bvandeusenandClaude Opus 5.5
8dad79f17a
#5034 "Playbook runs: path and inventory checks in trigger_run, connection vars admin-only, confirm enforced server-side, web actions audited". Ansible runs inside the Steward container, so an operator who could name any playbook path, set ansible_connection=local or ProxyCommand ssh args, or put {{ lookup('pipe', …) }} in a value could run commands on Steward. - steward/ansible/guards.py: check_playbook (the source must list it), check_inventory_scope (steward:* or an inventory file the source has), check_vars_for_role (ansible_* beyond host/port/user/password/become, and any Jinja in a value, are admin-only), changed_vars (an edit is held to the role only for what it changes). - trigger_run applies the path checks, so every run path — web, MCP, alerts, schedules, plugins — gets them. - Variables are checked by role on the web run form, host-page runs, schedule create/update, inventory group/target create/update, and MCP run_playbook / create_schedule / update_schedule. - A steward:confirm playbook needs the confirmation ticked on the server side for a real (non-check) web run, as MCP already required. - Audited: runs, cancel, schedule create/update/enable/disable/delete/ run-now, playbook create/update/delete, inventory group and target create/update/delete (variable names only, never values). One audit_request helper serves the web routes. - The CSRF form guard and the route guard now each test that they fail on a synthetic broken input (rule: a guard must be able to fail). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
305 lines
12 KiB
Python
305 lines
12 KiB
Python
from __future__ import annotations
|
|
import asyncio
|
|
import uuid
|
|
from quart import Blueprint, render_template, request, redirect, url_for, current_app, session
|
|
from sqlalchemy import select
|
|
from steward.ansible import executor, sources as ansible_src
|
|
from steward.auth.middleware import require_role
|
|
from steward.core.audit import log_audit
|
|
from steward.models.ansible import AnsibleRun, AnsibleRunStatus
|
|
from steward.models.hosts import Host
|
|
from steward.models.users import UserRole
|
|
from steward.hosts import service as host_svc
|
|
|
|
hosts_bp = Blueprint("hosts", __name__, url_prefix="/hosts")
|
|
|
|
|
|
def _ansible_source_names() -> list[str]:
|
|
try:
|
|
return [s["name"] for s in ansible_src.get_sources(current_app.config.get("ANSIBLE", {}))]
|
|
except Exception:
|
|
return []
|
|
|
|
|
|
@hosts_bp.get("/overview/widget")
|
|
@require_role(UserRole.viewer)
|
|
async def overview_widget():
|
|
"""Dashboard widget: unified per-host monitor + agent glance, linking to the hub."""
|
|
async with current_app.db_sessionmaker() as db:
|
|
hosts = (await db.execute(select(Host).order_by(Host.name))).scalars().all()
|
|
host_status = await host_svc.host_status(db, [h.id for h in hosts])
|
|
uptime = await host_svc.compute_uptime(db)
|
|
host_names = [h.name for h in hosts]
|
|
agent = await host_svc.agent_overview_by_host(
|
|
db, host_names, host_svc.agent_stale_after_seconds(current_app.config))
|
|
cpu_sparks = await host_svc.agent_cpu_sparks_by_host(db, host_names)
|
|
|
|
return await render_template(
|
|
"hosts/overview_widget.html",
|
|
hosts=hosts, host_status=host_status,
|
|
uptime=uptime, agent=agent, cpu_sparks=cpu_sparks,
|
|
)
|
|
|
|
|
|
@hosts_bp.get("/")
|
|
@require_role(UserRole.viewer)
|
|
async def list_hosts():
|
|
async with current_app.db_sessionmaker() as db:
|
|
result = await db.execute(select(Host).order_by(Host.name))
|
|
hosts = result.scalars().all()
|
|
host_status = await host_svc.host_status(db, [h.id for h in hosts])
|
|
uptime = await host_svc.compute_uptime(db)
|
|
agent_metrics = await host_svc.agent_metrics_by_host(db, [h.name for h in hosts])
|
|
|
|
return await render_template(
|
|
"hosts/list.html",
|
|
hosts=hosts,
|
|
host_status=host_status,
|
|
uptime=uptime,
|
|
agent_metrics=agent_metrics,
|
|
)
|
|
|
|
|
|
@hosts_bp.get("/<host_id>")
|
|
@require_role(UserRole.viewer)
|
|
async def host_detail(host_id: str):
|
|
"""The host hub: monitors + agent (embedded fragment) + Ansible, one view."""
|
|
from steward.models.ansible_inventory import AnsibleTarget
|
|
from sqlalchemy.orm import selectinload
|
|
|
|
async with current_app.db_sessionmaker() as db:
|
|
host = (await db.execute(
|
|
select(Host).where(Host.id == host_id))).scalar_one_or_none()
|
|
if host is None:
|
|
return "Not found", 404
|
|
monitors = await host_svc.host_monitors(db, host_id)
|
|
uptime = (await host_svc.compute_uptime(db)).get(host_id)
|
|
linked_target = (await db.execute(
|
|
select(AnsibleTarget).where(AnsibleTarget.host_id == host_id)
|
|
.options(selectinload(AnsibleTarget.groups)))).scalar_one_or_none()
|
|
linkable_targets = (await db.execute(
|
|
select(AnsibleTarget).where(AnsibleTarget.host_id.is_(None))
|
|
.order_by(AnsibleTarget.name))).scalars().all()
|
|
|
|
from steward.models.monitors import MonitorType
|
|
return await render_template(
|
|
"hosts/detail.html",
|
|
host=host, monitors=monitors, uptime=uptime,
|
|
monitor_types=list(MonitorType),
|
|
linked_target=linked_target, linkable_targets=linkable_targets,
|
|
ansible_sources=_ansible_source_names(),
|
|
)
|
|
|
|
|
|
@hosts_bp.get("/new")
|
|
@require_role(UserRole.operator)
|
|
async def new_host():
|
|
return await render_template("hosts/form.html", host=None)
|
|
|
|
|
|
@hosts_bp.post("/")
|
|
@require_role(UserRole.operator)
|
|
async def create_host():
|
|
form = await request.form
|
|
host = Host(
|
|
name=form["name"].strip(),
|
|
address=form["address"].strip(),
|
|
)
|
|
async with current_app.db_sessionmaker() as db:
|
|
async with db.begin():
|
|
db.add(host)
|
|
await log_audit(current_app, session.get("user_id"), session.get("username", ""),
|
|
"host.created", entity_type="host", entity_id=host.name,
|
|
detail={"address": host.address})
|
|
# Land on the new host's hub so monitors/agent/ansible can be set up next.
|
|
return redirect(url_for("hosts.host_detail", host_id=host.id))
|
|
|
|
|
|
@hosts_bp.get("/<host_id>/edit")
|
|
@require_role(UserRole.operator)
|
|
async def edit_host(host_id: str):
|
|
# Pure host config (name/address/monitors). Agent, Ansible target linking,
|
|
# and playbook runs live on the host detail page (the hub), not here.
|
|
async with current_app.db_sessionmaker() as db:
|
|
result = await db.execute(select(Host).where(Host.id == host_id))
|
|
host = result.scalar_one_or_none()
|
|
if host is None:
|
|
return "Not found", 404
|
|
|
|
return await render_template("hosts/form.html", host=host)
|
|
|
|
|
|
@hosts_bp.post("/<host_id>")
|
|
@require_role(UserRole.operator)
|
|
async def update_host(host_id: str):
|
|
form = await request.form
|
|
async with current_app.db_sessionmaker() as db:
|
|
async with db.begin():
|
|
result = await db.execute(select(Host).where(Host.id == host_id))
|
|
host = result.scalar_one_or_none()
|
|
if host is None:
|
|
return "Not found", 404
|
|
host.name = form["name"].strip()
|
|
host.address = form["address"].strip()
|
|
return redirect(url_for("hosts.host_detail", host_id=host_id))
|
|
|
|
|
|
@hosts_bp.post("/<host_id>/ansible-link")
|
|
@require_role(UserRole.operator)
|
|
async def ansible_link(host_id: str):
|
|
"""Link, unlink, or create an AnsibleTarget from this host."""
|
|
from steward.models.ansible_inventory import AnsibleTarget
|
|
|
|
form = await request.form
|
|
action = form.get("action", "")
|
|
|
|
async with current_app.db_sessionmaker() as db:
|
|
async with db.begin():
|
|
if action == "unlink":
|
|
linked_result = await db.execute(
|
|
select(AnsibleTarget).where(AnsibleTarget.host_id == host_id)
|
|
)
|
|
linked = linked_result.scalar_one_or_none()
|
|
if linked:
|
|
linked.host_id = None
|
|
|
|
elif action == "link":
|
|
target_id = form.get("target_id", "").strip()
|
|
if target_id:
|
|
result = await db.execute(
|
|
select(AnsibleTarget).where(AnsibleTarget.id == target_id)
|
|
)
|
|
target = result.scalar_one_or_none()
|
|
if target:
|
|
# Clear any previous link for this host first
|
|
old_result = await db.execute(
|
|
select(AnsibleTarget).where(AnsibleTarget.host_id == host_id)
|
|
)
|
|
old = old_result.scalar_one_or_none()
|
|
if old and old.id != target_id:
|
|
old.host_id = None
|
|
target.host_id = host_id
|
|
|
|
elif action == "create":
|
|
host_result = await db.execute(select(Host).where(Host.id == host_id))
|
|
host = host_result.scalar_one_or_none()
|
|
if host:
|
|
new_target = AnsibleTarget(
|
|
id=str(uuid.uuid4()),
|
|
name=host.name,
|
|
address=host.address,
|
|
host_id=host_id,
|
|
)
|
|
db.add(new_target)
|
|
|
|
return redirect(f"/hosts/{host_id}")
|
|
|
|
|
|
@hosts_bp.post("/<host_id>/run-playbook")
|
|
@require_role(UserRole.operator)
|
|
async def run_playbook(host_id: str):
|
|
"""Run an Ansible playbook against just this host (ephemeral one-host inventory)."""
|
|
form = await request.form
|
|
async with current_app.db_sessionmaker() as db:
|
|
host = (await db.execute(select(Host).where(Host.id == host_id))).scalar_one_or_none()
|
|
if host is None:
|
|
return "Not found", 404
|
|
|
|
source_name = (form.get("source_name", "") or "").strip()
|
|
playbook = (form.get("playbook_path", "") or "").strip()
|
|
if not source_name or not playbook:
|
|
return "source and playbook are required", 400
|
|
try:
|
|
srcs = ansible_src.get_sources(current_app.config.get("ANSIBLE", {}))
|
|
except Exception:
|
|
return "Ansible sources are misconfigured", 400
|
|
source = next((s for s in srcs if s["name"] == source_name), None)
|
|
if source is None:
|
|
return "Source not found", 404
|
|
if playbook not in ansible_src.discover_playbooks(source["path"]):
|
|
return f"Playbook '{playbook}' not found in source '{source_name}'", 404
|
|
|
|
# Shared parser: discovered var__ fields → extra_vars_map, secret__ → secret_vars
|
|
# (unpersisted), plus tags/check. No --limit — there's exactly one host.
|
|
from steward.ansible.routes import _parse_run_params, _run_vars, check_run_form
|
|
params_or_none, secret_vars, err = _parse_run_params(form)
|
|
if err:
|
|
return err, 400
|
|
err = check_run_form(form, source, playbook, params_or_none, secret_vars)
|
|
if err:
|
|
return err, 400
|
|
|
|
run_id = str(uuid.uuid4())
|
|
inv_content = ansible_src.host_inventory_content(host)
|
|
run = AnsibleRun(
|
|
id=run_id,
|
|
playbook_path=playbook,
|
|
inventory_path=f"host: {host.name}",
|
|
source_name=source_name,
|
|
triggered_by=session.get("user_id"),
|
|
status=AnsibleRunStatus.running,
|
|
params=params_or_none,
|
|
)
|
|
async with current_app.db_sessionmaker() as db:
|
|
async with db.begin():
|
|
db.add(run)
|
|
|
|
task = asyncio.create_task(
|
|
executor.start_run(
|
|
current_app._get_current_object(), # type: ignore[attr-defined]
|
|
run_id, playbook, f"host: {host.name}", source["path"],
|
|
params_or_none, inv_content, secret_vars=secret_vars,
|
|
)
|
|
)
|
|
task.add_done_callback(
|
|
lambda t: t.exception() and current_app.logger.error(
|
|
"Host playbook run %s raised: %s", run_id, t.exception()))
|
|
|
|
await log_audit(current_app, session.get("user_id"), session.get("username", ""),
|
|
"ansible.host_run", entity_type="host", entity_id=host.name,
|
|
detail={"playbook": playbook, "source": source_name, "run_id": run_id,
|
|
"check": bool((params_or_none or {}).get("check")),
|
|
"vars": sorted(_run_vars(params_or_none, secret_vars))})
|
|
return redirect(url_for("ansible.run_detail", run_id=run_id))
|
|
|
|
|
|
@hosts_bp.post("/<host_id>/delete")
|
|
@require_role(UserRole.admin)
|
|
async def delete_host(host_id: str):
|
|
host_name = None
|
|
async with current_app.db_sessionmaker() as db:
|
|
async with db.begin():
|
|
result = await db.execute(select(Host).where(Host.id == host_id))
|
|
host = result.scalar_one_or_none()
|
|
if host:
|
|
host_name = host.name
|
|
await db.delete(host)
|
|
if host_name:
|
|
await log_audit(current_app, session.get("user_id"), session.get("username", ""),
|
|
"host.deleted", entity_type="host", entity_id=host_name)
|
|
return redirect(url_for("hosts.list_hosts"))
|
|
|
|
|
|
@hosts_bp.get("/uptime")
|
|
@require_role(UserRole.viewer)
|
|
async def uptime_page():
|
|
async with current_app.db_sessionmaker() as db:
|
|
result = await db.execute(select(Host).order_by(Host.name))
|
|
hosts = result.scalars().all()
|
|
uptime = await host_svc.compute_uptime(db)
|
|
return await render_template("hosts/uptime.html", hosts=hosts, uptime=uptime)
|
|
|
|
|
|
@hosts_bp.get("/uptime/widget")
|
|
@require_role(UserRole.viewer)
|
|
async def uptime_widget():
|
|
async with current_app.db_sessionmaker() as db:
|
|
result = await db.execute(select(Host).order_by(Host.name))
|
|
hosts = result.scalars().all()
|
|
uptime = await host_svc.compute_uptime(db)
|
|
return await render_template(
|
|
"hosts/uptime_widget.html",
|
|
hosts=hosts,
|
|
uptime=uptime,
|
|
)
|