ligbox/ligbox-ops-platform
3
0
Fork 0
Code Issues 421 Pull requests Projects Releases Packages Wiki Activity Actions

docs(dns): sincronizar Spec 037/035 com deploy V1–V3 e V4 pendente

Browse source 
Actualiza dns-viewer, exec/rollback, fichas VM112/122/123, API Console
proxy, token interno wizard e verify script para evitar drift documental.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Ligbox Spec Hub 2026-06-25 16:42:07 +00:00
parent 038fb8f7ce
commit 1f340ef924
14 changed files with 287 additions and 75 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

76
deploy/vm112-wizard/DNS-VIEWER-V4.md
View file

@ -1,36 +1,90 @@
# Spec 037 V4 — Wizard DNS Viewer # Spec 037 V4 — Wizard DNS Viewer
**Spec:** [dns-viewer.md](../../specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md) · **Rollback:** [DNS-VIEWER-ROLLBACK.md](../../specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md) § VM112
Painel **read-only** no **passo DNS existente** (step 1) — **não** é menu nem página nova. Painel **read-only** no **passo DNS existente** (step 1) — **não** é menu nem página nova.
**Estado:** 📋 patches versionados no monorepo · deploy VM112 **pendente** (SSH CT130 falha: LAN permission denied, WAN timeout).
---
## Pré-requisitos
| Variável | Valor | Onde |
|----------|-------|------|
| `DESK_API_URL` | `http://10.10.10.122:8080` | env wizard backend |
| `OPS_INTERNAL_TOKEN` | igual ao Desk | env wizard + Desk `.env` |
Desk endpoint aceita `X-Ops-Internal-Token` via `require_internal_or_user` (`main.py`).
---
## Backend ## Backend
```bash ```bash
# Na VM112 # Na VM112 (paths locais após git pull / rsync monorepo)
python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py
# Requer OPS_INTERNAL_TOKEN + DESK_API_URL no env wizard systemctl restart ligbox-wizard 2>/dev/null || docker compose -f /opt/ligbox-wizard/docker-compose.yml restart backend
systemctl restart ligbox-wizard # ou docker compose restart backend
``` ```
Endpoint: `GET /api/onboarding/dns/viewer/{domain}` | Item | Valor |
Header: `X-Onboarding-Session` (sessão wizard) |------|-------|
| Endpoint | `GET /api/onboarding/dns/viewer/{domain}` |
| Auth sessão | Header `X-Onboarding-Session` |
| Proxy | Desk `GET /api/v1/dns/viewer/{domain}?email_service=true` |
| Resposta | Mesma shape Desk; `edit_links=[]`; `viewer_context=wizard_onboarding` |
Proxy → Desk `GET /api/v1/dns/viewer/{domain}` (token interno). ---
`edit_links` removidos na resposta wizard (cliente).
## Frontend ## Frontend
```bash ```bash
python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py python3 /opt/ligbox-ops-platform/deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py
cd /opt/ligbox-wizard/frontend && npm run build cd /opt/ligbox-wizard/frontend && npm run build
# Reiniciar serviço static/nginx conforme stack VM112
``` ```
## UI ## UI (sem nova rota)
Painel lateral abaixo das opções DNS: Painel lateral abaixo das opções DNS no step 1:
- Modo (Ligbox / externo / OpenPanel)
- Badge modo (Ligbox / externo / OpenPanel)
- Tabela registos (max 12 linhas) - Tabela registos (max 12 linhas)
- Secção «Serão aplicados» se `planned_records` - Secção «Serão aplicados» se `planned_records`
---
## Validação
```bash
# Com sessão onboarding válida
curl -sS -H "X-Onboarding-Session: <session>" \
"http://127.0.0.1:8090/api/onboarding/dns/viewer/exemplo.com.br" | jq .mode_label,.summary
```
Browser: `onboard.ligbox.com.br` → passo DNS → painel «Apontamentos DNS (visualização)» após escolher caminho.
---
## SSH / deploy a partir do CT130
| Destino | Comando | Resultado conhecido |
|---------|---------|---------------------|
| LAN | `ssh root@10.10.10.112` | Permission denied (password `805353` não válida) |
| WAN | `ssh -p 2512 root@95.216.14.146` | Timeout a partir CT130 |
**Acção:** Roger aplica patches directamente na VM112 ou fornece credencial SSH correcta.
---
## Rollback ## Rollback
Ver `specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md` § VM112. ```bash
ssh root@10.10.10.112
cd /opt/ligbox-wizard
BACKUP=$(ls -td .backups/dns-viewer-* 2>/dev/null | head -1)
[ -n "$BACKUP" ] && cp -a "$BACKUP"/backend/. backend/
systemctl restart ligbox-wizard 2>/dev/null || docker compose restart backend
```
Ver também rollback completo em `DNS-VIEWER-ROLLBACK.md`.

8
docs/vms/README.md
View file

@ -30,7 +30,8 @@ ligbox-ops-platform/
| **123** | 10.10.10.123 | :2523 | FOSSBilling + Odoo + OpenPanel + Console UI | `projects/finance/` | | **123** | 10.10.10.123 | :2523 | FOSSBilling + Odoo + OpenPanel + Console UI | `projects/finance/` |
| **104** | 10.10.10.104 | :2504 | Wazuh SIEM | integração Spec 002, 019 | | **104** | 10.10.10.104 | :2504 | Wazuh SIEM | integração Spec 002, 019 |
| **114** | 10.10.10.114 | — | Traefik (CT) | `docs/network/TRAEFIK_*` | | **114** | 10.10.10.114 | — | Traefik (CT) | `docs/network/TRAEFIK_*` |
| **116** | 10.10.10.116 | :2516 | Nextcloud Hub — ampliar storage mail (Spec 034) | `deploy/vm116-nextcloud/` | | **116** | 10.10.10.116 | :2516 | RustDesk relay + portal remoto | — |
| **124** | 10.10.10.124 | :2524 | **Nextcloud Hub** — storage mail (Spec 034) | `deploy/vm116-nextcloud/` |
| **130** | 10.10.10.130 | :2530 | **Spec Hub** Git + Obsidian + Portal | CT130 local | | **130** | 10.10.10.130 | :2530 | **Spec Hub** Git + Obsidian + Portal | CT130 local |
--- ---
@ -46,6 +47,7 @@ ligbox-ops-platform/
| 025 | wizard-onboarding-continuity | | 025 | wizard-onboarding-continuity |
| 026 | purge-traefik-validation | | 026 | purge-traefik-validation |
| 034 | nextcloud-carbonio-vm112-integration | | 034 | nextcloud-carbonio-vm112-integration |
| 037 | dns-viewer **V4 wizard** (painel step DNS — deploy pendente) |
| 010 | desk-assist-takeover (fases VM112) | | 010 | desk-assist-takeover (fases VM112) |
→ [Ficha VM112](VM112.md) → [Ficha VM112](VM112.md)
@ -53,6 +55,7 @@ ligbox-ops-platform/
### VM122 — Ops Desk (motor) ### VM122 — Ops Desk (motor)
| Spec | Nome | | Spec | Nome |
|------|------| |------|------|
| 035 | ligbox-watchman (vigilância + alertas) |
| 003 | desk-auth-rbac | | 003 | desk-auth-rbac |
| 004 | desk-account-management | | 004 | desk-account-management |
| 009 | ops-audit-overview | | 009 | ops-audit-overview |
@ -61,6 +64,7 @@ ligbox-ops-platform/
| 015 | desk-module-registry | | 015 | desk-module-registry |
| 027 | desk-rbac-function-matrix | | 027 | desk-rbac-function-matrix |
| 029 | agentic ops | | 029 | agentic ops |
| 037 | dns-viewer **V1–V2** API + Desk UI |
→ [Ficha VM122](VM122.md) → [Ficha VM122](VM122.md)
@ -71,6 +75,8 @@ ligbox-ops-platform/
| 023 | billing-recurrence-desk-visibility | | 023 | billing-recurrence-desk-visibility |
| 024 | openpanel-fossbilling | | 024 | openpanel-fossbilling |
| 027 | desk-rbac (matriz VM123) | | 027 | desk-rbac (matriz VM123) |
| 035 | ligbox-mail-bundles `/admin` gerente |
| 037 | dns-viewer **V3** `/admin/dominio` |
→ [Ficha VM123](VM123.md) → [Ficha VM123](VM123.md)

16
docs/vms/VM112.md
View file

@ -18,6 +18,7 @@
``` ```
deploy/vm112-spec022/ # Carbonio account scripts deploy/vm112-spec022/ # Carbonio account scripts
deploy/vm112-wizard/ # Patches wizard (Spec 037 V4 DNS Viewer)
deploy/vm112-wizard-security/ # CSP, webhooks, audit deploy/vm112-wizard-security/ # CSP, webhooks, audit
docs/EMAIL_LIGBOX_VM112.md docs/EMAIL_LIGBOX_VM112.md
specs/001-webhook-vm112-integration/ specs/001-webhook-vm112-integration/
@ -26,6 +27,7 @@ specs/022-carbonio-account-exists-release/
specs/025-wizard-onboarding-continuity/ specs/025-wizard-onboarding-continuity/
specs/026-purge-traefik-validation/ specs/026-purge-traefik-validation/
specs/034-nextcloud-carbonio-vm112-integration/ specs/034-nextcloud-carbonio-vm112-integration/
specs/037-dns-multi-cloudflare-orchestration/ # DNS Viewer V4 wizard
``` ```
## Deploy na VM112 ## Deploy na VM112
@ -35,9 +37,21 @@ git clone https://git.spec.ligbox.com.br/ligbox/ligbox-ops-platform.git
# Copiar deploy/vm112-* para paths locais — ver README em cada pasta # Copiar deploy/vm112-* para paths locais — ver README em cada pasta
``` ```
### DNS Viewer V4 (Spec 037 — pendente)
Painel read-only no passo DNS — **sem página nova**. Runbook:
```
deploy/vm112-wizard/DNS-VIEWER-V4.md
deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py
deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py
```
Env obrigatório: `DESK_API_URL`, `OPS_INTERNAL_TOKEN` (igual Desk VM122).
## Integração ## Integração
- **→ VM122:** webhooks `onboarding.*` · Assist/takeover API - **→ VM122:** webhooks `onboarding.*` · Assist/takeover API
- **→ CT114:** Traefik routers mail/onboard · `files.{dom}` (Spec 034) - **→ CT114:** Traefik routers mail/onboard · `files.{dom}` (Spec 034)
- **→ VM116:** IMAP/SMTP (Nextcloud Mail app) · OCS provisioning (Spec 034) - **→ VM124:** IMAP/SMTP (Nextcloud Mail app) · OCS provisioning (Spec 034)
- **← Desk:** purge, DNS revalidate, assist actions - **← Desk:** purge, DNS revalidate, assist actions

14
docs/vms/VM122.md
View file

@ -33,6 +33,20 @@ deploy/vm122-fossbilling/ # Stack legado (se activo)
- 015 desk-module-registry - 015 desk-module-registry
- 027 desk-rbac-function-matrix - 027 desk-rbac-function-matrix
- 029 agentic - 029 agentic
- **037** dns-viewer (V1–V2 API + Desk UI — `dns_viewer.py`, `dns-viewer.js`)
## DNS Viewer (Spec 037)
| Fase | Estado | Path runtime |
|------|--------|--------------|
| V1 API | ✅ | `/opt/ligbox-ops-platform/api/app/dns_viewer.py` |
| V1b Desk UI | ✅ | `frontend/assets/dns-viewer.js` |
| V2 OpenPanel | ✅ | `api/app/openpanel_dns.py` |
| V3 proxy Console | ✅ | `api/app/domain_console_routes.py` |
Feature flag: `DNS_VIEWER_ENABLED=1` em `.env`. Rollback: `specs/037-.../deploy/DNS-VIEWER-ROLLBACK.md`.
**Deploy API:** container Docker — após rsync, `docker cp api/app/. ligbox-ops-platform_api_1:/app/app/` + restart.
## Deploy ## Deploy

15
docs/vms/VM123.md
View file

@ -21,6 +21,8 @@ deploy/vm123-finance-stack/ # docker-compose FOSS/Odoo/OpenPanel
specs/019-ops-console-active-operations/deploy/ # Template Console UI specs/019-ops-console-active-operations/deploy/ # Template Console UI
specs/023-billing-recurrence-desk-visibility/ specs/023-billing-recurrence-desk-visibility/
specs/024-openpanel-fossbilling/ specs/024-openpanel-fossbilling/
specs/035-ligbox-mail-bundles-foss-openpanel/ # `/admin` gerente
specs/037-dns-multi-cloudflare-orchestration/ # DNS Viewer V3
docs/network/VM123_INVENTARIO.md docs/network/VM123_INVENTARIO.md
docs/VM123_OPS_CONSOLE_HANDOFF.md docs/VM123_OPS_CONSOLE_HANDOFF.md
``` ```
@ -32,7 +34,18 @@ docs/VM123_OPS_CONSOLE_HANDOFF.md
| fossbilling | 8092 | FOSSBilling | | fossbilling | 8092 | FOSSBilling |
| odoo | 8069 | Odoo 16 | | odoo | 8069 | Odoo 16 |
| openpanel | 2083 | OpenPanel | | openpanel | 2083 | OpenPanel |
| ligbox-ops-console-ui | 8100 | Console Spec 019 | | ligbox-ops-console-ui | 8100 | Console Spec 019 + `/admin/dominio` (037) |
## DNS Viewer Console (Spec 037 V3)
| Item | Valor |
|------|-------|
| URL | `https://console.ligbox.com.br/admin/dominio` |
| Frontend | `AdminDominio.jsx` + `DnsViewerPanel.jsx` |
| API | Proxy Desk `GET /api/v1/domain-console/dns/viewer/{domain}` (VM122) |
| Auth | Login Desk → JWT em `localStorage` |
Deploy: build em `specs/019-.../deploy/frontend` → `/opt/ligbox-ops-console/frontend`.
## Deploy ## Deploy

18
specs/035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md
View file

@ -243,12 +243,26 @@ Secção **read-only** — gerente **vê** apontamentos; **não edita** na Conso
#### API #### API
**Desk (staff directo):**
```http ```http
GET /api/v1/dns/viewer/{domain} GET /api/v1/dns/viewer/{domain}
Authorization: Bearer <domain-admin JWT> Authorization: Bearer <staff JWT>
Query: ?email_service=true&include_public=true
``` ```
Proxy Desk → agrega CF / OpenPanel / público conforme `dns_mode`. Ver [dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md). **Console gerente (proxy Desk — implementado V3):**
```http
GET /api/v1/domain-console/dns/viewer/{domain}
Authorization: Bearer <domain-admin JWT>
Query: ?email_service=true&include_public=true
```
Frontend Console (`AdminDominio.jsx`) chama o proxy acima via API Desk (`console.ligbox.com.br` → VM122).
Implementação: `domain_console_routes.py` — filtra links CF Ligbox para gerente.
Agrega CF / OpenPanel / público conforme `dns_mode`. Ver [dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md).
#### Elementos UI #### Elementos UI

2
specs/035-ligbox-mail-bundles-foss-openpanel/spec.md
View file

@ -609,6 +609,8 @@ Roger (2026-06-25): gerente e staff precisam **ver todos os apontamentos** sem a
Documento técnico: [037 dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md) Documento técnico: [037 dns-viewer.md](../037-dns-multi-cloudflare-orchestration/dns-viewer.md)
UI gerente: [domain-manager-console-ui.md §5.5](./domain-manager-console-ui.md#55-domínio--dns-dns-viewer--spec-037-dns-viewer) UI gerente: [domain-manager-console-ui.md §5.5](./domain-manager-console-ui.md#55-domínio--dns-dns-viewer--spec-037-dns-viewer)
**Deploy (2026-06-25):** Console `/admin/dominio` ✅ VM123 · API proxy `GET /api/v1/domain-console/dns/viewer/{domain}` ✅ VM122 · Wizard V4 📋 patches prontos.
--- ---
## 10. Add-ons FOSS (venda separada) ## 10. Add-ons FOSS (venda separada)

6
specs/035-ligbox-mail-bundles-foss-openpanel/tasks.md
View file

@ -32,10 +32,12 @@ Shell: [ligbox-console-shell.md](./ligbox-console-shell.md) · Detalhe: [domain-
- [ ] UX-A2: `/admin/contas` CRUD inline - [ ] UX-A2: `/admin/contas` CRUD inline
- [ ] UX-A3: `/admin/files` quotas + toggle Mail NC - [ ] UX-A3: `/admin/files` quotas + toggle Mail NC
- [ ] UX-A4: `/admin/certificacao` + `/admin/dominio` **DNS Viewer** (037 dns-viewer.md) - [ ] UX-A4: `/admin/certificacao` + `/admin/dominio` **DNS Viewer** (037 dns-viewer.md)
- [x] `/admin/dominio` V3 deploy VM123 2026-06-25 - [x] `/admin/dominio` V3 deploy VM123 2026-06-25 (`AdminDominio.jsx`, `DnsViewerPanel.jsx`)
- [ ] `/admin/certificacao` EasyDMARC card
- [ ] UX-A4b: `/admin/plano` boleto/PIX - [ ] UX-A4b: `/admin/plano` boleto/PIX
- [ ] SSO FOSS → `/admin?sso=TOKEN` - [ ] SSO FOSS → `/admin?sso=TOKEN`
- [ ] API Desk `/api/v1/domain-console/*` - [ ] API Desk `/api/v1/domain-console/*`
- [x] `GET /api/v1/domain-console/dns/viewer/{domain}` (VM122 2026-06-25)
## Fase 2b — OpenPanel (backend only) ## Fase 2b — OpenPanel (backend only)
@ -89,4 +91,4 @@ Ver placeholder: [user-self-service-ui.md](./user-self-service-ui.md)
- [ ] Actualizar `docs/vms/README.md` - [ ] Actualizar `docs/vms/README.md`
- [ ] Publicar Spec Hub Portal - [ ] Publicar Spec Hub Portal
- [x] Spec 037-DNS-VIEWER `dns-viewer.md` + §5.5 domain-manager actualizado - [x] Spec 037-DNS-VIEWER `dns-viewer.md` + §5.5 domain-manager actualizado
- [ ] Implementar `GET /api/v1/dns/viewer/{domain}` (Desk + Console) - [x] Implementar `GET /api/v1/dns/viewer/{domain}` (Desk VM122 + proxy Console VM123 2026-06-25)

129
specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-EXEC-20260625.md
View file

@ -1,72 +1,111 @@
# DNS Viewer V1 — Execução e versionamento # DNS Viewer — Execução e versionamento
**Responsável:** Cursor Agent · **Aprovado por:** Roger **Responsável:** Cursor Agent · **Aprovado por:** Roger
**Data:** 2026-06-25 **Data início:** 2026-06-25 · **Última actualização:** 2026-06-25
**Spec:** [dns-viewer.md](../dns-viewer.md) · Rollback: [DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md) **Spec:** [dns-viewer.md](../dns-viewer.md) · Rollback: [DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)
--- ---
## Escopo desta execução ## Escopo desta execução
| Fase | Incluída agora | Entregável | | Fase | Estado | VM | Entregável |
|------|----------------|------------| |------|--------|-----|------------|
| V0 | ✅ baseline | `cloudflare_dns.py` + modal Desk (já existe) | | V0 | ✅ baseline | VM122 | `cloudflare_dns.py` + modal Desk CF |
| V1 | 📋 próximo deploy | API `GET /api/v1/dns/viewer/{domain}` | | V1 | ✅ deploy OK | VM122 | `GET /api/v1/dns/viewer/{domain}` |
| V1b | 📋 | `dns-viewer.js` + migrar modal Desk | | V1b | ✅ deploy OK | VM122 | `dns-viewer.js` + modais Overview/IaaS |
| V2–V4 | ⏳ futuro | OpenPanel, Console, Wizard | | V2 | ✅ deploy OK | VM122 | `openpanel_dns.py` + `GET /api/v1/dns/openpanel/records` |
| V3 | ✅ deploy OK | VM123 | `/admin/dominio` + `DnsViewerPanel.jsx` |
| V4 | 📋 patches no repo | VM112 | Painel wizard — **deploy pendente** (SSH) |
--- ---
## Checklist pré-deploy (obrigatório) ## Checklist pré-deploy (obrigatório)
```bash ```bash
# CT130 — tag git (usar SSHPASS se preflight/rollback a partir do Spec Hub) # CT130 — tag git
cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform cd /opt/ligbox-spec-hub/repos/ligbox-ops-platform
git tag -a dns-viewer-pre-v1-$(date +%Y%m%d) -m "Antes DNS Viewer V1" git tag -a dns-viewer-pre-v1-$(date +%Y%m%d) -m "Antes DNS Viewer V1"
# VM122 — backup (CT130: export SSHPASS=805353) # VM122 — backup (CT130: export SSHPASS=805353)
export SSHPASS='805353' # opcional — só se SSH key falhar export SSHPASS='805353'
bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \ bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \
--host root@10.10.10.122 --host root@10.10.10.122
``` ```
Para V3 Console:
```bash
bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/preflight-dns-viewer.sh \
--host root@10.10.10.123 --console
```
--- ---
## Ficheiros versionados (monorepo) ## Ficheiros versionados (monorepo)
| Ficheiro | Fase | Notas | | Ficheiro | Fase | Notas |
|----------|------|-------| |----------|------|-------|
| `projects/ops-desk/api/app/cloudflare_dns.py` | V0 | Não remover — provider CF | | `projects/ops-desk/api/app/cloudflare_dns.py` | V0 | Provider CF — manter |
| `projects/ops-desk/api/app/dns_viewer.py` | V1 | **Novo** orquestrador | | `projects/ops-desk/api/app/dns_viewer.py` | V1 | Orquestrador |
| `projects/ops-desk/api/app/openpanel_dns.py` | V2 | Novo — opcional | | `projects/ops-desk/api/app/openpanel_dns.py` | V2 | BIND via `dig @10.10.10.123` |
| `projects/ops-desk/api/app/main.py` | V1 | Rota viewer + flag | | `projects/ops-desk/api/app/domain_console_routes.py` | V3 | Proxy Console |
| `projects/ops-desk/api/app/main.py` | V1+ | Rotas + `require_internal_or_user` |
| `projects/ops-desk/api/app/permissions.py` | V1 | `can_read_dns_viewer` | | `projects/ops-desk/api/app/permissions.py` | V1 | `can_read_dns_viewer` |
| `projects/ops-desk/frontend/assets/dns-viewer.js` | V1b | **Novo** componente | | `projects/ops-desk/frontend/assets/dns-viewer.js` | V1b | Componente Desk |
| `projects/ops-desk/frontend/assets/app.js` | V1b | Integrar viewer | | `projects/ops-desk/frontend/assets/app.js` | V1b | Integração modais |
| `projects/ops-desk/frontend/index.html` | V1b | Cache bust `?v=` | | `specs/019-.../deploy/frontend/src/views/admin/AdminDominio.jsx` | V3 | Página Console |
| `projects/wizard/backend/app/services/dns_viewer.py` | V4 | Wizard variant | | `specs/019-.../deploy/frontend/src/components/DnsViewerPanel.jsx` | V3 | Componente partilhado |
| `deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py` | V4 | Backend wizard |
| `deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py` | V4 | Frontend wizard |
| `deploy/vm112-wizard/DNS-VIEWER-V4.md` | V4 | Runbook |
--- ---
## Deploy VM122 (após implementação V1/V1b) ## Deploy VM122 (V1/V1b/V2)
```bash ```bash
# CT130 ou laptop com rsync
REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform
rsync -av --delete \ rsync -av "$REPO/projects/ops-desk/api/app/" root@10.10.10.122:/opt/ligbox-ops-platform/api/app/
"$REPO/projects/ops-desk/api/app/" \ rsync -av "$REPO/projects/ops-desk/frontend/assets/" root@10.10.10.122:/opt/ligbox-ops-platform/frontend/assets/
root@10.10.10.122:/opt/ligbox-ops-platform/api/app/
rsync -av \
"$REPO/projects/ops-desk/frontend/assets/" \
root@10.10.10.122:/opt/ligbox-ops-platform/frontend/assets/
ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \ ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \
grep -q DNS_VIEWER_ENABLED .env || echo DNS_VIEWER_ENABLED=1 >> .env && \ grep -q DNS_VIEWER_ENABLED .env || echo DNS_VIEWER_ENABLED=1 >> .env && \
docker compose -f docker-compose.mvp.yml build api frontend && \ docker cp api/app/. ligbox-ops-platform_api_1:/app/app/ && \
docker compose -f docker-compose.mvp.yml up -d api frontend' docker restart ligbox-ops-platform_api_1 && \
docker compose -f docker-compose.mvp.yml up -d frontend'
``` ```
**Importante:** API corre em container — `rsync` ao host **não** actualiza runtime sem `docker cp` ou rebuild.
---
## Deploy VM123 (V3 Console)
```bash
REPO=/opt/ligbox-spec-hub/repos/ligbox-ops-platform
cd "$REPO/specs/019-ops-console-active-operations/deploy/frontend"
npm run build
tar cf - dist | ssh root@10.10.10.123 'cd /opt/ligbox-ops-console && rm -rf frontend/* && tar xf - --strip-components=1 -C frontend'
ssh root@10.10.10.123 'cd /opt/ligbox-ops-console && docker compose up -d --build'
```
URL: `https://console.ligbox.com.br/admin/dominio`
---
## Deploy VM112 (V4 — pendente)
Ver **[deploy/vm112-wizard/DNS-VIEWER-V4.md](../../../deploy/vm112-wizard/DNS-VIEWER-V4.md)**.
Pré-requisitos env wizard:
```bash
DESK_API_URL=http://10.10.10.122:8080
OPS_INTERNAL_TOKEN=<mesmo token Desk>
```
SSH VM112: LAN `10.10.10.112` ou WAN `95.216.14.146:2512` (credencial distinta de VM122/123).
--- ---
## Validação pós-deploy ## Validação pós-deploy
@ -75,36 +114,40 @@ ssh root@10.10.10.122 'cd /opt/ligbox-ops-platform && \
bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh \ bash specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh \
--host 10.10.10.122 --host 10.10.10.122
# Console
curl -sS -o /dev/null -w '%{http_code}\n' https://console.ligbox.com.br/admin/dominio
# Manual UI # Manual UI
# Desk → Overview → tenant VM112 → domínio → secção DNS unificada # Desk → Overview → domínio → secção DNS unificada
# Browser devtools: zero SyntaxError em app.js / dns-viewer.js # Console → Admin → Domínio & DNS
``` ```
--- ---
## Rollback ## Rollback
Ver **[DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)** — ordem recomendada: Ver **[DNS-VIEWER-ROLLBACK.md](./DNS-VIEWER-ROLLBACK.md)** — ordem:
1. `DNS_VIEWER_ENABLED=0` (30 segundos) 1. `DNS_VIEWER_ENABLED=0` (30 s)
2. Rollback frontend se UI partida 2. Rollback frontend se UI partida
3. Rollback API se 500 3. Rollback API se 500
4. `git revert` CT130 se necessário 4. `git revert` CT130 se necessário
--- ---
## Registo de versões (preencher após cada deploy) ## Registo de versões
| Data | Tag git | VM122 backup dir | Commit | Notas | | Data | Tag git | VM backup / Docker | Commit | Notas |
|------|---------|------------------|--------|-------| |------|---------|-------------------|--------|-------|
| 2026-06-25 | `dns-viewer-pre-v1-20260625` | `.backups/dns-viewer-20260625-161839` | `7e4920a` | Pré-deploy | | 2026-06-25 | `dns-viewer-pre-v1-20260625` | `.backups/dns-viewer-20260625-161839` | `7e4920a` | Pré-deploy V1 |
| 2026-06-25 | — | tag Docker `post-dns-viewer-v1-20260625` | _(working tree)_ | **V1+V1b deploy OK** · verify PASSED | | 2026-06-25 | — | Docker `post-dns-viewer-v1-20260625` | — | V1+V1b VM122 · verify PASSED |
| 2026-06-25 | — | VM123 frontend tar deploy | — | V3 Console `/admin/dominio` |
| 2026-06-25 | — | — | `038fb8f` | **Commit monorepo** — Spec 037 entrega V1–V3 + patches V4 |
--- ---
## Pendente V2+ ## Pendente
- OpenPanel BIND provider - [ ] Deploy V4 VM112 (patches prontos; SSH bloqueado CT130→112)
- Console `console.ligbox.com.br/admin/dominio` - [ ] Formalizar `dns.viewer.read` em Spec 027
- Wizard `GET /api/onboarding/dns/viewer/{domain}` - [ ] Actualizar `verify-dns-viewer.sh` com smoke Console `/admin/dominio`
- Formalizar `dns.viewer.read` em Spec 027

2
specs/037-dns-multi-cloudflare-orchestration/deploy/DNS-VIEWER-ROLLBACK.md
View file

@ -43,6 +43,8 @@ ssh root@10.10.10.122
cd /opt/ligbox-ops-platform cd /opt/ligbox-ops-platform
sed -i 's/^DNS_VIEWER_ENABLED=.*/DNS_VIEWER_ENABLED=0/' .env sed -i 's/^DNS_VIEWER_ENABLED=.*/DNS_VIEWER_ENABLED=0/' .env
docker compose -f docker-compose.mvp.yml up -d api frontend docker compose -f docker-compose.mvp.yml up -d api frontend
# Se alterou ficheiros no host: docker cp api/app/. ligbox-ops-platform_api_1:/app/app/
docker restart ligbox-ops-platform_api_1
``` ```
--- ---

14
specs/037-dns-multi-cloudflare-orchestration/deploy/scripts/verify-dns-viewer.sh
View file

@ -1,5 +1,6 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# Spec 037-DNS-VIEWER — smoke tests pós-deploy ou pós-rollback # Spec 037-DNS-VIEWER — smoke tests pós-deploy ou pós-rollback
# VM122: API corre em container Docker — após rsync host, docker cp + restart (ver DNS-VIEWER-EXEC)
set -euo pipefail set -euo pipefail
HOST="10.10.10.122" HOST="10.10.10.122"
@ -70,6 +71,19 @@ if [[ "$LEGACY_ONLY" -eq 0 ]]; then
echo " FAIL dns/viewer → HTTP $CODE" echo " FAIL dns/viewer → HTTP $CODE"
FAIL=1 FAIL=1
fi fi
CODE=$(curl -sS -o /dev/null -w '%{http_code}' \
"${API}/api/v1/domain-console/dns/viewer/${DOMAIN}" 2>/dev/null || echo "000")
if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then
echo " OK domain-console/dns/viewer (no auth) → HTTP $CODE"
elif [[ "$CODE" == "200" ]]; then
echo " OK domain-console/dns/viewer → HTTP 200"
elif [[ "$CODE" == "404" ]]; then
echo " WARN domain-console/dns/viewer → 404 (router não deployado)"
else
echo " FAIL domain-console/dns/viewer → HTTP $CODE"
FAIL=1
fi
fi fi
# JS assets existem # JS assets existem

56
specs/037-dns-multi-cloudflare-orchestration/dns-viewer.md
View file

@ -2,7 +2,7 @@
**Criado:** 2026-06-25 **Criado:** 2026-06-25
**Solicitado por:** Roger **Solicitado por:** Roger
**Status:** 📋 Especificado — implementação Fase 1 parcial (Desk CF only) **Status:** 🏗️ V1–V3 em produção (VM122/VM123) · V4 patches prontos · deploy VM112 pendente
**Prioridade:** P1 **Prioridade:** P1
**Depende de:** [spec.md](./spec.md) · [004 cloudflare-zone-provision](../004-onboard-funnel-events/cloudflare-zone-provision.md) · [009](../009-ops-audit-overview/spec.md) · [028](../028-openpanel-ce-ligbox-reengineering/DNS53_OPENPANEL_PORTA53.md) · [035 §5.5](../035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md) · [027 RBAC](../027-desk-rbac-function-matrix/spec.md) **Depende de:** [spec.md](./spec.md) · [004 cloudflare-zone-provision](../004-onboard-funnel-events/cloudflare-zone-provision.md) · [009](../009-ops-audit-overview/spec.md) · [028](../028-openpanel-ce-ligbox-reengineering/DNS53_OPENPANEL_PORTA53.md) · [035 §5.5](../035-ligbox-mail-bundles-foss-openpanel/domain-manager-console-ui.md) · [027 RBAC](../027-desk-rbac-function-matrix/spec.md)
@ -101,9 +101,30 @@ flowchart TD
```http ```http
GET /api/v1/dns/viewer/{domain} GET /api/v1/dns/viewer/{domain}
Authorization: Bearer <JWT staff ou domain-admin> Authorization: Bearer <JWT staff ou domain-admin>
Query: ?include_public=true&include_planned=true # OU (wizard / workers internos):
X-Ops-Internal-Token: <OPS_INTERNAL_TOKEN>
Query: ?include_public=true&email_service=true
``` ```
**Variante Console gerente (Spec 035 V3):**
```http
GET /api/v1/domain-console/dns/viewer/{domain}
Authorization: Bearer <JWT domain-admin ou staff>
Query: ?email_service=true&include_public=true
```
Implementação: `domain_console_routes.py` — proxy para `fetch_dns_viewer()`; filtra `edit_links` CF Ligbox para roles não-staff.
**Autenticação interna (V4 wizard → Desk):**
| Header | Quem usa | Função |
|--------|----------|--------|
| `Authorization: Bearer …` | Desk UI, Console `/admin` | JWT staff ou domain-admin |
| `X-Ops-Internal-Token` | VM112 wizard backend | `require_internal_or_user` em `main.py` — evita duplicar lógica DNS no wizard |
Variáveis VM112: `DESK_API_URL=http://10.10.10.122:8080`, `OPS_INTERNAL_TOKEN` (mesmo valor Desk).
**Response:** **Response:**
```json ```json
@ -284,7 +305,7 @@ Resolver ordem:
| **V1b** | Desk UI unificada (`dns-viewer.js`) | ✅ VM122 2026-06-25 | | **V1b** | Desk UI unificada (`dns-viewer.js`) | ✅ VM122 2026-06-25 |
| **V2** | OpenPanel BIND records no viewer | ✅ VM122 2026-06-25 | | **V2** | OpenPanel BIND records no viewer | ✅ VM122 2026-06-25 |
| **V3** | Console `/admin/dominio` | ✅ VM123 2026-06-25 | | **V3** | Console `/admin/dominio` | ✅ VM123 2026-06-25 |
| **V4** | Wizard painel lateral + diff planned vs actual | 📋 | | **V4** | Wizard painel lateral + diff planned vs actual | 📋 patches no repo · deploy VM112 pendente (SSH) |
--- ---
@ -301,16 +322,23 @@ Resolver ordem:
--- ---
## 11. Código (alvo monorepo) ## 11. Código (monorepo + deploy)
| Caminho | Função | | Caminho | Função | Deploy |
|---------|--------| |---------|--------|--------|
| `projects/ops-desk/api/app/dns_viewer.py` | Orquestrador providers | | `projects/ops-desk/api/app/dns_viewer.py` | Orquestrador providers | VM122 API |
| `projects/ops-desk/api/app/cloudflare_dns.py` | Provider CF (existente) | | `projects/ops-desk/api/app/cloudflare_dns.py` | Provider CF | VM122 API |
| `projects/ops-desk/api/app/openpanel_dns.py` | Provider BIND (novo) | | `projects/ops-desk/api/app/openpanel_dns.py` | Provider BIND (`dig @10.10.10.123`) | VM122 API |
| `projects/wizard/backend/app/services/dns_viewer.py` | Wizard session variant | | `projects/ops-desk/api/app/domain_console_routes.py` | Proxy Console `/admin/dominio` | VM122 API |
| `projects/ops-desk/frontend/assets/dns-viewer.js` | Componente partilhado Desk | | `projects/ops-desk/api/app/main.py` | Rotas viewer + `require_internal_or_user` | VM122 API |
| `projects/console/frontend/.../DnsSection.tsx` | Console `/admin` | | `projects/ops-desk/frontend/assets/dns-viewer.js` | Componente Desk | VM122 frontend |
| `specs/019-.../deploy/frontend/src/components/DnsViewerPanel.jsx` | Componente Console | VM123 |
| `specs/019-.../deploy/frontend/src/views/admin/AdminDominio.jsx` | Página `/admin/dominio` | VM123 |
| `deploy/vm112-wizard/onboarding-dns-viewer-v4.patch.py` | Endpoint wizard proxy Desk | VM112 backend |
| `deploy/vm112-wizard/frontend-dns-viewer-v4.patch.py` | Painel lateral step DNS | VM112 frontend |
| `deploy/vm112-wizard/DNS-VIEWER-V4.md` | Runbook deploy V4 | — |
**Nota deploy VM122:** código API corre em container Docker — após `rsync` ao host, copiar para o container (`docker cp …/main.py …_api_1:/app/app/`) ou rebuild imagem.
--- ---
@ -324,6 +352,8 @@ Resolver ordem:
| [009 spec](../009-ops-audit-overview/spec.md) | Checks públicos | | [009 spec](../009-ops-audit-overview/spec.md) | Checks públicos |
| [027 spec](../027-desk-rbac-function-matrix/spec.md) | Deep-links CF / OP | | [027 spec](../027-desk-rbac-function-matrix/spec.md) | Deep-links CF / OP |
| [DNS-VIEWER-ROLLBACK](./deploy/DNS-VIEWER-ROLLBACK.md) | Rollback e feature flag | | [DNS-VIEWER-ROLLBACK](./deploy/DNS-VIEWER-ROLLBACK.md) | Rollback e feature flag |
| [DNS-VIEWER-EXEC-20260625](./deploy/DNS-VIEWER-EXEC-20260625.md) | Registo deploys e commits |
| [deploy/vm112-wizard/DNS-VIEWER-V4.md](../../../deploy/vm112-wizard/DNS-VIEWER-V4.md) | Runbook V4 wizard |
--- ---
@ -364,6 +394,8 @@ DNS_VIEWER_ENABLED=0 # fallback legado /dns/cloudflare/records + UI V0
git tag -a dns-viewer-pre-v1-YYYYMMDD -m "Antes DNS Viewer V1" git tag -a dns-viewer-pre-v1-YYYYMMDD -m "Antes DNS Viewer V1"
``` ```
Entrega monorepo V1–V3 + patches V4: commit **`038fb8f`** (2026-06-25).
### Endpoint legado (mantido até cutover) ### Endpoint legado (mantido até cutover)
`GET /api/v1/dns/cloudflare/records` — **não remover** enquanto rollback não estiver validado em produção ≥7 dias. `GET /api/v1/dns/cloudflare/records` — **não remover** enquanto rollback não estiver validado em produção ≥7 dias.

4
specs/037-dns-multi-cloudflare-orchestration/spec.md
View file

@ -131,7 +131,9 @@ Painel unificado para **exibir** apontamentos (staff Desk + gerente Console) **s
| **Cloudflare Ligbox** | Registos **planeados** (pré-NS) ou **aplicados** (pós-apply) + NS CF | | **Cloudflare Ligbox** | Registos **planeados** (pré-NS) ou **aplicados** (pós-apply) + NS CF |
| **BYO / Registrador / externo** | DNS **actual** (público + instructions) — **não** preview Ligbox | | **BYO / Registrador / externo** | DNS **actual** (público + instructions) — **não** preview Ligbox |
Documento completo: **[dns-viewer.md](./dns-viewer.md)** — endpoint `GET /api/v1/dns/viewer/{domain}`, links editar (CF / OpenPanel / registrador), fases V0–V4. Documento completo: **[dns-viewer.md](./dns-viewer.md)** — endpoints, links editar, fases V0–V4.
**Estado deploy (2026-06-25):** V1–V3 produção (VM122/123) · commit `038fb8f` · V4 wizard patches prontos · deploy VM112 pendente.
--- ---

2
specs/037-dns-multi-cloudflare-orchestration/tasks.md
View file

@ -53,5 +53,5 @@
- [x] V1b Desk UI unificada (`dns-viewer.js` + Overview/IaaS modal) - [x] V1b Desk UI unificada (`dns-viewer.js` + Overview/IaaS modal)
- [x] V2 OpenPanel BIND records (`openpanel_dns.py`) — VM122 2026-06-25 - [x] V2 OpenPanel BIND records (`openpanel_dns.py`) — VM122 2026-06-25
- [x] V3 Console `/admin/dominio` consume viewer API — VM123 2026-06-25 - [x] V3 Console `/admin/dominio` consume viewer API — VM123 2026-06-25
- [ ] V4 Wizard painel lateral + diff planned vs actual - [ ] V4 Wizard painel lateral — patches em `deploy/vm112-wizard/*-v4.patch.py` · deploy VM112 pendente
- [ ] RBAC `dns.viewer.read` formalizar Spec 027 - [ ] RBAC `dns.viewer.read` formalizar Spec 027