diff --git a/jobengine.py b/jobengine.py index 96ee93a..fd78c98 100644 --- a/jobengine.py +++ b/jobengine.py @@ -17,18 +17,26 @@ JOBS: dict[str, dict] = {} _LOG_CAP = 400 -def _run_job(job_id: str, args: list[str], env: dict | None = None): +def _run_job(job_id: str, args: list[str], env: dict | None = None, stdin_data: str | None = None): job = JOBS[job_id] job["state"] = "running" try: proc = subprocess.Popen( args, + stdin=subprocess.PIPE if stdin_data is not None else None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1, env={**os.environ, **(env or {})}, ) + if stdin_data is not None: + # Secret (z.B. sudo-Passwort) ueber stdin fuettern — landet NICHT im Log/ps. + try: + proc.stdin.write(stdin_data) # type: ignore[union-attr] + proc.stdin.close() # type: ignore[union-attr] + except Exception: # noqa: BLE001 + pass for line in proc.stdout: # type: ignore[union-attr] job["log"].append(line.rstrip("\n")) if len(job["log"]) > _LOG_CAP: @@ -43,16 +51,20 @@ def _run_job(job_id: str, args: list[str], env: dict | None = None): job["finished_at"] = time.time() -def start_job(args: list[str], label: str, env: dict | None = None) -> str: +def start_job(args: list[str], label: str, env: dict | None = None, + stdin_data: str | None = None, log_cmd: str | None = None) -> str: job_id = uuid.uuid4().hex[:12] + # log_cmd erlaubt eine sanitisierte Befehlszeile (kein Secret im Log), wenn stdin_data ein + # Geheimnis (sudo-Passwort) traegt. Sonst die echten Argumente. + first_line = log_cmd if log_cmd is not None else "$ " + " ".join(shlex.quote(a) for a in args) JOBS[job_id] = { "id": job_id, "label": label, "state": "queued", - "log": [f"$ {' '.join(shlex.quote(a) for a in args)}"], + "log": [first_line], "returncode": None, "started_at": time.time(), "finished_at": None, } - threading.Thread(target=_run_job, args=(job_id, args, env), daemon=True).start() + threading.Thread(target=_run_job, args=(job_id, args, env, stdin_data), daemon=True).start() return job_id diff --git a/routers/maintenance.py b/routers/maintenance.py index 56f7155..b141df2 100644 --- a/routers/maintenance.py +++ b/routers/maintenance.py @@ -31,8 +31,11 @@ def update(): @router.post("/os-update") def os_update(req: PwdReq): - cmd = f"echo {shlex.quote(req.password)} | sudo -S bash -c 'apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y'" - job_id = start_job(["bash", "-c", cmd], "os update") + # Passwort ueber stdin an sudo -S — NICHT als Klartext-Arg (sonst im Job-Log/ps sichtbar). + args = ["sudo", "-S", "bash", "-c", + "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y"] + job_id = start_job(args, "OS-Update (apt)", stdin_data=req.password + "\n", + log_cmd="$ sudo apt-get update && apt-get upgrade -y") return {"job_id": job_id} @router.post("/service/{name}/restart") @@ -44,19 +47,28 @@ def service_restart(name: str): @router.post("/reboot") def reboot(req: PwdReq): - cmd = f"echo {shlex.quote(req.password)} | sudo -S reboot" - subprocess.Popen(["bash", "-c", cmd]) + # Passwort ueber stdin (nicht in argv -> nicht in ps sichtbar). + proc = subprocess.Popen(["sudo", "-S", "reboot"], stdin=subprocess.PIPE, text=True) + try: + proc.stdin.write(req.password + "\n") + proc.stdin.flush() + except Exception: # noqa: BLE001 + pass return {"ok": True, "note": "Reboot getriggert."} @router.websocket("/logs/{service}") async def stream_logs(websocket: WebSocket, service: str): await websocket.accept() - if service not in ("llama-swap", "mission-control"): + if service not in ("llama-swap", "mission-control", "system"): await websocket.close(code=1008) return - + + if service == "system": + cmd = ["sudo", "journalctl", "-n", "100", "-f"] # ganzer Server (alle Units) + else: + cmd = ["sudo", "journalctl", "-u", service, "-n", "100", "-f"] process = await asyncio.create_subprocess_exec( - "sudo", "journalctl", "-u", service, "-n", "100", "-f", + *cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE ) diff --git a/routers/models.py b/routers/models.py index 58b46dc..ee0bafb 100644 --- a/routers/models.py +++ b/routers/models.py @@ -13,7 +13,7 @@ from pydantic import BaseModel from ruamel.yaml.scalarstring import LiteralScalarString from auth import auth -from config import CMD_TEMPLATE, CONFIG_PATH, DEFAULT_TTL, LLAMA_SWAP_URL, MODELS_DIR +from config import CMD_TEMPLATE, CONFIG_PATH, DEFAULT_TTL, LLAMA_SWAP_URL, MODELS_DIR, TOKEN from jobengine import JOBS, start_job from llamaswap import _swap_get, read_config, write_config import re @@ -118,6 +118,7 @@ def status(): "swap_url": LLAMA_SWAP_URL, "config_path": str(CONFIG_PATH), "models_dir": str(MODELS_DIR), + "secured": bool(TOKEN), "models": list(configured.values()), } diff --git a/static/css/components.css b/static/css/components.css index 5e03d71..2ee3737 100644 --- a/static/css/components.css +++ b/static/css/components.css @@ -96,8 +96,11 @@ .qa-ic.teal{background:rgba(45,212,191,.13);color:var(--accent)} .qa-ic.amber{background:rgba(224,163,46,.13);color:var(--warn)} .qa-ic.blue{background:rgba(68,147,224,.13);color:var(--act)} -.qa-main{flex:1;min-width:0} -.qa-t{font-size:13.5px} .qa-s{font-size:11.5px;color:var(--mut);margin-top:1px} +.qa-ic.red{background:rgba(240,87,63,.13);color:var(--err)} +.qa-danger:hover .qa-t{color:var(--err)} +.qa-danger:hover{border-color:rgba(240,87,63,.2)} +.qa-main{flex:1;min-width:0;display:flex;flex-direction:column} +.qa-t{font-size:13.5px} .qa-s{font-size:11.5px;color:var(--mut);margin-top:2px} .qa-arrow{color:var(--dim)} .qa-arrow svg{width:16px;height:16px} /* ---- Tabelle ---- */ diff --git a/static/js/main.js b/static/js/main.js index 71dafd5..dc1ee5b 100644 --- a/static/js/main.js +++ b/static/js/main.js @@ -41,9 +41,19 @@ function applyStatus(s) { if (s.swap_ok) hideAlert(); else showAlert(`LLM-Engine nicht erreichbar unter ${host} – läuft der llama-swap Dienst?`, true); } + setSecChip(s); for (const p of panels) p.onStatus?.(s); } +// Security-Chip: ehrlich anzeigen, ob ein Zugangs-Token aktiv ist. +function setSecChip(s) { + const chip = $("#sec-chip"), tx = $("#sec-chip-tx"); + if (!chip || !tx) return; + const secured = !!s?.secured; + chip.classList.toggle("ok", secured); + tx.textContent = secured ? "Geschützt · Heimnetz" : "Nur im Heimnetz (offen)"; +} + function applyJobs(jobs) { lastJobs = jobs || []; for (const p of panels) p.onJobs?.(lastJobs); diff --git a/static/js/panels/cookbook.js b/static/js/panels/cookbook.js index 839cb7a..87327fe 100644 --- a/static/js/panels/cookbook.js +++ b/static/js/panels/cookbook.js @@ -39,7 +39,15 @@ function mount() { -
+