menzeljandClaude Opus 5
51d1998307
StackPilot now manages exactly one Docker host: the one it runs on. The
stackpilot-agent sidecar and everything that proxied to it are gone — 4721
lines deleted against 657 added.
Deleted outright: agent/ (image, compose, env), agent_app.py, models/agent.py,
routers/agents.py (1200 lines), services/agent_service.py, the agent API client,
RemoteStackDetail, the host components and AgentStacksSection. That removes 57
API routes and the three /ws/agent-* proxies.
Threaded out everywhere else, which was the bulk of the work. Every API module
carried an optional agentId that switched the base path; every page that listed
Docker objects rendered one section per host behind a HostHeader; Files had a
host switcher; the New Stack editor and the template dialog had host selectors;
schedules, auto-update policies and stack summaries carried agent_id. All of it
is gone, and the typechecker drove the sweep — 85 files touched, tsc and the
build clean.
Two things the removal exposed as dead weight rather than merely unused:
compose_service kept an in-process busy set purely because the agent needed a
lock and has no database. With the agent gone that was a second source of truth
next to the real DB lock, so it is deleted; compute_status now reports only what
the containers say and the two callers that want "updating" overlay the lock.
StacksTable's linkBase prop only ever existed to point at /hosts/{id}/stacks.
The dashboard's "Hosts 1/1 online" KPI can no longer say anything else, so the
tile and the KPIs behind it are gone and the row is five wide.
Upgrading matters here. An existing install still has an agent table holding
each remote host's URL and bearer token — full Docker control of that host,
sitting in the database with nothing left to use it. _drop_removed_schema drops
it on first start, and drops the agent_id columns where the SQLite build
supports DROP COLUMN. Each statement runs in its own transaction on purpose: a
failed DDL poisons the transaction it is in, so sharing one would let an
unsupported column drop take the table drop down with it. test_agent_removal
covers both branches plus the fresh-install and idempotent cases, and an
end-to-end run against a seeded pre-0.48 database confirms the table is gone and
every /api/agents route answers 404.
Docstrings that justified a design by "shared with the agent, which has no
database" were rewritten rather than left lying: update_service's persistence
callback and image_status_store are still the right split (registry logic stays
testable without a database), but for that reason now, not the old one. The
README's multi-host sections are removed and an upgrade note explains what to do
with running agent containers; ROADMAP keeps its history behind a note saying
the feature it describes no longer exists.
CI no longer builds or pushes stackpilot-agent.
735 tests pass, ruff and tsc clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dk43rmEeRfYi5wsLDbmfyG
157 lines
5.6 KiB
Python
157 lines
5.6 KiB
Python
"""Stack storage and status derivation.
|
|
|
|
``compose_service`` is where the file-is-the-truth model lives: slugs become
|
|
directory names, directory names become compose project names, and container
|
|
states become the one status the UI shows. All three are pure enough to test
|
|
without a Docker daemon.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture
|
|
def svc():
|
|
from services import compose_service
|
|
|
|
return compose_service
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# Slugs — these become directory names and compose project names
|
|
# --------------------------------------------------------------------------- #
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"name,expected",
|
|
[
|
|
("Jellyfin", "jellyfin"),
|
|
("My Media Server", "my-media-server"),
|
|
("Paperless-NGX", "paperless-ngx"),
|
|
(" spaces ", "spaces"),
|
|
("Wiki.js", "wiki-js"),
|
|
("a---b", "a-b"),
|
|
("--leading-and-trailing--", "leading-and-trailing"),
|
|
("Ümlaut Stack", "mlaut-stack"),
|
|
],
|
|
)
|
|
def test_slugify(svc, name, expected):
|
|
assert svc.slugify(name) == expected
|
|
|
|
|
|
@pytest.mark.parametrize("name", ["", " ", "///", "..."])
|
|
def test_slugify_never_returns_an_empty_or_traversing_slug(svc, name):
|
|
"""The slug is joined onto STACKS_DIR, so an empty or dotted result would
|
|
point the stack directory at the root itself."""
|
|
slug = svc.slugify(name)
|
|
assert slug
|
|
assert slug not in (".", "..")
|
|
assert "/" not in slug
|
|
|
|
|
|
def test_stack_dir_stays_under_the_root(svc):
|
|
root = svc.stacks_root()
|
|
assert svc.stack_dir("jellyfin").startswith(root + os.sep)
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# Status derivation
|
|
# --------------------------------------------------------------------------- #
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"states,expected",
|
|
[
|
|
([], "stopped"),
|
|
(["running"], "running"),
|
|
(["running", "running"], "running"),
|
|
(["running", "exited"], "partial"),
|
|
(["exited", "exited"], "stopped"),
|
|
(["created"], "stopped"),
|
|
(["running", "dead"], "error"),
|
|
(["dead"], "error"),
|
|
],
|
|
)
|
|
def test_status_from_states(svc, states, expected):
|
|
assert svc._status_from_states(states) == expected
|
|
|
|
|
|
def test_status_comes_from_the_containers_alone(svc):
|
|
""""updating" is not derived here — that lives in ``stack_lock_service``,
|
|
and callers overlay it. Keeping both would be two sources of truth."""
|
|
assert svc.compute_status("no-such-stack", containers=[]) == "stopped"
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# Reading and writing stack files
|
|
# --------------------------------------------------------------------------- #
|
|
|
|
|
|
def test_write_compose_keeps_a_backup_of_the_previous_version(svc, tmp_path):
|
|
"""Every save writes a .bak — the raw material for a rollback feature."""
|
|
stack_id = "backup-check"
|
|
svc.write_compose(stack_id, "services:\n a:\n image: alpine\n", override=str(tmp_path))
|
|
svc.write_compose(stack_id, "services:\n b:\n image: nginx\n", override=str(tmp_path))
|
|
|
|
directory = tmp_path / stack_id
|
|
assert "image: nginx" in (directory / "compose.yaml").read_text()
|
|
assert "image: alpine" in (directory / "compose.yaml.bak").read_text()
|
|
|
|
|
|
def test_reading_a_missing_stack_returns_empty_not_an_error(svc, tmp_path):
|
|
assert svc.read_compose("does-not-exist", override=str(tmp_path)) == ""
|
|
assert svc.read_env("does-not-exist", override=str(tmp_path)) == ""
|
|
|
|
|
|
def test_discover_stacks_finds_only_directories_with_a_compose_file(svc, tmp_path):
|
|
(tmp_path / "real").mkdir()
|
|
(tmp_path / "real" / "compose.yaml").write_text("services: {}\n")
|
|
(tmp_path / "legacy").mkdir()
|
|
(tmp_path / "legacy" / "docker-compose.yml").write_text("services: {}\n")
|
|
(tmp_path / "not-a-stack").mkdir()
|
|
(tmp_path / "not-a-stack" / "readme.txt").write_text("hi\n")
|
|
|
|
assert svc.discover_stacks(override=str(tmp_path)) == ["legacy", "real"]
|
|
|
|
|
|
def test_clone_refuses_to_overwrite_an_existing_stack(svc, tmp_path):
|
|
svc.write_compose("source", "services: {}\n", override=str(tmp_path))
|
|
svc.write_compose("target", "services: {}\n", override=str(tmp_path))
|
|
with pytest.raises(svc.StackFileError):
|
|
svc.clone_stack_files("source", "target", override=str(tmp_path))
|
|
|
|
|
|
# --------------------------------------------------------------------------- #
|
|
# Per-stack secrets
|
|
# --------------------------------------------------------------------------- #
|
|
|
|
|
|
@pytest.mark.parametrize("name", ["../escape", "a/b", ".hidden", "", "na me"])
|
|
def test_secret_names_reject_traversal_and_hidden_files(name):
|
|
"""Secret names become filenames inside the stack's .secrets directory."""
|
|
from services import secret_service
|
|
|
|
with pytest.raises(secret_service.SecretError):
|
|
secret_service._check_name(name)
|
|
|
|
|
|
def test_secret_files_are_written_owner_only(tmp_path):
|
|
from services import secret_service
|
|
|
|
secret_service.write_secret("s", "secret", "db_password", "hunter2", override=str(tmp_path))
|
|
path = tmp_path / "s" / ".secrets" / "db_password"
|
|
assert path.read_text() == "hunter2"
|
|
assert oct(path.stat().st_mode)[-3:] == "600"
|
|
assert oct(path.parent.stat().st_mode)[-3:] == "700"
|
|
|
|
|
|
def test_listing_secrets_never_returns_their_content(tmp_path):
|
|
from services import secret_service
|
|
|
|
secret_service.write_secret("s2", "secret", "token", "top-secret", override=str(tmp_path))
|
|
listed = secret_service.list_secrets("s2", "secret", override=str(tmp_path))
|
|
assert [item["name"] for item in listed] == ["token"]
|
|
assert "top-secret" not in str(listed)
|