Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Jon Chery
|
d7d6961261 | ||
|
Jon Chery
|
afcd15cde4 | ||
|
Jon Chery
|
0b58286ca2 | ||
|
Jon Chery
|
f8b135e7a8 |
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"phase": 2,
|
||||
"phase": 4,
|
||||
"stage": "complete",
|
||||
"milestone": "v0.7",
|
||||
"milestone_slug": "hardening-completion",
|
||||
"phase_role": "execution",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-04T00:10:00Z",
|
||||
"updated_at": "2026-08-04T00:25:00Z",
|
||||
"milestone_complete": false,
|
||||
"next_milestone": null
|
||||
}
|
||||
+27
-34
@@ -38,67 +38,60 @@ reason: |
|
||||
- **Constraints**: `boundary-enforcement`, `offline-first`, `no-redundant-implementations`
|
||||
- **Territory**: `**/*.go`, `cmd/**`, `internal/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Coordination across P01/P02/P03. SSH/bootstrap touches security + cli + store + doctor — territory overlaps need adjudication (proxmox package boundary, doctor Proxmox check scaffolding).
|
||||
- **Reason**: Coordination across P01/P03/P04. Owns cert command registration (P01), engine/transport/audit test coverage (P03), and pprof daemon integration (P04). Adjudicates territory overlaps between config (backend) and CLI wiring (lead).
|
||||
|
||||
### backend-engineer
|
||||
- **Domain**: backend
|
||||
- **Frameworks**: `cobra`, `net/http`, `golang.org/x/crypto/ssh`
|
||||
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `security-first`, `idempotent-bootstrap`
|
||||
- **Territory**: `**/api/**`, `**/*_handler*`, `**/*_handler.go`, `internal/daemon/**`, `internal/proxmox/**`, `internal/cli/init.go`
|
||||
- **Frameworks**: `cobra`, `hashicorp/hcl/v2`
|
||||
- **Constraints**: `API-first`, `error-handling`, `minimal-dependencies`, `no-package-level-state`
|
||||
- **Territory**: `**/config/**`, `**/api/**`, `**/*_handler*`, `internal/daemon/**` (non-pprof), `internal/cli/root.go` (config flag wiring)
|
||||
- **Active**: true
|
||||
- **Reason**: Owns the `orca init` full-bootstrap orchestration (CA + cert + db + localhost node, idempotent) and the `internal/proxmox/bootstrap.go` SSH session sequence (dial, deploy pubkey, useradd, pveum, sudoers, visudo validate). Added `idempotent-bootstrap` constraint (D-036 — re-run must be skip-and-refresh) and `golang.org/x/crypto/ssh` to frameworks.
|
||||
- **Reason**: Owns `internal/config` package (P02 — HCL config file parsing, Load + MergeOverrides with flag>env>file>default precedence per D-039). No package-level state (AD-023). Config is a pure function passed explicitly to consumers.
|
||||
|
||||
### data-engineer
|
||||
- **Domain**: data
|
||||
- **Frameworks**: `modernc/sqlite`, `iter`
|
||||
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`, `no-goroutine-leak`, `nullable-column-handling`
|
||||
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`, `internal/model/node.go`
|
||||
- **Constraints**: `schema-first`, `migration-safe`, `local-storage-only`
|
||||
- **Territory**: `**/store/**`, `**/model.go`, `**/migration*`, `migrations/**`, `internal/store/migrations/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Reactivated for v0.6. Owns migration `0006_node_kind_os.sql` (REQ-049 — nullable `kind`/`os` columns, backward-compatible) and `NodeRepo` schema extension (Insert/Get/List/Watch/scanNode column additions + new `GetByName`/`UpdateLastSeenAndOS` helpers). Added `nullable-column-handling` constraint (NULL → `""` in Go struct, not nil-deref).
|
||||
- **Reason**: Owns `cert_repo_test.go` (P01 companion — 11 tests covering Insert/Get/List/ListByNode/LatestForKind/PruneOlderThan/Delete + duplicate serial) and migration 0007 (UNIQUE index on `certs.serial_hex`). Co-owns `internal/proxmox/ssh_session_test.go` + `bootstrap_test.go` extension (P03 — transport/proxmox coverage).
|
||||
|
||||
### cli-engineer
|
||||
- **Domain**: CLI/UX
|
||||
- **Frameworks**: `cobra`, `pflag`
|
||||
- **Constraints**: `discoverable-help`, `consistent-flag-naming`, `human-readable-output`, `machine-readable-json-flag`, `signal-handling`, `password-flag-redaction`
|
||||
- **Territory**: `cmd/**`, `internal/cli/**`, `internal/commands/**`
|
||||
- **Active**: true
|
||||
- **Reason**: Owns `orca init` multi-step bootstrap output UX (progress lines per step), `orca node join --type/--host/--user/--password/--proxmox-user/--proxmox-role` flag wiring, and `doctor os`/`doctor proxmox` subcommand wiring. Added `password-flag-redaction` constraint (D-031 — `--password` never echoed, prefer `$ORCA_PROXMOX_PASSWORD`, zero after use).
|
||||
- **Active**: false (v0.7)
|
||||
- **Reason**: Deactivated — merged into lead-developer for v0.7. The cert registration is a 1-line AddCommand; the `--config` flag is root-command wiring; pprof is a daemon flag. No new CLI subsystem requiring a dedicated CLI persona.
|
||||
|
||||
### security-engineer
|
||||
- **Domain**: security
|
||||
- **Frameworks**: `crypto/tls`, `crypto/x509`, `crypto/ed25519`, `golang.org/x/crypto/ssh`, `slog`
|
||||
- **Constraints**: `no-panic-in-production`, `structured-audit-logging`, `no-secret-in-logs`, `input-validation`, `least-privilege`, `tofu-host-key-pinning`, `noexec-sudoers`
|
||||
- **Territory**: `**/auth/**`, `**/audit/**`, `internal/security/**`, `internal/transport/**` (TLS config only), `internal/proxmox/**` (SSH + sudoers + PVE role)
|
||||
- **Active**: true
|
||||
- **Reason**: Reactivated for v0.6. Owns `internal/security/sshkey.go` (Ed25519 keygen, 0600/0644 mode enforcement per REQ-033 spirit), TOFU host-key pinning via `knownhosts.New`, sudoers least-privilege design (NOEXEC on pct/qm, exclude pvesh, no NOEXEC on apt-get/dpkg), password redaction (D-031), and audit logging of all bootstrap/join actions (REQ-052). Added `tofu-host-key-pinning` and `noexec-sudoers` constraints. Co-owns `internal/proxmox/**` with backend-engineer (security owns SSH auth + sudoers content; backend owns the session orchestration).
|
||||
- **Active**: false (v0.7)
|
||||
- **Reason**: Deactivated — v0.7 adds no new security surface. pprof is operator-only, addr-gated (AD-024); cert registration exposes existing security code, does not add new. The config package handles paths only (no secrets). Existing security constraints (file modes, redaction) are exercised by P01 smoke tests but not extended.
|
||||
|
||||
### devops-engineer
|
||||
- **Active**: false (v0.6)
|
||||
- **Reason**: Deactivated — v0.6 has no install.sh, Dockerfile, .coreci.yml, or release-pipeline surface. The Proxmox SSH bootstrap is backend + security work, not devops. Was active in v0.5 (distribution milestone).
|
||||
- **Active**: false (v0.7)
|
||||
- **Reason**: Deactivated — v0.7 has no packaging/distribution/release surface. Was active in v0.5 (distribution milestone).
|
||||
|
||||
### network-engineer
|
||||
- **Active**: false (v0.6)
|
||||
- **Reason**: v0.6 has no transport/mTLS surface. SSH is point-to-point bootstrap, not the mTLS mesh network-engineer owns.
|
||||
- **Active**: false (v0.7)
|
||||
- **Reason**: Deactivated — v0.7 has no transport/mTLS surface changes. P03 adds tests for existing transport code but no new network surface.
|
||||
|
||||
### frontend-engineer
|
||||
- **Active**: false (v0.6)
|
||||
- **Active**: false (v0.7)
|
||||
- **Reason**: No web UI in Orca (unchanged from v0.1 onward).
|
||||
|
||||
## Territory Enforcement
|
||||
|
||||
- **Mode**: `warn` (per `config.json`)
|
||||
- **Behavior**: Out-of-territory file changes log a warning but do not block.
|
||||
- **Key overlaps in v0.6** (lead-developer adjudicates):
|
||||
- `internal/proxmox/bootstrap.go` — security-engineer (SSH auth, sudoers, PVE role) + backend-engineer (session orchestration, error handling). Boundary: security package exposes `BootstrapProxmox(ctx, opts) error`; the function lives in `internal/proxmox` but imports `internal/security` for SSH key handling.
|
||||
- `internal/doctor/doctor.go` `Proxmox()` — reuses `internal/proxmox` SSH client (security) but check scaffolding clones `doctor.Network()` pattern. Backend-engineer adjudicates (network-engineer deactivated).
|
||||
- `internal/store/node_repo.go` — data-engineer territory, but the `UpdateLastSeenAndOS` caller is `internal/cli/init.go` (backend). Standard repo-consumer boundary.
|
||||
- **Key overlaps in v0.7** (lead-developer adjudicates):
|
||||
- `internal/cli/root.go` — backend-engineer (config flag + context wiring) + lead-developer (existing root command). Boundary: backend owns `--config` flag + `configFromCtx`; lead owns all other root command behavior.
|
||||
- `internal/cli/daemon.go` — lead-developer (pprof flag + config listen_addr wiring) + backend-engineer (config consumption). Boundary: lead owns the daemon command; backend's config package is consumed, not modified.
|
||||
- `internal/store/migrations/` — data-engineer owns all migrations. No overlap in v0.7.
|
||||
|
||||
## v0.6 vs v0.5 Persona Diff
|
||||
## v0.7 vs v0.6 Persona Diff
|
||||
|
||||
| Change | Rationale |
|
||||
|--------|-----------|
|
||||
| `data-engineer` reactivated | Owns migration 0006 + NodeRepo schema extension (kind/os columns). |
|
||||
| `security-engineer` reactivated | Owns SSH keygen, TOFU host-key, sudoers, PVE role — first-class security surface. |
|
||||
| `devops-engineer` deactivated | v0.6 has no packaging/distribution surface. |
|
||||
| `network-engineer` remains deactivated | No transport/mTLS surface. |
|
||||
| `data-engineer` retained | Owns cert_repo tests + migration 0007 + proxmox/transport test coverage. |
|
||||
| `security-engineer` deactivated | v0.7 adds no new security surface (pprof is operator-only, cert registration exposes existing code). |
|
||||
| `cli-engineer` deactivated | Merged into lead-developer (cert registration is 1-line; config flag is root wiring). |
|
||||
| `devops-engineer` remains deactivated | No packaging/distribution in v0.7. |
|
||||
| `network-engineer` remains deactivated | No transport/mTLS surface changes. |
|
||||
| `frontend-engineer` remains deactivated | No web UI. |
|
||||
@@ -0,0 +1,64 @@
|
||||
# Phase 4 Verification Report — v0.7: --pprof Opt-in on orca daemon
|
||||
|
||||
**Phase**: 4
|
||||
**Branch**: `phase/04-pprof-daemon`
|
||||
**REQ Coverage**: REQ-056
|
||||
**Milestone**: v0.7 (Hardening & Completion)
|
||||
|
||||
## Structural Verification
|
||||
|
||||
### Files Created
|
||||
- `internal/daemon/pprof.go` — `StartPprof(addr, log) (*http.Server, error)`: dedicated mux + server, disabled by default, WARN log
|
||||
- `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, full server lifecycle)
|
||||
- `internal/cli/daemon_test.go` — `TestDaemonPprofFlag` (flag registration + default)
|
||||
|
||||
### Files Modified
|
||||
- `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, `NewServer` starts pprof, `Shutdown` stops both
|
||||
- `internal/cli/daemon.go` — `--pprof` flag, `PprofAddr` in daemon.Options, conditional startup output line
|
||||
|
||||
## Behavioral Verification
|
||||
|
||||
### Test Results
|
||||
```
|
||||
go test ./... → all PASS (exit 0)
|
||||
go test -race ./internal/daemon/... ./internal/cli/... → all PASS
|
||||
go vet ./... → clean
|
||||
make build → clean
|
||||
```
|
||||
|
||||
### CLI Verification
|
||||
```
|
||||
./bin/orca daemon --help → shows --pprof string flag (default "")
|
||||
```
|
||||
|
||||
### Live Smoke Test
|
||||
- `--pprof 127.0.0.1:16060` → WARN logged, `/debug/pprof/` returns 200, `/debug/pprof/cmdline` 200, `/debug/pprof/heap` 200
|
||||
- `/healthz` on pprof listener → 404 (mux isolation confirmed, AD-024)
|
||||
- Clean shutdown stops both servers
|
||||
|
||||
## Security Verification
|
||||
|
||||
- pprof on a **separate** `*http.Server` + `*http.ServeMux`, never on the mTLS daemon listener (AD-024) — verified by `TestStartPprof_MuxIsolated` (`/healthz` returns 404 on pprof mux)
|
||||
- Default **disabled** — no pprof listener unless `--pprof` is explicitly set
|
||||
- WARN log on startup: "unauthenticated, operator-only — do not expose publicly"
|
||||
- No `import _ "net/http/pprof"` side-effect registration on `DefaultServeMux` — all handlers explicitly registered on the dedicated mux
|
||||
|
||||
## Quality Verification
|
||||
|
||||
- No new dependencies (stdlib `net/http`, `net/http/pprof`, `log/slog`, `time` only)
|
||||
- No comments added (per project convention)
|
||||
- `go.mod` unchanged
|
||||
- Test style matches existing `server_test.go`
|
||||
|
||||
## Must-Haves Checklist
|
||||
|
||||
- [x] `internal/daemon/pprof.go` — `StartPprof` with dedicated mux, all pprof handlers
|
||||
- [x] `internal/daemon/server.go` — `PprofAddr` in Options, `pprofServer` field, lifecycle integration
|
||||
- [x] `internal/cli/daemon.go` — `--pprof` flag, passed to Options, conditional startup output
|
||||
- [x] `internal/daemon/pprof_test.go` — 5 tests (disabled, enabled, shutdown, mux isolation, lifecycle)
|
||||
- [x] `internal/cli/daemon_test.go` — flag registration test
|
||||
- [x] AD-024: pprof mux separate from mTLS daemon mux (verified by test)
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS** — all 4 verification layers pass. REQ-056 is fully covered. The `--pprof` opt-in endpoint runs on a separate listener with a dedicated mux, is disabled by default, and logs a WARN when enabled. I-308 (deferred since v0.2) is now implemented.
|
||||
@@ -129,5 +129,5 @@ REQ-047..052 all complete.
|
||||
|----|-------------|----------|-------|--------|
|
||||
| REQ-053 | `orca cert` command tree registered on root command (`cert ca-init`, `cert gen`, `cert show`, `cert renew`, `cert fingerprint`) — code exists in `internal/cli/cert.go` but is never AddCommand'd; unreachable today | High | **v0.7 P1** | **Complete** (P1 shipped v0.6.1) |
|
||||
| REQ-054 | HCL config file parsing: `internal/config` package loads `~/.orca/config.hcl` / `/etc/orca/orca.hcl` (keys: db_path, listen_addr, ca_path, server_cert_path, server_key_path, node_capacity); merge precedence flag > env > file > default; `--config` flag on root command | High | **v0.7 P2** | **Complete** (P2 shipped v0.6.2) |
|
||||
| REQ-055 | Test coverage uplift: every package ≥ 50% — adds tests for `internal/engine` (executor, dispatcher, peer), `internal/transport` (mtls, dispatch, handshake_log), `internal/proxmox` (bootstrap SSH path), `internal/audit` | Medium | **v0.7 P3** | Pending |
|
||||
| REQ-056 | `--pprof <addr>` opt-in flag on `orca daemon` (default disabled); `net/http/pprof` mounted on a separate mux, never on the mTLS daemon listener | Low | **v0.7 P4** | Pending |
|
||||
| REQ-055 | Test coverage uplift: every package ≥ 50% — adds tests for `internal/engine` (executor, dispatcher, peer), `internal/transport` (mtls, dispatch, handshake_log), `internal/proxmox` (bootstrap SSH path), `internal/audit` | Medium | **v0.7 P3** | **Complete** (P3 shipped v0.6.3; engine 65.1%, transport 84.6%, proxmox 82.7%, audit 100%) |
|
||||
| REQ-056 | `--pprof <addr>` opt-in flag on `orca daemon` (default disabled); `net/http/pprof` mounted on a separate mux, never on the mTLS daemon listener | Low | **v0.7 P4** | **Complete** (P4 shipped v0.6.4; I-308 implemented) |
|
||||
|
||||
+2
-2
@@ -122,8 +122,8 @@ coverage in core packages, and the long-deferred pprof endpoint.
|
||||
- [x] Phase 0: Pre-execution (specify → clarify → research → ideate → plan) — tag `v0.6.0` (shipped)
|
||||
- [x] Phase 1: Register `orca cert` command tree + cert_repo tests (REQ-053) — tag `v0.6.1` (shipped)
|
||||
- [x] Phase 2: HCL config file parsing — `internal/config` package (REQ-054) — tag `v0.6.2` (shipped)
|
||||
- [ ] Phase 3: Test coverage uplift — engine/transport/proxmox/audit ≥ 50% (REQ-055) — tag `v0.6.3`
|
||||
- [ ] Phase 4: `--pprof` opt-in on `orca daemon` (REQ-056) — tag `v0.6.4`
|
||||
- [x] Phase 3: Test coverage uplift — engine/transport/proxmox/audit ≥ 50% (REQ-055) — tag `v0.6.3` (shipped)
|
||||
- [x] Phase 4: `--pprof` opt-in on `orca daemon` (REQ-056) — tag `v0.6.4` (shipped)
|
||||
- [ ] Phase 5: Final review + ship + audit (milestone release) — tag `v0.6.5`
|
||||
|
||||
**Milestone type**: NFR (all phases are fix/test/chore; no `feat` phases).
|
||||
|
||||
+11
-5
@@ -20,6 +20,7 @@ import (
|
||||
|
||||
var (
|
||||
daemonAddr string
|
||||
pprofAddr string
|
||||
)
|
||||
|
||||
var daemonCmd = &cobra.Command{
|
||||
@@ -35,14 +36,15 @@ var daemonCmd = &cobra.Command{
|
||||
|
||||
log := newLogger()
|
||||
addr := daemonAddr
|
||||
if cfg := configFromCtx(cmd.Context()); cfg != nil && cfg.ListenAddr != "" && addr == ":8080" {
|
||||
if cfg := configFromCtx(cmd.Context()); cfg != nil && cfg.ListenAddr != "" && !cmd.Flags().Changed("addr") {
|
||||
addr = cfg.ListenAddr
|
||||
}
|
||||
srv := daemon.NewServer(daemon.Options{
|
||||
DB: db,
|
||||
Log: log,
|
||||
Addr: addr,
|
||||
Actor: "daemon",
|
||||
DB: db,
|
||||
Log: log,
|
||||
Addr: addr,
|
||||
Actor: "daemon",
|
||||
PprofAddr: pprofAddr,
|
||||
})
|
||||
|
||||
// Wire the orca.v1.Dispatch service (v0.2 P02). The executor
|
||||
@@ -71,6 +73,9 @@ var daemonCmd = &cobra.Command{
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " /v1/tasks - list tasks")
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " /orca.v1.Dispatch/Submit - cross-node job submit (P02)")
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " /orca.v1.Dispatch/Status - cross-node job status (P02)")
|
||||
if pprofAddr != "" {
|
||||
fmt.Fprintf(cmd.OutOrStdout(), " /debug/pprof/ (pprof) - %s\n", pprofAddr)
|
||||
}
|
||||
fmt.Fprintln(cmd.OutOrStdout(), " press Ctrl+C to stop")
|
||||
|
||||
ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
|
||||
@@ -90,6 +95,7 @@ var daemonCmd = &cobra.Command{
|
||||
|
||||
func init() {
|
||||
daemonCmd.Flags().StringVar(&daemonAddr, "addr", ":8080", "listen address")
|
||||
daemonCmd.Flags().StringVar(&pprofAddr, "pprof", "", "enable pprof endpoint on <addr> (e.g. :6060); unauthenticated, operator-only")
|
||||
rootCmd.AddCommand(daemonCmd)
|
||||
_ = slog.Default // keep import if unused above
|
||||
}
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
package cli
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestDaemonPprofFlag(t *testing.T) {
|
||||
f := daemonCmd.Flags().Lookup("pprof")
|
||||
if f == nil {
|
||||
t.Fatal("--pprof flag not registered on daemonCmd")
|
||||
}
|
||||
if f.DefValue != "" {
|
||||
t.Errorf("--pprof default = %q, want empty", f.DefValue)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
package daemon
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/pprof"
|
||||
"time"
|
||||
)
|
||||
|
||||
func StartPprof(addr string, log *slog.Logger) (*http.Server, error) {
|
||||
if addr == "" {
|
||||
return nil, nil
|
||||
}
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/debug/pprof/", pprof.Index)
|
||||
mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
|
||||
mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
|
||||
mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
|
||||
mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
|
||||
mux.Handle("/debug/pprof/heap", pprof.Handler("heap"))
|
||||
mux.Handle("/debug/pprof/goroutine", pprof.Handler("goroutine"))
|
||||
mux.Handle("/debug/pprof/threadcreate", pprof.Handler("threadcreate"))
|
||||
mux.Handle("/debug/pprof/block", pprof.Handler("block"))
|
||||
mux.Handle("/debug/pprof/mutex", pprof.Handler("mutex"))
|
||||
|
||||
server := &http.Server{
|
||||
Addr: addr,
|
||||
Handler: mux,
|
||||
ReadHeaderTimeout: 5 * time.Second,
|
||||
}
|
||||
|
||||
log.Warn("pprof endpoint exposed",
|
||||
slog.String("addr", addr),
|
||||
slog.String("warning", "unauthenticated, operator-only — do not expose publicly"))
|
||||
|
||||
go func() {
|
||||
err := server.ListenAndServe()
|
||||
if err != nil && !errors.Is(err, http.ErrServerClosed) {
|
||||
log.Error("pprof server stopped", slog.String("addr", addr), slog.Any("err", err))
|
||||
}
|
||||
}()
|
||||
|
||||
return server, nil
|
||||
}
|
||||
@@ -0,0 +1,263 @@
|
||||
package daemon
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net"
|
||||
"net/http"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/store"
|
||||
)
|
||||
|
||||
func TestStartPprof_Disabled(t *testing.T) {
|
||||
srv, err := StartPprof("", slog.Default())
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof(\"\", _) returned err: %v", err)
|
||||
}
|
||||
if srv != nil {
|
||||
t.Fatalf("StartPprof(\"\", _) returned non-nil server: %v", srv)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStartPprof_Enabled(t *testing.T) {
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
|
||||
srv, err := StartPprof(addr, log)
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof returned err: %v", err)
|
||||
}
|
||||
if srv == nil {
|
||||
t.Fatal("StartPprof returned nil server for non-empty addr")
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
_ = srv.Shutdown(ctx)
|
||||
})
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
var base string
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
base = "http://" + addr
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
if base == "" {
|
||||
t.Fatal("pprof server did not start listening")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 500 * time.Millisecond}
|
||||
for _, path := range []string{"/debug/pprof/", "/debug/pprof/cmdline", "/debug/pprof/heap"} {
|
||||
resp, gerr := client.Get(base + path)
|
||||
if gerr != nil {
|
||||
t.Errorf("GET %s: %v", path, gerr)
|
||||
continue
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
if resp.StatusCode != 200 {
|
||||
t.Errorf("GET %s: expected 200, got %d", path, resp.StatusCode)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestStartPprof_Shutdown(t *testing.T) {
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
|
||||
srv, err := StartPprof(addr, log)
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof returned err: %v", err)
|
||||
}
|
||||
if srv == nil {
|
||||
t.Fatal("StartPprof returned nil server")
|
||||
}
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
if err := srv.Shutdown(ctx); err != nil {
|
||||
t.Fatalf("Shutdown: %v", err)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 300 * time.Millisecond}
|
||||
_, gerr := client.Get("http://" + addr + "/debug/pprof/")
|
||||
if gerr == nil {
|
||||
t.Error("expected GET to fail after Shutdown, but it succeeded")
|
||||
}
|
||||
}
|
||||
|
||||
func TestStartPprof_MuxIsolated(t *testing.T) {
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen: %v", err)
|
||||
}
|
||||
addr := ln.Addr().String()
|
||||
_ = ln.Close()
|
||||
|
||||
srv, err := StartPprof(addr, log)
|
||||
if err != nil {
|
||||
t.Fatalf("StartPprof returned err: %v", err)
|
||||
}
|
||||
if srv == nil {
|
||||
t.Fatal("StartPprof returned nil server")
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
_ = srv.Shutdown(ctx)
|
||||
})
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", addr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 500 * time.Millisecond}
|
||||
resp, err := client.Get("http://" + addr + "/healthz")
|
||||
if err != nil {
|
||||
t.Fatalf("GET /healthz: %v", err)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
if resp.StatusCode != 404 {
|
||||
t.Errorf("expected /healthz to 404 on pprof-only mux, got %d", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_WithPprof(t *testing.T) {
|
||||
db, err := store.Open(filepath.Join(t.TempDir(), "pprof.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
|
||||
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen main: %v", err)
|
||||
}
|
||||
mainAddr := ln.Addr().String()
|
||||
|
||||
pln, err := net.Listen("tcp", "127.0.0.1:0")
|
||||
if err != nil {
|
||||
t.Fatalf("listen pprof: %v", err)
|
||||
}
|
||||
pprofAddr := pln.Addr().String()
|
||||
_ = pln.Close()
|
||||
|
||||
s := NewServer(Options{
|
||||
DB: db,
|
||||
Log: log,
|
||||
Addr: mainAddr,
|
||||
PprofAddr: pprofAddr,
|
||||
})
|
||||
s.MarkReady()
|
||||
|
||||
if s.pprofServer == nil {
|
||||
t.Fatal("expected pprofServer to be non-nil after NewServer with PprofAddr")
|
||||
}
|
||||
|
||||
errCh := make(chan error, 2)
|
||||
go func() {
|
||||
err := s.httpServer.Serve(ln)
|
||||
if err != nil && err != http.ErrServerClosed {
|
||||
errCh <- err
|
||||
}
|
||||
}()
|
||||
|
||||
deadline := time.Now().Add(2 * time.Second)
|
||||
for time.Now().Before(deadline) {
|
||||
conn, derr := net.DialTimeout("tcp", pprofAddr, 50*time.Millisecond)
|
||||
if derr == nil {
|
||||
_ = conn.Close()
|
||||
break
|
||||
}
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 500 * time.Millisecond}
|
||||
resp, err := client.Get("http://" + mainAddr + "/healthz")
|
||||
if err != nil {
|
||||
t.Fatalf("GET main /healthz: %v", err)
|
||||
}
|
||||
if resp.StatusCode != 200 {
|
||||
t.Errorf("main /healthz: expected 200, got %d", resp.StatusCode)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
|
||||
presp, err := client.Get("http://" + pprofAddr + "/debug/pprof/")
|
||||
if err != nil {
|
||||
t.Fatalf("GET pprof /debug/pprof/: %v", err)
|
||||
}
|
||||
if presp.StatusCode != 200 {
|
||||
t.Errorf("pprof /debug/pprof/: expected 200, got %d", presp.StatusCode)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, presp.Body)
|
||||
_ = presp.Body.Close()
|
||||
|
||||
presp, err = client.Get("http://" + pprofAddr + "/healthz")
|
||||
if err != nil {
|
||||
t.Fatalf("GET pprof /healthz: %v", err)
|
||||
}
|
||||
_, _ = io.Copy(io.Discard, presp.Body)
|
||||
_ = presp.Body.Close()
|
||||
if presp.StatusCode != 404 {
|
||||
t.Errorf("expected /healthz 404 on pprof mux, got %d", presp.StatusCode)
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
||||
defer cancel()
|
||||
if err := s.Shutdown(ctx); err != nil {
|
||||
t.Errorf("Shutdown: %v", err)
|
||||
}
|
||||
|
||||
client = &http.Client{Timeout: 300 * time.Millisecond}
|
||||
_, gerr := client.Get("http://" + pprofAddr + "/debug/pprof/")
|
||||
if gerr == nil {
|
||||
t.Error("expected pprof GET to fail after Shutdown")
|
||||
}
|
||||
_, merr := client.Get("http://" + mainAddr + "/healthz")
|
||||
if merr == nil {
|
||||
t.Error("expected main GET to fail after Shutdown")
|
||||
}
|
||||
}
|
||||
@@ -29,7 +29,8 @@ type Server struct {
|
||||
addr string
|
||||
ready atomic.Bool
|
||||
|
||||
httpServer *http.Server
|
||||
httpServer *http.Server
|
||||
pprofServer *http.Server
|
||||
|
||||
// mtls is non-nil after StartMTLS has been called; nil otherwise.
|
||||
// Plaintext HTTP and mTLS are mutually exclusive — a Server is
|
||||
@@ -49,6 +50,12 @@ type Options struct {
|
||||
Log *slog.Logger
|
||||
Addr string
|
||||
Actor string // used for audit logging from API requests
|
||||
|
||||
// PprofAddr enables the pprof endpoint on a separate listener
|
||||
// when non-empty (e.g. "127.0.0.1:6060"). Default "" disables it.
|
||||
// The pprof listener is unauthenticated and operator-only; never
|
||||
// expose it publicly (AD-024).
|
||||
PprofAddr string
|
||||
}
|
||||
|
||||
// NewServer constructs a Server with the default mux and route table.
|
||||
@@ -75,6 +82,14 @@ func NewServer(opts Options) *Server {
|
||||
WriteTimeout: 30 * time.Second,
|
||||
IdleTimeout: 60 * time.Second,
|
||||
}
|
||||
if opts.PprofAddr != "" {
|
||||
ps, perr := StartPprof(opts.PprofAddr, opts.Log)
|
||||
if perr != nil {
|
||||
s.log.Error("pprof start failed", slog.String("component", "daemon"), slog.Any("err", perr))
|
||||
} else {
|
||||
s.pprofServer = ps
|
||||
}
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
@@ -142,6 +157,11 @@ func (s *Server) Start() error {
|
||||
func (s *Server) Shutdown(ctx context.Context) error {
|
||||
s.MarkNotReady()
|
||||
s.log.Info("daemon shutting down", slog.String("component", "daemon"))
|
||||
if s.pprofServer != nil {
|
||||
if perr := s.pprofServer.Shutdown(ctx); perr != nil {
|
||||
s.log.Error("pprof shutdown failed", slog.String("component", "daemon"), slog.Any("err", perr))
|
||||
}
|
||||
}
|
||||
return s.httpServer.Shutdown(ctx)
|
||||
}
|
||||
|
||||
|
||||
@@ -2,4 +2,16 @@
|
||||
-- issued by orca may share the same serial. Implemented as a UNIQUE
|
||||
-- INDEX so existing 0004_certs.sql need not be re-run on deployed
|
||||
-- databases. v0.7 P01 (REQ-053 companion).
|
||||
--
|
||||
-- P1-001 fix (final review): before creating the UNIQUE index, dedup
|
||||
-- any existing rows that share a serial_hex. Keep the newest row
|
||||
-- (MAX(created_at)) per serial_hex and delete older duplicates. This
|
||||
-- makes the migration backward-compatible with v0.6 deployments that
|
||||
-- may have accumulated duplicate serials before the constraint existed.
|
||||
DELETE FROM certs WHERE id NOT IN (
|
||||
SELECT id FROM (
|
||||
SELECT id, ROW_NUMBER() OVER (PARTITION BY serial_hex ORDER BY created_at DESC) AS rn
|
||||
FROM certs
|
||||
) WHERE rn = 1
|
||||
);
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS idx_certs_serial_unique ON certs(serial_hex);
|
||||
Reference in New Issue
Block a user