diff --git a/install_virtuality_node.sh b/install_virtuality_node.sh index 17f1db5..6eb7057 100644 --- a/install_virtuality_node.sh +++ b/install_virtuality_node.sh @@ -178,7 +178,7 @@ case "$(uname -m)" in esac install_available "Пакеты виртуализации установлены" \ "${QEMU_SYSTEM_PACKAGES[@]}" qemu-utils libvirt-daemon-system libvirt-clients virtinst \ - bridge-utils dnsmasq-base swtpm cloud-image-utils + bridge-utils dnsmasq-base swtpm cloud-image-utils xorriso step "Устанавливаем зависимости панели управления" install_available "Пакеты панели установлены" \ diff --git a/tests/test_app.py b/tests/test_app.py index ba4310e..95f4139 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -139,7 +139,7 @@ def test_vm_create_iso_builds_virt_install(logged_in, data_dirs, monkeypatch): cmd = captured["cmd"] assert cmd[0] == "virt-install" assert "--cdrom" in cmd and str(iso) in cmd - assert "network=virtuality-nat,model=virtio" in cmd + assert any(part.startswith("network=virtuality-nat,model=virtio,mac=52:54:00:") for part in cmd) assert captured["operation"]["boot_order"] == "cdrom_disk" diff --git a/tests/test_downloads.py b/tests/test_downloads.py index d2bff1b..fc1527d 100644 --- a/tests/test_downloads.py +++ b/tests/test_downloads.py @@ -317,12 +317,16 @@ def test_catalog_route(logged_in, data_dirs, www, monkeypatch): monkeypatch.setattr(app, "start_disk_convert_operation", lambda path: None) assert unquote(logged_in.post("/downloads/catalog/nope", follow_redirects=False).headers["location"]).startswith("/disk-images?download_error=Такого образа нет") + # The worker is started by hand below: a 6 KB file would otherwise finish before the page is rendered. + pending = {} + monkeypatch.setattr(downloads, "run_operation", lambda operation, worker: pending.update(operation=operation, worker=worker)) response = logged_in.post("/downloads/catalog/debian-13", follow_redirects=False) assert response.status_code == 303 and "download_message=" in response.headers["location"] page = logged_in.get("/disk-images").text assert "Скачивается" in page running = downloads.active_downloads("disk") assert running[0]["catalog_id"] == "debian-13" + core.run_operation(pending["operation"], pending["worker"]) assert wait_for(running[0]["id"])["status"] == "success" assert (data_dirs["disk_images"] / "debian-13-genericcloud-amd64.qcow2").read_bytes() == payload page = logged_in.get("/disk-images").text diff --git a/tests/test_quickvm.py b/tests/test_quickvm.py new file mode 100644 index 0000000..b26411f --- /dev/null +++ b/tests/test_quickvm.py @@ -0,0 +1,149 @@ +"""Quick machines from cloud images (cloud-init), OS types for installers, fixed NAT addresses.""" +import shlex + +import app +import cloudinit +import conftest +import network_core +from test_audit_fixes import find, recording + + +def create(logged_in, monkeypatch, form): + captured = {} + monkeypatch.setattr(app, "start_background_operation", lambda operation, cmd: captured.update(operation=operation, cmd=cmd)) + monkeypatch.setattr(app.network_core, "create_nat_network", lambda: {}) + response = logged_in.post("/vm/create", data=form, follow_redirects=False) + return response, captured + + +def cloud_form(image, **extra): + form = {"name": "cloud-vm", "memory": 2048, "vcpus": 2, "disk_size": 20, "disk_image_path": str(image), "source_type": "disk_image", "network_mode": "nat", "cloud_init": "1", "ci_user": "viktor", "ci_password": "secret123"} + form.update(extra) + return form + + +# ---------------------------------------------------------------- cloud-init seed +def test_user_data_has_user_password_and_keys(): + text = cloudinit.build_user_data("web", "viktor", "$6$abc", ["ssh-ed25519 AAAAC3 me@laptop"]) + assert "hostname: web" in text and "- name: viktor" in text and "passwd: '$6$abc'" in text + assert "- ssh-ed25519 AAAAC3 me@laptop" in text and "ssh_pwauth: true" in text and "growpart" in text + assert "ssh_pwauth: false" in cloudinit.build_user_data("web", "viktor", "", ["ssh-ed25519 AAAAC3 me"]) + + +def test_ssh_keys_and_users_are_validated(): + assert cloudinit.parse_ssh_keys("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 me\n\nssh-rsa AAAAB3 x\n") == ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 me", "ssh-rsa AAAAB3 x"] + assert cloudinit.parse_ssh_keys("-----BEGIN OPENSSH PRIVATE KEY-----") is None + assert cloudinit.parse_ssh_keys("") == [] + assert cloudinit.valid_user("viktor") and cloudinit.valid_user("web_admin-2") + assert not cloudinit.valid_user("root") and not cloudinit.valid_user("Viktor") and not cloudinit.valid_user("") + + +def test_password_hash_uses_sha512_crypt(): + digest = cloudinit.hash_password("secret123") + assert digest.startswith("$6$") and len(digest) > 60 + + +def test_default_login_comes_from_catalog(): + assert cloudinit.default_user("resolute-server-cloudimg-amd64.img") == "ubuntu" + assert cloudinit.default_user("debian-13-genericcloud-arm64.qcow2") == "debian" + assert cloudinit.default_user("my-own-image.qcow2") == "admin" + + +# ---------------------------------------------------------------- creating from a cloud image +def test_cloud_image_vm_gets_seed_resize_and_fixed_address(logged_in, data_dirs, monkeypatch): + image = data_dirs["disk_images"] / "resolute-server-cloudimg-amd64.img" + image.write_bytes(b"QFI\xfb") + monkeypatch.setattr(cloudinit, "hash_password", lambda password: "$6$fake$hash") + calls = recording(monkeypatch, network_core, [(["virsh", "net-dumpxml"], conftest.fake_result((conftest.FIXTURES / "net-dumpxml.xml").read_text()))]) + response, captured = create(logged_in, monkeypatch, cloud_form(image, disk_size=60)) + assert response.status_code == 303, response.text[:400] + script = captured["cmd"][-1] + assert "qemu-img convert -p -f qcow2 -O qcow2" in script + assert f"qemu-img resize {shlex.quote(str(data_dirs['images'] / 'cloud-vm.qcow2'))} 60G" in script + assert "--import" in script and "--osinfo ubuntu24.04" in script and "--cloud-init user-data=" in script and "bus=virtio" in script + operation = captured["operation"] + assert operation["cloud_init_user"] == "viktor" and operation["nat_ip"] == "192.168.100.50" + assert "Вход: viktor по паролю" in operation["success_message"] and "192.168.100.50" in operation["success_message"] + mac = network_core.stable_mac("cloud-vm") + assert f"mac={mac}" in operation["network"] and mac.startswith("52:54:00:") + reservation = find(calls, "virsh", "net-update", "virtuality-nat", "add-last", "ip-dhcp-host")[0] + assert f"mac='{mac}' name='cloud-vm' ip='192.168.100.50'" in reservation[5] and "--live" in reservation and "--config" in reservation + user_data = open(operation["seed_file"]).read() + assert "- name: viktor" in user_data and "$6$fake$hash" in user_data and "hostname: cloud-vm" in user_data + cloudinit.remove_seed(operation["seed_file"]) + + +def test_cloud_image_smaller_disk_is_not_resized(logged_in, data_dirs, monkeypatch): + image = data_dirs["disk_images"] / "cloud.qcow2" + image.write_bytes(b"qcow") + monkeypatch.setattr(cloudinit, "hash_password", lambda password: "$6$fake$hash") + response, captured = create(logged_in, monkeypatch, cloud_form(image, disk_size=20)) + assert response.status_code == 303 + assert "qemu-img resize" not in captured["cmd"][-1] and "--osinfo detect=on,require=off" in captured["cmd"][-1] + cloudinit.remove_seed(captured["operation"]["seed_file"]) + + +def test_cloud_init_can_be_skipped(logged_in, data_dirs, monkeypatch): + image = data_dirs["disk_images"] / "cloud.qcow2" + image.write_bytes(b"qcow") + response, captured = create(logged_in, monkeypatch, cloud_form(image, cloud_init="0", ci_user="", ci_password="")) + assert response.status_code == 303 and "--cloud-init" not in captured["cmd"][-1] and captured["operation"]["seed_file"] == "" + + +def test_cloud_init_validation(logged_in, data_dirs, monkeypatch): + image = data_dirs["disk_images"] / "cloud.qcow2" + image.write_bytes(b"qcow") + assert create(logged_in, monkeypatch, cloud_form(image, ci_password="123"))[0].status_code == 400 + assert create(logged_in, monkeypatch, cloud_form(image, ci_user="Root User"))[0].status_code == 400 + assert create(logged_in, monkeypatch, cloud_form(image, ci_user="root"))[0].status_code == 400 + assert create(logged_in, monkeypatch, cloud_form(image, ci_ssh_key="not a key"))[0].status_code == 400 + monkeypatch.setattr(cloudinit, "hash_password", lambda password: "$6$fake$hash") + ok, captured = create(logged_in, monkeypatch, cloud_form(image, ci_password="", ci_ssh_key="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA me@pc")) + assert ok.status_code == 303 and "по SSH-ключу" in captured["operation"]["success_message"] + cloudinit.remove_seed(captured["operation"]["seed_file"]) + + +# ---------------------------------------------------------------- installers by OS type +def iso_form(iso, **extra): + form = {"name": "new-vm", "memory": 4096, "vcpus": 2, "disk_size": 64, "iso_path": str(iso), "source_type": "iso", "network_mode": "nat"} + form.update(extra) + return form + + +def test_windows11_gets_uefi_tpm_sata_and_e1000e(logged_in, data_dirs, monkeypatch): + iso = data_dirs["iso"] / "win11.iso" + iso.write_bytes(b"iso") + response, captured = create(logged_in, monkeypatch, iso_form(iso, os_type="windows11")) + assert response.status_code == 303 + cmd = captured["cmd"] + assert "--osinfo" in cmd and cmd[cmd.index("--osinfo") + 1] == "win11" + assert cmd[cmd.index("--boot") + 1] == "uefi,cdrom,hd" + assert "--tpm" in cmd and "backend.version=2.0" in cmd[cmd.index("--tpm") + 1] + assert "bus=sata" in cmd[cmd.index("--disk") + 1] and "model=e1000e" in cmd[cmd.index("--network") + 1] + + +def test_linux_installer_detects_os_and_uses_virtio(logged_in, data_dirs, monkeypatch): + iso = data_dirs["iso"] / "debian.iso" + iso.write_bytes(b"iso") + response, captured = create(logged_in, monkeypatch, iso_form(iso)) + cmd = captured["cmd"] + assert cmd[cmd.index("--osinfo") + 1] == "detect=on,require=off" and cmd[cmd.index("--boot") + 1] == "cdrom,hd" + assert "bus=virtio" in cmd[cmd.index("--disk") + 1] and "model=virtio" in cmd[cmd.index("--network") + 1] and "--tpm" not in cmd + assert create(logged_in, monkeypatch, iso_form(iso, os_type="bsd"))[0].status_code == 400 + + +# ---------------------------------------------------------------- fixed addresses +def test_reservation_is_reused_and_released(data_dirs, monkeypatch): + calls = recording(monkeypatch, network_core, [(["virsh", "net-dumpxml"], conftest.fake_result((conftest.FIXTURES / "net-dumpxml.xml").read_text()))]) + assert network_core.reserve_nat_address("web01", "52:54:00:aa:bb:cc") == "192.168.100.51" + assert not find(calls, "virsh", "net-update") + network_core.release_nat_address("web01") + deleted = find(calls, "virsh", "net-update", "virtuality-nat", "delete")[0] + assert "name='web01' ip='192.168.100.51'" in deleted[5] + + +def test_vm_delete_releases_address(logged_in, data_dirs, monkeypatch): + calls = recording(monkeypatch, app, []) + net_calls = recording(monkeypatch, network_core, [(["virsh", "net-dumpxml"], conftest.fake_result((conftest.FIXTURES / "net-dumpxml.xml").read_text()))]) + assert logged_in.post("/vm/web01/delete", follow_redirects=False).status_code == 303 + assert find(calls, "virsh", "undefine") and find(net_calls, "virsh", "net-update", "virtuality-nat", "delete") diff --git a/web/app.py b/web/app.py index fc5cbe4..4b94a08 100644 --- a/web/app.py +++ b/web/app.py @@ -4,6 +4,7 @@ import json import os import platform import re +import shlex import shutil import subprocess import tempfile @@ -26,6 +27,8 @@ from itsdangerous import BadSignature, URLSafeSerializer, URLSafeTimedSerializer import auth import host_profile +import catalog +import cloudinit import network_core import presenters import update_core @@ -293,12 +296,16 @@ def run_operation_worker(operation_id: str, cmd: list[str]) -> None: update_operation(fresh, progress=new_progress, message=line.strip()[:240] or fresh.get("message")) exit_code = process.wait() fresh = read_operation(operation_id) or operation + if fresh.get("seed_file"): + cloudinit.remove_seed(fresh["seed_file"]) if exit_code == 0: append_operation_log(operation_id, "virt-install завершился успешно.") run_cmd(["virsh", "pool-refresh", "virtuality-images"], timeout=20) - update_operation(fresh, status="success", progress=100, exit_code=exit_code, message="VM создана успешно", finished_at=utc_now()) + update_operation(fresh, status="success", progress=100, exit_code=exit_code, message=fresh.get("success_message") or "Машина создана", finished_at=utc_now()) else: append_operation_log(operation_id, f"virt-install завершился с ошибкой. Exit code: {exit_code}") + if fresh.get("vm_name") and fresh.get("network_mode") == "nat": + network_core.release_nat_address(fresh["vm_name"]) update_operation(fresh, status="error", progress=100, exit_code=exit_code, message=f"virt-install завершился с ошибкой: {exit_code}", finished_at=utc_now()) except Exception as exc: fresh = read_operation(operation_id) or operation @@ -577,7 +584,8 @@ def list_disk_image_files() -> list[dict[str, str]]: except OSError: size_gb = 0 updated = "unknown" - files.append({"name": item.name, "path": str(item), "format": item.suffix.lower().lstrip('.'), "size": f"{size_gb:.2f} GB", "updated": updated}) + entry = catalog.entry_for_filename(item.name) + files.append({"name": item.name, "path": str(item), "format": item.suffix.lower().lstrip('.'), "size": f"{size_gb:.2f} GB", "updated": updated, "login": cloudinit.default_user(item.name), "title": entry["title"] if entry else "", "catalog_id": entry["id"] if entry else ""}) return files @@ -614,6 +622,14 @@ def disk_image_format(path: Path) -> str: return 'qcow2' if path.suffix.lower() == '.qcow2' else 'raw' +def disk_image_virtual_size(path: Path) -> int: + info = run_cmd(["qemu-img", "info", "--output=json", str(path)], timeout=30) + try: + return int(json.loads(info.get("stdout") or "{}").get("virtual-size", 0)) if info.get("ok") else 0 + except (json.JSONDecodeError, TypeError, ValueError): + return 0 + + def bridge_exists(name: str) -> bool: if not name or not re.fullmatch(r"[a-zA-Z0-9_.:-]+", name): return False @@ -1239,7 +1255,7 @@ def virt_boot_arg(boot_order: str, is_arm: bool) -> str: def vm_form_context(request: Request, error: str | None = None, form: dict[str, Any] | None = None, status_code: int = 200): profile = host_profile.load_host_profile() default_mode = profile.get("recommended_network", "nat") - return templates.TemplateResponse("vm_create.html", {"request": request, "app_name": APP_NAME, "user": AUTH_USER, "isos": list_iso_files(), "disk_images": list_disk_image_files(), "boot_options": vm_boot_order_options(), "error": error, "profile": profile, "form": form or {"memory": 4096, "vcpus": 2, "disk_size": 40, "source_type": "iso", "boot_order": "auto", "network_mode": default_mode, "bridge": DEFAULT_BRIDGE}}, status_code=status_code) + return templates.TemplateResponse("vm_create.html", {"request": request, "app_name": APP_NAME, "user": AUTH_USER, "isos": list_iso_files(), "disk_images": list_disk_image_files(), "os_types": catalog.OS_TYPES, "boot_options": vm_boot_order_options(), "error": error, "profile": profile, "form": form or {"memory": 4096, "vcpus": 2, "disk_size": 40, "source_type": "iso", "boot_order": "auto", "network_mode": default_mode, "bridge": DEFAULT_BRIDGE}}, status_code=status_code) # Virtuality noVNC console patch @@ -1748,12 +1764,15 @@ def vm_create_page(request: Request, iso: str = "", image: str = ""): @app.post("/vm/create", response_class=HTMLResponse) -def vm_create_submit(request: Request, name: str = Form(...), memory: int = Form(...), vcpus: int = Form(...), disk_size: int = Form(20), iso_path: str = Form(""), disk_image_path: str = Form(""), source_type: str = Form("iso"), boot_order: str = Form("auto"), network_mode: str = Form("nat"), bridge: str = Form(DEFAULT_BRIDGE)): +def vm_create_submit(request: Request, name: str = Form(...), memory: int = Form(...), vcpus: int = Form(...), disk_size: int = Form(20), iso_path: str = Form(""), disk_image_path: str = Form(""), source_type: str = Form("iso"), boot_order: str = Form("auto"), network_mode: str = Form("nat"), bridge: str = Form(DEFAULT_BRIDGE), os_type: str = Form("linux"), cloud_init: str = Form("0"), ci_user: str = Form(""), ci_password: str = Form(""), ci_ssh_key: str = Form("")): auth_redirect = require_auth(request) if auth_redirect: return auth_redirect - form = {"name": name, "memory": memory, "vcpus": vcpus, "disk_size": disk_size, "iso_path": iso_path, "disk_image_path": disk_image_path, "source_type": source_type, "boot_order": boot_order, "network_mode": network_mode, "bridge": bridge} + ci_user = ci_user.strip() + form = {"name": name, "memory": memory, "vcpus": vcpus, "disk_size": disk_size, "iso_path": iso_path, "disk_image_path": disk_image_path, "source_type": source_type, "boot_order": boot_order, "network_mode": network_mode, "bridge": bridge, "os_type": os_type, "cloud_init": cloud_init, "ci_user": ci_user, "ci_ssh_key": ci_ssh_key} error = None + use_cloud_init = source_type == "disk_image" and cloud_init == "1" + ssh_keys = cloudinit.parse_ssh_keys(ci_ssh_key) if use_cloud_init else [] if not valid_vm_name(name): error = "Имя VM может содержать латиницу, цифры, точку, дефис и подчёркивание. Длина 2–63 символа." elif vm_exists(name): @@ -1772,6 +1791,14 @@ def vm_create_submit(request: Request, name: str = Form(...), memory: int = Form error = "Некорректный источник VM." elif boot_order not in ("auto", "disk", "cdrom_disk", "disk_cdrom"): error = "Некорректный порядок загрузки VM." + elif os_type not in {item["id"] for item in catalog.OS_TYPES}: + error = "Некорректный тип системы." + elif use_cloud_init and not cloudinit.valid_user(ci_user): + error = "Имя пользователя: строчные латинские буквы, цифры, дефис и подчёркивание, до 32 символов." + elif use_cloud_init and ssh_keys is None: + error = "SSH-ключ не похож на публичный ключ. Нужна строка вида «ssh-ed25519 AAAA… комментарий» — из файла ~/.ssh/id_ed25519.pub." + elif use_cloud_init and not ssh_keys and len(ci_password) < 6: + error = "Задайте пароль не короче 6 символов или вставьте публичный SSH-ключ — иначе в машину нельзя будет войти." elif network_mode == "bridge" and not bridge_exists(bridge): error = f"Bridge {bridge} не найден на сервере. Для VPS выбери режим NAT Router — virtuality-nat, либо сначала создай bridge {bridge}." else: @@ -1802,24 +1829,60 @@ def vm_create_submit(request: Request, name: str = Form(...), memory: int = Form selected_boot_order = normalize_boot_order(boot_order, source_type) is_arm = selected_arch == "aarch64" virt_type = "kvm" if profile.get("kvm_device") else "qemu" - network_arg = f"network={network_core.NETWORK_NAME},model=virtio" if network_mode == "nat" else f"bridge={bridge},model=virtio" + os_info = catalog.os_type(os_type) if source_type == "iso" else None + windows = os_type.startswith("windows") if source_type == "iso" else False + # Windows installers have no virtio drivers: SATA disk and an Intel network card work out of the box. + disk_bus = "sata" if windows or os_type == "other" and source_type == "iso" else "virtio" + nic_model = "e1000e" if disk_bus == "sata" else "virtio" + nat_ip = None + if network_mode == "nat": + mac = network_core.stable_mac(name) + nat_ip = network_core.reserve_nat_address(name, mac) + network_arg = f"network={network_core.NETWORK_NAME},model={nic_model},mac={mac}" + else: + network_arg = f"bridge={bridge},model={nic_model}" cmd = ["virt-install", "--name", name, "--memory", str(memory), "--vcpus", str(vcpus), "--virt-type", virt_type] if is_arm: cmd += ["--arch", "aarch64", "--machine", "virt", "--cpu", "host" if virt_type == "kvm" else "cortex-a57"] + uefi = is_arm or os_type == "windows11" and source_type == "iso" + catalog_entry = catalog.entry_for_filename(Path(disk_image_path).name) if source_type == "disk_image" else None + if catalog_entry: + uefi = uefi or bool(catalog_entry["arches"].get(selected_arch, {}).get("uefi")) + boot_arg = virt_boot_arg(selected_boot_order, uefi) + cmd += ["--boot", boot_arg] + if os_type == "windows11" and source_type == "iso": + # Windows 11 refuses to install without a TPM 2.0. + cmd += ["--tpm", "model=tpm-crb,backend.type=emulator,backend.version=2.0"] + graphics = ["--graphics", "vnc,listen=127.0.0.1", "--noautoconsole"] - cmd += ["--boot", virt_boot_arg(selected_boot_order, is_arm)] - + seed_file = "" + login_hint = "" if source_type == "disk_image": source_disk = Path(disk_image_path).resolve() source_format = disk_image_format(source_disk) - convert_cmd = f"qemu-img convert -p -f {source_format} -O qcow2 {source_disk} {disk_path}" - virt_cmd = " ".join(cmd + ["--import", "--disk", f"path={disk_path},format=qcow2,bus=virtio", "--os-variant", "generic", "--network", network_arg, "--graphics", "vnc,listen=127.0.0.1", "--noautoconsole"]) - cmd = ["bash", "-lc", f"set -euo pipefail; {convert_cmd}; {virt_cmd}"] + osinfo = catalog_entry["osinfo"] if catalog_entry else "detect=on,require=off" + steps = [f"qemu-img convert -p -f {source_format} -O qcow2 {shlex.quote(str(source_disk))} {shlex.quote(str(disk_path))}"] + if disk_size * 1024 ** 3 > disk_image_virtual_size(source_disk): + # cloud-init grows the root file system to the new size on first boot. + steps.append(f"qemu-img resize {shlex.quote(str(disk_path))} {disk_size}G") + virt = cmd + ["--import", "--disk", f"path={disk_path},format=qcow2,bus={disk_bus}", "--osinfo", osinfo, "--network", network_arg, *graphics] + if use_cloud_init: + try: + password_hash = cloudinit.hash_password(ci_password) if ci_password else "" + except RuntimeError as exc: + return vm_form_context(request, error=f"Не удалось подготовить пароль: {exc}", form=form, status_code=500) + user_file, meta_file = cloudinit.write_seed(name, cloudinit.build_user_data(name, ci_user, password_hash, ssh_keys or []), cloudinit.build_meta_data(name)) + seed_file = str(user_file) + virt += ["--cloud-init", f"user-data={user_file},meta-data={meta_file}"] + login_hint = f"Вход: {ci_user}" + (" по паролю" if password_hash else "") + (" и по SSH-ключу" if ssh_keys else "") + steps.append(" ".join(shlex.quote(part) for part in virt)) + cmd = ["bash", "-lc", "set -euo pipefail; " + "; ".join(steps)] else: - cmd += ["--disk", f"path={disk_path},size={disk_size},format=qcow2,bus=virtio", "--cdrom", iso_path, "--os-variant", "generic", "--network", network_arg, "--graphics", "vnc,listen=127.0.0.1", "--noautoconsole"] + cmd += ["--disk", f"path={disk_path},size={disk_size},format=qcow2,bus={disk_bus}", "--cdrom", iso_path, "--osinfo", os_info["osinfo"], "--network", network_arg, *graphics] + success_message = "Машина создана" + (f". {login_hint}" if login_hint else "") + (f". Адрес в сети машин: {nat_ip}" if nat_ip else "") operation_id = str(uuid.uuid4()) - operation = {"id": operation_id, "type": "vm_create", "title": f"Создание VM {name}", "status": "queued", "progress": 0, "message": "Операция поставлена в очередь", "created_at": utc_now(), "updated_at": utc_now(), "created_by": AUTH_USER, "vm_name": name, "disk_path": str(disk_path), "iso_path": iso_path, "host_profile": profile.get("profile"), "guest_arch": selected_arch, "boot_order": selected_boot_order, "network_mode": network_mode, "network": network_arg, "bridge": bridge, "memory": memory, "vcpus": vcpus, "disk_size": disk_size, "cmd": " ".join(cmd)} + operation = {"id": operation_id, "type": "vm_create", "title": f"Создание VM {name}", "status": "queued", "progress": 0, "message": "Операция поставлена в очередь", "created_at": utc_now(), "updated_at": utc_now(), "created_by": AUTH_USER, "vm_name": name, "disk_path": str(disk_path), "iso_path": iso_path, "host_profile": profile.get("profile"), "guest_arch": selected_arch, "boot_order": selected_boot_order, "network_mode": network_mode, "network": network_arg, "bridge": bridge, "memory": memory, "vcpus": vcpus, "disk_size": disk_size, "os_type": os_type, "cloud_init_user": ci_user if use_cloud_init else "", "nat_ip": nat_ip or "", "seed_file": seed_file, "success_message": success_message, "cmd": " ".join(cmd)} start_background_operation(operation, cmd) return RedirectResponse(url=f"/operations/{operation_id}", status_code=303) @@ -1959,6 +2022,7 @@ def vm_action(request: Request, name: str, action: str): result = run_cmd(["virsh", "undefine", name, "--remove-all-storage", "--nvram", "--managed-save", "--snapshots-metadata", "--checkpoints-metadata"], timeout=120) if not result["ok"]: return redirect_with_message(f"/vm/{name}", "error", f"Не удалось удалить машину: {virsh_error(result)}") + network_core.release_nat_address(name) return redirect_with_message("/", "message", f"Машина {name} удалена") if action not in allowed: return JSONResponse({"ok": False, "error": "Unsupported action"}, status_code=400) diff --git a/web/catalog.py b/web/catalog.py index 014871b..9d8da61 100644 --- a/web/catalog.py +++ b/web/catalog.py @@ -80,3 +80,12 @@ def os_type(type_id: str) -> dict[str, Any]: def image_filename(entry: dict[str, Any], arch: str) -> str: url = entry["arches"][arch]["url"] return url.rsplit("/", 1)[-1] + + +def entry_for_filename(name: str) -> dict[str, Any] | None: + """Catalog entry whose download has this file name (any architecture).""" + for entry in CLOUD_IMAGES: + for arch in entry["arches"].values(): + if arch["url"].rsplit("/", 1)[-1] == name: + return entry + return None diff --git a/web/cloudinit.py b/web/cloudinit.py new file mode 100644 index 0000000..9b55af2 --- /dev/null +++ b/web/cloudinit.py @@ -0,0 +1,104 @@ +"""cloud-init seed for machines created from ready-made (cloud) images. + +Cloud images ship without a password: the first login is configured here — +user, password and/or SSH key — and virt-install attaches the seed as a small +CD-ROM (`--cloud-init user-data=…,meta-data=…`).""" +import re +import shutil +import subprocess +import tempfile +from pathlib import Path + +import catalog +from core import STORAGE_DIR + +USER_RE = re.compile(r"[a-z_][a-z0-9_-]{0,31}") +SSH_KEY_RE = re.compile(r"^(ssh-(ed25519|rsa|dss)|ecdsa-sha2-nistp(256|384|521)|sk-(ssh-ed25519|ecdsa-sha2-nistp256)@openssh\.com) [A-Za-z0-9+/=]+( .*)?$") +RESERVED_USERS = {"root", "daemon", "bin", "sys", "nobody", "systemd-network", "syslog", "messagebus"} + + +def default_user(image_name: str) -> str: + entry = catalog.entry_for_filename(image_name) + return str(entry.get("login") or "admin") if entry else "admin" + + +def valid_user(name: str) -> bool: + return bool(USER_RE.fullmatch(name or "")) and name not in RESERVED_USERS + + +def parse_ssh_keys(text: str) -> list[str] | None: + """Public keys, one per line. None when a line is not a public key.""" + keys = [] + for line in (text or "").splitlines(): + line = line.strip() + if not line: + continue + if not SSH_KEY_RE.match(line) or len(line) > 4096: + return None + keys.append(line) + return keys + + +def hash_password(password: str) -> str: + """SHA-512 crypt hash: the seed CD-ROM stays readable on the server, so the password is never stored as text.""" + try: + result = subprocess.run(["openssl", "passwd", "-6", "-stdin"], input=password + "\n", capture_output=True, text=True, timeout=20, check=False) + except (OSError, subprocess.SubprocessError) as exc: + raise RuntimeError(f"openssl недоступен: {exc}") from exc + digest = result.stdout.strip() + if result.returncode != 0 or not digest.startswith("$6$"): + raise RuntimeError(result.stderr.strip() or "openssl passwd завершился с ошибкой") + return digest + + +def build_user_data(hostname: str, user: str, password_hash: str, ssh_keys: list[str]) -> str: + lines = [ + "#cloud-config", + f"hostname: {hostname}", + "manage_etc_hosts: true", + "users:", + f" - name: {user}", + " sudo: ALL=(ALL) NOPASSWD:ALL", + " groups: [sudo, wheel, adm]", + " shell: /bin/bash", + " lock_passwd: false", + ] + if password_hash: + lines.append(f" passwd: '{password_hash}'") + if ssh_keys: + lines.append(" ssh_authorized_keys:") + lines += [f" - {key}" for key in ssh_keys] + lines += [ + f"ssh_pwauth: {'true' if password_hash else 'false'}", + "chpasswd:", + " expire: false", + "disable_root: true", + "growpart:", + " mode: auto", + " devices: ['/']", + "resize_rootfs: true", + "package_update: false", + ] + return "\n".join(lines) + "\n" + + +def build_meta_data(name: str) -> str: + return f"instance-id: virtuality-{name}\nlocal-hostname: {name}\n" + + +def write_seed(name: str, user_data: str, meta_data: str) -> tuple[Path, Path]: + """Files for virt-install --cloud-init; the folder is removed once the machine is created.""" + root = STORAGE_DIR / "tmp" + root.mkdir(parents=True, exist_ok=True) + folder = Path(tempfile.mkdtemp(prefix=f"cloudinit-{name}-", dir=str(root))) + user_file, meta_file = folder / "user-data", folder / "meta-data" + user_file.write_text(user_data) + meta_file.write_text(meta_data) + user_file.chmod(0o600) + return user_file, meta_file + + +def remove_seed(user_file: Path | str) -> None: + folder = Path(user_file).parent + if folder.name.startswith("cloudinit-"): + shutil.rmtree(folder, ignore_errors=True) diff --git a/web/network_core.py b/web/network_core.py index 49b7f9c..5ce94df 100644 --- a/web/network_core.py +++ b/web/network_core.py @@ -177,6 +177,60 @@ def nat_network_xml() -> str: """ +def stable_mac(vm_name: str) -> str: + """Locally administered QEMU MAC derived from the machine name (same name → same address).""" + import hashlib + + digest = hashlib.sha1(vm_name.encode()).digest() + return '52:54:00:' + ':'.join(f'{b:02x}' for b in digest[:3]) + + +def nat_reservations() -> list[dict[str, str]]: + """DHCP reservations of the NAT network: [{'name', 'mac', 'ip'}].""" + result = run_cmd(['virsh', 'net-dumpxml', NETWORK_NAME], timeout=8) + if not result['ok']: + return [] + return [ + {'mac': m.group(1).lower(), 'name': m.group(2), 'ip': m.group(3)} + for m in re.finditer(r"", result['stdout']) + ] + + +def _net_update(action: str, host_xml: str) -> dict[str, Any]: + base = ['virsh', 'net-update', NETWORK_NAME, action, 'ip-dhcp-host', host_xml] + result = run_cmd(base + ['--live', '--config'], timeout=15) + if not result['ok'] and 'not active' in (result['stderr'] + result['stdout']).lower(): + result = run_cmd(base + ['--config'], timeout=15) + return result + + +def reserve_nat_address(vm_name: str, mac: str) -> str | None: + """Pin the machine to one NAT address for its whole life; None when libvirt refused.""" + if not re.fullmatch(r'[a-zA-Z0-9][a-zA-Z0-9_.-]{1,62}', vm_name or ''): + return None + reservations = nat_reservations() + for item in reservations: + if item['name'] == vm_name: + if item['mac'] != mac.lower(): + _net_update('modify', f"") + return item['ip'] + taken = {item['ip'] for item in reservations} + leases = run_cmd(['virsh', 'net-dhcp-leases', NETWORK_NAME], timeout=8) + taken.update(re.findall(r'\b(192\.168\.100\.\d+)/', leases['stdout'] if leases['ok'] else '')) + start, end = int(DHCP_START.rsplit('.', 1)[1]), int(DHCP_END.rsplit('.', 1)[1]) + free = next((f'192.168.100.{last}' for last in range(start, end + 1) if f'192.168.100.{last}' not in taken), None) + if not free: + return None + result = _net_update('add-last', f"") + return free if result['ok'] else None + + +def release_nat_address(vm_name: str) -> None: + for item in nat_reservations(): + if item['name'] == vm_name: + _net_update('delete', f"") + + def libvirt_network_info() -> dict[str, Any]: info = run_cmd(['virsh', 'net-info', NETWORK_NAME], timeout=8) leases = run_cmd(['virsh', 'net-dhcp-leases', NETWORK_NAME], timeout=8) diff --git a/web/static/panel.js b/web/static/panel.js index 4e1c45a..60a41b1 100644 --- a/web/static/panel.js +++ b/web/static/panel.js @@ -445,8 +445,17 @@ }); $$('[data-visible-when]', form).forEach((el) => { const [key, expected] = el.dataset.visibleWhen.split('='); - el.hidden = value(key) !== expected; + const target = field(key); + const current = target instanceof HTMLInputElement && target.type === 'checkbox' ? (target.checked ? target.value : '0') : value(key); + el.hidden = current !== expected; }); + // Default login of the chosen cloud image (ubuntu, debian, …) until the user types a name. + const login = field('ci_user'); + if (login && login.dataset.autoLogin === '1') { + const image = field('disk_image_path'); + const option = image && image.selectedIndex >= 0 ? image.options[image.selectedIndex] : null; + login.value = option?.dataset.login || 'admin'; + } const preset = value('preset'); const custom = preset === 'custom'; const presetInput = $(`input[name=preset][value="${preset}"]`, form); @@ -461,13 +470,13 @@ setSummary('source', source === 'disk_image' ? optionText(field('disk_image_path')) : optionText(field('iso_path'))); setSummary('cpu', `${value('vcpus')} ${Number(value('vcpus')) === 1 ? 'ядро' : 'ядра'}`); setSummary('memory', memory >= 1024 ? `${+(memory / 1024).toFixed(1)} ГБ` : `${memory} МБ`); - setSummary('disk', source === 'disk_image' ? 'из образа' : `${value('disk_size')} ГБ`); + setSummary('disk', `${value('disk_size')} ГБ`); setSummary('network', value('network_mode') === 'bridge' ? 'Локальная сеть' : 'Автоматически (NAT)'); const hasSource = source === 'disk_image' ? form.dataset.hasDisks === '1' : form.dataset.hasIsos === '1'; $$('[data-create-button]').forEach((btn) => { btn.disabled = !hasSource || !value('name'); }); $$('[data-missing-source]').forEach((el) => { el.hidden = hasSource || el.dataset.missingSource !== source; }); } - form.addEventListener('input', sync); + form.addEventListener('input', (event) => { if (event.target.name === 'ci_user') event.target.dataset.autoLogin = event.target.value ? '0' : '1'; sync(); }); form.addEventListener('change', sync); sync(); } diff --git a/web/templates/vm_create.html b/web/templates/vm_create.html index 421f3e4..4fbaf00 100644 --- a/web/templates/vm_create.html +++ b/web/templates/vm_create.html @@ -55,15 +55,40 @@ Нужен другой? Загрузите образ. {% endif %} +
+ +
+ {% for os in os_types %} + + {% endfor %} +
+ От этого зависят виртуальные устройства: Windows получит совместимые диск и сеть, Windows 11 — UEFI и TPM. +
{% if disk_images %} Образ будет скопирован — оригинал останется для других машин. {% endif %}
+
+ +
+
+
Получит права администратора (sudo)
+
Не короче 6 символов
+
+
С ключом можно обойтись без пароля: вход по SSH будет только по ключу.
+
+
@@ -95,7 +120,7 @@
-
+
{% if profile.virtualization_warning %}{{ alert('warning', 'На этом сервере нет аппаратного ускорения — машины будут заметно медленнее.') }}{% endif %}