adam
7878e17e55
Adversarial review (gpt-5.5) of the new architecture surfaced real gaps: Hardware-safety / storm prevention: - Restart-storm guard: on startup, defer the first sweep if a sweep ran < POLL_SWEEP_INTERVAL ago (persisted in Redis), so deploy-cycling can no longer trigger back-to-back full hardware sweeps (poller.py). - Centralize pacing in the hardware gate: POLL_DRIVE_GAP is now held after EVERY hardware op (SMART, SES, host, MegaRAID, ledctl), not just the enclosure-drive loop (hwgate.py); removed the now-redundant per-loop sleeps. - Single-instance lock made atomic (Lua compare-and-set / compare-and-expire) and the refresher is now fatal on any error + has a done-callback, so a dropped lock can never leave two pollers sweeping concurrently (store.py, poller.py). - Warn loudly when POLL_CONCURRENCY > 1. Correctness: - Heartbeat now actually writes: cache_set omits EX when ttl<=0 (Redis rejects EX 0), so poller meta/last_sweep_ts persists — this also enables the restart-storm guard and the poller_fresh health flag (cache.py). - Web image runs a single uvicorn worker so the MQTT publisher is a true singleton (two workers shared a client_id and flapped the broker) (Dockerfile). - LED enqueue catches Redis errors -> API returns 503, not 500 (store.py). Deploy independence: - build.sh takes a target (web|poller|all) so web iterations never rebuild or repush the poller image. Nits: drop dead SMART_CACHE_TTL constant.
57 lines
1.6 KiB
Docker
57 lines
1.6 KiB
Docker
# ---- Stage: build frontend ----
|
|
FROM node:22-alpine AS frontend-build
|
|
WORKDIR /app/frontend
|
|
COPY frontend/package.json frontend/package-lock.json* ./
|
|
RUN npm install
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
# Output: /app/static/
|
|
|
|
# ---- Target: poller (hardware producer) ----
|
|
# Privileged at runtime; the only image with SAS/SMART tooling. Slim Python
|
|
# deps (just Redis) — no web stack.
|
|
FROM python:3.13-slim AS poller
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
smartmontools \
|
|
sg3-utils \
|
|
lsscsi \
|
|
util-linux \
|
|
ledmon \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
COPY requirements-poller.txt .
|
|
RUN pip install --no-cache-dir -r requirements-poller.txt
|
|
|
|
COPY poller.py .
|
|
COPY services/ services/
|
|
|
|
CMD ["python", "-u", "poller.py"]
|
|
|
|
# ---- Target: web (read-only consumer) ----
|
|
# Unprivileged at runtime; no hardware tools. Serves REST/UI + MQTT, reads Redis.
|
|
FROM python:3.13-slim AS web
|
|
|
|
WORKDIR /app
|
|
|
|
COPY requirements-web.txt .
|
|
RUN pip install --no-cache-dir -r requirements-web.txt
|
|
|
|
COPY main.py .
|
|
COPY routers/ routers/
|
|
COPY services/ services/
|
|
COPY models/ models/
|
|
COPY --from=frontend-build /app/static/ static/
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health')" || exit 1
|
|
|
|
# Single worker: the MQTT publisher is a per-process singleton (multiple
|
|
# workers would connect with the same client_id and flap the broker). The
|
|
# API is a low-traffic internal monitor, so one worker is plenty.
|
|
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
|