Initial scaffold: FastAPI backend + Vue 3 frontend + Docker setup

Backend: config/db/security/logging core, SQLAlchemy models (Server, Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh, cau, audit, job_runner), REST API (auth, servers, updates, audit), Socket.io WebSocket layer. Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers, Updates, Audit, Login), axios + socket.io-client, nginx prod config.
2026-07-31 23:45:31 +00:00
commit cf7c29639c
72 changed files with 10610 additions and 0 deletions
@@ -0,0 +1,172 @@
+# Insight Updater
+
+Self-hosted update orchestration for Windows (CAU/WSUS) and Linux servers via WinRM/SSH. Web UI to manage inventory, trigger updates, stream live progress via WebSocket.
+
+## Features
+
+- **Server Inventory** — Windows/WinRM, Linux/SSH, CAU Clusters
+- **Live Updates** — WebSocket log stream with progress per node
+- **CAU Support** — Trigger `Invoke-CauRun`, track per-node phases
+- **Linux Patching** — `apt/dnf/yum update` via SSH with sudo
+- **Audit Log** — Structured JSON: who, when, what server, outcome
+- **Health Checks** — WinRM/SSH connectivity test
+- **LDAP Ready** — Config schema + stub for Active Directory auth
+
+## Quick Start (Development)
+
+```bash
+# Clone and enter
+git clone ssh://git@gitea.insight-it.de:2222/b0rbor4d/insight-updater.git
+cd insight-updater
+
+# Configure environment
+cp .env.example .env
+# Edit .env with your secrets
+
+# Start all services
+docker compose up -d --build
+
+# Access
+# Frontend: http://localhost:3000
+# Backend API: http://localhost:8000
+# API Docs: http://localhost:8000/docs
+```
+
+## Production Deployment (monitoring.insight.local)
+
+```bash
+# On monitoring host (10.0.2.105)
+git clone ssh://git@gitea.insight-it.de:2222/b0rbor4d/insight-updater.git
+cd insight-updater
+
+# Configure production environment
+cp .env.example .env
+# Fill in all secrets: SECRET_KEY, ENCRYPTION_KEY, DB_PASSWORD, LDAP creds, etc.
+
+# Generate JWT keys
+mkdir -p keys
+openssl genrsa -out keys/private.pem 2048
+openssl rsa -in keys/private.pem -pubout -out keys/public.pem
+
+# Deploy
+docker compose -f docker-compose.prod.yml up -d --build
+```
+
+## Architecture
+
+```
+┌─────────────┐    WebSocket    ┌─────────────┐
+│  Frontend   │ ◀─────────────▶ │   Backend   │
+│   (Vue 3)   │   REST + WS     │  (FastAPI)  │
+└─────────────┘                 └──────┬──────┘
+                                       │
+                    ┌──────────────────┼──────────────────┐
+                    ▼                  ▼                  ▼
+              ┌───────────┐      ┌───────────┐      ┌───────────┐
+              │  WinRM    │      │   SSH     │      │   CAU     │
+              │ Service   │      │ Service   │      │ Service   │
+              └───────────┘      └───────────┘      └───────────┘
+```
+
+## Tech Stack
+
+| Layer | Technology |
+|-------|------------|
+| Backend | Python 3.11+, FastAPI, SQLAlchemy 2.0, Alembic |
+| Frontend | Vue 3, TypeScript, Vite, Pinia, Tailwind CSS |
+| Database | SQLite (dev) / PostgreSQL (prod) |
+| Cache/Queue | Redis 7 |
+| Auth | JWT (RS256), LDAP stub |
+| Encryption | Fernet (cryptography) |
+| WebSocket | python-socketio |
+| Windows | python-winrm (Kerberos/NTLM) |
+| Linux | asyncssh / paramiko |
+| Deploy | Docker Compose, Traefik |
+
+## Project Structure
+
+```
+insight-updater/
+├── backend/
+│   ├── app/
+│   │   ├── api/           # REST routes
+│   │   ├── core/          # config, security, db
+│   │   ├── models/        # SQLAlchemy models
+│   │   ├── schemas/       # Pydantic schemas
+│   │   ├── services/      # winrm, ssh, cau, audit
+│   │   ├── websocket/     # Socket.io handlers
+│   │   └── main.py
+│   ├── tests/
+│   ├── Dockerfile
+│   ├── pyproject.toml
+│   └── requirements.txt
+├── frontend/
+│   ├── src/
+│   │   ├── components/
+│   │   ├── views/
+│   │   ├── stores/
+│   │   ├── api/
+│   │   └── main.ts
+│   ├── Dockerfile
+│   ├── nginx.conf
+│   ├── package.json
+│   └── vite.config.ts
+├── docker-compose.yml         # Development
+├── docker-compose.prod.yml    # Production
+├── .env.example
+├── .gitignore
+├── AGENTS.md
+├── PROMPT.md
+└── README.md
+```
+
+## Environment Variables
+
+Key variables (see `.env.example` for full list):
+
+| Variable | Description |
+|----------|-------------|
+| `SECRET_KEY` | JWT signing key (32+ chars) |
+| `ENCRYPTION_KEY` | Fernet key for credentials (32 bytes base64) |
+| `DATABASE_URL` | SQLite (dev) or PostgreSQL (prod) |
+| `WINRM_TRANSPORT` | `ntlm` \| `kerberos` \| `credssp` |
+| `LDAP_ENABLED` | Enable LDAP auth stub |
+| `JWT_PRIVATE_KEY_PATH` | Path to RS256 private key |
+| `JWT_PUBLIC_KEY_PATH` | Path to RS256 public key |
+
+## Development Commands
+
+```bash
+# Backend
+cd backend
+pip install -e .
+uvicorn app.main:app --reload
+
+# Run tests
+pytest -v
+
+# Lint
+ruff check .
+mypy .
+
+# Frontend
+cd frontend
+npm install
+npm run dev
+
+# Build
+npm run build
+
+# Type check
+vue-tsc --noEmit
+```
+
+## API Documentation
+
+- Swagger UI: `http://localhost:8000/docs`
+- ReDoc: `http://localhost:8000/redoc`
+- WebSocket: `ws://localhost:8000/ws/updates`
+
+## License
+
+MIT — Insight IT