# Insight Updater

Self-hosted update orchestration for Windows (CAU/WSUS) and Linux servers via WinRM/SSH. Web UI to manage inventory, trigger updates, stream live progress via WebSocket.

## Features

- **Server Inventory** — Windows/WinRM, Linux/SSH, CAU Clusters
- **Live Updates** — WebSocket log stream with progress per node
- **CAU Support** — Trigger `Invoke-CauRun`, track per-node phases
- **Linux Patching** — `apt/dnf/yum update` via SSH with sudo
- **Audit Log** — Structured JSON: who, when, what server, outcome
- **Health Checks** — WinRM/SSH connectivity test
- **LDAP Ready** — Config schema + stub for Active Directory auth

## Quick Start (Development)

```bash
# Clone and enter
git clone ssh://git@gitea.insight-it.de:2222/b0rbor4d/insight-updater.git
cd insight-updater

# Configure environment
cp .env.example .env
# Edit .env with your secrets

# Start all services
docker compose up -d --build

# Access
# Frontend: http://localhost:3000
# Backend API: http://localhost:8000
# API Docs: http://localhost:8000/docs
```

## Production Deployment (monitoring.insight.local)

```bash
# On monitoring host (10.0.2.105)
git clone ssh://git@gitea.insight-it.de:2222/b0rbor4d/insight-updater.git
cd insight-updater

# Configure production environment
cp .env.example .env
# Fill in all secrets: SECRET_KEY, ENCRYPTION_KEY, DB_PASSWORD, LDAP creds, etc.

# Generate JWT keys
mkdir -p keys
openssl genrsa -out keys/private.pem 2048
openssl rsa -in keys/private.pem -pubout -out keys/public.pem

# Deploy
docker compose -f docker-compose.prod.yml up -d --build
```

## Architecture

```
┌─────────────┐    WebSocket    ┌─────────────┐
│  Frontend   │ ◀─────────────▶ │   Backend   │
│   (Vue 3)   │   REST + WS     │  (FastAPI)  │
└─────────────┘                 └──────┬──────┘
                                       │
                    ┌──────────────────┼──────────────────┐
                    ▼                  ▼                  ▼
              ┌───────────┐      ┌───────────┐      ┌───────────┐
              │  WinRM    │      │   SSH     │      │   CAU     │
              │ Service   │      │ Service   │      │ Service   │
              └───────────┘      └───────────┘      └───────────┘
```

## Tech Stack

| Layer | Technology |
|-------|------------|
| Backend | Python 3.11+, FastAPI, SQLAlchemy 2.0, Alembic |
| Frontend | Vue 3, TypeScript, Vite, Pinia, Tailwind CSS |
| Database | SQLite (dev) / PostgreSQL (prod) |
| Cache/Queue | Redis 7 |
| Auth | JWT (RS256), LDAP stub |
| Encryption | Fernet (cryptography) |
| WebSocket | python-socketio |
| Windows | python-winrm (Kerberos/NTLM) |
| Linux | asyncssh / paramiko |
| Deploy | Docker Compose, Traefik |

## Project Structure

```
insight-updater/
├── backend/
│   ├── app/
│   │   ├── api/           # REST routes
│   │   ├── core/          # config, security, db
│   │   ├── models/        # SQLAlchemy models
│   │   ├── schemas/       # Pydantic schemas
│   │   ├── services/      # winrm, ssh, cau, audit
│   │   ├── websocket/     # Socket.io handlers
│   │   └── main.py
│   ├── tests/
│   ├── Dockerfile
│   ├── pyproject.toml
│   └── requirements.txt
├── frontend/
│   ├── src/
│   │   ├── components/
│   │   ├── views/
│   │   ├── stores/
│   │   ├── api/
│   │   └── main.ts
│   ├── Dockerfile
│   ├── nginx.conf
│   ├── package.json
│   └── vite.config.ts
├── docker-compose.yml         # Development
├── docker-compose.prod.yml    # Production
├── .env.example
├── .gitignore
├── AGENTS.md
├── PROMPT.md
└── README.md
```

## Environment Variables

Key variables (see `.env.example` for full list):

| Variable | Description |
|----------|-------------|
| `SECRET_KEY` | JWT signing key (32+ chars) |
| `ENCRYPTION_KEY` | Fernet key for credentials (32 bytes base64) |
| `DATABASE_URL` | SQLite (dev) or PostgreSQL (prod) |
| `WINRM_TRANSPORT` | `ntlm` \| `kerberos` \| `credssp` |
| `LDAP_ENABLED` | Enable LDAP auth stub |
| `JWT_PRIVATE_KEY_PATH` | Path to RS256 private key |
| `JWT_PUBLIC_KEY_PATH` | Path to RS256 public key |

## Development Commands

```bash
# Backend
cd backend
pip install -e .
uvicorn app.main:app --reload

# Run tests
pytest -v

# Lint
ruff check .
mypy .

# Frontend
cd frontend
npm install
npm run dev

# Build
npm run build

# Type check
vue-tsc --noEmit
```

## API Documentation

- Swagger UI: `http://localhost:8000/docs`
- ReDoc: `http://localhost:8000/redoc`
- WebSocket: `ws://localhost:8000/ws/updates`

## License

MIT — Insight IT