Sam Rolfe
4f233a8012
Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11: the shared device keycode and the versioned admin HTTP API the separate Kotlin admin app will call. - store: migration 004 adds state.grant_until and a settings table. New overrides.go records every override in `overrides` and verifies the shared keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also clears an expired grant, and NextScheduleBoundary includes the grant end so a device re-locks on time. - effective state: a grant unlocks a device inside a schedule window; a manual lock clears a grant and a grant clears a manual lock. The retained config payload gains grant_until (additive, v stays 1). - web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device keycode endpoint POST /api/v1/device/override with per-address throttling. A state change is published retained before the API responds. - cmd/control: `keycode` subcommand and start-up seeding from CONTROL_DEVICE_KEYCODE_HASH. - deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done: an API lock reaches a real broker subscriber in well under a second. - Version 0.6.0-phase8 (compose, Makefile, docs). Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler 1 ms, request to retained publish accepted). Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine. Co-Authored-By: Paperclip <noreply@paperclip.ing>
85 lines
2.8 KiB
Makefile
85 lines
2.8 KiB
Makefile
IMAGE ?= webrestrict/control:0.6.0-phase8
|
|
BUILD_VERSION ?= 0.6.0-phase8
|
|
|
|
# Bounded docker helper for the Go toolchain. The container runs as the current
|
|
# user, so the repository and the module cache stay owned by you.
|
|
GO_IMAGE ?= golang:1.25-alpine
|
|
GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)" \
|
|
-e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
|
|
-v "$$PWD":/src -w /src $(GO_IMAGE)
|
|
|
|
# Scratch broker used by `make mqtt-verify` (see deploy/mosquitto/README.md).
|
|
MQTT_VERIFY_PORT ?= 18883
|
|
MQTT_IMAGE ?= eclipse-mosquitto:latest
|
|
|
|
.PHONY: help test vet build up down restart logs ps hash-password deps fmt \
|
|
mqtt-tls mqtt-verify mqtt-config verify-phase8
|
|
|
|
help:
|
|
@echo "make test run go test ./... in golang:1.25-alpine"
|
|
@echo "make vet run go vet ./... in golang:1.25-alpine"
|
|
@echo "make build build the container image ($(IMAGE))"
|
|
@echo "make up docker compose up -d --build"
|
|
@echo "make down docker compose down"
|
|
@echo "make logs follow container logs"
|
|
@echo "make ps docker compose ps"
|
|
@echo "make hash-password generate a bcrypt hash (PASSWORD=...)"
|
|
@echo "make deps go mod tidy + download (writes go.mod/go.sum)"
|
|
@echo "make mqtt-tls generate the lab CA and broker certificate"
|
|
@echo "make mqtt-config build the scratch broker config in deploy/mosquitto/build/"
|
|
@echo "make mqtt-verify prove TLS + credentials + topic ACLs on a scratch broker"
|
|
@echo "make verify-phase8 prove an API lock reaches a device in under a second"
|
|
|
|
test:
|
|
$(GO_RUN) go test ./...
|
|
|
|
vet:
|
|
$(GO_RUN) go vet ./...
|
|
|
|
deps:
|
|
$(GO_RUN) sh -c 'go mod tidy'
|
|
|
|
fmt:
|
|
$(GO_RUN) sh -c 'go fmt ./...'
|
|
|
|
build:
|
|
docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .
|
|
|
|
up:
|
|
docker compose up -d --build
|
|
|
|
down:
|
|
docker compose down
|
|
|
|
restart:
|
|
docker compose restart control
|
|
|
|
logs:
|
|
docker compose logs -f control
|
|
|
|
ps:
|
|
docker compose ps
|
|
|
|
hash-password:
|
|
@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
|
|
docker run --rm --entrypoint /app/control $(IMAGE) hash-password '$(PASSWORD)'
|
|
|
|
# --- MQTT ---------------------------------------------------------------
|
|
# These targets never touch the shared Mosquitto. They build the material and
|
|
# prove it on a scratch broker on $(MQTT_VERIFY_PORT). See deploy/mosquitto/README.md.
|
|
|
|
mqtt-tls:
|
|
deploy/mosquitto/generate-tls.sh
|
|
|
|
mqtt-config: mqtt-tls
|
|
deploy/mosquitto/build-config.sh
|
|
|
|
mqtt-verify: mqtt-config
|
|
MQTT_VERIFY_PORT=$(MQTT_VERIFY_PORT) MQTT_IMAGE=$(MQTT_IMAGE) \
|
|
deploy/mosquitto/verify-isolation.sh
|
|
|
|
# Phase 8 definition of done: lock through the admin API, measured until a real
|
|
# broker subscriber receives the retained config. Never touches the 1883 plane.
|
|
verify-phase8:
|
|
deploy/verify-phase8.sh
|