logan
f9c6c1d826
基于 WEB-UI-Development-Guide 标准的整体升级,并更名 LokiDeploy → opsx-loki。 前端(Gin+React+shadcn/ui): - 按 02/07 章重构:页面域化拆分(无超 400 行文件)、PageContainer/ListQuery、 反馈分级(成功静默/失败 toast/危险确认)、401 单飞刷新+队列重放 - 暗色模式(next-themes)+ 语义 Token(--primary 品牌色/success/warning/info) - 部署向导(状态推导四步:环境→存储→Loki→采集,内嵌表单闭环) - 日志查询页:LogQL 标签构建器/拖拽直方图/日志上下文/Live Tail/查询历史 - 按用户+标签策略的查询授权(服务端强制合并策略) 后端(Go+Gin+JSON DB): - 简单用户管理(仅 admin,无 RBAC)+ TokenVersion 会话吊销 + 登录 IP 限流 - LDAP 接入:配置(AES 加密存储/hasPassword 脱敏)/测试连接/批量导入/登录 - 存储配置测试连接(SigV4 零依赖)+ 桶不存在自动创建 - Loki 三模式部署修复:SSH 密钥认证、3.x 配置模板、ruler 对象存储嵌套块、 凭证解密、孤儿 deploying 状态恢复、Grafana 部署(可选默认关)+面板导入 - DaemonSet 采集纯 YAML(去 helm 依赖)+ DNS 自愈回退 ClusterIP + 集群名标签 - 日志查询代理:cluster-svc 经 kube-apiserver proxy/url 直连 + cursor 翻页 - 统一 log 命名空间;部署就绪探活;Grafana 访问地址自动记录 修复:run.sh 增量编译检测、Sanitized 脱敏补全、LokiDeployment Update 白名单、 健康检查 CreatedAt 零值等 10+ 存量 bug。 数据兼容:DB 沿用旧 lokideploy.json(新名优先);localStorage 一次性迁移; HKDF 加密前缀保留(已加密凭证不受影响)。
217 lines
7.9 KiB
Go
217 lines
7.9 KiB
Go
package routers
|
||
|
||
import (
|
||
"net/http"
|
||
"os"
|
||
"path/filepath"
|
||
"strings"
|
||
"time"
|
||
|
||
"opsxloki/controllers"
|
||
"opsxloki/middleware"
|
||
|
||
"github.com/gin-contrib/cors"
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
func SetupRouter() *gin.Engine {
|
||
r := gin.Default()
|
||
|
||
// CORS
|
||
cfg := cors.DefaultConfig()
|
||
cfg.AllowAllOrigins = true
|
||
cfg.AllowHeaders = []string{"Origin", "Content-Type", "Accept", "Authorization", "X-Requested-With"}
|
||
cfg.AllowMethods = []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"}
|
||
r.Use(cors.New(cfg))
|
||
|
||
// Controllers
|
||
authCtrl := controllers.NewAuthController()
|
||
clusterCtrl := controllers.NewClusterController()
|
||
hostCtrl := controllers.NewHostController()
|
||
storageCtrl := controllers.NewStorageController()
|
||
deploymentCtrl := controllers.NewDeploymentController()
|
||
collectorCtrl := controllers.NewCollectorController()
|
||
userCtrl := controllers.NewUserController()
|
||
ldapCtrl := controllers.NewLdapController()
|
||
logsCtrl := controllers.NewLogsController()
|
||
|
||
// API v1
|
||
api := r.Group("/api/v1")
|
||
|
||
// 健康检查（公开访问，用于负载均衡和监控）
|
||
api.GET("/health", func(c *gin.Context) {
|
||
c.JSON(http.StatusOK, gin.H{
|
||
"status": "ok",
|
||
"timestamp": time.Now().Unix(),
|
||
"version": "2.0.0",
|
||
})
|
||
})
|
||
|
||
// Prometheus metrics 端点（公开访问，可被Prometheus抓取）
|
||
api.GET("/metrics", func(c *gin.Context) {
|
||
// 基础metrics输出（符合Prometheus文本格式）
|
||
c.Header("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
|
||
c.String(http.StatusOK, "# LokiDeploy Metrics\n")
|
||
})
|
||
|
||
// Public（登录接口挂 IP 限流防爆破：20 次/分钟）
|
||
api.POST("/auth/login", middleware.LoginRateLimit(20, time.Minute), authCtrl.Login)
|
||
api.POST("/auth/refresh", authCtrl.RefreshToken)
|
||
|
||
// Auth required
|
||
authorized := api.Group("")
|
||
authorized.Use(middleware.JWTAuth())
|
||
|
||
// Auth routes
|
||
authorized.GET("/auth/user", authCtrl.GetUser)
|
||
authorized.POST("/auth/password", authCtrl.ChangePassword)
|
||
|
||
// 日志查询:数据源管理 + Loki 代理查询
|
||
logs := authorized.Group("/logs")
|
||
{
|
||
logs.GET("/sources", logsCtrl.ListSources)
|
||
logs.POST("/sources", middleware.AdminAuth(), logsCtrl.CreateSource)
|
||
logs.PUT("/sources/:id", middleware.AdminAuth(), logsCtrl.UpdateSource)
|
||
logs.DELETE("/sources/:id", middleware.AdminAuth(), logsCtrl.DeleteSource)
|
||
logs.POST("/sources/test", middleware.AdminAuth(), logsCtrl.TestSource)
|
||
logs.GET("/policy-groups", middleware.AdminAuth(), logsCtrl.ListPolicyGroups)
|
||
logs.POST("/policy-groups", middleware.AdminAuth(), logsCtrl.CreatePolicyGroup)
|
||
logs.PUT("/policy-groups/:id", middleware.AdminAuth(), logsCtrl.UpdatePolicyGroup)
|
||
logs.DELETE("/policy-groups/:id", middleware.AdminAuth(), logsCtrl.DeletePolicyGroup)
|
||
logs.POST("/query", logsCtrl.Query)
|
||
logs.POST("/context", logsCtrl.Context)
|
||
logs.GET("/labels", logsCtrl.Labels)
|
||
logs.GET("/label/:name/values", logsCtrl.LabelValues)
|
||
logs.POST("/histogram", logsCtrl.Histogram)
|
||
logs.GET("/health", logsCtrl.Health)
|
||
}
|
||
|
||
// LDAP 配置(admin 读写;查询供用户页判断导入按钮显隐,登录用户即可读)
|
||
authorized.GET("/settings/ldap", middleware.AdminAuth(), ldapCtrl.GetConfig)
|
||
authorized.PUT("/settings/ldap", middleware.AdminAuth(), ldapCtrl.UpdateConfig)
|
||
authorized.POST("/settings/ldap/test", middleware.AdminAuth(), ldapCtrl.TestConnection)
|
||
authorized.POST("/settings/ldap/users", middleware.AdminAuth(), ldapCtrl.ListUsers)
|
||
|
||
// Users（admin 专用）
|
||
users := authorized.Group("/users")
|
||
users.Use(middleware.AdminAuth())
|
||
{
|
||
users.GET("", userCtrl.List)
|
||
users.POST("", userCtrl.Create)
|
||
users.DELETE("/:id", userCtrl.Delete)
|
||
users.POST("/:id/reset-password", userCtrl.ResetPassword)
|
||
users.POST("/batch-import-ldap", userCtrl.BatchImportLDAP)
|
||
}
|
||
// 普通用户仅可访问日志查询及自己的账号接口；管理资源统一在服务端保护。
|
||
authorized.Use(middleware.AdminAuth())
|
||
|
||
// Clusters
|
||
authorized.GET("/clusters", clusterCtrl.List)
|
||
authorized.GET("/clusters/:id", clusterCtrl.Get)
|
||
authorized.POST("/clusters", clusterCtrl.Create)
|
||
authorized.PUT("/clusters/:id", clusterCtrl.Update)
|
||
authorized.DELETE("/clusters/:id", clusterCtrl.Delete)
|
||
authorized.POST("/clusters/:id/validate", clusterCtrl.Validate)
|
||
authorized.GET("/clusters/:id/info", clusterCtrl.GetInfo)
|
||
|
||
// Hosts
|
||
authorized.GET("/hosts", hostCtrl.List)
|
||
authorized.GET("/hosts/:id", hostCtrl.Get)
|
||
authorized.POST("/hosts", hostCtrl.Create)
|
||
authorized.PUT("/hosts/:id", hostCtrl.Update)
|
||
authorized.DELETE("/hosts/:id", hostCtrl.Delete)
|
||
authorized.POST("/hosts/:id/validate", hostCtrl.Validate)
|
||
authorized.GET("/hosts/:id/info", hostCtrl.GetInfo)
|
||
authorized.POST("/hosts/:id/execute", hostCtrl.Execute)
|
||
|
||
// Storage
|
||
authorized.GET("/storages", storageCtrl.List)
|
||
authorized.GET("/storages/:id", storageCtrl.Get)
|
||
authorized.POST("/storages", storageCtrl.Create)
|
||
authorized.POST("/storages/test", storageCtrl.TestConnection)
|
||
authorized.PUT("/storages/:id", storageCtrl.Update)
|
||
authorized.DELETE("/storages/:id", storageCtrl.Delete)
|
||
authorized.GET("/storages/default", storageCtrl.GetDefault)
|
||
|
||
// Deployments
|
||
authorized.GET("/deployments", deploymentCtrl.List)
|
||
authorized.GET("/deployments/:id", deploymentCtrl.Get)
|
||
authorized.POST("/deployments", deploymentCtrl.Create)
|
||
authorized.PUT("/deployments/:id", deploymentCtrl.Update)
|
||
authorized.DELETE("/deployments/:id", deploymentCtrl.Delete)
|
||
authorized.POST("/deployments/:id/deploy", deploymentCtrl.Deploy)
|
||
authorized.POST("/deployments/:id/stop", deploymentCtrl.Stop)
|
||
authorized.POST("/deployments/:id/restart", deploymentCtrl.Restart)
|
||
authorized.GET("/deployments/:id/logs", deploymentCtrl.GetLogs)
|
||
authorized.GET("/deployments/stats", deploymentCtrl.GetStats)
|
||
authorized.GET("/deployments/preflight", deploymentCtrl.Preflight)
|
||
authorized.GET("/deployments/:id/ready", deploymentCtrl.Ready)
|
||
authorized.GET("/deployments/versions", deploymentCtrl.GetVersions)
|
||
|
||
// Collectors
|
||
authorized.GET("/collectors", collectorCtrl.List)
|
||
authorized.GET("/collectors/:id", collectorCtrl.Get)
|
||
authorized.POST("/collectors", collectorCtrl.Create)
|
||
authorized.PUT("/collectors/:id", collectorCtrl.Update)
|
||
authorized.DELETE("/collectors/:id", collectorCtrl.Delete)
|
||
authorized.POST("/collectors/:id/install", collectorCtrl.Install)
|
||
authorized.POST("/collectors/:id/uninstall", collectorCtrl.Uninstall)
|
||
|
||
// Static files - use executable directory as base
|
||
distPath := findDistPath()
|
||
|
||
if distPath != "" {
|
||
r.Static("/assets", filepath.Join(distPath, "assets"))
|
||
|
||
// favicon：NoRoute 会把所有非 /api/ 请求回退到 index.html，
|
||
// 故此处显式注册 /favicon.svg 与 /favicon.ico，否则浏览器请求图标只会拿到 HTML。
|
||
faviconSVG := filepath.Join(distPath, "favicon.svg")
|
||
serveFavicon := func(c *gin.Context) {
|
||
if _, err := os.Stat(faviconSVG); err != nil {
|
||
c.Status(404)
|
||
return
|
||
}
|
||
c.Header("Content-Type", "image/svg+xml")
|
||
c.File(faviconSVG)
|
||
}
|
||
r.GET("/favicon.svg", serveFavicon)
|
||
r.GET("/favicon.ico", serveFavicon)
|
||
|
||
r.NoRoute(func(c *gin.Context) {
|
||
if strings.HasPrefix(c.Request.URL.Path, "/api/") {
|
||
c.JSON(404, gin.H{"code": 404, "message": "API endpoint not found"})
|
||
return
|
||
}
|
||
c.File(filepath.Join(distPath, "index.html"))
|
||
})
|
||
}
|
||
|
||
return r
|
||
}
|
||
|
||
// findDistPath finds the frontend dist directory
|
||
func findDistPath() string {
|
||
// Try relative to executable
|
||
if ex, err := os.Executable(); err == nil {
|
||
execDir := filepath.Dir(ex)
|
||
// If running via "go run", executable is in temp dir - fall through
|
||
if !strings.Contains(execDir, "/tmp/go-build") {
|
||
for _, rel := range []string{"dist", "../dist", "../../dist"} {
|
||
p := filepath.Join(execDir, rel)
|
||
if _, err := os.Stat(filepath.Join(p, "index.html")); err == nil {
|
||
return p
|
||
}
|
||
}
|
||
}
|
||
}
|
||
// Try working directory relative paths
|
||
for _, p := range []string{"./dist", "../dist", "/app/dist"} {
|
||
if abs, err := filepath.Abs(p); err == nil {
|
||
if _, err := os.Stat(filepath.Join(abs, "index.html")); err == nil {
|
||
return abs
|
||
}
|
||
}
|
||
}
|
||
return ""
|
||
}
|