mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-20 16:01:19 +00:00
Matthew Meszaros
261cc439ad
Workers are no longer curl|sh-only. Admins add and manage them from the
dashboard over SSH, with all runtime config (Kafka, Schema Registry,
Redis, AWS keys) stored encrypted via the existing KMS-envelope cipher
service.
Worker lifecycle:
1. Admin POSTs host/port/user. Backend generates an ed25519 keypair,
encrypts the private key under uuid.Nil (platform identity), and
stores the row in 'pending' state.
2. Admin pastes the returned public key into the VPS's authorized_keys.
3. Test connection — runs `true` over SSH, pins the host SHA256
fingerprint on first success (TOFU).
4. Install — backend scp's install-worker.sh + a per-worker env file
and runs it. State moves pending → provisioning → installed.
5. From then on: restart, update image, apply config, uninstall,
rotate keys, tail logs, live status, OS package update, reboot —
all dashboard buttons backed by SSH operations.
Credentials are reusable entities:
- aws_credentials: named keypair, secret encrypted at rest
- worker_profiles: bundles Kafka + Schema Registry + Redis + image +
release channel, references one AWS credentials row
- workers.profile_id links a worker to a profile; many workers can
share one profile
Saving a profile doesn't restart anything. The dashboard compares
profile.updated_at to each worker's config_applied_at and shows a
"stale config" badge; Apply rewrites /etc/warmbly/worker.env over SSH
and restarts the unit.
Auto-update on GitHub release:
- profile.release_channel ∈ {pinned, stable, dev}
- profile.auto_update toggles automatic rollout
- Trigger model is push, not poll: one check on backend boot, then
the /webhooks/github/releases endpoint (HMAC-validated with
RELEASES_WEBHOOK_SECRET) on every release event. Manual "Check now"
button as fallback.
- When a new tag resolves, the orchestrator SSHes into each assigned
worker, runs install-worker.sh --update --image <new>, which now
rewrites the systemd unit (not just `docker pull`) so the image
actually changes. workers.image_version captures the running tag
for the UI's "v1.2.3 → v1.2.4" diff.
Self-hostable: every release knob is env-driven —
RELEASES_GITHUB_REPO, RELEASES_WORKER_IMAGE_REPO,
RELEASES_WEBHOOK_SECRET, RELEASES_GITHUB_TOKEN, RELEASES_ENABLED. Set
RELEASES_ENABLED=false to disable the feature entirely.
OS-level updates and reboot are also exposed: detect apt / dnf / yum /
pacman / apk, run the right upgrade noninteractively, return the full
output and a reboot-required flag. Reboots are never automatic.
Migrations:
000028_worker_ssh — ssh fields, install_state enum, last_seen,
host fingerprint
000029_worker_credentials — aws_credentials + worker_profiles +
workers.profile_id + workers.config_applied_at
000030_worker_releases — release_channel enum, auto_update,
resolved_image_tag, workers.image_version
Endpoints added:
POST /admin/workers (create + keypair)
GET /admin/workers/managed
GET /admin/workers/:id/managed
POST /admin/workers/:id/{test,install,restart,upgrade,uninstall,rotate-keys,apply,system-update,reboot}
PUT /admin/workers/:id/profile
GET /admin/workers/:id/{live-status,logs}
DELETE /admin/workers/:id
GET /admin/aws-credentials CRUD
GET /admin/worker-profiles CRUD + /workers + /apply + /release
GET /admin/releases/state
POST /admin/releases/check
POST /webhooks/github/releases public, HMAC-validated
Admin UI:
/app/admin/workers list with status + version columns
/app/admin/workers/new add form with profile dropdown
/app/admin/workers/:id detail with all actions + logs + system update
/app/admin/credentials tabs: AWS credentials + worker profiles,
Releases panel, channel selector +
auto-update toggle in profile form
65 lines
2.6 KiB
SQL
65 lines
2.6 KiB
SQL
-- Reusable worker credentials and runtime profiles.
|
|
--
|
|
-- aws_credentials: named AWS keypair, one row can be referenced by many
|
|
-- worker_profiles, which in turn can be referenced by many workers.
|
|
--
|
|
-- worker_profiles: a named bundle of everything a worker container needs
|
|
-- at runtime besides its identity (kafka, schema registry, redis, AWS
|
|
-- reference, image tag, env). One profile can be assigned to many workers.
|
|
--
|
|
-- All secret material (AWS secret access key, Kafka SASL password, Schema
|
|
-- Registry secret, Redis URL) is stored as ciphertext from the cipher
|
|
-- service under the platform identity (uuid.Nil). Same envelope encryption
|
|
-- as worker SSH private keys.
|
|
|
|
CREATE TABLE aws_credentials (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name VARCHAR(120) NOT NULL UNIQUE,
|
|
description TEXT NOT NULL DEFAULT '',
|
|
region VARCHAR(40) NOT NULL,
|
|
access_key_id TEXT NOT NULL,
|
|
secret_access_key_encrypted TEXT NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
);
|
|
|
|
CREATE TABLE worker_profiles (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name VARCHAR(120) NOT NULL UNIQUE,
|
|
description TEXT NOT NULL DEFAULT '',
|
|
app_env VARCHAR(20) NOT NULL DEFAULT 'prod',
|
|
worker_image TEXT NOT NULL DEFAULT 'ghcr.io/warmbly/worker:latest',
|
|
|
|
-- Kafka
|
|
kafka_bootstrap_servers TEXT NOT NULL DEFAULT '',
|
|
kafka_sasl_username TEXT NOT NULL DEFAULT '',
|
|
kafka_sasl_password_encrypted TEXT NOT NULL DEFAULT '',
|
|
|
|
-- Schema registry
|
|
schema_registry_url TEXT NOT NULL DEFAULT '',
|
|
schema_registry_key TEXT NOT NULL DEFAULT '',
|
|
schema_registry_secret_encrypted TEXT NOT NULL DEFAULT '',
|
|
|
|
-- Redis (URL contains password; encrypt the whole thing)
|
|
redis_url_encrypted TEXT NOT NULL DEFAULT '',
|
|
|
|
-- AWS credentials reference. ON DELETE RESTRICT — you cannot delete a
|
|
-- credential row that profiles still depend on.
|
|
aws_credential_id UUID REFERENCES aws_credentials(id) ON DELETE RESTRICT,
|
|
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|
);
|
|
|
|
CREATE INDEX idx_worker_profiles_aws ON worker_profiles(aws_credential_id);
|
|
|
|
-- Workers point to one profile. Detaching is fine (worker falls back to the
|
|
-- backend's process-env defaults for dev/sim).
|
|
ALTER TABLE workers
|
|
ADD COLUMN profile_id UUID REFERENCES worker_profiles(id) ON DELETE SET NULL,
|
|
-- Set on every successful Install/Apply. Compared to the profile's
|
|
-- updated_at to compute the "stale config" indicator in the UI.
|
|
ADD COLUMN config_applied_at TIMESTAMPTZ;
|
|
|
|
CREATE INDEX idx_workers_profile ON workers(profile_id);
|