff, and its helper panel listed the starter service "app" for every existing stack. Monaco is bundled instead of loaded from jsdelivr, so the editor works offline (and monaco-editor 0.57 drops the dompurify advisory; axios and react-router updated). UI. All times were two hours off: offset-less UTC from SQLite was read as local time, and "next run" always said "just now". A token refresh mid-session duplicated deploys, reset terminals and doubled logs. A backend restart (update, self-update) signed everyone out on reload; the page now waits for it. The editor was unusable on a phone, tables and tabs overflowed, dialog text was black on the dark theme, and the file browser opened on an error with the default roots. Read-only users get "Admin only" pages instead of 403s; in-use networks offer no delete; "Scan all" covers StackPilot's own stacks only and runs in the background instead of timing out at 600s. Deployment. nginx passes the port in Host (the OIDC redirect URI lost :5009) and keeps an outer proxy's X-Forwarded-Proto. The frontend waits for a healthy backend (healthcheck probes every 2s while starting). The frontend image builds with npm ci. Secrets are 0644 in a 0700 folder so non-root containers can read them; existing files are fixed at startup. The test suite no longer starts real containers on a host with Docker. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fx7gcuy8d6nPd95g43rGHu	2026-10-15 13:51:26 +02:00
menzeljandClaude Opus 5	052a85067b	Stop handing StackPilot's own settings to the stacks it deploys (0.66.3) ... docker compose ran with StackPilot's whole environment, and compose resolves ${VAR} from the calling environment before a stack's own .env. A stack whose compose file says SECRET_KEY: ${SECRET_KEY} therefore ran with StackPilot's SECRET_KEY instead of the one in its .env — and with its own again whenever it was started from a shell. AnsiblePilot hit exactly this: credentials saved under one key became unreadable under the other, twice. config.child_env() is os.environ minus every StackPilot setting (SECRET_KEY, DATA_DIR, STACKS_DIR, PORT, ...); the docker CLI and git subprocesses now get that instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-19 13:49:52 +02:00
menzeljandClaude Opus 5	95e03f031f	Add private registry credentials, and stop update checks lying (0.56.0) ... This was on the gap list as a missing feature, but it was a bug first. The update checker asks the registry for a tag's digest over HTTP itself, and could only do it anonymously. A private repository answers 401, remote_digest returned None, and None already meant "could not reach registry" — so a private image was indistinguishable from a network blip. The Images page showed nothing and a stack pinned to a six-month-old image looked up to date indefinitely. So AuthRequired is now its own exception, separate from unreachable, and the error names the registry and which of the two problems it is: "ghcr.io needs credentials" when there are none, "ghcr.io rejected the stored credentials" when there are and they are wrong. Those are different fixes, and the message should say which one you need. The plain unreachable message survives unchanged, with a test pinning it, because not every failure is an auth failure. Two consumers need the credentials and they need them in completely different shapes, which is why this is its own service rather than a field on something else. StackPilot's own checker wants (user, password) inside async code that has no database session, so the rows are mirrored into an in-memory cache that reload() refills on startup and after every write. The Docker CLI wants a config.json, so reload() writes one into ${DATA_DIR}/docker and compose runs with DOCKER_CONFIG pointed at it. Generating it from the database every time is what makes deletion real: removing a registry in the UI revokes the CLI's login instead of leaving a stale one in ~/.docker. Host normalization is the join that makes any of it work, and it is easy to underestimate. parse_ref only ever produces registry-1.docker.io, nobody types that, and the CLI wants the whole thing under https://index.docker.io/v1/ — three spellings of one registry across three layers. canonical_host settles on what parse_ref produces, the config writer translates on the way out, and a bare nginx:alpine finds credentials entered as "docker.io". Verified end to end: typed as the v1 URL, stored as registry-1.docker.io, written as the v1 URL. The password is encrypted at rest with the same key as backup destinations and never leaves the server, not even masked — the API returns has_password, which is all the form needs to offer "leave blank to keep". A row that cannot be decrypted after a SECRET_KEY change is skipped with a warning rather than taking every other registry down with it. Everything here is admin-only including the reads, because even masked the rows say which registries this install talks to and under what account. The Test button asks the registry rather than validating a string, following the Bearer challenge with credentials attached the way a real client does. Only an outright 401 counts as wrong credentials; anything else means reachable and talking, which is as much as a credentials check can honestly claim. Checked against the live Docker Hub token endpoint with deliberately wrong credentials. 33 tests: the normalization table, the cache, the generated config.json down to its 0600 mode and the Docker Hub key, encryption at rest, that no password field appears in any response, and the 401-is-reported behaviour that started this. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-18 00:42:27 +02:00