fix(review): 处理全量审查剩余项（M4-M8/M11/M12 + 21 条 low）
后端
- asset_service: delete_asset 先清 subdomains/site_certs 子表（SQLite 不强制
FK 且 assets.id 无 AUTOINCREMENT，删最大 id 后新建会复用 rowid 导致孤儿误挂）；
metrics.db 清理改 best-effort，不再让已成功的删除返回 500
- provider_service: slug 唯一约束竞态补 IntegrityError 兜底（与 account_service 一致）
- account_service/sync_service: raise HTTPException 补 from e，保留原始异常链
- sync_service: 删死代码 _load_config；新增 BalanceUnsupported，平台无余额接口时
计入 skipped 而不是静默当作失败；到期日写库前归一
- ai: 删掉 OpenAI 早已下线的 billing 余额接口实现，能力探测如实报「不支持」
- adapters/base: _overridden 改走 MRO，中间层基类实现的能力不再被误判为未实现
- core/timeutils: 删死代码 utcnow_iso（注释声称 Z 后缀，实际输出 +00:00）
- main: lifespan 退出时 await 被 cancel 的清理任务，避免 pending task 被销毁
- ssl_service: 写 site_certs/subdomains 前校验 asset_id 存在，杜绝悬空引用；
到期阈值贯穿 _judge_status/_apply_probe/check_one/check_all_site_certs
- routers/credentials、accounts: 明文密码 GET 补 Cache-Control: no-store
- routers/stats: /stats/expiring 的 Query 描述与实际语义对齐（不设下界，含已过期）
Agent
- collector: 解析 sshd_config 的 Include（含 sshd_config.d/*.conf，按 sshd 语义
「首次出现的值生效」），未显式配置的关键字按编译默认值判定，消除假 pass；
防火墙检测改用 iptables -S 统计 -A 规则行并读 INPUT 策略（-L -n 恒有链头输出）
- reporter: 4xx（除 429）不再重试直接退出，429 优先按 Retry-After 退避
安全与部署
- core/security: require_agent_key 改为对外 fail-closed——tailnet/本机放行，
外部来源未配 AGENT_KEY 时一律 401（此前全放行，而服务默认监听 0.0.0.0，
公网上任何人可伪造监控指标与安全检查结果）
- main: 启动时把「未配 API_KEY/AGENT_KEY 则外部来源不可用」打进日志
- run.sh: HOST/PORT 可用环境变量覆盖，并说明默认 0.0.0.0 的权衡
- deploy/setup.sh: 新装时自动生成随机 API_KEY/AGENT_KEY 并提示同步到各 VPS；
注册 vps-cert-check.timer
- deploy/vps-cert-check.{service,timer}: 新增每日 09:30 的站点证书到期探测
（此前 check_site_certs.py 没有任何 unit，证书提醒不会自动跑）
- deploy/update.sh: sync_units 对 timer 用 enable --now（新增 timer 只 restart
不会建开机自启软链），主服务 unit 变更后额外 restart；pip 安装失败不再被吞
- scripts/check_site_certs.py: threshold 参数真正生效并打印
- scripts/make_migration_bundle.py: 缺 assets.db 直接 abort；umask 077 + chmod 600
（包内含 .env 的 MASTER_KEY 与 escrow，不能默认 644 落在 /tmp）
- scripts/restore_migration_bundle.py: 校验之外补必备文件预检，缺文件在触碰
目标机状态之前就 abort
前端
- store: 拆分列表口径 assets 与统计口径 allAssets（无筛选时同源，不重复请求）；
删除已无消费者的 expiring/loadExpiring（每次 loadAll 白发一个请求）
- dashboard/monitor/providers/subscriptions/modals: 统计与计数改用 allAssets，
资产页的筛选（含统计卡片点击跳转带的筛选）不再让其他视图的数字缩水
- modals: 账号同步后补 loadOverview；settings: 导入后改 loadAll
- api: countdownText 支持 unit/empty 选项，monitor/domains 各自的实现改为委托，
assets/domains/subscriptions 的到期列不再直出「(-3天)」
- servers: cpu/mem/disk 百分比统一判空，采样缺项不再渲染「null%」
- assets: 同步 AI 余额的结果提示区分 skipped（平台无余额接口）与 failed
- modals: 修正凭据库头注释——2FA 动态码是选填 + 可事后补验，与实现一致
测试
- 新增 tests/test_agent_collector.py（8 条）、tests/test_security.py（11 条）
- 全量 113 passed；改动 JS 均通过 node --check，deploy 脚本通过 bash -n
- 浏览器实测：筛选态下总览/监控中心/平台页/付费资产的统计仍为全量口径，
到期文案与 null 百分比渲染正确，console 零报错
This commit is contained in:
gouki
+5
-1
@@ -8,7 +8,11 @@ APP_NAME=VPS 资产管理系统
|
||||
# 外部来源必须携带 X-API-Key: <此密钥>；留空则外部来源一律拒绝（仅内网可用）
|
||||
API_KEY=
|
||||
|
||||
# Agent 上报鉴权密钥（可选）
|
||||
# Agent 上报鉴权密钥
|
||||
# 与 API_KEY 同一套可信来源判定：tailnet（100.64.0.0/10）/本机自动放行，
|
||||
# 外部来源必须携带 X-Agent-Key；留空则外部上报一律 401（防止公网伪造监控数据）。
|
||||
# deploy/setup.sh 新建安装时会自动生成随机值；启用后需同步写入各 VPS 的
|
||||
# /etc/vps-agent.env（VPS_AGENT_KEY），否则那台机器的 Agent 上报会失败
|
||||
AGENT_KEY=
|
||||
|
||||
# 凭证加密主密钥（Fernet，必填以加密 API Key/SSH 凭证）
|
||||
|
||||
+65
-19
@@ -4,6 +4,7 @@
|
||||
依赖 psutil + 少量系统命令（ufw/iptables/sshd_config）。
|
||||
"""
|
||||
|
||||
import glob
|
||||
import platform
|
||||
import socket
|
||||
import subprocess
|
||||
@@ -74,25 +75,56 @@ def collect_server_info() -> dict:
|
||||
}
|
||||
|
||||
|
||||
def _check_ssh_config() -> dict:
|
||||
"""检查 SSH 配置（root 登录 / 密码登录）"""
|
||||
path = "/etc/ssh/sshd_config"
|
||||
permit_root = "unknown"
|
||||
password_auth = "unknown"
|
||||
SSHD_CONFIG = "/etc/ssh/sshd_config"
|
||||
_SSHD_KEYS = ("permitrootlogin", "passwordauthentication")
|
||||
# sshd 编译默认值：关键字未显式配置时实际生效的就是这些
|
||||
_SSHD_DEFAULTS = {"permitrootlogin": "prohibit-password", "passwordauthentication": "yes"}
|
||||
|
||||
|
||||
def _parse_sshd_config(path: str, values: dict, seen: set, depth: int = 0) -> bool:
|
||||
"""按 sshd 语义解析配置：Include 就地展开、同一关键字「首次出现的值生效」
|
||||
|
||||
返回是否成功打开该文件。Debian/Ubuntu 云镜像通常把加固项放在
|
||||
/etc/ssh/sshd_config.d/*.conf，而主配置顶部就有 Include；只读主文件会漏掉
|
||||
这些值，把已加固的机器误报成 warn，或反过来漏报。
|
||||
"""
|
||||
real = path if path.startswith("/") else f"/etc/ssh/{path}"
|
||||
if depth > 3 or real in seen:
|
||||
return False
|
||||
seen.add(real)
|
||||
try:
|
||||
with open(path) as f:
|
||||
for line in f:
|
||||
low = line.strip().lower()
|
||||
if low.startswith("permitrootlogin"):
|
||||
parts = low.split()
|
||||
permit_root = parts[1] if len(parts) > 1 else "unknown"
|
||||
elif low.startswith("passwordauthentication"):
|
||||
parts = low.split()
|
||||
password_auth = parts[1] if len(parts) > 1 else "unknown"
|
||||
except Exception:
|
||||
with open(real) as f:
|
||||
lines = f.readlines()
|
||||
except OSError:
|
||||
return False
|
||||
for line in lines:
|
||||
low = line.strip().lower()
|
||||
if not low or low.startswith("#"):
|
||||
continue
|
||||
parts = low.split()
|
||||
if parts[0] == "include" and len(parts) > 1:
|
||||
# Include 的相对路径由 sshd 按 /etc/ssh 解析，不能交给 glob 按 CWD 展开
|
||||
pattern = parts[1] if parts[1].startswith("/") else f"/etc/ssh/{parts[1]}"
|
||||
for inc in sorted(glob.glob(pattern)):
|
||||
_parse_sshd_config(inc, values, seen, depth + 1)
|
||||
elif parts[0] in _SSHD_KEYS and len(parts) > 1:
|
||||
values.setdefault(parts[0], parts[1]) # 首次出现生效
|
||||
return True
|
||||
|
||||
|
||||
def _check_ssh_config() -> dict:
|
||||
"""检查 SSH 配置（root 登录 / 密码登录），含 sshd_config.d 与默认值判定"""
|
||||
values: dict = {}
|
||||
if not _parse_sshd_config(SSHD_CONFIG, values, set()):
|
||||
return {"check_item": "ssh_config", "status": "unknown",
|
||||
"detail": "无法读取 sshd_config", "suggestion": None}
|
||||
|
||||
permit_root = values.get("permitrootlogin", _SSHD_DEFAULTS["permitrootlogin"])
|
||||
password_auth = values.get("passwordauthentication", _SSHD_DEFAULTS["passwordauthentication"])
|
||||
# 未显式配置的关键字按 sshd 默认值判定，不能因为「没写」就当作已通过
|
||||
# （PasswordAuthentication 默认就是 yes，这类机器实际是开着密码登录的）
|
||||
implicit = [k for k in _SSHD_KEYS if k not in values]
|
||||
|
||||
status = "pass"
|
||||
suggestions = []
|
||||
if permit_root == "yes":
|
||||
@@ -101,10 +133,13 @@ def _check_ssh_config() -> dict:
|
||||
if password_auth == "yes":
|
||||
status = "warn"
|
||||
suggestions.append("关闭密码登录 PasswordAuthentication no，改用密钥")
|
||||
detail = f"PermitRootLogin={permit_root}, PasswordAuthentication={password_auth}"
|
||||
if implicit:
|
||||
detail += f"（{'/'.join(implicit)} 未显式配置，取 sshd 默认值）"
|
||||
return {
|
||||
"check_item": "ssh_config",
|
||||
"status": status,
|
||||
"detail": f"PermitRootLogin={permit_root}, PasswordAuthentication={password_auth}",
|
||||
"detail": detail,
|
||||
"suggestion": "；".join(suggestions) if suggestions else None,
|
||||
}
|
||||
|
||||
@@ -120,10 +155,21 @@ def _check_firewall() -> dict:
|
||||
"detail": "ufw 未启用", "suggestion": "启用防火墙 ufw enable"}
|
||||
except Exception:
|
||||
try:
|
||||
out = subprocess.run(["iptables", "-L", "-n"], capture_output=True, text=True, timeout=5)
|
||||
if out.stdout.strip():
|
||||
# 用 -S 而不是 -L：-L 即使零规则也会输出链头（Chain INPUT ... + 表头），
|
||||
# 拿 stdout 非空当「有规则」会永远判 pass
|
||||
out = subprocess.run(["iptables", "-S"], capture_output=True, text=True, timeout=5)
|
||||
lines = [ln.strip() for ln in out.stdout.splitlines() if ln.strip()]
|
||||
rules = [ln for ln in lines if ln.startswith("-A")]
|
||||
policy = next(
|
||||
(ln.split()[-1] for ln in lines if ln.startswith("-P INPUT")), "ACCEPT"
|
||||
)
|
||||
if rules or policy.upper() == "DROP":
|
||||
return {"check_item": "firewall", "status": "pass",
|
||||
"detail": "iptables 有规则", "suggestion": None}
|
||||
"detail": f"iptables {len(rules)} 条规则，INPUT 策略 {policy}",
|
||||
"suggestion": None}
|
||||
return {"check_item": "firewall", "status": "warn",
|
||||
"detail": f"iptables 无过滤规则（INPUT 策略 {policy}）",
|
||||
"suggestion": "配置防火墙规则，或启用 ufw/nftables"}
|
||||
except Exception:
|
||||
pass
|
||||
return {"check_item": "firewall", "status": "unknown",
|
||||
|
||||
+27
-9
@@ -4,7 +4,7 @@
|
||||
VPS_MANAGER_URL 中心地址，如 http://100.89.0.11:8000
|
||||
VPS_ASSET_ID 本机对应的资产 ID
|
||||
VPS_AGENT_KEY Agent Key（中心配置了 AGENT_KEY 时必填）
|
||||
VPS_AGENT_RETRY 上报失败重试次数（默认 2，指数退避）
|
||||
VPS_AGENT_RETRY 上报失败重试次数（默认 2，指数退避；4xx 不重试，429 按 Retry-After）
|
||||
"""
|
||||
|
||||
import os
|
||||
@@ -16,6 +16,16 @@ import httpx
|
||||
from collector import collect_metrics, collect_security, collect_server_info
|
||||
|
||||
|
||||
def _next_wait(attempt: int, resp=None) -> int:
|
||||
"""重试等待：429 优先按服务端 Retry-After，其余走指数退避"""
|
||||
if resp is not None:
|
||||
try:
|
||||
return max(1, min(int(resp.headers.get("Retry-After")), 300))
|
||||
except (TypeError, ValueError):
|
||||
pass
|
||||
return 2 ** attempt
|
||||
|
||||
|
||||
def main() -> int:
|
||||
url = os.environ.get("VPS_MANAGER_URL", "").rstrip("/")
|
||||
asset_id = os.environ.get("VPS_ASSET_ID", "")
|
||||
@@ -39,17 +49,25 @@ def main() -> int:
|
||||
resp = httpx.post(
|
||||
f"{url}/api/agent/report", json=payload, headers=headers, timeout=30
|
||||
)
|
||||
print(f"上报完成 HTTP {resp.status_code}: {resp.text}")
|
||||
resp.raise_for_status()
|
||||
print(f"上报完成 HTTP {resp.status_code}: {resp.text}")
|
||||
return 0
|
||||
except Exception as e: # noqa: BLE001
|
||||
if attempt < max_retry:
|
||||
wait = 2 ** attempt
|
||||
print(f"上报失败（{attempt + 1}/{max_retry + 1}），{wait}s 后重试: {e}")
|
||||
time.sleep(wait)
|
||||
else:
|
||||
print(f"上报失败（已重试 {max_retry} 次）: {e}")
|
||||
except httpx.HTTPStatusError as e:
|
||||
code = e.response.status_code
|
||||
if 400 <= code < 500 and code != 429:
|
||||
# 鉴权失败/参数错误这类 4xx 重试必然继续失败，白白拖完退避还丢点；
|
||||
# 立即退出并把原因留给 systemd 日志（429 是频控，例外）
|
||||
print(f"上报被拒绝 HTTP {code}（不重试）：{e.response.text[:200]}")
|
||||
return 1
|
||||
wait, err = _next_wait(attempt, e.response), f"HTTP {code}"
|
||||
except Exception as e: # noqa: BLE001 网络/DNS/超时
|
||||
wait, err = _next_wait(attempt), str(e)
|
||||
if attempt < max_retry:
|
||||
print(f"上报失败（{attempt + 1}/{max_retry + 1}）{err}，{wait}s 后重试")
|
||||
time.sleep(wait)
|
||||
else:
|
||||
print(f"上报失败（已重试 {max_retry} 次）：{err}")
|
||||
return 1
|
||||
return 1
|
||||
|
||||
|
||||
|
||||
+4
-7
@@ -89,13 +89,10 @@ class OpenAIAdapter(_AIBase):
|
||||
except Exception as e: # noqa: BLE001
|
||||
return {"ok": False, "message": str(e)}
|
||||
|
||||
def get_account(self) -> AccountInfo:
|
||||
# OpenAI 余额接口需组织级权限，尝试旧版 billing，失败返回空
|
||||
try:
|
||||
data = self._get("https://api.openai.com/dashboard/billing/credit_grants")
|
||||
return AccountInfo(balance=data.get("total_available"), currency="USD", raw=data)
|
||||
except Exception: # noqa: BLE001
|
||||
return AccountInfo(balance=None, currency="USD", raw={})
|
||||
# 故意不实现 get_account：OpenAI 的 /dashboard/billing/credit_grants 早已下线
|
||||
# （且需组织级权限）。旧实现把异常静默吞掉并返回 balance=None，
|
||||
# 导致前端提示「已更新」但数值永远不变；不实现则 capabilities() 中
|
||||
# get_account 为 False，刷新余额时会如实提示「暂不支持余额查询」。
|
||||
|
||||
|
||||
@register("minimax-api")
|
||||
|
||||
@@ -87,8 +87,13 @@ class AccountInfo:
|
||||
|
||||
|
||||
def _overridden(instance: "BaseAdapter", method_name: str) -> bool:
|
||||
"""判断子类是否重写了某方法（用于能力探测）"""
|
||||
return type(instance).__dict__.get(method_name) is not None
|
||||
"""判断子类是否重写了某方法（用于能力探测）
|
||||
|
||||
比较按 MRO 解析到的实现与 BaseAdapter 的默认实现：只查 type(instance).__dict__
|
||||
的话，由中间层基类（如 ai._AIBase）实现的能力会被误判为「未实现」。
|
||||
"""
|
||||
impl = getattr(type(instance), method_name, None)
|
||||
return impl is not None and impl is not getattr(BaseAdapter, method_name, None)
|
||||
|
||||
|
||||
class BaseAdapter(ABC):
|
||||
|
||||
+29
-7
@@ -1,8 +1,8 @@
|
||||
"""API Key 认证依赖
|
||||
|
||||
用于保护写操作（POST/PUT/DELETE）。
|
||||
用于保护写操作（POST/PUT/DELETE）与 Agent 上报。
|
||||
- 来自可信内网（Tailscale 100.64.0.0/10、本机回环）的请求直接放行；
|
||||
- 其余来源：API_KEY 已配置则校验 X-API-Key，未配置则拒绝（防止外部裸奔）。
|
||||
- 其余来源：密钥已配置则校验对应请求头，未配置则拒绝（防止外部裸奔）。
|
||||
"""
|
||||
|
||||
import hmac
|
||||
@@ -92,14 +92,36 @@ async def require_api_key(
|
||||
await _require_key(x_api_key)
|
||||
|
||||
|
||||
async def require_agent_key(
|
||||
x_agent_key: Optional[str] = Header(default=None, alias="X-Agent-Key"),
|
||||
) -> None:
|
||||
"""校验 Agent 上报 Key（可选启用）"""
|
||||
async def _require_agent_key(x_agent_key: Optional[str]) -> None:
|
||||
"""按外部来源校验 Agent Key（可信内网已在调用方排除）"""
|
||||
if not settings.AGENT_KEY:
|
||||
return
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail=(
|
||||
"Agent 上报来自外部网络，需先在 .env 配置 AGENT_KEY"
|
||||
"并写入各 VPS 的 /etc/vps-agent.env（VPS_AGENT_KEY）"
|
||||
),
|
||||
)
|
||||
if not _key_matches(x_agent_key, settings.AGENT_KEY):
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Agent Key 无效或缺失",
|
||||
)
|
||||
|
||||
|
||||
async def require_agent_key(
|
||||
request: Request,
|
||||
x_agent_key: Optional[str] = Header(default=None, alias="X-Agent-Key"),
|
||||
) -> None:
|
||||
"""校验 Agent 上报 Key：tailnet/本机放行，外部来源必须携带有效 Key
|
||||
|
||||
与 require_api_key 用同一套可信来源判定。此前未配 AGENT_KEY 时对任意来源全放行，
|
||||
而服务默认监听 0.0.0.0——公网上任何人都能伪造监控指标与安全检查结果上报。
|
||||
改成「外部来源必须有 key」后，走 tailnet IP 上报的 Agent 不受影响。
|
||||
"""
|
||||
if _is_funnel_request(request):
|
||||
await _require_agent_key(x_agent_key)
|
||||
return
|
||||
if _is_trusted(_client_ip(request)):
|
||||
return
|
||||
await _require_agent_key(x_agent_key)
|
||||
|
||||
@@ -12,8 +12,3 @@ from datetime import datetime, timezone
|
||||
def utcnow() -> datetime:
|
||||
"""返回当前 UTC 时间（naive，与 datetime.utcnow() 行为一致）"""
|
||||
return datetime.now(timezone.utc).replace(tzinfo=None)
|
||||
|
||||
|
||||
def utcnow_iso() -> str:
|
||||
"""返回当前 UTC 时间的 ISO 格式字符串（带 Z 后缀标识 UTC）"""
|
||||
return datetime.now(timezone.utc).isoformat()
|
||||
|
||||
+21
-1
@@ -6,7 +6,7 @@
|
||||
- 启用 CORS（便于外部程序/其他 AI 跨域调用写入接口）
|
||||
"""
|
||||
|
||||
from contextlib import asynccontextmanager
|
||||
from contextlib import asynccontextmanager, suppress
|
||||
from pathlib import Path
|
||||
import asyncio
|
||||
import logging
|
||||
@@ -85,15 +85,35 @@ logging.basicConfig(
|
||||
jinja_env = Environment(loader=FileSystemLoader(TEMPLATE_DIR), autoescape=True)
|
||||
|
||||
|
||||
def _warn_insecure_config() -> None:
|
||||
"""把「暴露面 vs 密钥」的配置缺口打到启动日志里，避免静默裸奔
|
||||
|
||||
服务默认监听 0.0.0.0，而密钥留空时外部来源会被 fail-closed 拒绝：
|
||||
这意味着 funnel/公网访问直接不可用，原因必须在日志里说清。
|
||||
"""
|
||||
log = logging.getLogger(__name__)
|
||||
if not settings.API_KEY:
|
||||
log.warning("未配置 API_KEY：外部来源的写操作一律 401，仅 tailnet/本机可用")
|
||||
if not settings.AGENT_KEY:
|
||||
log.warning(
|
||||
"未配置 AGENT_KEY：外部来源的 Agent 上报一律 401（tailnet 内的 Agent 不受影响）"
|
||||
)
|
||||
|
||||
|
||||
@asynccontextmanager
|
||||
async def lifespan(_: FastAPI):
|
||||
"""应用启动时自动建表、初始化预设平台，并启动监控数据定期清理任务"""
|
||||
init_db()
|
||||
_warn_insecure_config()
|
||||
with Session(assets_engine) as session:
|
||||
seed_providers(session)
|
||||
cleanup_task = asyncio.create_task(cleanup_service.cleanup_loop())
|
||||
yield
|
||||
cleanup_task.cancel()
|
||||
# 等取消真正落地：只 cancel 不 await 的话，事件循环关闭时该 task 仍处于 pending，
|
||||
# 会打出 "Task was destroyed but it is pending"，也可能跳过清理协程的收尾逻辑
|
||||
with suppress(asyncio.CancelledError):
|
||||
await cleanup_task
|
||||
|
||||
|
||||
app = FastAPI(title=settings.APP_NAME, version=f"{APP_VERSION} ({GIT_COMMIT})", lifespan=lifespan)
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
|
||||
from typing import List
|
||||
|
||||
from fastapi import APIRouter, Depends
|
||||
from fastapi import APIRouter, Depends, Response
|
||||
from sqlmodel import Session
|
||||
|
||||
from app.core.security import require_api_key
|
||||
@@ -60,7 +60,11 @@ def delete_account(account_id: int, session: Session = Depends(get_session)) ->
|
||||
summary="查看账号登录密码明文（解密返回）",
|
||||
dependencies=[Depends(require_api_key)],
|
||||
)
|
||||
def reveal_password(account_id: int, session: Session = Depends(get_session)) -> dict:
|
||||
def reveal_password(
|
||||
account_id: int, response: Response, session: Session = Depends(get_session)
|
||||
) -> dict:
|
||||
# 明文密码禁止缓存（与凭据库 /otp、/password 保持一致）
|
||||
response.headers["Cache-Control"] = "no-store"
|
||||
return account_service.reveal_password(session, account_id)
|
||||
|
||||
|
||||
|
||||
@@ -76,7 +76,11 @@ def delete_credential(credential_id: int, session: Session = Depends(get_session
|
||||
summary="查看凭据密码明文（解密返回）",
|
||||
dependencies=[Depends(require_api_key)],
|
||||
)
|
||||
def reveal_password(credential_id: int, session: Session = Depends(get_session)) -> dict:
|
||||
def reveal_password(
|
||||
credential_id: int, response: Response, session: Session = Depends(get_session)
|
||||
) -> dict:
|
||||
# 明文密码禁止缓存（与 /otp 保持一致），避免浏览器/代理缓存或历史残留
|
||||
response.headers["Cache-Control"] = "no-store"
|
||||
return credential_service.reveal_password(session, credential_id)
|
||||
|
||||
|
||||
|
||||
@@ -19,7 +19,13 @@ def overview(session: Session = Depends(get_session)) -> dict:
|
||||
|
||||
@router.get("/expiring", response_model=List[AssetRead], summary="续费倒计时")
|
||||
def expiring(
|
||||
days: int = Query(default=30, ge=1, le=365, description="统计未来 N 天内到期"),
|
||||
days: int = Query(
|
||||
default=30,
|
||||
ge=1,
|
||||
le=365,
|
||||
description="到期日上界 = 今天 + N 天；不设下界，已过期未处理的也会返回（days_to_expiry 可为负）",
|
||||
),
|
||||
session: Session = Depends(get_session),
|
||||
):
|
||||
"""对外 API：前端的到期卡片直接走 /stats/overview + 资产列表，不再调本接口"""
|
||||
return asset_service.get_expiring(session, days)
|
||||
|
||||
@@ -113,13 +113,13 @@ def create_account(session: Session, data: AccountCreate) -> AccountRead:
|
||||
try:
|
||||
session.add(account)
|
||||
session.commit()
|
||||
except IntegrityError:
|
||||
except IntegrityError as e:
|
||||
# 并发创建同名账号时唯一约束兜底：检查与提交之间存在竞态窗口
|
||||
session.rollback()
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"该平台下账号已存在：{name}",
|
||||
)
|
||||
) from e
|
||||
session.refresh(account)
|
||||
return _to_read(account, _asset_counts(session), _cred_of(session, account))
|
||||
|
||||
@@ -150,13 +150,13 @@ def update_account(session: Session, account_id: int, data: AccountUpdate) -> Ac
|
||||
try:
|
||||
session.add(account)
|
||||
session.commit()
|
||||
except IntegrityError:
|
||||
except IntegrityError as e:
|
||||
# 重命名撞上已有账号时唯一约束兜底，与 _check_name_taken 存在竞态窗口
|
||||
session.rollback()
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"该平台下账号已存在：{account.name}",
|
||||
)
|
||||
) from e
|
||||
session.refresh(account)
|
||||
return _to_read(account, _asset_counts(session), _cred_of(session, account))
|
||||
|
||||
|
||||
@@ -299,17 +299,42 @@ def update_asset(session: Session, asset_id: int, data: AssetUpdate) -> AssetRea
|
||||
|
||||
|
||||
def delete_asset(session: Session, asset_id: int) -> None:
|
||||
"""删除资产及其详情，并清理 metrics.db 中的关联监控数据（避免孤儿数据）"""
|
||||
"""删除资产及其详情/子表，并尽力清理 metrics.db 中的关联监控数据（避免孤儿数据）"""
|
||||
asset = session.get(Asset, asset_id)
|
||||
if not asset:
|
||||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="资产不存在")
|
||||
detail = _get_detail(session, asset)
|
||||
if detail is not None:
|
||||
session.delete(detail)
|
||||
_delete_child_rows(session, asset_id)
|
||||
session.delete(asset)
|
||||
session.commit()
|
||||
logger.info("删除资产 id=%s name=%s", asset_id, asset.name)
|
||||
_cleanup_metrics_for_asset(asset_id)
|
||||
# metrics.db 是独立库（可能正在被 Agent 写入而短暂锁定），
|
||||
# 清理失败不应让已经成功的删除返回 500，否则前端会误报「删除失败」
|
||||
try:
|
||||
_cleanup_metrics_for_asset(asset_id)
|
||||
except Exception as e: # noqa: BLE001
|
||||
logger.warning(
|
||||
"清理资产监控数据失败 asset_id=%s：%s（资产已删除，监控数据可后续手动清理）",
|
||||
asset_id,
|
||||
e,
|
||||
)
|
||||
|
||||
|
||||
def _delete_child_rows(session: Session, asset_id: int) -> None:
|
||||
"""删除 assets.db 中引用该资产的子表行（subdomains / site_certs）
|
||||
|
||||
必须显式清理：SQLite 默认不强制外键（PRAGMA foreign_keys=0），残留行会变成孤儿；
|
||||
而 assets.id 是 INTEGER PRIMARY KEY（无 AUTOINCREMENT），删掉最大 id 后
|
||||
新建资产必然复用该 id，孤儿行会被误挂到不相干的新资产上。
|
||||
"""
|
||||
from sqlmodel import delete
|
||||
|
||||
from app.models.ssl import SiteCert, Subdomain
|
||||
|
||||
for model in (Subdomain, SiteCert):
|
||||
session.exec(delete(model).where(model.asset_id == asset_id))
|
||||
|
||||
|
||||
def _cleanup_metrics_for_asset(asset_id: int) -> None:
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
from typing import List, Optional
|
||||
|
||||
from fastapi import HTTPException, status
|
||||
from sqlalchemy.exc import IntegrityError
|
||||
from sqlmodel import Session, select
|
||||
|
||||
from app.core import crypto
|
||||
@@ -47,8 +48,16 @@ def create_provider(session: Session, data: ProviderCreate) -> ProviderRead:
|
||||
provider_data = data.model_dump(exclude={"api_config"})
|
||||
provider = Provider(**provider_data)
|
||||
provider.api_config_encrypted = crypto.encrypt(data.api_config)
|
||||
session.add(provider)
|
||||
session.commit()
|
||||
try:
|
||||
session.add(provider)
|
||||
session.commit()
|
||||
except IntegrityError as e:
|
||||
# 上面的 exists 检查与 commit 之间存在竞态窗口，靠 slug 唯一约束兜底，
|
||||
# 否则并发建同名平台会直接把 IntegrityError 抛成 500
|
||||
session.rollback()
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST, detail=f"slug 已存在：{data.slug}"
|
||||
) from e
|
||||
session.refresh(provider)
|
||||
return _to_read(provider)
|
||||
|
||||
@@ -64,8 +73,15 @@ def update_provider(
|
||||
setattr(provider, key, value)
|
||||
if data.api_config is not None:
|
||||
provider.api_config_encrypted = crypto.encrypt(data.api_config)
|
||||
session.add(provider)
|
||||
session.commit()
|
||||
try:
|
||||
session.add(provider)
|
||||
session.commit()
|
||||
except IntegrityError as e:
|
||||
# 改 slug 撞上已有平台时同样靠唯一约束兜底
|
||||
session.rollback()
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST, detail=f"slug 已存在：{provider.slug}"
|
||||
) from e
|
||||
session.refresh(provider)
|
||||
return _to_read(provider)
|
||||
|
||||
|
||||
@@ -29,13 +29,13 @@ def days_until(d: Optional[date]) -> Optional[int]:
|
||||
return (d - date.today()).days
|
||||
|
||||
|
||||
def _judge_status(days: Optional[int]) -> str:
|
||||
def _judge_status(days: Optional[int], threshold: int = EXPIRING_THRESHOLD) -> str:
|
||||
"""按剩余天数定级：expired / expiring / valid"""
|
||||
if days is None:
|
||||
return "unknown"
|
||||
if days < 0:
|
||||
return "expired"
|
||||
if days <= EXPIRING_THRESHOLD:
|
||||
if days <= threshold:
|
||||
return "expiring"
|
||||
return "valid"
|
||||
|
||||
@@ -115,7 +115,20 @@ def list_subdomains(session: Session, asset_id: Optional[int] = None) -> list:
|
||||
]
|
||||
|
||||
|
||||
def _require_asset(session: Session, asset_id: Optional[int]) -> None:
|
||||
"""校验关联资产存在
|
||||
|
||||
SQLite 默认不强制外键，写一个不存在的 asset_id 不会报错，
|
||||
但列表页 join 不出资产名，删除资产时也清不到这些悬空行。
|
||||
"""
|
||||
if asset_id is None:
|
||||
return
|
||||
if not session.get(Asset, asset_id):
|
||||
raise ValueError(f"关联资产不存在（id={asset_id}）")
|
||||
|
||||
|
||||
def create_subdomain(session: Session, data: dict) -> Subdomain:
|
||||
_require_asset(session, data["asset_id"])
|
||||
sub = Subdomain(
|
||||
asset_id=data["asset_id"],
|
||||
host=data["host"].strip().lower(),
|
||||
@@ -157,7 +170,7 @@ def delete_subdomain(session: Session, sub_id: int) -> None:
|
||||
|
||||
# ---------------- 站点证书监控 ----------------
|
||||
|
||||
def _apply_probe(cert: SiteCert, info: dict) -> SiteCert:
|
||||
def _apply_probe(cert: SiteCert, info: dict, threshold: int = EXPIRING_THRESHOLD) -> SiteCert:
|
||||
"""把探测结果写入模型并定级"""
|
||||
cert.subject_cn = info["subject_cn"]
|
||||
cert.issuer = info["issuer"]
|
||||
@@ -165,16 +178,16 @@ def _apply_probe(cert: SiteCert, info: dict) -> SiteCert:
|
||||
cert.valid_to = info["valid_to"]
|
||||
cert.fingerprint = info["fingerprint"]
|
||||
cert.error = None
|
||||
cert.status = _judge_status(days_until(info["valid_to"]))
|
||||
cert.status = _judge_status(days_until(info["valid_to"]), threshold)
|
||||
cert.last_checked_at = utcnow()
|
||||
return cert
|
||||
|
||||
|
||||
def check_one(session: Session, cert: SiteCert) -> SiteCert:
|
||||
def check_one(session: Session, cert: SiteCert, threshold: int = EXPIRING_THRESHOLD) -> SiteCert:
|
||||
"""重新探测单条证书记录（失败则标记 error，保留旧到期信息）"""
|
||||
try:
|
||||
info = probe_site_cert(cert.hostname, cert.port)
|
||||
_apply_probe(cert, info)
|
||||
_apply_probe(cert, info, threshold)
|
||||
except Exception as e: # noqa: BLE001
|
||||
cert.status = "error"
|
||||
cert.error = str(e)[:200]
|
||||
@@ -187,6 +200,7 @@ def check_one(session: Session, cert: SiteCert) -> SiteCert:
|
||||
|
||||
def create_site_cert(session: Session, hostname: str, port: int = 443, asset_id: Optional[int] = None) -> SiteCert:
|
||||
"""创建探测目标并立即探测一次；hostname+port 已存在则复用并刷新"""
|
||||
_require_asset(session, asset_id)
|
||||
hostname = hostname.strip().lower()
|
||||
existing = session.exec(
|
||||
select(SiteCert).where(SiteCert.hostname == hostname, SiteCert.port == port)
|
||||
@@ -223,12 +237,13 @@ def delete_site_cert(session: Session, cert_id: int) -> None:
|
||||
session.commit()
|
||||
|
||||
|
||||
def check_all_site_certs(session: Session) -> dict:
|
||||
def check_all_site_certs(session: Session, threshold: int = EXPIRING_THRESHOLD) -> dict:
|
||||
"""全量刷新所有站点证书，返回统计与异常清单
|
||||
|
||||
探测为纯网络 IO（单次最长 8s），用线程池并发探测后统一写库：
|
||||
串行时 N 个站点最坏耗时 N×8s，并发后接近单站点耗时；
|
||||
写库集中在主线程一次 commit（原来逐条 commit 产生 N 次事务）。
|
||||
threshold：「即将到期」的天数阈值，默认 EXPIRING_THRESHOLD。
|
||||
"""
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
|
||||
@@ -244,7 +259,7 @@ def check_all_site_certs(session: Session) -> dict:
|
||||
for future in futures:
|
||||
cert = futures[future]
|
||||
try:
|
||||
_apply_probe(cert, future.result())
|
||||
_apply_probe(cert, future.result(), threshold)
|
||||
except Exception as e: # noqa: BLE001
|
||||
cert.status = "error"
|
||||
cert.error = str(e)[:200]
|
||||
|
||||
@@ -36,17 +36,6 @@ from app.models.provider import Provider
|
||||
_VALID_STATUS = {s.value for s in AssetStatus}
|
||||
|
||||
|
||||
def _load_config(provider: Provider) -> dict:
|
||||
"""（已弃用）解密平台级 API 配置，仅为兼容历史数据保留"""
|
||||
plain = crypto.decrypt(provider.api_config_encrypted)
|
||||
if not plain:
|
||||
return {}
|
||||
try:
|
||||
return json.loads(plain)
|
||||
except (json.JSONDecodeError, TypeError):
|
||||
return {}
|
||||
|
||||
|
||||
def _load_account_config(account: Account) -> dict:
|
||||
"""解密账号的 API 配置 JSON"""
|
||||
plain = crypto.decrypt(account.api_config_encrypted)
|
||||
@@ -334,6 +323,20 @@ _AI_SDK_MAP = {
|
||||
}
|
||||
|
||||
|
||||
class BalanceUnsupported(HTTPException):
|
||||
"""该平台没有可用的余额查询接口
|
||||
|
||||
与「查询失败」区分开：sync_all_ai_balances 把它计入 skipped 而不是 failed，
|
||||
否则每次「同步 AI 余额」都会把这类平台报成错误。
|
||||
"""
|
||||
|
||||
def __init__(self, sdk_type: str):
|
||||
super().__init__(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"{sdk_type} 暂不支持余额查询",
|
||||
)
|
||||
|
||||
|
||||
def refresh_ai_balance(session: Session, asset_id: int) -> dict:
|
||||
"""刷新 AI 账号余额：解密 api_key → 适配器 get_account → 更新余额"""
|
||||
asset = session.get(Asset, asset_id)
|
||||
@@ -367,19 +370,18 @@ def refresh_ai_balance(session: Session, asset_id: int) -> dict:
|
||||
)
|
||||
|
||||
adapter = registry.get_adapter(sdk_type, {"api_key": api_key})
|
||||
if not adapter.capabilities().get("get_account"):
|
||||
raise BalanceUnsupported(sdk_type)
|
||||
try:
|
||||
acc = adapter.get_account()
|
||||
except NotImplementedError:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_400_BAD_REQUEST,
|
||||
detail=f"{sdk_type} 暂不支持余额查询",
|
||||
)
|
||||
except NotImplementedError as e:
|
||||
raise BalanceUnsupported(sdk_type) from e
|
||||
except HTTPException:
|
||||
raise
|
||||
except Exception as e: # noqa: BLE001
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_502_BAD_GATEWAY, detail=f"查询余额失败：{e}"
|
||||
)
|
||||
) from e
|
||||
|
||||
if acc.balance is not None:
|
||||
ai.balance = acc.balance
|
||||
@@ -417,6 +419,7 @@ def sync_all_ai_balances(session: Session, max_workers: int = 5) -> dict:
|
||||
|
||||
success = 0
|
||||
failed = 0
|
||||
skipped = 0
|
||||
errors = []
|
||||
with ThreadPoolExecutor(max_workers=max_workers) as pool:
|
||||
futures = {pool.submit(_refresh_one, aid): name for aid, name in asset_ids}
|
||||
@@ -425,6 +428,9 @@ def sync_all_ai_balances(session: Session, max_workers: int = 5) -> dict:
|
||||
try:
|
||||
future.result()
|
||||
success += 1
|
||||
except BalanceUnsupported:
|
||||
# 平台本身没余额接口，不算失败（否则每次都报一堆红）
|
||||
skipped += 1
|
||||
except HTTPException as e:
|
||||
failed += 1
|
||||
errors.append(f"{name}: {e.detail}")
|
||||
@@ -435,6 +441,7 @@ def sync_all_ai_balances(session: Session, max_workers: int = 5) -> dict:
|
||||
"total": len(asset_ids),
|
||||
"success": success,
|
||||
"failed": failed,
|
||||
"skipped": skipped,
|
||||
"errors": errors,
|
||||
"synced_at": utcnow().isoformat(),
|
||||
}
|
||||
|
||||
+12
-4
@@ -40,10 +40,15 @@ python3 -m venv .venv
|
||||
echo "==> [4/6] 生成 .env（若不存在）"
|
||||
if [ ! -f .env ]; then
|
||||
MASTER_KEY="$(.venv/bin/python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")"
|
||||
# API_KEY / AGENT_KEY 默认生成强随机值：留空时 Agent 上报接口对任意来源放行
|
||||
# （require_agent_key 未配 key 即全放），而服务默认监听 0.0.0.0，
|
||||
# 公网上任何人都能伪造监控数据上报
|
||||
API_KEY="$(.venv/bin/python -c "import secrets; print(secrets.token_urlsafe(32))")"
|
||||
AGENT_KEY="$(.venv/bin/python -c "import secrets; print(secrets.token_urlsafe(32))")"
|
||||
cat > .env <<EOF
|
||||
APP_NAME=VPS 资产管理系统
|
||||
API_KEY=
|
||||
AGENT_KEY=
|
||||
API_KEY=$API_KEY
|
||||
AGENT_KEY=$AGENT_KEY
|
||||
MASTER_KEY=$MASTER_KEY
|
||||
TELEGRAM_BOT_TOKEN=
|
||||
TELEGRAM_CHAT_ID=
|
||||
@@ -62,7 +67,9 @@ S3_PREFIX=vps-manager
|
||||
S3_REGION=auto
|
||||
EOF
|
||||
chmod 600 .env
|
||||
echo " 已生成 .env（MASTER_KEY 自动生成，请妥善保管）"
|
||||
echo " 已生成 .env（MASTER_KEY / API_KEY / AGENT_KEY 均自动生成，请妥善保管）"
|
||||
echo " - API_KEY：填入前端「设置」后，外部（非 tailnet/本机）来源的写操作才能通过鉴权"
|
||||
echo " - AGENT_KEY：需写入各 VPS 的 /etc/vps-agent.env（VPS_AGENT_KEY），否则 Agent 上报会 401"
|
||||
else
|
||||
echo " .env 已存在，跳过生成"
|
||||
fi
|
||||
@@ -74,11 +81,12 @@ cp deploy/vps-backup-assets.service deploy/vps-backup-assets.timer /etc/systemd/
|
||||
cp deploy/vps-backup-metrics.service deploy/vps-backup-metrics.timer /etc/systemd/system/
|
||||
cp deploy/vps-sync-ai.service deploy/vps-sync-ai.timer /etc/systemd/system/
|
||||
cp deploy/vps-renewal-check.service deploy/vps-renewal-check.timer /etc/systemd/system/
|
||||
cp deploy/vps-cert-check.service deploy/vps-cert-check.timer /etc/systemd/system/
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now vps-manager
|
||||
systemctl enable --now vps-manager-update.timer
|
||||
systemctl enable --now vps-backup-assets.timer vps-backup-metrics.timer
|
||||
systemctl enable --now vps-sync-ai.timer vps-renewal-check.timer
|
||||
systemctl enable --now vps-sync-ai.timer vps-renewal-check.timer vps-cert-check.timer
|
||||
|
||||
echo "==> [6/6] 验证服务状态"
|
||||
sleep 3
|
||||
|
||||
+23
-5
@@ -1,6 +1,7 @@
|
||||
#!/usr/bin/env bash
|
||||
# vps-manager 自动更新脚本（由 systemd timer 定时触发）
|
||||
# 1. 自动同步 deploy/ 下的 systemd 单元文件（有变更才拷贝 + daemon-reload）
|
||||
# 1. 自动同步 deploy/ 下的 systemd 单元文件（有变更才拷贝 + daemon-reload；
|
||||
# timer 变更 enable --now，主服务 unit 变更额外 restart）
|
||||
# 2. 从 Gitea 拉取最新代码，如有更新则装依赖并重启服务
|
||||
#
|
||||
# 可配置项（环境变量）：
|
||||
@@ -30,10 +31,11 @@ print_version() {
|
||||
}
|
||||
|
||||
# 同步 systemd 单元文件：deploy/ 下的 .service/.timer 与 /etc/systemd/system
|
||||
# 不一致时拷贝并 reload；timer 变更额外 restart 使新调度周期立即生效。
|
||||
# 不一致时拷贝并 reload；timer 变更额外 enable --now（新调度周期立即生效且开机自启），
|
||||
# 主服务 unit 变更额外 restart（否则光 daemon-reload 日志说已更新、实际没生效）。
|
||||
# 每次都执行（而非仅版本更新时），保证单元变更不依赖代码变更触发。
|
||||
sync_units() {
|
||||
local changed=0 f base
|
||||
local changed=0 restart_main=0 f base
|
||||
for f in "$APP_DIR"/deploy/*.service "$APP_DIR"/deploy/*.timer; do
|
||||
[ -f "$f" ] || continue
|
||||
base=$(basename "$f")
|
||||
@@ -42,7 +44,16 @@ sync_units() {
|
||||
echo "[$(date '+%F %T')] 单元已更新: $base"
|
||||
changed=1
|
||||
case "$base" in
|
||||
*.timer) systemctl restart "$base" 2>/dev/null || true ;;
|
||||
*.timer)
|
||||
# enable --now：新增的 timer 只 restart 不会建开机自启软链，宿主重启后就丢了
|
||||
systemctl enable --now "$base" 2>/dev/null \
|
||||
|| systemctl restart "$base" 2>/dev/null || true
|
||||
;;
|
||||
"$SERVICE_NAME".service)
|
||||
# 常驻服务的 unit 变更（如 ExecStart）光 daemon-reload 不生效，必须 restart；
|
||||
# oneshot 服务下次触发自然读新配置，无需 restart
|
||||
restart_main=1
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
done
|
||||
@@ -50,6 +61,10 @@ sync_units() {
|
||||
systemctl daemon-reload
|
||||
echo "[$(date '+%F %T')] systemd 单元同步完成"
|
||||
fi
|
||||
if [ "$restart_main" -eq 1 ]; then
|
||||
systemctl restart "$SERVICE_NAME"
|
||||
echo "[$(date '+%F %T')] 已重启 $SERVICE_NAME 使 unit 变更生效"
|
||||
fi
|
||||
}
|
||||
|
||||
sync_units
|
||||
@@ -72,7 +87,10 @@ git reset --hard -q "origin/$BRANCH"
|
||||
|
||||
# 依赖如有变更自动安装（无变化时 pip 会快速跳过）
|
||||
if [ -x ".venv/bin/pip" ]; then
|
||||
.venv/bin/pip install -q -r requirements.txt 2>/dev/null || true
|
||||
# 不再用 2>/dev/null || true 把报错全吞：装不上时只表现为服务重启后 ImportError，极难定位
|
||||
if ! .venv/bin/pip install -q -r requirements.txt; then
|
||||
echo "[$(date '+%F %T')] 警告：依赖安装失败，服务可能因 ImportError 起不来；请手动执行 .venv/bin/pip install -r requirements.txt 看完整报错"
|
||||
fi
|
||||
fi
|
||||
|
||||
# 重启服务加载新代码
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
# 站点 SSL 证书检查服务（oneshot，由 timer 触发）
|
||||
# 部署位置：/etc/systemd/system/vps-cert-check.service
|
||||
|
||||
[Unit]
|
||||
Description=Probe site SSL certificates and notify on expiry
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
WorkingDirectory=/opt/vps-manager
|
||||
EnvironmentFile=-/opt/vps-manager/.env
|
||||
ExecStart=/opt/vps-manager/.venv/bin/python /opt/vps-manager/scripts/check_site_certs.py
|
||||
@@ -0,0 +1,15 @@
|
||||
# 站点 SSL 证书每日检查定时器（09:30，错开 09:00 的续费检查，避免两条提醒同时发）
|
||||
# 部署位置：/etc/systemd/system/vps-cert-check.timer
|
||||
# 阈值默认取 ssl_service.EXPIRING_THRESHOLD（30 天）；如需自定义，
|
||||
# 在 vps-cert-check.service 的 ExecStart 末尾追加天数参数即可。
|
||||
|
||||
[Unit]
|
||||
Description=Daily site SSL certificate check
|
||||
|
||||
[Timer]
|
||||
OnCalendar=*-*-* 09:30:00
|
||||
Persistent=true
|
||||
Unit=vps-cert-check.service
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -11,4 +11,12 @@ if [ ! -d ".venv" ]; then
|
||||
.venv/bin/pip install -r requirements.txt
|
||||
fi
|
||||
|
||||
exec .venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000 "$@"
|
||||
# 监听地址/端口可用环境变量覆盖（HOST=127.0.0.1 ./run.sh）。
|
||||
# 默认 0.0.0.0 是为了让其他 VPS 上的 Agent 能直连 100.89.0.11:8000 上报；
|
||||
# 若所有 Agent 都改走 tailscale serve 的 HTTPS 地址，HOST=127.0.0.1 更安全：
|
||||
# GET 接口对 tailnet/本机零鉴权，绑公网 IP 时资产清单会被任意读取。
|
||||
# 注：生产由 systemd 拉起，绑定地址在 deploy/vps-manager.service 的 ExecStart 里。
|
||||
HOST="${HOST:-0.0.0.0}"
|
||||
PORT="${PORT:-8000}"
|
||||
|
||||
exec .venv/bin/uvicorn app.main:app --host "$HOST" --port "$PORT" "$@"
|
||||
|
||||
@@ -22,7 +22,9 @@ def main() -> int:
|
||||
threshold = int(sys.argv[1]) if len(sys.argv) > 1 else ssl_service.EXPIRING_THRESHOLD
|
||||
init_db()
|
||||
with Session(assets_engine) as session:
|
||||
result = ssl_service.check_all_site_certs(session)
|
||||
# 阈值必须传进去：否则定级仍按模块常量 EXPIRING_THRESHOLD，
|
||||
# CLI 参数取了却从未生效（文档声称支持）
|
||||
result = ssl_service.check_all_site_certs(session, threshold)
|
||||
stats = result["stats"]
|
||||
|
||||
# 即将到期 / 已过期 / 探测失败的证书 → 发提醒
|
||||
@@ -40,7 +42,7 @@ def main() -> int:
|
||||
)
|
||||
|
||||
print(
|
||||
f"[SSL检查] 共 {stats['total']} 个站点 | 正常 {stats['ok']} | "
|
||||
f"[SSL检查] 阈值 {threshold} 天 | 共 {stats['total']} 个站点 | 正常 {stats['ok']} | "
|
||||
f"即将到期 {stats['expiring']} | 已过期 {stats['expired']} | 探测失败 {stats['error']}"
|
||||
)
|
||||
for p in result["problems"]:
|
||||
|
||||
@@ -18,6 +18,7 @@ setup.sh 与一条 serve 命令重建，故不在包内）：
|
||||
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import shutil
|
||||
import socket
|
||||
import sqlite3
|
||||
@@ -81,8 +82,14 @@ def main() -> int:
|
||||
if src.exists():
|
||||
snap_db(src, data_dst / db)
|
||||
copied.append(f"data/{db}")
|
||||
elif db == "assets.db":
|
||||
# 资产库是迁移的主体：缺了它仍打包，恢复端会把目标机 data/ 换成空库
|
||||
# 并报「恢复成功」，旧数据仅存于 data.pre-restore-*
|
||||
print("[abort] 缺少 data/assets.db（迁移包没有主体数据）", file=sys.stderr)
|
||||
shutil.rmtree(work, ignore_errors=True)
|
||||
return 2
|
||||
else:
|
||||
print(f"[skip] {db} 不存在")
|
||||
print("[warn] metrics.db 不存在，包内不含监控历史（不影响资产迁移）")
|
||||
escrow = data_src / "master_key.escrow"
|
||||
if escrow.exists():
|
||||
shutil.copy2(escrow, data_dst / "master_key.escrow")
|
||||
@@ -119,8 +126,15 @@ def main() -> int:
|
||||
)
|
||||
|
||||
out.parent.mkdir(parents=True, exist_ok=True)
|
||||
with tarfile.open(out, "w:gz") as tar:
|
||||
tar.add(root, arcname="bundle")
|
||||
# 包内含 .env（MASTER_KEY）与 escrow：先收紧 umask 再落盘，
|
||||
# 避免默认 644 落在 /tmp 被同机其他用户读走
|
||||
old_umask = os.umask(0o077)
|
||||
try:
|
||||
with tarfile.open(out, "w:gz") as tar:
|
||||
tar.add(root, arcname="bundle")
|
||||
finally:
|
||||
os.umask(old_umask)
|
||||
out.chmod(0o600)
|
||||
shutil.rmtree(work, ignore_errors=True)
|
||||
|
||||
print(f"[ok] 迁移包：{out}")
|
||||
|
||||
@@ -65,10 +65,12 @@ def main() -> int:
|
||||
print("[abort] 包内缺 manifest.sha256，拒绝恢复", file=sys.stderr)
|
||||
return 2
|
||||
print("[1/4] 校验包内文件…")
|
||||
listed: set[str] = set()
|
||||
for line in manifest_sha.read_text(encoding="utf-8").splitlines():
|
||||
if not line.strip():
|
||||
continue
|
||||
digest, name = line.split(" ", 1)
|
||||
listed.add(name)
|
||||
target = root / name
|
||||
if not target.exists():
|
||||
print(f"[abort] 包内缺文件：{name}", file=sys.stderr)
|
||||
@@ -80,6 +82,18 @@ def main() -> int:
|
||||
return 2
|
||||
print(f" ok {name}")
|
||||
|
||||
# 必备文件预检：校验和只能证明「已列出的文件完好」，发现不了「压根没打进包」。
|
||||
# 缺 assets.db/.env 还往下走的话，目标机 data/ 与 .env 已被移走，
|
||||
# 恢复出的却是空库，而且还会报「恢复成功」
|
||||
missing = [
|
||||
name for name in ("data/assets.db", ".env")
|
||||
if name not in listed or not (root / name).exists()
|
||||
]
|
||||
if missing:
|
||||
print(f"[abort] 迁移包缺必备文件：{', '.join(missing)}（尚未触碰目标机状态）",
|
||||
file=sys.stderr)
|
||||
return 2
|
||||
|
||||
ts = datetime.now().strftime("%Y%m%d_%H%M%S")
|
||||
print("[2/4] 备份目标机现有状态…")
|
||||
for src, tag in ((app_dir / "data", f"data.pre-restore-{ts}"),
|
||||
|
||||
+7
-4
@@ -124,12 +124,15 @@ window.VpsFmt = {
|
||||
if (d !== null && d !== undefined && d <= 30) return 'bg-amber-500/10 text-amber-600 dark:text-amber-400';
|
||||
return 'bg-slate-500/10 text-slate-500';
|
||||
},
|
||||
/* 倒计时文案：统一「距到期还有多久」的表述，负数归一为「已过期 N 天」，避免直出 "-3 天" */
|
||||
countdownText(d) {
|
||||
if (d === null || d === undefined) return '未设到期日';
|
||||
/* 倒计时文案：统一「距到期还有多久」的表述，负数归一为「已过期 N 天」，避免直出 "-3 天"
|
||||
opts.unit 传 '' 时只说「N 天」（表格窄列用），默认「N 天后」
|
||||
opts.empty 无到期日时的占位，默认「未设到期日」（表格里可传 '—' / '未知'）
|
||||
已有多处视图各自实现一份（且措辞不一），一律改为调这里 */
|
||||
countdownText(d, opts = {}) {
|
||||
if (d === null || d === undefined) return opts.empty === undefined ? '未设到期日' : opts.empty;
|
||||
if (d < 0) return '已过期 ' + Math.abs(d) + ' 天';
|
||||
if (d === 0) return '今天到期';
|
||||
return d + ' 天后';
|
||||
return d + (opts.unit === '' ? ' 天' : ' 天后');
|
||||
},
|
||||
checkBadge(s) {
|
||||
return { pass: 'bg-emerald-500/10 text-emerald-600 dark:text-emerald-400', warn: 'bg-amber-500/10 text-amber-600 dark:text-amber-400', fail: 'bg-red-500/10 text-red-600 dark:text-red-400', unknown: 'bg-slate-500/10 text-slate-500' }[s] || 'bg-slate-500/10 text-slate-500';
|
||||
|
||||
+7
-3
@@ -376,7 +376,8 @@ const AccountsViewModal = {
|
||||
return p ? p.name : slug;
|
||||
}
|
||||
function assetsOf(a) {
|
||||
return store.assets.filter(x => x.account_id === a.id);
|
||||
// 用 allAssets（全量口径）：账号名下有多少资产是事实，不该受资产页筛选影响
|
||||
return store.allAssets.filter(x => x.account_id === a.id);
|
||||
}
|
||||
function toggle(id) { expanded[id] = !expanded[id]; }
|
||||
// 账号所属平台配了 sdk_type 且账号有 API 配置时，提供测试/同步
|
||||
@@ -402,7 +403,9 @@ const AccountsViewModal = {
|
||||
if (r.vps_error) lines.push('VPS 错误：' + r.vps_error);
|
||||
if (r.domains_error) lines.push('域名错误：' + r.domains_error);
|
||||
alert(lines.join('\n'));
|
||||
await Promise.all([loadAccounts(), loadAssets()]);
|
||||
// 同步会新建/更新资产（含到期日），总览的统计卡片也得跟着刷，
|
||||
// 否则回到总览看到的还是同步前的数字
|
||||
await Promise.all([loadAccounts(), loadAssets(), loadOverview()]);
|
||||
} catch (e) { alert('同步失败：' + e.message); }
|
||||
}
|
||||
// 每次打开重置展开状态；关闭时连带收掉密码弹窗
|
||||
@@ -472,7 +475,8 @@ const AccountsViewModal = {
|
||||
/* 凭据编辑模态框（密码库）
|
||||
*
|
||||
* 粒度 = 站点 × 登录方式：同一邮箱注册多个站点就录多条，密码相同也各存一份。
|
||||
* 2FA 录入必须同时填当前动态码（服务端校验），防 secret 手误成废条目。
|
||||
* 2FA 的动态码是选填：填了就当场校验（防 secret 手误成废条目），拿不到可以先存着，
|
||||
* 条目会标「未验证」，之后在列表里随时补验。
|
||||
*/
|
||||
const CredentialModal = {
|
||||
template: `
|
||||
|
||||
+21
-4
@@ -25,13 +25,13 @@ function _writeOauthList(k, list) {
|
||||
|
||||
const store = reactive({
|
||||
view: 'dashboard',
|
||||
assets: [],
|
||||
assets: [], // 列表口径：按当前筛选条件（类型/状态/平台/搜索）的结果
|
||||
allAssets: [], // 统计口径：不带筛选的全量资产（总览/监控卡片/平台计数用）
|
||||
providers: [],
|
||||
accounts: [],
|
||||
subdomains: [],
|
||||
siteCerts: [],
|
||||
overview: {},
|
||||
expiring: [],
|
||||
serverMetrics: {},
|
||||
search: '',
|
||||
filterType: '',
|
||||
@@ -106,7 +106,25 @@ function buildAssetPayload(f) {
|
||||
// 后端 status 参数只认单个 AssetStatus 枚举值；「异常」是「已停止 + 已过期」的组合概念，
|
||||
// 后端不支持多值筛选，这里当作前端本地筛选的哨兵值，不发给 API，由视图层自己过滤。
|
||||
const CLIENT_SIDE_STATUS_FILTERS = new Set(['abnormal']);
|
||||
|
||||
// 列表口径 vs 统计口径必须分开：总览到期日历、监控中心统计卡片、平台页
|
||||
// 「关联 N 个资产」、账号弹窗的资产清单都是全量语义，如果跟着筛选走，
|
||||
// 用户在资产页点了筛选（或从统计卡片跳转筛选）后，其他视图的数字会跟着变小，
|
||||
// 看起来像数据丢了。
|
||||
async function loadAllAssets() {
|
||||
const params = new URLSearchParams();
|
||||
params.set('sort', 'expiry_date'); params.set('order', 'asc');
|
||||
store.allAssets = await Api.get('/assets?' + params.toString());
|
||||
}
|
||||
function _hasAssetFilter() {
|
||||
return !!(store.filterType || store.filterStatus || store.filterProvider || store.search);
|
||||
}
|
||||
async function loadAssets() {
|
||||
await loadAllAssets();
|
||||
if (!_hasAssetFilter()) {
|
||||
store.assets = [...store.allAssets]; // 无筛选时两个口径同源，不重复请求
|
||||
return;
|
||||
}
|
||||
const params = new URLSearchParams();
|
||||
if (store.filterType) params.set('asset_type', store.filterType);
|
||||
if (store.filterStatus && !CLIENT_SIDE_STATUS_FILTERS.has(store.filterStatus)) params.set('status', store.filterStatus);
|
||||
@@ -127,10 +145,9 @@ async function loadCredentials() {
|
||||
async function loadSubdomains() { store.subdomains = await Api.get('/subdomains'); }
|
||||
async function loadSiteCerts() { store.siteCerts = await Api.get('/site-certs'); }
|
||||
async function loadOverview() { store.overview = await Api.get('/stats/overview'); }
|
||||
async function loadExpiring() { store.expiring = await Api.get('/stats/expiring?days=30'); }
|
||||
async function loadAll() {
|
||||
store.loading = true; store.error = '';
|
||||
try { await Promise.all([loadAssets(), loadProviders(), loadAccounts(), loadCredentials(), loadSubdomains(), loadSiteCerts(), loadOverview(), loadExpiring()]); }
|
||||
try { await Promise.all([loadAssets(), loadProviders(), loadAccounts(), loadCredentials(), loadSubdomains(), loadSiteCerts(), loadOverview()]); }
|
||||
catch (e) { store.error = e.message; } finally { store.loading = false; }
|
||||
}
|
||||
|
||||
|
||||
@@ -54,7 +54,7 @@ const AssetsView = {
|
||||
<td class="px-4 py-2.5 font-medium">{{ a.name }}</td>
|
||||
<td class="px-4 py-2.5"><span class="text-xs px-2 py-0.5 rounded-full" :class="Fmt.typeBadge(a.asset_type)">{{ Fmt.TYPE_LABELS[a.asset_type] }}</span></td>
|
||||
<td class="px-4 py-2.5 text-slate-500">{{ a.provider_name || a.provider }}</td>
|
||||
<td class="px-4 py-2.5" :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '—' }}<span v-if="a.days_to_expiry!==null && a.days_to_expiry!==undefined" class="text-xs ml-1">({{ a.days_to_expiry }}天)</span></td>
|
||||
<td class="px-4 py-2.5" :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '—' }}<span v-if="a.days_to_expiry!==null && a.days_to_expiry!==undefined" class="text-xs ml-1">({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }})</span></td>
|
||||
<td class="px-4 py-2.5 text-slate-600 dark:text-slate-300">{{ a.cost }} {{ a.currency }}<span v-if="a.renewal_cycle" class="text-xs text-slate-400 ml-1">/{{ Fmt.CYCLE_LABELS[a.renewal_cycle] || a.renewal_cycle }}</span></td>
|
||||
<td class="px-4 py-2.5"><span class="text-xs px-2 py-0.5 rounded-full" :class="Fmt.statusBadge(a.status)">{{ Fmt.STATUS_LABELS[a.status] }}</span></td>
|
||||
<td class="px-4 py-2.5 text-right whitespace-nowrap">
|
||||
@@ -80,7 +80,7 @@ const AssetsView = {
|
||||
<span class="text-xs px-2 py-0.5 rounded-full shrink-0" :class="Fmt.typeBadge(a.asset_type)">{{ Fmt.TYPE_LABELS[a.asset_type] }}</span>
|
||||
</div>
|
||||
<div class="flex items-center gap-3 mt-2 text-xs">
|
||||
<span :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '无到期' }}<span v-if="a.days_to_expiry!==null&&a.days_to_expiry!==undefined"> ({{ a.days_to_expiry }}天)</span></span>
|
||||
<span :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '无到期' }}<span v-if="a.days_to_expiry!==null&&a.days_to_expiry!==undefined"> ({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }})</span></span>
|
||||
<span class="text-slate-500">{{ a.cost }}{{ a.currency }}</span>
|
||||
<span class="px-2 py-0.5 rounded-full" :class="Fmt.statusBadge(a.status)">{{ Fmt.STATUS_LABELS[a.status] }}</span>
|
||||
</div>
|
||||
@@ -149,7 +149,10 @@ const AssetsView = {
|
||||
if (!confirm('同步所有 AI 账号的余额？')) return;
|
||||
try {
|
||||
const r = await Api.post('/sync/ai-balances', {});
|
||||
alert('同步完成：成功 ' + r.success + '，失败 ' + r.failed + (r.errors && r.errors.length ? '\n' + r.errors.join('\n') : ''));
|
||||
// skipped：平台本身没余额接口（如 OpenAI 已下线 billing），不属于失败
|
||||
alert('同步完成：成功 ' + r.success + '，失败 ' + r.failed +
|
||||
(r.skipped ? '，跳过 ' + r.skipped + '（平台无余额接口）' : '') +
|
||||
(r.errors && r.errors.length ? '\n' + r.errors.join('\n') : ''));
|
||||
await loadAssets();
|
||||
} catch (e) { alert('同步失败：' + e.message); }
|
||||
}
|
||||
|
||||
@@ -56,10 +56,11 @@ const DashboardView = {
|
||||
</div>`,
|
||||
setup() {
|
||||
// 到期日历：只看未注销且有到期日的资产，最紧急（含已过期）排最前
|
||||
const expiryList = Vue.computed(() => store.assets
|
||||
// 用 allAssets（全量口径）：总览是全局视图，不能跟着资产页的筛选变小
|
||||
const expiryList = Vue.computed(() => store.allAssets
|
||||
.filter(a => a.expiry_date && a.status !== 'cancelled')
|
||||
.sort((x, y) => (x.days_to_expiry ?? 10 ** 9) - (y.days_to_expiry ?? 10 ** 9)));
|
||||
const noExpiryCount = Vue.computed(() => store.assets.filter(a => !a.expiry_date && a.status !== 'cancelled').length);
|
||||
const noExpiryCount = Vue.computed(() => store.allAssets.filter(a => !a.expiry_date && a.status !== 'cancelled').length);
|
||||
// 副标题：类型 · 平台 · 费用/周期，缺失的字段不占位（避免出现 "VPS · · 3.5USD"）
|
||||
function meta(a) {
|
||||
const bits = [Fmt.TYPE_LABELS[a.asset_type] || a.asset_type, a.provider_name || a.provider];
|
||||
|
||||
@@ -29,7 +29,7 @@ const DomainsView = {
|
||||
<td class="px-4 py-2.5 font-medium">{{ a.domain_detail.domain_name }}</td>
|
||||
<td class="px-4 py-2.5 text-slate-500">{{ a.domain_detail.registrar || '—' }}</td>
|
||||
<td class="px-4 py-2.5 text-slate-500">{{ a.domain_detail.dns_provider || '—' }}</td>
|
||||
<td class="px-4 py-2.5" :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '—' }}<span v-if="a.days_to_expiry!==null" class="text-xs ml-1">({{ a.days_to_expiry }}天)</span></td>
|
||||
<td class="px-4 py-2.5" :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '—' }}<span v-if="a.days_to_expiry!==null&&a.days_to_expiry!==undefined" class="text-xs ml-1">({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }})</span></td>
|
||||
<td class="px-4 py-2.5">
|
||||
<span v-if="sslByAsset[a.id]" class="text-xs px-2 py-0.5 rounded-full whitespace-nowrap" :class="certBadge(sslByAsset[a.id].days_to_expiry)" :title="sslByAsset[a.id].issuer || ''">
|
||||
{{ sslByAsset[a.id].hostname }} · {{ certText(sslByAsset[a.id]) }}
|
||||
@@ -154,11 +154,8 @@ const DomainsView = {
|
||||
} catch (e) { alert('探测失败：' + e.message); }
|
||||
}
|
||||
function certText(c) {
|
||||
const d = c.days_to_expiry;
|
||||
if (d === null || d === undefined) return '未知';
|
||||
if (d < 0) return '已过期' + Math.abs(d) + '天';
|
||||
if (d === 0) return '今天到期';
|
||||
return d + '天';
|
||||
// 统一走 Fmt.countdownText：不再自己维护一份，也避免负数直出「-3天」
|
||||
return Fmt.countdownText(c.days_to_expiry, { unit: '', empty: '未知' });
|
||||
}
|
||||
function certBadge(d) {
|
||||
if (d === null || d === undefined) return 'bg-slate-500/10 text-slate-500';
|
||||
|
||||
@@ -189,9 +189,11 @@ const MonitorView = {
|
||||
];
|
||||
const hasExpiry = a => a.expiry_date && a.status !== 'cancelled';
|
||||
// 当前 TAB 下、有到期日的资产（未叠加到期区间子筛选），作为统计卡片与列表的共同基础数据集
|
||||
// 用 allAssets（全量口径）：监控中心靠自己的 TAB 与子筛选限定范围，
|
||||
// 不应该继承资产页的类型/状态/平台/搜索筛选，否则卡片数字会莫名变小
|
||||
const tabScopedAssets = Vue.computed(() => {
|
||||
if (store.monitorTab === 'ssl') return [];
|
||||
let list = store.assets.filter(hasExpiry);
|
||||
let list = store.allAssets.filter(hasExpiry);
|
||||
const t = store.monitorTab;
|
||||
if (t === 'subscription') list = list.filter(a => a.cost > 0);
|
||||
else if (t) list = list.filter(a => a.asset_type === t);
|
||||
@@ -253,12 +255,9 @@ const MonitorView = {
|
||||
function clearExpiryFilter() { store.monitorExpiryFilter = ''; }
|
||||
function toggleSslStatusFilter(k) { store.monitorSslStatusFilter = store.monitorSslStatusFilter === k ? '' : k; }
|
||||
function clearSslStatusFilter() { store.monitorSslStatusFilter = ''; }
|
||||
function countdownText(d) {
|
||||
if (d === null || d === undefined) return '—';
|
||||
if (d < 0) return '已过期 ' + Math.abs(d) + ' 天';
|
||||
if (d === 0) return '今天到期';
|
||||
return d + ' 天';
|
||||
}
|
||||
// 文案统一走 Fmt.countdownText（不再自己维护一份）；
|
||||
// 此处保留窄列样式：无到期日显示 —，天数不带「后」
|
||||
const countdownText = d => Fmt.countdownText(d, { unit: '', empty: '—' });
|
||||
function countdownBadge(d) {
|
||||
if (d === null || d === undefined) return 'bg-slate-500/10 text-slate-500';
|
||||
if (d < 0 || d === 0 || d <= 7) return 'bg-red-500/10 text-red-600 dark:text-red-400';
|
||||
|
||||
@@ -47,9 +47,11 @@ const ProvidersView = {
|
||||
setup() {
|
||||
// 凭证已下沉到账号层：平台卡片不再提供测试/同步（见账号弹窗）
|
||||
// 平台关联资产数：优先按 provider_id 归并，其次按资产里填的平台名/slug
|
||||
// 用 allAssets（全量口径）：「关联 N 个资产」是平台的事实数量，
|
||||
// 不能因为资产页正在筛选就少算（否则点进去看到的清单与数字对不上）
|
||||
const assetCounts = Vue.computed(() => {
|
||||
const m = {};
|
||||
for (const a of store.assets) {
|
||||
for (const a of store.allAssets) {
|
||||
if (a.provider_id) m['id:' + a.provider_id] = (m['id:' + a.provider_id] || 0) + 1;
|
||||
else if (a.provider) m['p:' + a.provider] = (m['p:' + a.provider] || 0) + 1;
|
||||
}
|
||||
|
||||
@@ -13,17 +13,17 @@ const ServersView = {
|
||||
<div v-if="m.info" class="grid grid-cols-2 lg:grid-cols-4 gap-3">
|
||||
<div class="bg-white dark:bg-slate-900 rounded-xl border border-slate-200 dark:border-slate-800 p-4">
|
||||
<div class="text-xs text-slate-500">CPU</div>
|
||||
<div class="text-xl font-bold mt-1">{{ latest ? latest.cpu_pct : '—' }}%</div>
|
||||
<div class="text-xl font-bold mt-1">{{ pct(latest && latest.cpu_pct) }}</div>
|
||||
<div class="text-xs text-slate-400 mt-1">{{ m.info.cpu_cores }} 核</div>
|
||||
</div>
|
||||
<div class="bg-white dark:bg-slate-900 rounded-xl border border-slate-200 dark:border-slate-800 p-4">
|
||||
<div class="text-xs text-slate-500">内存</div>
|
||||
<div class="text-xl font-bold mt-1">{{ latest ? latest.mem_pct : '—' }}%</div>
|
||||
<div class="text-xl font-bold mt-1">{{ pct(latest && latest.mem_pct) }}</div>
|
||||
<div class="text-xs text-slate-400 mt-1">{{ m.info.mem_total_gb }} GB</div>
|
||||
</div>
|
||||
<div class="bg-white dark:bg-slate-900 rounded-xl border border-slate-200 dark:border-slate-800 p-4">
|
||||
<div class="text-xs text-slate-500">磁盘</div>
|
||||
<div class="text-xl font-bold mt-1">{{ latest ? latest.disk_pct : '—' }}%</div>
|
||||
<div class="text-xl font-bold mt-1">{{ pct(latest && latest.disk_pct) }}</div>
|
||||
<div class="text-xs text-slate-400 mt-1">{{ m.info.disk_total_gb }} GB</div>
|
||||
</div>
|
||||
<div class="bg-white dark:bg-slate-900 rounded-xl border border-slate-200 dark:border-slate-800 p-4">
|
||||
@@ -100,7 +100,11 @@ const ServersView = {
|
||||
function scoreClass(level) {
|
||||
return { good: 'text-emerald-600 dark:text-emerald-400', warning: 'text-amber-600 dark:text-amber-400', risk: 'text-red-600 dark:text-red-400', unknown: 'text-slate-400' }[level] || 'text-slate-400';
|
||||
}
|
||||
// 百分比统一判空：采样缺项时字段是 null，直出模板会渲染成「null%」
|
||||
function pct(v) {
|
||||
return (v === null || v === undefined) ? '—' : v + '%';
|
||||
}
|
||||
function goBack() { window.location.hash = '#assets'; }
|
||||
return { store, Fmt, m, latest, scoreClass, goBack };
|
||||
return { store, Fmt, m, latest, scoreClass, pct, goBack };
|
||||
},
|
||||
};
|
||||
|
||||
@@ -96,7 +96,9 @@ const SettingsView = {
|
||||
const data = JSON.parse(ev.target.result);
|
||||
const r = await Api.post('/assets/import', data);
|
||||
dataResult.value = '导入完成：新增 ' + r.created + '，更新 ' + r.updated + (r.errors && r.errors.length ? '，错误 ' + r.errors.length : '');
|
||||
await loadAssets();
|
||||
// 导入可能新增平台/账号/资产，全量重拉（含总览统计），
|
||||
// 只刷 loadAssets 会让总览卡片与平台页计数停在导入前
|
||||
await loadAll();
|
||||
} catch (err) { dataResult.value = '导入失败：' + err.message; }
|
||||
};
|
||||
reader.readAsText(file);
|
||||
|
||||
@@ -38,7 +38,7 @@ const SubscriptionsView = {
|
||||
<td class="px-4 py-2.5 font-medium">{{ a.name }}</td>
|
||||
<td class="px-4 py-2.5 text-slate-500">{{ a.provider_name || a.provider }}</td>
|
||||
<td class="px-4 py-2.5 text-slate-600 dark:text-slate-300">{{ a.cost }} {{ a.currency }}<span v-if="a.renewal_cycle" class="text-xs text-slate-400 ml-1">/{{ Fmt.CYCLE_LABELS[a.renewal_cycle] || a.renewal_cycle }}</span></td>
|
||||
<td class="px-4 py-2.5" :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '—' }}<span v-if="a.days_to_expiry!==null&&a.days_to_expiry!==undefined" class="text-xs ml-1">({{ a.days_to_expiry }}天)</span></td>
|
||||
<td class="px-4 py-2.5" :class="Fmt.expiryText(a.days_to_expiry)">{{ a.expiry_date || '—' }}<span v-if="a.days_to_expiry!==null&&a.days_to_expiry!==undefined" class="text-xs ml-1">({{ Fmt.countdownText(a.days_to_expiry, { unit: '' }) }})</span></td>
|
||||
<td class="px-4 py-2.5 text-right whitespace-nowrap">
|
||||
<a v-if="a.renew_url" :href="a.renew_url" target="_blank" class="text-emerald-600 dark:text-emerald-400 hover:underline mr-3 text-xs">续费</a>
|
||||
<a v-if="a.cancel_url" :href="a.cancel_url" target="_blank" class="text-red-600 dark:text-red-400 hover:underline text-xs">取消</a>
|
||||
@@ -50,7 +50,9 @@ const SubscriptionsView = {
|
||||
</div>
|
||||
</div>`,
|
||||
setup() {
|
||||
const subs = Vue.computed(() => store.assets
|
||||
// 用 allAssets（全量口径）：本页有自己的口径（付费/有到期日），
|
||||
// 不该被资产页的类型/状态/搜索筛选影响，否则月度支出统计会跟着缩水
|
||||
const subs = Vue.computed(() => store.allAssets
|
||||
.filter(a => (a.cost > 0 || a.expiry_date) && a.status !== 'cancelled')
|
||||
.sort((x, y) => (x.days_to_expiry ?? 9999) - (y.days_to_expiry ?? 9999)));
|
||||
const monthlyByCurrency = Vue.computed(() => {
|
||||
|
||||
@@ -0,0 +1,139 @@
|
||||
"""VPS Agent 安全检查采集测试
|
||||
|
||||
覆盖两处「假 pass」回归：
|
||||
|
||||
1. ssh_config：只读 /etc/ssh/sshd_config 会漏掉 Include 展开的 sshd_config.d/*.conf
|
||||
（Debian/Ubuntu 云镜像把加固项放在那里），且关键字缺失时被当成 unknown 直接放过；
|
||||
实际 PasswordAuthentication 的 sshd 默认值就是 yes，这类机器是开着密码登录的。
|
||||
2. firewall：`iptables -L -n` 即使零规则也会输出链头，拿 stdout 非空判「有规则」
|
||||
会永远 pass；改用 `iptables -S` 统计 -A 规则行并结合 INPUT 策略判断。
|
||||
|
||||
运行：.venv/bin/pytest tests/test_agent_collector.py -v
|
||||
"""
|
||||
|
||||
import subprocess
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
import pytest
|
||||
|
||||
AGENT_DIR = Path(__file__).resolve().parent.parent / "agent"
|
||||
if str(AGENT_DIR) not in sys.path:
|
||||
sys.path.insert(0, str(AGENT_DIR))
|
||||
|
||||
import collector # noqa: E402 （agent 目录不是包，按路径导入）
|
||||
|
||||
|
||||
@pytest.fixture()
|
||||
def sshd_tree(tmp_path, monkeypatch):
|
||||
"""把 collector.SSHD_CONFIG 指向 tmp 下的假配置树"""
|
||||
main = tmp_path / "sshd_config"
|
||||
dropin_dir = tmp_path / "sshd_config.d"
|
||||
dropin_dir.mkdir()
|
||||
monkeypatch.setattr(collector, "SSHD_CONFIG", str(main))
|
||||
return main, dropin_dir
|
||||
|
||||
|
||||
def test_ssh_config_reads_included_dropins(sshd_tree):
|
||||
"""加固项写在 sshd_config.d/*.conf 时必须被读到，不能误报 warn"""
|
||||
main, dropin_dir = sshd_tree
|
||||
main.write_text(
|
||||
f"Include {dropin_dir}/*.conf\n\n# 主文件里是未加固的旧值\nPermitRootLogin yes\n"
|
||||
)
|
||||
(dropin_dir / "50-cloud.conf").write_text(
|
||||
"PermitRootLogin prohibit-password\nPasswordAuthentication no\n"
|
||||
)
|
||||
|
||||
result = collector._check_ssh_config()
|
||||
|
||||
assert result["status"] == "pass"
|
||||
assert "PermitRootLogin=prohibit-password" in result["detail"]
|
||||
assert "PasswordAuthentication=no" in result["detail"]
|
||||
|
||||
|
||||
def test_ssh_config_first_value_wins(sshd_tree):
|
||||
"""sshd 语义是「首次出现的值生效」：Include 在顶部时 drop-in 优先于主文件"""
|
||||
main, dropin_dir = sshd_tree
|
||||
main.write_text(f"Include {dropin_dir}/*.conf\nPasswordAuthentication yes\n")
|
||||
(dropin_dir / "60-hardening.conf").write_text("PasswordAuthentication no\n")
|
||||
|
||||
result = collector._check_ssh_config()
|
||||
|
||||
assert result["status"] == "pass"
|
||||
assert "PasswordAuthentication=no" in result["detail"]
|
||||
|
||||
|
||||
def test_ssh_config_missing_keys_use_sshd_defaults(sshd_tree):
|
||||
"""关键字没写 ≠ 安全：PasswordAuthentication 默认 yes，必须告警而不是 pass"""
|
||||
main, _ = sshd_tree
|
||||
main.write_text("# 空配置，两个关键字都没写\nPort 22\n")
|
||||
|
||||
result = collector._check_ssh_config()
|
||||
|
||||
assert result["status"] == "warn"
|
||||
assert "PasswordAuthentication=yes" in result["detail"]
|
||||
assert "未显式配置" in result["detail"]
|
||||
assert "关闭密码登录" in result["suggestion"]
|
||||
|
||||
|
||||
def test_ssh_config_unreadable_is_unknown(monkeypatch):
|
||||
"""读不到主配置时如实报 unknown，不能默认放行"""
|
||||
monkeypatch.setattr(collector, "SSHD_CONFIG", "/nonexistent/sshd_config")
|
||||
|
||||
result = collector._check_ssh_config()
|
||||
|
||||
assert result["status"] == "unknown"
|
||||
assert "无法读取" in result["detail"]
|
||||
|
||||
|
||||
def _fake_run(monkeypatch, iptables_output: str):
|
||||
"""ufw 不存在（走 iptables 分支），iptables -S 返回指定输出"""
|
||||
|
||||
def run(cmd, **kwargs):
|
||||
if cmd[0] == "ufw":
|
||||
raise FileNotFoundError("ufw not installed")
|
||||
return subprocess.CompletedProcess(cmd, 0, stdout=iptables_output, stderr="")
|
||||
|
||||
monkeypatch.setattr(collector.subprocess, "run", run)
|
||||
|
||||
|
||||
def test_firewall_no_rules_is_warn(monkeypatch):
|
||||
"""零规则时 -S 仍有 -P 行，不能据此判 pass"""
|
||||
_fake_run(monkeypatch, "-P INPUT ACCEPT\n-P FORWARD ACCEPT\n-P OUTPUT ACCEPT\n")
|
||||
|
||||
result = collector._check_firewall()
|
||||
|
||||
assert result["status"] == "warn"
|
||||
assert "无过滤规则" in result["detail"]
|
||||
assert result["suggestion"]
|
||||
|
||||
|
||||
def test_firewall_with_rules_is_pass(monkeypatch):
|
||||
_fake_run(
|
||||
monkeypatch,
|
||||
"-P INPUT ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT\n",
|
||||
)
|
||||
|
||||
result = collector._check_firewall()
|
||||
|
||||
assert result["status"] == "pass"
|
||||
assert "2 条规则" in result["detail"]
|
||||
|
||||
|
||||
def test_firewall_drop_policy_without_rules_is_pass(monkeypatch):
|
||||
"""没有 -A 规则但 INPUT 策略是 DROP，本身就是有效防护"""
|
||||
_fake_run(monkeypatch, "-P INPUT DROP\n-P FORWARD DROP\n-P OUTPUT ACCEPT\n")
|
||||
|
||||
result = collector._check_firewall()
|
||||
|
||||
assert result["status"] == "pass"
|
||||
assert "INPUT 策略 DROP" in result["detail"]
|
||||
|
||||
|
||||
def test_firewall_unknown_when_no_tool(monkeypatch):
|
||||
def run(cmd, **kwargs):
|
||||
raise FileNotFoundError(cmd[0])
|
||||
|
||||
monkeypatch.setattr(collector.subprocess, "run", run)
|
||||
|
||||
assert collector._check_firewall()["status"] == "unknown"
|
||||
@@ -0,0 +1,121 @@
|
||||
"""API Key / Agent Key 鉴权边界测试
|
||||
|
||||
锁死两条不可回退的行为：
|
||||
|
||||
1. 可信来源判定：tailnet（100.64.0.0/10）与本机回环放行；仅当请求确实来自回环时
|
||||
才信任 X-Forwarded-For（tailscale serve 转发场景），防止外部直连伪造 XFF 绕过。
|
||||
2. 未配置密钥时对外部来源必须**拒绝**（fail-closed）。Agent 上报此前是「未配 key
|
||||
就全放行」，而服务默认监听 0.0.0.0，公网上任何人都能伪造监控数据上报。
|
||||
|
||||
运行：.venv/bin/pytest tests/test_security.py -v
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
|
||||
import pytest
|
||||
from fastapi import HTTPException
|
||||
from starlette.requests import Request
|
||||
|
||||
from app.core.config import settings
|
||||
from app.core.security import require_agent_key, require_api_key
|
||||
|
||||
TAILNET_IP = "100.89.0.5"
|
||||
PUBLIC_IP = "203.0.113.7"
|
||||
|
||||
|
||||
def _request(client_ip: str = PUBLIC_IP, headers: dict = None) -> Request:
|
||||
"""构造最小 Request：只需 client 与 headers 两个属性"""
|
||||
scope = {
|
||||
"type": "http",
|
||||
"method": "POST",
|
||||
"path": "/api/agent/report",
|
||||
"client": (client_ip, 40000) if client_ip else None,
|
||||
"headers": [
|
||||
(k.lower().encode(), v.encode()) for k, v in (headers or {}).items()
|
||||
],
|
||||
}
|
||||
return Request(scope)
|
||||
|
||||
|
||||
def _run(coro):
|
||||
return asyncio.run(coro)
|
||||
|
||||
|
||||
def _assert_401(coro):
|
||||
with pytest.raises(HTTPException) as exc:
|
||||
_run(coro)
|
||||
assert exc.value.status_code == 401
|
||||
return exc.value
|
||||
|
||||
|
||||
# ----------------------------- 可信来源放行 ----------------------------- #
|
||||
def test_tailnet_source_allowed_without_key(monkeypatch):
|
||||
"""走 tailnet IP 上报的 Agent 不受密钥缺失影响"""
|
||||
monkeypatch.setattr(settings, "AGENT_KEY", "")
|
||||
_run(require_agent_key(_request(TAILNET_IP), None)) # 不抛异常即通过
|
||||
|
||||
|
||||
def test_loopback_source_allowed_without_key(monkeypatch):
|
||||
monkeypatch.setattr(settings, "API_KEY", "")
|
||||
_run(require_api_key(_request("127.0.0.1"), None))
|
||||
|
||||
|
||||
def test_loopback_xff_tailnet_allowed(monkeypatch):
|
||||
"""tailscale serve 转发：peer 是回环、真实来源在 XFF 里且属于 tailnet"""
|
||||
monkeypatch.setattr(settings, "API_KEY", "")
|
||||
req = _request("127.0.0.1", {"X-Forwarded-For": TAILNET_IP})
|
||||
_run(require_api_key(req, None))
|
||||
|
||||
|
||||
def test_xff_from_public_source_is_ignored(monkeypatch):
|
||||
"""外部直连时伪造 XFF 不能绕过鉴权（只有回环来源的 XFF 才可信）"""
|
||||
monkeypatch.setattr(settings, "API_KEY", "secret")
|
||||
req = _request(PUBLIC_IP, {"X-Forwarded-For": TAILNET_IP})
|
||||
exc = _assert_401(require_api_key(req, None))
|
||||
assert "API Key" in exc.detail
|
||||
|
||||
|
||||
def test_loopback_xff_public_still_requires_key(monkeypatch):
|
||||
"""回环转发但真实来源是公网 IP（funnel 之外的代理场景）→ 仍需 key"""
|
||||
monkeypatch.setattr(settings, "API_KEY", "")
|
||||
req = _request("127.0.0.1", {"X-Forwarded-For": PUBLIC_IP})
|
||||
_assert_401(require_api_key(req, None))
|
||||
|
||||
|
||||
def test_funnel_request_forces_key_even_from_tailnet_ip(monkeypatch):
|
||||
"""funnel 公网流量强制校验，即使来源 IP 恰在 tailnet 网段（双保险）"""
|
||||
monkeypatch.setattr(settings, "AGENT_KEY", "")
|
||||
req = _request(TAILNET_IP, {"Tailscale-Funnel-Request": "?1"})
|
||||
_assert_401(require_agent_key(req, None))
|
||||
|
||||
|
||||
# ----------------------------- 外部来源 fail-closed ----------------------------- #
|
||||
def test_agent_key_unset_rejects_external(monkeypatch):
|
||||
"""未配 AGENT_KEY 时，外部来源必须 401（此前是全放行）"""
|
||||
monkeypatch.setattr(settings, "AGENT_KEY", "")
|
||||
exc = _assert_401(require_agent_key(_request(PUBLIC_IP), None))
|
||||
assert "AGENT_KEY" in exc.detail
|
||||
|
||||
|
||||
def test_api_key_unset_rejects_external(monkeypatch):
|
||||
monkeypatch.setattr(settings, "API_KEY", "")
|
||||
_assert_401(require_api_key(_request(PUBLIC_IP), None))
|
||||
|
||||
|
||||
def test_agent_key_valid_and_invalid(monkeypatch):
|
||||
monkeypatch.setattr(settings, "AGENT_KEY", "sekret")
|
||||
_run(require_agent_key(_request(PUBLIC_IP), "sekret")) # 正确 key 放行
|
||||
_assert_401(require_agent_key(_request(PUBLIC_IP), "wrong"))
|
||||
_assert_401(require_agent_key(_request(PUBLIC_IP), None))
|
||||
|
||||
|
||||
def test_api_key_valid_and_invalid(monkeypatch):
|
||||
monkeypatch.setattr(settings, "API_KEY", "sekret")
|
||||
_run(require_api_key(_request(PUBLIC_IP), "sekret"))
|
||||
_assert_401(require_api_key(_request(PUBLIC_IP), "wrong"))
|
||||
|
||||
|
||||
def test_unknown_client_is_not_trusted(monkeypatch):
|
||||
"""拿不到 client（如某些代理场景）时按不可信处理，不能默认放行"""
|
||||
monkeypatch.setattr(settings, "AGENT_KEY", "")
|
||||
_assert_401(require_agent_key(_request(None), None))
|
||||
Reference in New Issue
Block a user