330 lines
9.7 KiB
Go
330 lines
9.7 KiB
Go
package main
|
|
|
|
// panelctl admin: out-of-band repair commands that drive the controller's
|
|
// /admin/v1/ HTTP surface (NOT the gRPC Panel service used by every other
|
|
// command in this CLI). Auth is loopback-bypass on the controller host or
|
|
// X-Panel-Admin-Token over the wire — see admin.go in the controller for
|
|
// the server-side pair.
|
|
//
|
|
// Token resolution order, used by every admin subcommand:
|
|
// 1. --admin-token flag value (if non-empty)
|
|
// 2. $PANEL_ADMIN_TOKEN environment variable
|
|
// 3. <data-dir>/admin-token file (default data dir: ./data)
|
|
//
|
|
// The empty-token case is allowed: when running on the controller host
|
|
// itself, the request reaches the admin mux over loopback and the
|
|
// server bypasses the token check.
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"errors"
|
|
"flag"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
defaultAdminHTTP = "http://localhost:8080"
|
|
adminTokenFilename = "admin-token"
|
|
adminAuthHeaderName = "X-Panel-Admin-Token"
|
|
)
|
|
|
|
func adminUsage() {
|
|
fmt.Fprintln(os.Stderr, `panelctl admin — out-of-band repair commands.
|
|
|
|
Usage:
|
|
panelctl admin [flags] token-show
|
|
panelctl admin [flags] status
|
|
panelctl admin [flags] instances
|
|
panelctl admin [flags] ark-rebind <instance-id>
|
|
panelctl admin [flags] set-config <instance-id> KEY=VALUE [KEY=VALUE...]
|
|
panelctl admin [flags] del-config <instance-id> KEY [KEY...]
|
|
panelctl admin [flags] recreate <instance-id> [--mount CONTAINER_PATH=HOST_PATH ...]
|
|
|
|
Flags:
|
|
--http URL Controller HTTP base URL (default `+defaultAdminHTTP+`, prod: http://localhost:8180)
|
|
Or set PANEL_HTTP env var.
|
|
--admin-token TOK Admin token. Defaults to $PANEL_ADMIN_TOKEN or <data-dir>/admin-token.
|
|
Not required when calling from the controller host (loopback bypass).
|
|
--data-dir DIR Where to look for admin-token file (default ./data; prod: /home/refuge/panel/data).
|
|
Or set PANEL_DATA_DIR env var.
|
|
|
|
Notes:
|
|
set-config / del-config / recreate trigger a stop→delete-preserve→
|
|
recreate→start dance. ARK cluster mount overrides are preserved
|
|
automatically. Pass --mount to recreate to override the mount map.`)
|
|
}
|
|
|
|
// cmdAdmin is the entrypoint dispatched from main.go's switch.
|
|
func cmdAdmin(args []string) {
|
|
fs := flag.NewFlagSet("panelctl admin", flag.ExitOnError)
|
|
httpURL := fs.String("http", envOrDefault("PANEL_HTTP", defaultAdminHTTP), "controller HTTP base URL")
|
|
tokenFlag := fs.String("admin-token", os.Getenv("PANEL_ADMIN_TOKEN"), "admin token (or use PANEL_ADMIN_TOKEN, or read from data-dir)")
|
|
dataDir := fs.String("data-dir", envOrDefault("PANEL_DATA_DIR", "./data"), "data directory containing admin-token")
|
|
fs.Usage = adminUsage
|
|
if err := fs.Parse(args); err != nil {
|
|
os.Exit(2)
|
|
}
|
|
rest := fs.Args()
|
|
if len(rest) < 1 {
|
|
adminUsage()
|
|
os.Exit(2)
|
|
}
|
|
|
|
// Resolve the token unless the user explicitly passed --admin-token=.
|
|
// The empty result is fine — server-side loopback bypass covers it.
|
|
token := *tokenFlag
|
|
if token == "" {
|
|
token = readTokenFile(*dataDir)
|
|
}
|
|
|
|
switch rest[0] {
|
|
case "token-show":
|
|
adminTokenShow(*dataDir)
|
|
case "status", "ping", "health":
|
|
adminStatus(*httpURL, token)
|
|
case "instances", "ls":
|
|
adminInstances(*httpURL, token)
|
|
case "ark-rebind":
|
|
if len(rest) < 2 {
|
|
die("usage: panelctl admin ark-rebind <instance-id>")
|
|
}
|
|
adminArkRebind(*httpURL, token, rest[1])
|
|
case "set-config":
|
|
if len(rest) < 3 {
|
|
die("usage: panelctl admin set-config <instance-id> KEY=VALUE [KEY=VALUE...]")
|
|
}
|
|
adminSetConfig(*httpURL, token, rest[1], rest[2:])
|
|
case "del-config":
|
|
if len(rest) < 3 {
|
|
die("usage: panelctl admin del-config <instance-id> KEY [KEY...]")
|
|
}
|
|
adminDelConfig(*httpURL, token, rest[1], rest[2:])
|
|
case "recreate":
|
|
if len(rest) < 2 {
|
|
die("usage: panelctl admin recreate <instance-id> [--mount CONTAINER=HOST ...]")
|
|
}
|
|
adminRecreate(*httpURL, token, rest[1], rest[2:])
|
|
default:
|
|
adminUsage()
|
|
os.Exit(2)
|
|
}
|
|
}
|
|
|
|
// ---- handlers ----
|
|
|
|
func adminTokenShow(dataDir string) {
|
|
tok := readTokenFile(dataDir)
|
|
if tok == "" {
|
|
fmt.Fprintf(os.Stderr, "panelctl: no admin-token file found at %s\n", filepath.Join(dataDir, adminTokenFilename))
|
|
fmt.Fprintln(os.Stderr, " (controller writes this on first start; check $PANEL_DATA_DIR)")
|
|
os.Exit(1)
|
|
}
|
|
fmt.Println(tok)
|
|
}
|
|
|
|
func adminStatus(httpURL, token string) {
|
|
body, status := adminGET(httpURL, "/admin/v1/health", token)
|
|
if status != http.StatusOK {
|
|
fmt.Fprintf(os.Stderr, "health: HTTP %d\n%s\n", status, string(body))
|
|
os.Exit(1)
|
|
}
|
|
prettyPrintJSON(body)
|
|
}
|
|
|
|
func adminInstances(httpURL, token string) {
|
|
body, status := adminGET(httpURL, "/admin/v1/instances", token)
|
|
if status != http.StatusOK {
|
|
fmt.Fprintf(os.Stderr, "instances: HTTP %d\n%s\n", status, string(body))
|
|
os.Exit(1)
|
|
}
|
|
var resp struct {
|
|
Instances []struct {
|
|
InstanceID string `json:"instance_id"`
|
|
AgentID string `json:"agent_id"`
|
|
ModuleID string `json:"module_id"`
|
|
Status string `json:"status"`
|
|
ConfigValues map[string]string `json:"config_values"`
|
|
AssignedPorts map[string]uint32 `json:"assigned_ports"`
|
|
ARKClusterID string `json:"ark_cluster_id"`
|
|
} `json:"instances"`
|
|
}
|
|
if err := json.Unmarshal(body, &resp); err != nil {
|
|
fmt.Fprintf(os.Stderr, "decode: %v\n%s\n", err, string(body))
|
|
os.Exit(1)
|
|
}
|
|
if len(resp.Instances) == 0 {
|
|
fmt.Println("(no instances)")
|
|
return
|
|
}
|
|
fmt.Printf("%-20s %-18s %-14s %-10s %-12s %s\n",
|
|
"INSTANCE_ID", "AGENT_ID", "MODULE", "STATUS", "CFG_KEYS", "CLUSTER")
|
|
for _, i := range resp.Instances {
|
|
fmt.Printf("%-20s %-18s %-14s %-10s %-12d %s\n",
|
|
i.InstanceID, i.AgentID, i.ModuleID, i.Status, len(i.ConfigValues), i.ARKClusterID)
|
|
}
|
|
}
|
|
|
|
func adminArkRebind(httpURL, token, instanceID string) {
|
|
body, status := adminPOST(httpURL, "/admin/v1/instances/"+instanceID+"/ark-cluster-rebind", token, nil)
|
|
if status != http.StatusOK {
|
|
fmt.Fprintf(os.Stderr, "ark-rebind: HTTP %d\n%s\n", status, string(body))
|
|
os.Exit(1)
|
|
}
|
|
prettyPrintJSON(body)
|
|
}
|
|
|
|
func adminSetConfig(httpURL, token, instanceID string, kvs []string) {
|
|
set := map[string]string{}
|
|
for _, kv := range kvs {
|
|
eq := strings.IndexByte(kv, '=')
|
|
if eq <= 0 {
|
|
die("malformed KEY=VALUE: %q (must have a non-empty key before '=')", kv)
|
|
}
|
|
set[kv[:eq]] = kv[eq+1:]
|
|
}
|
|
payload := map[string]any{"set": set}
|
|
body, status := adminPOST(httpURL, "/admin/v1/instances/"+instanceID+"/config", token, payload)
|
|
if status != http.StatusOK {
|
|
fmt.Fprintf(os.Stderr, "set-config: HTTP %d\n%s\n", status, string(body))
|
|
os.Exit(1)
|
|
}
|
|
prettyPrintJSON(body)
|
|
}
|
|
|
|
func adminDelConfig(httpURL, token, instanceID string, keys []string) {
|
|
payload := map[string]any{"delete": keys}
|
|
body, status := adminPOST(httpURL, "/admin/v1/instances/"+instanceID+"/config", token, payload)
|
|
if status != http.StatusOK {
|
|
fmt.Fprintf(os.Stderr, "del-config: HTTP %d\n%s\n", status, string(body))
|
|
os.Exit(1)
|
|
}
|
|
prettyPrintJSON(body)
|
|
}
|
|
|
|
func adminRecreate(httpURL, token, instanceID string, args []string) {
|
|
mounts := map[string]string{}
|
|
hasMount := false
|
|
for i := 0; i < len(args); i++ {
|
|
a := args[i]
|
|
switch {
|
|
case a == "--mount":
|
|
if i+1 >= len(args) {
|
|
die("--mount requires CONTAINER_PATH=HOST_PATH")
|
|
}
|
|
i++
|
|
parseMountInto(args[i], mounts)
|
|
hasMount = true
|
|
case strings.HasPrefix(a, "--mount="):
|
|
parseMountInto(a[len("--mount="):], mounts)
|
|
hasMount = true
|
|
default:
|
|
die("unknown arg %q to recreate", a)
|
|
}
|
|
}
|
|
payload := map[string]any{}
|
|
if hasMount {
|
|
payload["mount_overrides"] = mounts
|
|
}
|
|
body, status := adminPOST(httpURL, "/admin/v1/instances/"+instanceID+"/recreate", token, payload)
|
|
if status != http.StatusOK {
|
|
fmt.Fprintf(os.Stderr, "recreate: HTTP %d\n%s\n", status, string(body))
|
|
os.Exit(1)
|
|
}
|
|
prettyPrintJSON(body)
|
|
}
|
|
|
|
func parseMountInto(spec string, out map[string]string) {
|
|
eq := strings.IndexByte(spec, '=')
|
|
if eq <= 0 {
|
|
die("malformed --mount %q (expected CONTAINER_PATH=HOST_PATH)", spec)
|
|
}
|
|
out[spec[:eq]] = spec[eq+1:]
|
|
}
|
|
|
|
// ---- HTTP helpers ----
|
|
|
|
func adminGET(httpURL, path, token string) ([]byte, int) {
|
|
req, err := http.NewRequest(http.MethodGet, strings.TrimRight(httpURL, "/")+path, nil)
|
|
if err != nil {
|
|
die("request: %v", err)
|
|
}
|
|
return doAdminRequest(req, token)
|
|
}
|
|
|
|
func adminPOST(httpURL, path, token string, payload any) ([]byte, int) {
|
|
var body io.Reader
|
|
if payload != nil {
|
|
b, err := json.Marshal(payload)
|
|
if err != nil {
|
|
die("marshal: %v", err)
|
|
}
|
|
body = bytes.NewReader(b)
|
|
}
|
|
req, err := http.NewRequest(http.MethodPost, strings.TrimRight(httpURL, "/")+path, body)
|
|
if err != nil {
|
|
die("request: %v", err)
|
|
}
|
|
if payload != nil {
|
|
req.Header.Set("Content-Type", "application/json")
|
|
}
|
|
return doAdminRequest(req, token)
|
|
}
|
|
|
|
func doAdminRequest(req *http.Request, token string) ([]byte, int) {
|
|
if token != "" {
|
|
req.Header.Set(adminAuthHeaderName, token)
|
|
}
|
|
client := &http.Client{Timeout: 4 * time.Minute}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
die("http: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
die("read body: %v", err)
|
|
}
|
|
return body, resp.StatusCode
|
|
}
|
|
|
|
// ---- misc ----
|
|
|
|
func readTokenFile(dataDir string) string {
|
|
b, err := os.ReadFile(filepath.Join(dataDir, adminTokenFilename))
|
|
if err != nil {
|
|
if !errors.Is(err, os.ErrNotExist) {
|
|
fmt.Fprintf(os.Stderr, "panelctl: warn: read admin-token: %v\n", err)
|
|
}
|
|
return ""
|
|
}
|
|
return strings.TrimSpace(string(b))
|
|
}
|
|
|
|
func envOrDefault(key, def string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return def
|
|
}
|
|
|
|
func prettyPrintJSON(body []byte) {
|
|
var v any
|
|
if err := json.Unmarshal(body, &v); err != nil {
|
|
fmt.Println(string(body))
|
|
return
|
|
}
|
|
out, err := json.MarshalIndent(v, "", " ")
|
|
if err != nil {
|
|
fmt.Println(string(body))
|
|
return
|
|
}
|
|
fmt.Println(string(out))
|
|
}
|