Repository navigation
fix: redeploy through a host unit, honest image prune, accurate disk use, stricter requests - #20
Merged
Merged
Conversation
…sk use and stricter requests Redeploy runs graphite-up as a transient systemd unit through nsenter instead of calling the agent, returns at once, and the page polls the unit's state and log, so Cloudflare's 100 second limit and a redeploy of the console itself both work. The missing-secret hint ignores names the project's values file supplies, and the needs-redeploy hint counts graphite-up's .applied marker as a rollout. Removing images now removes every unused image and refreshes disk use. Disk use is reported as df does. Every response carries the security headers, and a write needs this console's Origin or Sec-Fetch-Site same-origin.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes reported after the secret store went live.
fetch failed/reapplyover HTTPgraphite-redeploy-<project>, a transient systemd unit runninggraphite-up <project>on the host throughnsenter(as the host shell already does), and answers at once. The button pollsGET /api/projects/<project>/redeployfor the unit's state and, on failure, its journal. The unit outlives the console, so redeploying the console works, and nothing waits on Cloudflare's 100 s limit. Moved toPOST /api/projects/<slug>/redeploy(project access), with a button on every Project page.${NAME:?}in the applied compose counted as a secretvaluesfile supplies are not secrets./srv/graphite/<project>/.applied, whichgraphite-uptouches after a successful rollout (Project-Graphite/platform#45).sha-tagsdfshows.Security: every response sends
X-Frame-Options,Cross-Origin-Opener-Policy,Cross-Origin-Resource-Policy,Permissions-Policy,Referrer-Policy,nosniffand, in production, HSTS. A non-GET API request needs this console'sOrigin, orSec-Fetch-Site: same-originwhen there is none; a request with neither is refused.AGENT_URLand the use of/agent/CONSOLE_TOKENare gone.Checks:
tsc(server and web),oxlint,npm run build,test/secrets.spec.ts,test/access.spec.ts,test/backups.spec.ts,test/alerts.spec.ts,test/host.spec.ts. The redeploy unit has not been run on the VPS.