B0rbor4d
cf7c29639c
Backend: config/db/security/logging core, SQLAlchemy models (Server, Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh, cau, audit, job_runner), REST API (auth, servers, updates, audit), Socket.io WebSocket layer. Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers, Updates, Audit, Login), axios + socket.io-client, nginx prod config.
172 lines
5.1 KiB
Markdown
172 lines
5.1 KiB
Markdown
# Insight Updater
|
|
|
|
Self-hosted update orchestration for Windows (CAU/WSUS) and Linux servers via WinRM/SSH. Web UI to manage inventory, trigger updates, stream live progress via WebSocket.
|
|
|
|
## Features
|
|
|
|
- **Server Inventory** — Windows/WinRM, Linux/SSH, CAU Clusters
|
|
- **Live Updates** — WebSocket log stream with progress per node
|
|
- **CAU Support** — Trigger `Invoke-CauRun`, track per-node phases
|
|
- **Linux Patching** — `apt/dnf/yum update` via SSH with sudo
|
|
- **Audit Log** — Structured JSON: who, when, what server, outcome
|
|
- **Health Checks** — WinRM/SSH connectivity test
|
|
- **LDAP Ready** — Config schema + stub for Active Directory auth
|
|
|
|
## Quick Start (Development)
|
|
|
|
```bash
|
|
# Clone and enter
|
|
git clone ssh://git@gitea.insight-it.de:2222/b0rbor4d/insight-updater.git
|
|
cd insight-updater
|
|
|
|
# Configure environment
|
|
cp .env.example .env
|
|
# Edit .env with your secrets
|
|
|
|
# Start all services
|
|
docker compose up -d --build
|
|
|
|
# Access
|
|
# Frontend: http://localhost:3000
|
|
# Backend API: http://localhost:8000
|
|
# API Docs: http://localhost:8000/docs
|
|
```
|
|
|
|
## Production Deployment (monitoring.insight.local)
|
|
|
|
```bash
|
|
# On monitoring host (10.0.2.105)
|
|
git clone ssh://git@gitea.insight-it.de:2222/b0rbor4d/insight-updater.git
|
|
cd insight-updater
|
|
|
|
# Configure production environment
|
|
cp .env.example .env
|
|
# Fill in all secrets: SECRET_KEY, ENCRYPTION_KEY, DB_PASSWORD, LDAP creds, etc.
|
|
|
|
# Generate JWT keys
|
|
mkdir -p keys
|
|
openssl genrsa -out keys/private.pem 2048
|
|
openssl rsa -in keys/private.pem -pubout -out keys/public.pem
|
|
|
|
# Deploy
|
|
docker compose -f docker-compose.prod.yml up -d --build
|
|
```
|
|
|
|
## Architecture
|
|
|
|
```
|
|
┌─────────────┐ WebSocket ┌─────────────┐
|
|
│ Frontend │ ◀─────────────▶ │ Backend │
|
|
│ (Vue 3) │ REST + WS │ (FastAPI) │
|
|
└─────────────┘ └──────┬──────┘
|
|
│
|
|
┌──────────────────┼──────────────────┐
|
|
▼ ▼ ▼
|
|
┌───────────┐ ┌───────────┐ ┌───────────┐
|
|
│ WinRM │ │ SSH │ │ CAU │
|
|
│ Service │ │ Service │ │ Service │
|
|
└───────────┘ └───────────┘ └───────────┘
|
|
```
|
|
|
|
## Tech Stack
|
|
|
|
| Layer | Technology |
|
|
|-------|------------|
|
|
| Backend | Python 3.11+, FastAPI, SQLAlchemy 2.0, Alembic |
|
|
| Frontend | Vue 3, TypeScript, Vite, Pinia, Tailwind CSS |
|
|
| Database | SQLite (dev) / PostgreSQL (prod) |
|
|
| Cache/Queue | Redis 7 |
|
|
| Auth | JWT (RS256), LDAP stub |
|
|
| Encryption | Fernet (cryptography) |
|
|
| WebSocket | python-socketio |
|
|
| Windows | python-winrm (Kerberos/NTLM) |
|
|
| Linux | asyncssh / paramiko |
|
|
| Deploy | Docker Compose, Traefik |
|
|
|
|
## Project Structure
|
|
|
|
```
|
|
insight-updater/
|
|
├── backend/
|
|
│ ├── app/
|
|
│ │ ├── api/ # REST routes
|
|
│ │ ├── core/ # config, security, db
|
|
│ │ ├── models/ # SQLAlchemy models
|
|
│ │ ├── schemas/ # Pydantic schemas
|
|
│ │ ├── services/ # winrm, ssh, cau, audit
|
|
│ │ ├── websocket/ # Socket.io handlers
|
|
│ │ └── main.py
|
|
│ ├── tests/
|
|
│ ├── Dockerfile
|
|
│ ├── pyproject.toml
|
|
│ └── requirements.txt
|
|
├── frontend/
|
|
│ ├── src/
|
|
│ │ ├── components/
|
|
│ │ ├── views/
|
|
│ │ ├── stores/
|
|
│ │ ├── api/
|
|
│ │ └── main.ts
|
|
│ ├── Dockerfile
|
|
│ ├── nginx.conf
|
|
│ ├── package.json
|
|
│ └── vite.config.ts
|
|
├── docker-compose.yml # Development
|
|
├── docker-compose.prod.yml # Production
|
|
├── .env.example
|
|
├── .gitignore
|
|
├── AGENTS.md
|
|
├── PROMPT.md
|
|
└── README.md
|
|
```
|
|
|
|
## Environment Variables
|
|
|
|
Key variables (see `.env.example` for full list):
|
|
|
|
| Variable | Description |
|
|
|----------|-------------|
|
|
| `SECRET_KEY` | JWT signing key (32+ chars) |
|
|
| `ENCRYPTION_KEY` | Fernet key for credentials (32 bytes base64) |
|
|
| `DATABASE_URL` | SQLite (dev) or PostgreSQL (prod) |
|
|
| `WINRM_TRANSPORT` | `ntlm` \| `kerberos` \| `credssp` |
|
|
| `LDAP_ENABLED` | Enable LDAP auth stub |
|
|
| `JWT_PRIVATE_KEY_PATH` | Path to RS256 private key |
|
|
| `JWT_PUBLIC_KEY_PATH` | Path to RS256 public key |
|
|
|
|
## Development Commands
|
|
|
|
```bash
|
|
# Backend
|
|
cd backend
|
|
pip install -e .
|
|
uvicorn app.main:app --reload
|
|
|
|
# Run tests
|
|
pytest -v
|
|
|
|
# Lint
|
|
ruff check .
|
|
mypy .
|
|
|
|
# Frontend
|
|
cd frontend
|
|
npm install
|
|
npm run dev
|
|
|
|
# Build
|
|
npm run build
|
|
|
|
# Type check
|
|
vue-tsc --noEmit
|
|
```
|
|
|
|
## API Documentation
|
|
|
|
- Swagger UI: `http://localhost:8000/docs`
|
|
- ReDoc: `http://localhost:8000/redoc`
|
|
- WebSocket: `ws://localhost:8000/ws/updates`
|
|
|
|
## License
|
|
|
|
MIT — Insight IT |