mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-11 16:08:09 +00:00
Workers are no longer curl|sh-only. Admins add and manage them from the
dashboard over SSH, with all runtime config (Kafka, Schema Registry,
Redis, AWS keys) stored encrypted via the existing KMS-envelope cipher
service.
Worker lifecycle:
1. Admin POSTs host/port/user. Backend generates an ed25519 keypair,
encrypts the private key under uuid.Nil (platform identity), and
stores the row in 'pending' state.
2. Admin pastes the returned public key into the VPS's authorized_keys.
3. Test connection — runs `true` over SSH, pins the host SHA256
fingerprint on first success (TOFU).
4. Install — backend scp's install-worker.sh + a per-worker env file
and runs it. State moves pending → provisioning → installed.
5. From then on: restart, update image, apply config, uninstall,
rotate keys, tail logs, live status, OS package update, reboot —
all dashboard buttons backed by SSH operations.
Credentials are reusable entities:
- aws_credentials: named keypair, secret encrypted at rest
- worker_profiles: bundles Kafka + Schema Registry + Redis + image +
release channel, references one AWS credentials row
- workers.profile_id links a worker to a profile; many workers can
share one profile
Saving a profile doesn't restart anything. The dashboard compares
profile.updated_at to each worker's config_applied_at and shows a
"stale config" badge; Apply rewrites /etc/warmbly/worker.env over SSH
and restarts the unit.
Auto-update on GitHub release:
- profile.release_channel ∈ {pinned, stable, dev}
- profile.auto_update toggles automatic rollout
- Trigger model is push, not poll: one check on backend boot, then
the /webhooks/github/releases endpoint (HMAC-validated with
RELEASES_WEBHOOK_SECRET) on every release event. Manual "Check now"
button as fallback.
- When a new tag resolves, the orchestrator SSHes into each assigned
worker, runs install-worker.sh --update --image <new>, which now
rewrites the systemd unit (not just `docker pull`) so the image
actually changes. workers.image_version captures the running tag
for the UI's "v1.2.3 → v1.2.4" diff.
Self-hostable: every release knob is env-driven —
RELEASES_GITHUB_REPO, RELEASES_WORKER_IMAGE_REPO,
RELEASES_WEBHOOK_SECRET, RELEASES_GITHUB_TOKEN, RELEASES_ENABLED. Set
RELEASES_ENABLED=false to disable the feature entirely.
OS-level updates and reboot are also exposed: detect apt / dnf / yum /
pacman / apk, run the right upgrade noninteractively, return the full
output and a reboot-required flag. Reboots are never automatic.
Migrations:
000028_worker_ssh — ssh fields, install_state enum, last_seen,
host fingerprint
000029_worker_credentials — aws_credentials + worker_profiles +
workers.profile_id + workers.config_applied_at
000030_worker_releases — release_channel enum, auto_update,
resolved_image_tag, workers.image_version
Endpoints added:
POST /admin/workers (create + keypair)
GET /admin/workers/managed
GET /admin/workers/:id/managed
POST /admin/workers/:id/{test,install,restart,upgrade,uninstall,rotate-keys,apply,system-update,reboot}
PUT /admin/workers/:id/profile
GET /admin/workers/:id/{live-status,logs}
DELETE /admin/workers/:id
GET /admin/aws-credentials CRUD
GET /admin/worker-profiles CRUD + /workers + /apply + /release
GET /admin/releases/state
POST /admin/releases/check
POST /webhooks/github/releases public, HMAC-validated
Admin UI:
/app/admin/workers list with status + version columns
/app/admin/workers/new add form with profile dropdown
/app/admin/workers/:id detail with all actions + logs + system update
/app/admin/credentials tabs: AWS credentials + worker profiles,
Releases panel, channel selector +
auto-update toggle in profile form
177 lines
7.2 KiB
Go
177 lines
7.2 KiB
Go
package models
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
"golang.org/x/oauth2"
|
|
)
|
|
|
|
// WorkerType represents the type of worker
|
|
type WorkerType string
|
|
|
|
const (
|
|
WorkerTypeShared WorkerType = "shared"
|
|
WorkerTypeDedicated WorkerType = "dedicated"
|
|
)
|
|
|
|
type Worker struct {
|
|
ID uuid.UUID `json:"id"`
|
|
Name string `json:"name"`
|
|
Notes string `json:"notes"`
|
|
IPAddr string `json:"ip_addr"`
|
|
Active bool `json:"active"`
|
|
FreeTier bool `json:"free_tier"`
|
|
WorkerType WorkerType `json:"worker_type"`
|
|
AccountCount int `json:"account_count"`
|
|
|
|
// SSH management (none of these expose secret material — the encrypted
|
|
// private key is fetched separately via GetWorkerSSHCredentials).
|
|
SSHHost string `json:"ssh_host,omitempty"`
|
|
SSHPort int `json:"ssh_port,omitempty"`
|
|
SSHUser string `json:"ssh_user,omitempty"`
|
|
SSHPublicKey string `json:"ssh_public_key,omitempty"`
|
|
SSHHostFingerprint string `json:"ssh_host_fingerprint,omitempty"`
|
|
InstallState WorkerInstallState `json:"install_state"`
|
|
LastSeenAt *time.Time `json:"last_seen_at,omitempty"`
|
|
LastError string `json:"last_error,omitempty"`
|
|
|
|
// Profile assignment. Nil means "use backend env defaults".
|
|
ProfileID *uuid.UUID `json:"profile_id,omitempty"`
|
|
ConfigAppliedAt *time.Time `json:"config_applied_at,omitempty"`
|
|
|
|
// Image tag the worker is currently running, captured on every successful
|
|
// Update. Used for the "v1.2.3 → v1.2.4" badge in the dashboard.
|
|
ImageVersion string `json:"image_version,omitempty"`
|
|
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
// WorkerInstallState mirrors the worker_install_state enum.
|
|
type WorkerInstallState string
|
|
|
|
const (
|
|
WorkerInstallStatePending WorkerInstallState = "pending"
|
|
WorkerInstallStateProvisioning WorkerInstallState = "provisioning"
|
|
WorkerInstallStateInstalled WorkerInstallState = "installed"
|
|
WorkerInstallStateError WorkerInstallState = "error"
|
|
WorkerInstallStateUninstalling WorkerInstallState = "uninstalling"
|
|
WorkerInstallStateUninstalled WorkerInstallState = "uninstalled"
|
|
)
|
|
|
|
// WorkerSSHCredentials carries the encrypted private key alongside the
|
|
// connection info. Only the orchestrator should ever fetch this; the field is
|
|
// never serialised to admin clients.
|
|
type WorkerSSHCredentials struct {
|
|
WorkerID uuid.UUID
|
|
SSHHost string
|
|
SSHPort int
|
|
SSHUser string
|
|
SSHPublicKey string
|
|
SSHPrivateKeyEncrypted string
|
|
SSHHostFingerprint string
|
|
}
|
|
|
|
type UpdateWorker struct {
|
|
IPAddr *string `json:"ip_addr"`
|
|
Active *bool `json:"active"`
|
|
WorkerType *WorkerType `json:"worker_type,omitempty"`
|
|
}
|
|
|
|
// DedicatedWorkerAssignment represents a dedicated worker assignment to a user
|
|
type DedicatedWorkerAssignment struct {
|
|
ID uuid.UUID `json:"id"`
|
|
WorkerID uuid.UUID `json:"worker_id"`
|
|
UserID uuid.UUID `json:"user_id"`
|
|
SubscriptionID uuid.UUID `json:"subscription_id"`
|
|
AssignedAt time.Time `json:"assigned_at"`
|
|
ReleasedAt *time.Time `json:"released_at,omitempty"`
|
|
}
|
|
|
|
type WorkerStatus string
|
|
|
|
const (
|
|
WorkerStatusOffline WorkerStatus = "offline"
|
|
WorkerStatusLoading WorkerStatus = "loading"
|
|
WorkerStatusOnline WorkerStatus = "online"
|
|
)
|
|
|
|
type SendEmail struct {
|
|
TaskID uuid.UUID `json:"task_id" avro:"task_id"`
|
|
EmailID uuid.UUID `json:"email_id" avro:"email_id"`
|
|
UserID uuid.UUID `json:"user_id" avro:"user_id"`
|
|
To []string `json:"to" avro:"to"`
|
|
Cc []string `json:"cc" avro:"cc"`
|
|
Bcc []string `json:"bcc" avro:"bcc"`
|
|
Subject string `json:"subject" avro:"subject"`
|
|
BodyS3Key string `json:"body_s3_key" avro:"body_s3_key"`
|
|
MessageID string `json:"message_id" avro:"message_id"`
|
|
InReplyTo string `json:"in_reply_to,omitempty" avro:"in_reply_to"`
|
|
Parent *EmailParent `json:"parent,omitempty" avro:"parent"`
|
|
IsWarmup bool `json:"is_warmup" avro:"is_warmup"`
|
|
TrackingInfo *TrackingInfo `json:"tracking_info,omitempty" avro:"tracking_info"`
|
|
WarmupToken string `json:"warmup_token,omitempty" avro:"warmup_token"`
|
|
UnsubscribeURL string `json:"unsubscribe_url,omitempty" avro:"unsubscribe_url"`
|
|
}
|
|
|
|
// TrackingInfo contains tracking configuration for campaign emails
|
|
type TrackingInfo struct {
|
|
OpenTracking bool `json:"open_tracking" avro:"open_tracking"`
|
|
LinkTracking bool `json:"link_tracking" avro:"link_tracking"`
|
|
TrackingDomain string `json:"tracking_domain" avro:"tracking_domain"`
|
|
}
|
|
|
|
// EmailSendError contains detailed error information for failed email sends
|
|
type EmailSendError struct {
|
|
Code string `json:"code" avro:"code"`
|
|
Type string `json:"type" avro:"type"`
|
|
Message string `json:"message" avro:"message"`
|
|
ResolveMethod string `json:"resolve_method" avro:"resolve_method"`
|
|
UserVisible bool `json:"user_visible" avro:"user_visible"`
|
|
UserTitle string `json:"user_title,omitempty" avro:"user_title"`
|
|
UserMessage string `json:"user_message,omitempty" avro:"user_message"`
|
|
ActionRequired string `json:"action_required,omitempty" avro:"action_required"`
|
|
}
|
|
|
|
// SendEmailResult is the result from worker after sending email
|
|
type SendEmailResult struct {
|
|
TaskID uuid.UUID `json:"task_id" avro:"task_id"`
|
|
Success bool `json:"success" avro:"success"`
|
|
MessageID string `json:"message_id,omitempty" avro:"message_id"`
|
|
ProviderMsgID string `json:"provider_msg_id,omitempty" avro:"provider_msg_id"`
|
|
SentAt time.Time `json:"sent_at,omitempty" avro:"sent_at"`
|
|
Error *EmailSendError `json:"error,omitempty" avro:"error"`
|
|
LegacyErrorMsg string `json:"legacy_error,omitempty" avro:"legacy_error"` // Deprecated: use Error instead
|
|
}
|
|
|
|
type AddWorkerEmailGoogleData struct {
|
|
LastHistoryID uint64 `json:"last_history_id" avro:"last_history_id"`
|
|
Token *oauth2.Token `json:"token" avro:"token"`
|
|
}
|
|
|
|
type AddWorkerEmailSmtpImapData struct {
|
|
Mailboxes []Mailbox `json:"mailboxes" avro:"mailboxes"`
|
|
Token *oauth2.Token `json:"token" avro:"token"`
|
|
Credentials *SmtpImap `json:"credentials" avro:"credentials"`
|
|
}
|
|
|
|
type AddWorkerEmail struct {
|
|
ID uuid.UUID `json:"id" avro:"id"`
|
|
UserID uuid.UUID `json:"user_id" avro:"user_id"`
|
|
ImapSync bool `json:"imap_sync" avro:"imap_sync"`
|
|
Email string `json:"email" avro:"email"`
|
|
FirstName string `json:"first_name" avro:"first_name"`
|
|
LastName string `json:"last_name" avro:"last_name"`
|
|
Type InboxProvider `json:"type" avro:"type"`
|
|
Google *AddWorkerEmailGoogleData `json:"google" avro:"google"`
|
|
SmtpImap *AddWorkerEmailSmtpImapData `json:"smtp_imap" avro:"smtp_imap"`
|
|
|
|
Cfg oauth2.Config `json:"-" avro:"-"`
|
|
}
|
|
|
|
type RemoveWorkerEmail struct {
|
|
UserID string `json:"user_id" avro:"user_id"`
|
|
EmailID string `json:"email_id" avro:"email_id"`
|
|
}
|