From 1f340ef9243fc4304bd38d8f7eab79e57121e926 Mon Sep 17 00:00:00 2001 From: Ligbox Spec Hub Date: Thu, 25 Jun 2026 16:42:07 +0000 Subject: [PATCH] =?UTF-8?q?docs(dns):=20sincronizar=20Spec=20037/035=20com?= =?UTF-8?q?=20deploy=20V1=E2=80=93V3=20e=20V4=20pendente?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Actualiza dns-viewer, exec/rollback, fichas VM112/122/123, API Console proxy, token interno wizard e verify script para evitar drift documental. Co-authored-by: Cursor --- deploy/vm112-wizard/DNS-VIEWER-V4.md | 76 +++++++++-- docs/vms/README.md | 8 +- docs/vms/VM112.md | 16 ++- docs/vms/VM122.md | 14 ++ docs/vms/VM123.md | 15 +- .../domain-manager-console-ui.md | 18 ++- .../spec.md | 2 + .../tasks.md | 6 +- .../deploy/DNS-VIEWER-EXEC-20260625.md | 129 ++++++++++++------ .../deploy/DNS-VIEWER-ROLLBACK.md | 2 + .../deploy/scripts/verify-dns-viewer.sh | 14 ++ .../dns-viewer.md | 56 ++++++-- .../spec.md | 4 +- .../tasks.md | 2 +- 14 files changed, 287 insertions(+), 75 deletions(-) diff --git a/deploy/vm112-wizard/DNS-VIEWER-V4.md b/deploy/vm112-wizard/DNS-VIEWER-V4.md index d65c54e..2b00169 100644 --- a/deploy/vm112-wizard/DNS-VIEWER-V4.md +++ b/deploy/vm112-wizard/DNS-VIEWER-V4.md @@ -1,36 +1,90 @@ # Spec 037 V4 — Wizard DNS Viewer +**Spec:** [dns-viewer.md](../../specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md) · **Rollback:** [DNS-VIEWER-ROLLBACK.md](../../specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md) § VM112 + Painel **read-only** no **passo DNS existente** (step 1) — **não** é menu nem página nova. +**Estado:** 📋 patches versionados no monorepo · deploy VM112 **pendente** (SSH CT130 falha: LAN permission denied, WAN timeout). + +--- + +## Pré-requisitos + +| Variável | Valor | Onde | +|----------|-------|------| +| `DESK_API_URL` | `http://10.10.10.122:8080` | env wizard backend | +| `OPS_INTERNAL_TOKEN` | igual ao Desk | env wizard + Desk `.env` | + +Desk endpoint aceita `X-Ops-Internal-Token` via `require_internal_or_user` (`main.py`). + +--- + ## Backend ```bash -# Na VM112 +# Na VM112 (paths locais após git pull / rsync monorepo) python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py -# Requer OPS_INTERNAL_TOKEN + DESK_API_URL no env wizard -systemctl restart ligbox-wizard # ou docker compose restart backend +systemctl restart ligbox-wizard 2>/dev/null || docker compose -f /opt/ligbox-wizard/docker-compose.yml restart backend ``` -Endpoint: `GET /api/onboarding/dns/viewer/{domain}` -Header: `X-Onboarding-Session` (sessão wizard) +| Item | Valor | +|------|-------| +| Endpoint | `GET /api/onboarding/dns/viewer/{domain}` | +| Auth sessão | Header `X-Onboarding-Session` | +| Proxy | Desk `GET /api/v1/dns/viewer/{domain}?email_service=true` | +| Resposta | Mesma shape Desk; `edit_links=[]`; `viewer_context=wizard_onboarding` | -Proxy → Desk `GET /api/v1/dns/viewer/{domain}` (token interno). -`edit_links` removidos na resposta wizard (cliente). +--- ## Frontend ```bash python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py cd /opt/ligbox-wizard/frontend && npm run build +# Reiniciar serviço static/nginx conforme stack VM112 ``` -## UI +## UI (sem nova rota) -Painel lateral abaixo das opções DNS: -- Modo (Ligbox / externo / OpenPanel) +Painel lateral abaixo das opções DNS no step 1: + +- Badge modo (Ligbox / externo / OpenPanel) - Tabela registos (max 12 linhas) - Secção «Serão aplicados» se `planned_records` +--- + +## Validação + +```bash +# Com sessão onboarding válida +curl -sS -H "X-Onboarding-Session: " \ + "http://127.0.0.1:8090/api/onboarding/dns/viewer/exemplo.com.br" | jq .mode_label,.summary +``` + +Browser: `onboard.ligbox.com.br` → passo DNS → painel «Apontamentos DNS (visualização)» após escolher caminho. + +--- + +## SSH / deploy a partir do CT130 + +| Destino | Comando | Resultado conhecido | +|---------|---------|---------------------| +| LAN | `ssh root@10.10.10.112` | Permission denied (password `805353` não válida) | +| WAN | `ssh -p 2512 root@95.216.14.146` | Timeout a partir CT130 | + +**Acção:** Roger aplica patches directamente na VM112 ou fornece credencial SSH correcta. + +--- + ## Rollback -Ver `specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md` § VM112. +```bash +ssh root@10.10.10.112 +cd /opt/ligbox-wizard +BACKUP=$(ls -td .backups/dns-viewer-* 2>/dev/null | head -1) +[ -n "$BACKUP" ] && cp -a "$BACKUP"/backend/. backend/ +systemctl restart ligbox-wizard 2>/dev/null || docker compose restart backend +``` + +Ver também rollback completo em `DNS-VIEWER-ROLLBACK.md`. diff --git a/docs/vms/README.md b/docs/vms/README.md index e99cf5e..1f7ea28 100644 --- a/docs/vms/README.md +++ b/docs/vms/README.md @@ -30,7 +30,8 @@ ligbox-ops-platform/ | **123** | 10.10.10.123 | :2523 | FOSSBilling + Odoo + OpenPanel + Console UI | `projects/finance/` | | **104** | 10.10.10.104 | :2504 | Wazuh SIEM | integração Spec 002, 019 | | **114** | 10.10.10.114 | — | Traefik (CT) | `docs/network/TRAEFIK_*` | -| **116** | 10.10.10.116 | :2516 | Nextcloud Hub — ampliar storage mail (Spec 034) | `deploy/vm116-nextcloud/` | +| **116** | 10.10.10.116 | :2516 | RustDesk relay + portal remoto | — | +| **124** | 10.10.10.124 | :2524 | **Nextcloud Hub** — storage mail (Spec 034) | `deploy/vm116-nextcloud/` | | **130** | 10.10.10.130 | :2530 | **Spec Hub** Git + Obsidian + Portal | CT130 local | --- @@ -46,6 +47,7 @@ ligbox-ops-platform/ | 025 | wizard-onboarding-continuity | | 026 | purge-traefik-validation | | 034 | nextcloud-carbonio-vm112-integration | +| 037 | dns-viewer **V4 wizard** (painel step DNS — deploy pendente) | | 010 | desk-assist-takeover (fases VM112) | → [Ficha VM112](VM112.md) @@ -53,6 +55,7 @@ ligbox-ops-platform/ ### VM122 — Ops Desk (motor) | Spec | Nome | |------|------| +| 035 | ligbox-watchman (vigilância + alertas) | | 003 | desk-auth-rbac | | 004 | desk-account-management | | 009 | ops-audit-overview | @@ -61,6 +64,7 @@ ligbox-ops-platform/ | 015 | desk-module-registry | | 027 | desk-rbac-function-matrix | | 029 | agentic ops | +| 037 | dns-viewer **V1–V2** API + Desk UI | → [Ficha VM122](VM122.md) @@ -71,6 +75,8 @@ ligbox-ops-platform/ | 023 | billing-recurrence-desk-visibility | | 024 | openpanel-fossbilling | | 027 | desk-rbac (matriz VM123) | +| 035 | ligbox-mail-bundles `/admin` gerente | +| 037 | dns-viewer **V3** `/admin/dominio` | → [Ficha VM123](VM123.md) diff --git a/docs/vms/VM112.md b/docs/vms/VM112.md index 552192b..0522a41 100644 --- a/docs/vms/VM112.md +++ b/docs/vms/VM112.md @@ -18,6 +18,7 @@ ``` deploy/vm112-spec022/ # Carbonio account scripts +deploy/vm112-wizard/ # Patches wizard (Spec 037 V4 DNS Viewer) deploy/vm112-wizard-security/ # CSP, webhooks, audit docs/EMAIL_LIGBOX_VM112.md specs/001-webhook-vm112-integration/ @@ -26,6 +27,7 @@ specs/022-carbonio-account-exists-release/ specs/025-wizard-onboarding-continuity/ specs/026-purge-traefik-validation/ specs/034-nextcloud-carbonio-vm112-integration/ +specs/037-dns-multi-cloudflare-orchestration/ # DNS Viewer V4 wizard ``` ## Deploy na VM112 @@ -35,9 +37,21 @@ git clone https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform.git # Copiar deploy/vm112-* para paths locais — ver README em cada pasta ``` +### DNS Viewer V4 (Spec 037 — pendente) + +Painel read-only no passo DNS — **sem página nova**. Runbook: + +``` +deploy/vm112-wizard/DNS-VIEWER-V4.md +deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py +deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py +``` + +Env obrigatório: `DESK_API_URL`, `OPS_INTERNAL_TOKEN` (igual Desk VM122). + ## Integração - **→ VM122:** webhooks `onboarding.*` · Assist/takeover API - **→ CT114:** Traefik routers mail/onboard · `files.{dom}` (Spec 034) -- **→ VM116:** IMAP/SMTP (Nextcloud Mail app) · OCS provisioning (Spec 034) +- **→ VM124:** IMAP/SMTP (Nextcloud Mail app) · OCS provisioning (Spec 034) - **← Desk:** purge, DNS revalidate, assist actions diff --git a/docs/vms/VM122.md b/docs/vms/VM122.md index a2454e6..ec2e3d0 100644 --- a/docs/vms/VM122.md +++ b/docs/vms/VM122.md @@ -33,6 +33,20 @@ deploy/vm122-fossbilling/ # Stack legado (se activo) - 015 desk-module-registry - 027 desk-rbac-function-matrix - 029 agentic +- **037** dns-viewer (V1–V2 API + Desk UI — `dns_viewer.py`, `dns-viewer.js`) + +## DNS Viewer (Spec 037) + +| Fase | Estado | Path runtime | +|------|--------|--------------| +| V1 API | ✅ | `/opt/ligbox-ops-platform/api/app/dns_viewer.py` | +| V1b Desk UI | ✅ | `frontend/assets/dns-viewer.js` | +| V2 OpenPanel | ✅ | `api/app/openpanel_dns.py` | +| V3 proxy Console | ✅ | `api/app/domain_console_routes.py` | + +Feature flag: `DNS_VIEWER_ENABLED=1` em `.env`. Rollback: `specs/037-.../deploy/DNS-VIEWER-ROLLBACK.md`. + +**Deploy API:** container Docker — após rsync, `docker cp api/app/. ligbox-ops-platform_api_1:/app/app/` + restart. ## Deploy diff --git a/docs/vms/VM123.md b/docs/vms/VM123.md index 632c6f1..4c16ae7 100644 --- a/docs/vms/VM123.md +++ b/docs/vms/VM123.md @@ -21,6 +21,8 @@ deploy/vm123-finance-stack/ # docker-compose FOSS/Odoo/OpenPanel specs/019-ops-console-active-operations/deploy/ # Template Console UI specs/023-billing-recurrence-desk-visibility/ specs/024-openpanel-fossbilling/ +specs/035-ligbox-mail-bundles-foss-openpanel/ # `/admin` gerente +specs/037-dns-multi-cloudflare-orchestration/ # DNS Viewer V3 docs/network/VM123_INVENTARIO.md docs/VM123_OPS_CONSOLE_HANDOFF.md ``` @@ -32,7 +34,18 @@ docs/VM123_OPS_CONSOLE_HANDOFF.md | fossbilling | 8092 | FOSSBilling | | odoo | 8069 | Odoo 16 | | openpanel | 2083 | OpenPanel | -| ligbox-ops-console-ui | 8100 | Console Spec 019 | +| ligbox-ops-console-ui | 8100 | Console Spec 019 + `/admin/dominio` (037) | + +## DNS Viewer Console (Spec 037 V3) + +| Item | Valor | +|------|-------| +| URL | `https://console.ligbox.com.br/admin/dominio` | +| Frontend | `AdminDominio.jsx` + `DnsViewerPanel.jsx` | +| API | Proxy Desk `GET /api/v1/domain-console/dns/viewer/{domain}` (VM122) | +| Auth | Login Desk → JWT em `localStorage` | + +Deploy: build em `specs/019-.../deploy/frontend` → `/opt/ligbox-ops-console/frontend`. ## Deploy diff --git a/specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md b/specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md index 96f8b31..fe538b4 100644 --- a/specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md +++ b/specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md @@ -243,12 +243,26 @@ Secção **read-only** — gerente **vê** apontamentos; **não edita** na Conso #### API +**Desk (staff directo):** + ```http GET /api/v1/dns/viewer/{domain} -Authorization: Bearer +Authorization: Bearer +Query: ?email_service=true&include_public=true ``` -Proxy Desk → agrega CF / OpenPanel / público conforme `dns_mode`. Ver [dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md). +**Console gerente (proxy Desk — implementado V3):** + +```http +GET /api/v1/domain-console/dns/viewer/{domain} +Authorization: Bearer +Query: ?email_service=true&include_public=true +``` + +Frontend Console (`AdminDominio.jsx`) chama o proxy acima via API Desk (`console.ligbox.com.br` → VM122). +Implementação: `domain_console_routes.py` — filtra links CF Ligbox para gerente. + +Agrega CF / OpenPanel / público conforme `dns_mode`. Ver [dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md). #### Elementos UI diff --git a/specs/035-ligbox-mail-bundles-foss-openpanel/spec.md b/specs/035-ligbox-mail-bundles-foss-openpanel/spec.md index a899244..82b4cf1 100644 --- a/specs/035-ligbox-mail-bundles-foss-openpanel/spec.md +++ b/specs/035-ligbox-mail-bundles-foss-openpanel/spec.md @@ -609,6 +609,8 @@ Roger (2026-06-25): gerente e staff precisam **ver todos os apontamentos** sem a Documento técnico: [037 dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md) UI gerente: [domain-manager-console-ui.md §5.5](./domain-manager-console-ui.md#55-domínio--dns-dns-viewer--spec-037-dns-viewer) +**Deploy (2026-06-25):** Console `/admin/dominio` ✅ VM123 · API proxy `GET /api/v1/domain-console/dns/viewer/{domain}` ✅ VM122 · Wizard V4 📋 patches prontos. + --- ## 10. Add-ons FOSS (venda separada) diff --git a/specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md b/specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md index a705e55..054b351 100644 --- a/specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md +++ b/specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md @@ -32,10 +32,12 @@ Shell: [ligbox-console-shell.md](./ligbox-console-shell.md) · Detalhe: [domain- - [ ] UX-A2: `/admin/contas` CRUD inline - [ ] UX-A3: `/admin/files` quotas + toggle Mail NC - [ ] UX-A4: `/admin/certificacao` + `/admin/dominio` **DNS Viewer** (037 dns-viewer.md) - - [x] `/admin/dominio` V3 deploy VM123 2026-06-25 + - [x] `/admin/dominio` V3 deploy VM123 2026-06-25 (`AdminDominio.jsx`, `DnsViewerPanel.jsx`) + - [ ] `/admin/certificacao` EasyDMARC card - [ ] UX-A4b: `/admin/plano` boleto/PIX - [ ] SSO FOSS → `/admin?sso=TOKEN` - [ ] API Desk `/api/v1/domain-console/*` + - [x] `GET /api/v1/domain-console/dns/viewer/{domain}` (VM122 2026-06-25) ## Fase 2b — OpenPanel (backend only) @@ -89,4 +91,4 @@ Ver placeholder: [user-self-service-ui.md](./user-self-service-ui.md) - [ ] Actualizar `docs/vms/README.md` - [ ] Publicar Spec Hub Portal - [x] Spec 037-DNS-VIEWER `dns-viewer.md` + §5.5 domain-manager actualizado -- [ ] Implementar `GET /api/v1/dns/viewer/{domain}` (Desk + Console) +- [x] Implementar `GET /api/v1/dns/viewer/{domain}` (Desk VM122 + proxy Console VM123 2026-06-25) diff --git a/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md b/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md index 75c854c..7e07cec 100644 --- a/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md +++ b/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md @@ -1,72 +1,111 @@ -# DNS Viewer V1 — Execução e versionamento +# DNS Viewer — Execução e versionamento **Responsável:** Cursor Agent · **Aprovado por:** Roger -**Data:** 2026-06-25 +**Data início:** 2026-06-25 · **Última actualização:** 2026-06-25 **Spec:** [dns-viewer.md](../dns-viewer.md) · Rollback: [DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md) --- ## Escopo desta execução -| Fase | Incluída agora | Entregável | -|------|----------------|------------| -| V0 | ✅ baseline | `cloudflare_dns.py` + modal Desk (já existe) | -| V1 | 📋 próximo deploy | API `GET /api/v1/dns/viewer/{domain}` | -| V1b | 📋 | `dns-viewer.js` + migrar modal Desk | -| V2–V4 | ⏳ futuro | OpenPanel, Console, Wizard | +| Fase | Estado | VM | Entregável | +|------|--------|-----|------------| +| V0 | ✅ baseline | VM122 | `cloudflare_dns.py` + modal Desk CF | +| V1 | ✅ deploy OK | VM122 | `GET /api/v1/dns/viewer/{domain}` | +| V1b | ✅ deploy OK | VM122 | `dns-viewer.js` + modais Overview/IaaS | +| V2 | ✅ deploy OK | VM122 | `openpanel_dns.py` + `GET /api/v1/dns/openpanel/records` | +| V3 | ✅ deploy OK | VM123 | `/admin/dominio` + `DnsViewerPanel.jsx` | +| V4 | 📋 patches no repo | VM112 | Painel wizard — **deploy pendente** (SSH) | --- ## Checklist pré-deploy (obrigatório) ```bash -# CT130 — tag git (usar SSHPASS se preflight/rollback a partir do Spec Hub) +# CT130 — tag git cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform git tag -a dns-viewer-pre-v1-$(date +%Y%m%d) -m "Antes DNS Viewer V1" # VM122 — backup (CT130: export SSHPASS=805353) -export SSHPASS='805353' # opcional — só se SSH key falhar +export SSHPASS='805353' bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \ --host root@10.10.10.122 ``` +Para V3 Console: + +```bash +bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \ + --host root@10.10.10.123 --console +``` + --- ## Ficheiros versionados (monorepo) | Ficheiro | Fase | Notas | |----------|------|-------| -| `projects/ops-desk/api/app/cloudflare_dns.py` | V0 | Não remover — provider CF | -| `projects/ops-desk/api/app/dns_viewer.py` | V1 | **Novo** orquestrador | -| `projects/ops-desk/api/app/openpanel_dns.py` | V2 | Novo — opcional | -| `projects/ops-desk/api/app/main.py` | V1 | Rota viewer + flag | +| `projects/ops-desk/api/app/cloudflare_dns.py` | V0 | Provider CF — manter | +| `projects/ops-desk/api/app/dns_viewer.py` | V1 | Orquestrador | +| `projects/ops-desk/api/app/openpanel_dns.py` | V2 | BIND via `dig @10.10.10.123` | +| `projects/ops-desk/api/app/domain_console_routes.py` | V3 | Proxy Console | +| `projects/ops-desk/api/app/main.py` | V1+ | Rotas + `require_internal_or_user` | | `projects/ops-desk/api/app/permissions.py` | V1 | `can_read_dns_viewer` | -| `projects/ops-desk/frontend/assets/dns-viewer.js` | V1b | **Novo** componente | -| `projects/ops-desk/frontend/assets/app.js` | V1b | Integrar viewer | -| `projects/ops-desk/frontend/index.html` | V1b | Cache bust `?v=` | -| `projects/wizard/backend/app/services/dns_viewer.py` | V4 | Wizard variant | +| `projects/ops-desk/frontend/assets/dns-viewer.js` | V1b | Componente Desk | +| `projects/ops-desk/frontend/assets/app.js` | V1b | Integração modais | +| `specs/019-.../deploy/frontend/src/views/admin/AdminDominio.jsx` | V3 | Página Console | +| `specs/019-.../deploy/frontend/src/components/DnsViewerPanel.jsx` | V3 | Componente partilhado | +| `deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py` | V4 | Backend wizard | +| `deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py` | V4 | Frontend wizard | +| `deploy/vm112-wizard/DNS-VIEWER-V4.md` | V4 | Runbook | --- -## Deploy VM122 (após implementação V1/V1b) +## Deploy VM122 (V1/V1b/V2) ```bash -# CT130 ou laptop com rsync REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform -rsync -av --delete \ - "$REPO/projects/ops-desk/api/app/" \ - root@10.10.10.122:/opt/ligbox-ops-platform/api/app/ - -rsync -av \ - "$REPO/projects/ops-desk/frontend/assets/" \ - root@10.10.10.122:/opt/ligbox-ops-platform/frontend/assets/ +rsync -av "$REPO/projects/ops-desk/api/app/" root@10.10.10.122:/opt/ligbox-ops-platform/api/app/ +rsync -av "$REPO/projects/ops-desk/frontend/assets/" root@10.10.10.122:/opt/ligbox-ops-platform/frontend/assets/ ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \ grep -q DNS_VIEWER_ENABLED .env || echo DNS_VIEWER_ENABLED=1 >> .env && \ - docker compose -f docker-compose.mvp.yml build api frontend && \ - docker compose -f docker-compose.mvp.yml up -d api frontend' + docker cp api/app/. ligbox-ops-platform_api_1:/app/app/ && \ + docker restart ligbox-ops-platform_api_1 && \ + docker compose -f docker-compose.mvp.yml up -d frontend' ``` +**Importante:** API corre em container — `rsync` ao host **não** actualiza runtime sem `docker cp` ou rebuild. + +--- + +## Deploy VM123 (V3 Console) + +```bash +REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform +cd "$REPO/specs/019-ops-console-active-operations/deploy/frontend" +npm run build +tar cf - dist | ssh root@10.10.10.123 'cd /opt/ligbox-ops-console && rm -rf frontend/* && tar xf - --strip-components=1 -C frontend' +ssh root@10.10.10.123 'cd /opt/ligbox-ops-console && docker compose up -d --build' +``` + +URL: `https://console.ligbox.com.br/admin/dominio` + +--- + +## Deploy VM112 (V4 — pendente) + +Ver **[deploy/vm112-wizard/DNS-VIEWER-V4.md](../../../deploy/vm112-wizard/DNS-VIEWER-V4.md)**. + +Pré-requisitos env wizard: + +```bash +DESK_API_URL=http://10.10.10.122:8080 +OPS_INTERNAL_TOKEN= +``` + +SSH VM112: LAN `10.10.10.112` ou WAN `95.216.14.146:2512` (credencial distinta de VM122/123). + --- ## Validação pós-deploy @@ -75,36 +114,40 @@ ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \ bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh \ --host 10.10.10.122 +# Console +curl -sS -o /dev/null -w '%{http_code}\n' https://console.ligbox.com.br/admin/dominio + # Manual UI -# Desk → Overview → tenant VM112 → domínio → secção DNS unificada -# Browser devtools: zero SyntaxError em app.js / dns-viewer.js +# Desk → Overview → domínio → secção DNS unificada +# Console → Admin → Domínio & DNS ``` --- ## Rollback -Ver **[DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)** — ordem recomendada: +Ver **[DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)** — ordem: -1. `DNS_VIEWER_ENABLED=0` (30 segundos) +1. `DNS_VIEWER_ENABLED=0` (30 s) 2. Rollback frontend se UI partida 3. Rollback API se 500 4. `git revert` CT130 se necessário --- -## Registo de versões (preencher após cada deploy) +## Registo de versões -| Data | Tag git | VM122 backup dir | Commit | Notas | -|------|---------|------------------|--------|-------| -| 2026-06-25 | `dns-viewer-pre-v1-20260625` | `.backups/dns-viewer-20260625-161839` | `7e4920a` | Pré-deploy | -| 2026-06-25 | — | tag Docker `post-dns-viewer-v1-20260625` | _(working tree)_ | **V1+V1b deploy OK** · verify PASSED | +| Data | Tag git | VM backup / Docker | Commit | Notas | +|------|---------|-------------------|--------|-------| +| 2026-06-25 | `dns-viewer-pre-v1-20260625` | `.backups/dns-viewer-20260625-161839` | `7e4920a` | Pré-deploy V1 | +| 2026-06-25 | — | Docker `post-dns-viewer-v1-20260625` | — | V1+V1b VM122 · verify PASSED | +| 2026-06-25 | — | VM123 frontend tar deploy | — | V3 Console `/admin/dominio` | +| 2026-06-25 | — | — | `038fb8f` | **Commit monorepo** — Spec 037 entrega V1–V3 + patches V4 | --- -## Pendente V2+ +## Pendente -- OpenPanel BIND provider -- Console `console.ligbox.com.br/admin/dominio` -- Wizard `GET /api/onboarding/dns/viewer/{domain}` -- Formalizar `dns.viewer.read` em Spec 027 +- [ ] Deploy V4 VM112 (patches prontos; SSH bloqueado CT130→112) +- [ ] Formalizar `dns.viewer.read` em Spec 027 +- [ ] Actualizar `verify-dns-viewer.sh` com smoke Console `/admin/dominio` diff --git a/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md b/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md index 79c0299..d51735e 100644 --- a/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md +++ b/specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md @@ -43,6 +43,8 @@ ssh root@10.10.10.122 cd /opt/ligbox-ops-platform sed -i 's/^DNS_VIEWER_ENABLED=.*/DNS_VIEWER_ENABLED=0/' .env docker compose -f docker-compose.mvp.yml up -d api frontend +# Se alterou ficheiros no host: docker cp api/app/. ligbox-ops-platform_api_1:/app/app/ +docker restart ligbox-ops-platform_api_1 ``` --- diff --git a/specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh b/specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh index edd5f9f..05313c5 100755 --- a/specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh +++ b/specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh @@ -1,5 +1,6 @@ #!/usr/bin/env bash # Spec 037-DNS-VIEWER — smoke tests pós-deploy ou pós-rollback +# VM122: API corre em container Docker — após rsync host, docker cp + restart (ver DNS-VIEWER-EXEC) set -euo pipefail HOST="10.10.10.122" @@ -70,6 +71,19 @@ if [[ "$LEGACY_ONLY" -eq 0 ]]; then echo " FAIL dns/viewer → HTTP $CODE" FAIL=1 fi + + CODE=$(curl -sS -o /dev/null -w '%{http_code}' \ + "${API}/api/v1/domain-console/dns/viewer/${DOMAIN}" 2>/dev/null || echo "000") + if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then + echo " OK domain-console/dns/viewer (no auth) → HTTP $CODE" + elif [[ "$CODE" == "200" ]]; then + echo " OK domain-console/dns/viewer → HTTP 200" + elif [[ "$CODE" == "404" ]]; then + echo " WARN domain-console/dns/viewer → 404 (router não deployado)" + else + echo " FAIL domain-console/dns/viewer → HTTP $CODE" + FAIL=1 + fi fi # JS assets existem diff --git a/specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md b/specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md index 75054dd..93ba044 100644 --- a/specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md +++ b/specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md @@ -2,7 +2,7 @@ **Criado:** 2026-06-25 **Solicitado por:** Roger -**Status:** 📋 Especificado — implementação Fase 1 parcial (Desk CF only) +**Status:** 🏗️ V1–V3 em produção (VM122/VM123) · V4 patches prontos · deploy VM112 pendente **Prioridade:** P1 **Depende de:** [spec.md](./spec.md) · [004 cloudflare-zone-provision](../004-onboard-funnel-events/cloudflare-zone-provision.md) · [009](../009-ops-audit-overview/spec.md) · [028](../028-openpanel-ce-ligbox-reengineering/DNS53_OPENPANEL_PORTA53.md) · [035 §5.5](../035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md) · [027 RBAC](../027-desk-rbac-function-matrix/spec.md) @@ -101,9 +101,30 @@ flowchart TD ```http GET /api/v1/dns/viewer/{domain} Authorization: Bearer -Query: ?include_public=true&include_planned=true +# OU (wizard / workers internos): +X-Ops-Internal-Token: +Query: ?include_public=true&email_service=true ``` +**Variante Console gerente (Spec 035 V3):** + +```http +GET /api/v1/domain-console/dns/viewer/{domain} +Authorization: Bearer +Query: ?email_service=true&include_public=true +``` + +Implementação: `domain_console_routes.py` — proxy para `fetch_dns_viewer()`; filtra `edit_links` CF Ligbox para roles não-staff. + +**Autenticação interna (V4 wizard → Desk):** + +| Header | Quem usa | Função | +|--------|----------|--------| +| `Authorization: Bearer …` | Desk UI, Console `/admin` | JWT staff ou domain-admin | +| `X-Ops-Internal-Token` | VM112 wizard backend | `require_internal_or_user` em `main.py` — evita duplicar lógica DNS no wizard | + +Variáveis VM112: `DESK_API_URL=http://10.10.10.122:8080`, `OPS_INTERNAL_TOKEN` (mesmo valor Desk). + **Response:** ```json @@ -284,7 +305,7 @@ Resolver ordem: | **V1b** | Desk UI unificada (`dns-viewer.js`) | ✅ VM122 2026-06-25 | | **V2** | OpenPanel BIND records no viewer | ✅ VM122 2026-06-25 | | **V3** | Console `/admin/dominio` | ✅ VM123 2026-06-25 | -| **V4** | Wizard painel lateral + diff planned vs actual | 📋 | +| **V4** | Wizard painel lateral + diff planned vs actual | 📋 patches no repo · deploy VM112 pendente (SSH) | --- @@ -301,16 +322,23 @@ Resolver ordem: --- -## 11. Código (alvo monorepo) +## 11. Código (monorepo + deploy) -| Caminho | Função | -|---------|--------| -| `projects/ops-desk/api/app/dns_viewer.py` | Orquestrador providers | -| `projects/ops-desk/api/app/cloudflare_dns.py` | Provider CF (existente) | -| `projects/ops-desk/api/app/openpanel_dns.py` | Provider BIND (novo) | -| `projects/wizard/backend/app/services/dns_viewer.py` | Wizard session variant | -| `projects/ops-desk/frontend/assets/dns-viewer.js` | Componente partilhado Desk | -| `projects/console/frontend/.../DnsSection.tsx` | Console `/admin` | +| Caminho | Função | Deploy | +|---------|--------|--------| +| `projects/ops-desk/api/app/dns_viewer.py` | Orquestrador providers | VM122 API | +| `projects/ops-desk/api/app/cloudflare_dns.py` | Provider CF | VM122 API | +| `projects/ops-desk/api/app/openpanel_dns.py` | Provider BIND (`dig @10.10.10.123`) | VM122 API | +| `projects/ops-desk/api/app/domain_console_routes.py` | Proxy Console `/admin/dominio` | VM122 API | +| `projects/ops-desk/api/app/main.py` | Rotas viewer + `require_internal_or_user` | VM122 API | +| `projects/ops-desk/frontend/assets/dns-viewer.js` | Componente Desk | VM122 frontend | +| `specs/019-.../deploy/frontend/src/components/DnsViewerPanel.jsx` | Componente Console | VM123 | +| `specs/019-.../deploy/frontend/src/views/admin/AdminDominio.jsx` | Página `/admin/dominio` | VM123 | +| `deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py` | Endpoint wizard proxy Desk | VM112 backend | +| `deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py` | Painel lateral step DNS | VM112 frontend | +| `deploy/vm112-wizard/DNS-VIEWER-V4.md` | Runbook deploy V4 | — | + +**Nota deploy VM122:** código API corre em container Docker — após `rsync` ao host, copiar para o container (`docker cp …/main.py …_api_1:/app/app/`) ou rebuild imagem. --- @@ -324,6 +352,8 @@ Resolver ordem: | [009 spec](../009-ops-audit-overview/spec.md) | Checks públicos | | [027 spec](../027-desk-rbac-function-matrix/spec.md) | Deep-links CF / OP | | [DNS-VIEWER-ROLLBACK](./deploy/DNS-VIEWER-ROLLBACK.md) | Rollback e feature flag | +| [DNS-VIEWER-EXEC-20260625](./deploy/DNS-VIEWER-EXEC-20260625.md) | Registo deploys e commits | +| [deploy/vm112-wizard/DNS-VIEWER-V4.md](../../../deploy/vm112-wizard/DNS-VIEWER-V4.md) | Runbook V4 wizard | --- @@ -364,6 +394,8 @@ DNS_VIEWER_ENABLED=0 # fallback legado /dns/cloudflare/records + UI V0 git tag -a dns-viewer-pre-v1-YYYYMMDD -m "Antes DNS Viewer V1" ``` +Entrega monorepo V1–V3 + patches V4: commit **`038fb8f`** (2026-06-25). + ### Endpoint legado (mantido até cutover) `GET /api/v1/dns/cloudflare/records` — **não remover** enquanto rollback não estiver validado em produção ≥7 dias. diff --git a/specs/037-dns-multi-cloudflare-orchestration/spec.md b/specs/037-dns-multi-cloudflare-orchestration/spec.md index e40eb17..95e2c3d 100644 --- a/specs/037-dns-multi-cloudflare-orchestration/spec.md +++ b/specs/037-dns-multi-cloudflare-orchestration/spec.md @@ -131,7 +131,9 @@ Painel unificado para **exibir** apontamentos (staff Desk + gerente Console) **s | **Cloudflare Ligbox** | Registos **planeados** (pré-NS) ou **aplicados** (pós-apply) + NS CF | | **BYO / Registrador / externo** | DNS **actual** (público + instructions) — **não** preview Ligbox | -Documento completo: **[dns-viewer.md](./dns-viewer.md)** — endpoint `GET /api/v1/dns/viewer/{domain}`, links editar (CF / OpenPanel / registrador), fases V0–V4. +Documento completo: **[dns-viewer.md](./dns-viewer.md)** — endpoints, links editar, fases V0–V4. + +**Estado deploy (2026-06-25):** V1–V3 produção (VM122/123) · commit `038fb8f` · V4 wizard patches prontos · deploy VM112 pendente. --- diff --git a/specs/037-dns-multi-cloudflare-orchestration/tasks.md b/specs/037-dns-multi-cloudflare-orchestration/tasks.md index 30d4999..36dc6e5 100644 --- a/specs/037-dns-multi-cloudflare-orchestration/tasks.md +++ b/specs/037-dns-multi-cloudflare-orchestration/tasks.md @@ -53,5 +53,5 @@ - [x] V1b Desk UI unificada (`dns-viewer.js` + Overview/IaaS modal) - [x] V2 OpenPanel BIND records (`openpanel_dns.py`) — VM122 2026-06-25 - [x] V3 Console `/admin/dominio` consume viewer API — VM123 2026-06-25 -- [ ] V4 Wizard painel lateral + diff planned vs actual +- [ ] V4 Wizard painel lateral — patches em `deploy/vm112-wizard/*-v4.patch.py` · deploy VM112 pendente - [ ] RBAC `dns.viewer.read` formalizar Spec 027