diff --git a/jobengine.py b/jobengine.py index 96ee93a..fd78c98 100644 --- a/jobengine.py +++ b/jobengine.py @@ -17,18 +17,26 @@ JOBS: dict[str, dict] = {} _LOG_CAP = 400 -def _run_job(job_id: str, args: list[str], env: dict | None = None): +def _run_job(job_id: str, args: list[str], env: dict | None = None, stdin_data: str | None = None): job = JOBS[job_id] job["state"] = "running" try: proc = subprocess.Popen( args, + stdin=subprocess.PIPE if stdin_data is not None else None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1, env={**os.environ, **(env or {})}, ) + if stdin_data is not None: + # Secret (z.B. sudo-Passwort) ueber stdin fuettern — landet NICHT im Log/ps. + try: + proc.stdin.write(stdin_data) # type: ignore[union-attr] + proc.stdin.close() # type: ignore[union-attr] + except Exception: # noqa: BLE001 + pass for line in proc.stdout: # type: ignore[union-attr] job["log"].append(line.rstrip("\n")) if len(job["log"]) > _LOG_CAP: @@ -43,16 +51,20 @@ def _run_job(job_id: str, args: list[str], env: dict | None = None): job["finished_at"] = time.time() -def start_job(args: list[str], label: str, env: dict | None = None) -> str: +def start_job(args: list[str], label: str, env: dict | None = None, + stdin_data: str | None = None, log_cmd: str | None = None) -> str: job_id = uuid.uuid4().hex[:12] + # log_cmd erlaubt eine sanitisierte Befehlszeile (kein Secret im Log), wenn stdin_data ein + # Geheimnis (sudo-Passwort) traegt. Sonst die echten Argumente. + first_line = log_cmd if log_cmd is not None else "$ " + " ".join(shlex.quote(a) for a in args) JOBS[job_id] = { "id": job_id, "label": label, "state": "queued", - "log": [f"$ {' '.join(shlex.quote(a) for a in args)}"], + "log": [first_line], "returncode": None, "started_at": time.time(), "finished_at": None, } - threading.Thread(target=_run_job, args=(job_id, args, env), daemon=True).start() + threading.Thread(target=_run_job, args=(job_id, args, env, stdin_data), daemon=True).start() return job_id diff --git a/routers/maintenance.py b/routers/maintenance.py index 56f7155..b141df2 100644 --- a/routers/maintenance.py +++ b/routers/maintenance.py @@ -31,8 +31,11 @@ def update(): @router.post("/os-update") def os_update(req: PwdReq): - cmd = f"echo {shlex.quote(req.password)} | sudo -S bash -c 'apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y'" - job_id = start_job(["bash", "-c", cmd], "os update") + # Passwort ueber stdin an sudo -S — NICHT als Klartext-Arg (sonst im Job-Log/ps sichtbar). + args = ["sudo", "-S", "bash", "-c", + "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y"] + job_id = start_job(args, "OS-Update (apt)", stdin_data=req.password + "\n", + log_cmd="$ sudo apt-get update && apt-get upgrade -y") return {"job_id": job_id} @router.post("/service/{name}/restart") @@ -44,19 +47,28 @@ def service_restart(name: str): @router.post("/reboot") def reboot(req: PwdReq): - cmd = f"echo {shlex.quote(req.password)} | sudo -S reboot" - subprocess.Popen(["bash", "-c", cmd]) + # Passwort ueber stdin (nicht in argv -> nicht in ps sichtbar). + proc = subprocess.Popen(["sudo", "-S", "reboot"], stdin=subprocess.PIPE, text=True) + try: + proc.stdin.write(req.password + "\n") + proc.stdin.flush() + except Exception: # noqa: BLE001 + pass return {"ok": True, "note": "Reboot getriggert."} @router.websocket("/logs/{service}") async def stream_logs(websocket: WebSocket, service: str): await websocket.accept() - if service not in ("llama-swap", "mission-control"): + if service not in ("llama-swap", "mission-control", "system"): await websocket.close(code=1008) return - + + if service == "system": + cmd = ["sudo", "journalctl", "-n", "100", "-f"] # ganzer Server (alle Units) + else: + cmd = ["sudo", "journalctl", "-u", service, "-n", "100", "-f"] process = await asyncio.create_subprocess_exec( - "sudo", "journalctl", "-u", service, "-n", "100", "-f", + *cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE ) diff --git a/routers/models.py b/routers/models.py index 58b46dc..ee0bafb 100644 --- a/routers/models.py +++ b/routers/models.py @@ -13,7 +13,7 @@ from pydantic import BaseModel from ruamel.yaml.scalarstring import LiteralScalarString from auth import auth -from config import CMD_TEMPLATE, CONFIG_PATH, DEFAULT_TTL, LLAMA_SWAP_URL, MODELS_DIR +from config import CMD_TEMPLATE, CONFIG_PATH, DEFAULT_TTL, LLAMA_SWAP_URL, MODELS_DIR, TOKEN from jobengine import JOBS, start_job from llamaswap import _swap_get, read_config, write_config import re @@ -118,6 +118,7 @@ def status(): "swap_url": LLAMA_SWAP_URL, "config_path": str(CONFIG_PATH), "models_dir": str(MODELS_DIR), + "secured": bool(TOKEN), "models": list(configured.values()), } diff --git a/static/css/components.css b/static/css/components.css index 5e03d71..2ee3737 100644 --- a/static/css/components.css +++ b/static/css/components.css @@ -96,8 +96,11 @@ .qa-ic.teal{background:rgba(45,212,191,.13);color:var(--accent)} .qa-ic.amber{background:rgba(224,163,46,.13);color:var(--warn)} .qa-ic.blue{background:rgba(68,147,224,.13);color:var(--act)} -.qa-main{flex:1;min-width:0} -.qa-t{font-size:13.5px} .qa-s{font-size:11.5px;color:var(--mut);margin-top:1px} +.qa-ic.red{background:rgba(240,87,63,.13);color:var(--err)} +.qa-danger:hover .qa-t{color:var(--err)} +.qa-danger:hover{border-color:rgba(240,87,63,.2)} +.qa-main{flex:1;min-width:0;display:flex;flex-direction:column} +.qa-t{font-size:13.5px} .qa-s{font-size:11.5px;color:var(--mut);margin-top:2px} .qa-arrow{color:var(--dim)} .qa-arrow svg{width:16px;height:16px} /* ---- Tabelle ---- */ diff --git a/static/js/main.js b/static/js/main.js index 71dafd5..dc1ee5b 100644 --- a/static/js/main.js +++ b/static/js/main.js @@ -41,9 +41,19 @@ function applyStatus(s) { if (s.swap_ok) hideAlert(); else showAlert(`LLM-Engine nicht erreichbar unter ${host} – läuft der llama-swap Dienst?`, true); } + setSecChip(s); for (const p of panels) p.onStatus?.(s); } +// Security-Chip: ehrlich anzeigen, ob ein Zugangs-Token aktiv ist. +function setSecChip(s) { + const chip = $("#sec-chip"), tx = $("#sec-chip-tx"); + if (!chip || !tx) return; + const secured = !!s?.secured; + chip.classList.toggle("ok", secured); + tx.textContent = secured ? "Geschützt · Heimnetz" : "Nur im Heimnetz (offen)"; +} + function applyJobs(jobs) { lastJobs = jobs || []; for (const p of panels) p.onJobs?.(lastJobs); diff --git a/static/js/panels/cookbook.js b/static/js/panels/cookbook.js index 839cb7a..87327fe 100644 --- a/static/js/panels/cookbook.js +++ b/static/js/panels/cookbook.js @@ -39,7 +39,15 @@ function mount() { -
+
+
+ +

Empfohlen für deine Hardware

@@ -80,6 +88,7 @@ function mount() { renderFilters(); $("#cb-btn-search").addEventListener("click", doSearch); $("#cb-search").addEventListener("keydown", e => { if (e.key === "Enter") doSearch(); }); + $("#cb-sort").addEventListener("change", () => { if ($("#cb-search").value.trim() || activeFilter) doSearch(); }); $("#cb-modal-close").addEventListener("click", () => $("#cb-modal").style.display = "none"); $("#cb-modal").addEventListener("click", e => { if (e.target.id === "cb-modal") $("#cb-modal").style.display = "none"; }); $("#cb-m-download").addEventListener("click", doDownload); @@ -141,12 +150,13 @@ async function doSearch() { if (activeFilter) q = q ? q + " " + activeFilter : activeFilter; if (!q) return renderCurated(); + const sort = $("#cb-sort")?.value || "downloads"; const btn = $("#cb-btn-search"); btn.disabled = true; btn.textContent = "Lade…"; $("#cb-section-title").textContent = "Suchergebnisse: " + q; const grid = $("#cb-grid"); grid.innerHTML = `
Suche auf HuggingFace…
`; try { - const url = `https://huggingface.co/api/models?search=${encodeURIComponent(q)}&filter=gguf&sort=downloads&direction=-1&limit=12`; + const url = `https://huggingface.co/api/models?search=${encodeURIComponent(q)}&filter=gguf&sort=${encodeURIComponent(sort)}&direction=-1&limit=12`; const r = await fetch(url); currentResults = await r.json(); renderResults(currentResults); diff --git a/static/js/panels/server.js b/static/js/panels/server.js index 2a78009..b825ecd 100644 --- a/static/js/panels/server.js +++ b/static/js/panels/server.js @@ -1,5 +1,5 @@ // server.js — Server & Wartung (v3): Dienste, OS-Updates, Reboot, Live-Konsole. -// Heikle Aktionen mit Klartext-Bestätigung (confirmModal/promptModal). +// Selbsterklärende Aktionszeilen + heikle Aktionen mit Klartext-Bestätigung. import { api, getToken } from "../core/api.js"; import { $, toast, icon, confirmModal, promptModal } from "../core/ui.js"; @@ -7,41 +7,45 @@ import { track } from "./jobs.js"; function refreshSoon() { document.dispatchEvent(new Event("mc:refresh")); } +function row(id, ic, tone, title, desc) { + return ``; +} + function mount() { $("#wartung").outerHTML = `

Server & Wartung

-
Dienste steuern, Updates einspielen und live mitlesen — ohne SSH/Terminal.
+
Dienste steuern, Updates einspielen und live mitlesen — ganz ohne SSH oder Terminal.

Dienste & Applikation

-
Neustarts sind harmlos und passwortlos — nichts geht dabei verloren.
-
- - - - -
+
Diese Aktionen sind harmlos und passwortlos — es geht nichts dabei verloren.
+ ${row("w-restart-swap", "refresh", "teal", "LLM-Engine neustarten", "Startet llama-swap neu. Geladene Modelle werden kurz entladen (~5 Sek), laden danach automatisch wieder.")} + ${row("w-restart-mc", "refresh", "blue", "Dashboard neustarten", "Startet diese Oberfläche neu. Sie trennt kurz und verbindet automatisch wieder.")} + ${row("w-update", "download", "teal", "Nach Updates suchen", "Holt den neuesten Mission-Control-Code und spielt ihn ein.")} + ${row("w-unload", "database", "amber", "Grafikspeicher leeren", "Wirft alle aktuell geladenen Modelle aus dem VRAM. Fragt vorher nach.")}

Betriebssystem (Bosgame)

Tiefe Eingriffe — das Dashboard fragt einmalig nach deinem sudo-Passwort.
-
- - -
+ ${row("w-os-update", "refresh", "amber", "OS-Updates installieren", "Führt apt update & upgrade aus. Kann ein paar Minuten dauern — Fortschritt in der Aktivität.")} + ${row("w-reboot", "bolt", "red", "Server neustarten (Reboot)", "Bootet den ganzen Bosgame neu. Alles ist für ~1 Minute offline, auch dieses Dashboard.")}

Live-Konsole

- +
-
Was der Dienst gerade tut — live mitlesen.
+
Live mitlesen, was der Dienst gerade tut.
Verbinde…
`;