Nail/IoT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: монолит iot-service (Фаза 1) — config/store/api/bridge/consumer без k8s, устройства в PG, новые Dockerfile/Makefile

Browse Source
This commit is contained in:
“Naeel”
2026-08-16 10:07:51 +04:00
parent f0c36a11ee
commit 9d08473d5f
27 changed files with 3716 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/service/api/handler/admin.go
+58
View File
@@ -0,0 +1,58 @@
// admin.go — статистика для страницы администратора.
//
// Endpoint: GET /iot-admin/stats (Bearer ADMIN_STATS_TOKEN).
// Источники: PostgreSQL (iotpg), shared-SQS (атрибуты очереди), рантайм процесса.
// k8s-статусы подов убраны — компоненты теперь в одном процессе.
package handler
import (
"context"
"net/http"
"strings"
"time"
)
// AdminStats — GET /iot-admin/stats.
func (h *Handler) AdminStats(w http.ResponseWriter, r *http.Request) {
if h.Cfg.AdminStatsToken == "" {
writeJSON(w, http.StatusServiceUnavailable, errResp("admin stats not configured: ADMIN_STATS_TOKEN not set"))
return
}
authHeader := r.Header.Get("Authorization")
if !strings.HasPrefix(authHeader, "Bearer ") || strings.TrimPrefix(authHeader, "Bearer ") != h.Cfg.AdminStatsToken {
writeJSON(w, http.StatusUnauthorized, errResp("unauthorized"))
return
}
ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
defer cancel()
result := map[string]any{
"collected_at": time.Now().UTC(),
}
// PostgreSQL: статистика по всем tenant (как в старом коде).
if h.IoTPG != nil {
pgStats, err := h.IoTPG.GetAdminStats(ctx)
if err != nil {
result["postgres"] = map[string]any{"reachable": false, "error": err.Error()}
} else {
result["postgres"] = pgStats
}
} else {
result["postgres"] = map[string]any{"reachable": false, "error": "IoTPG not configured"}
}
// SQS: approximate counts очереди телеметрии.
result["sqs"] = h.collectSQSStats(ctx)
// Рантайм процесса (вместо статусов k8s-подов).
result["runtime"] = map[string]any{
"version": h.Version,
"uptime_sec": int64(time.Since(h.StartedAt).Seconds()),
"started_at": h.StartedAt.UTC().Format(time.RFC3339),
}
writeJSON(w, http.StatusOK, result)
}
internal/service/api/handler/devices.go
+244
View File
@@ -0,0 +1,244 @@
// devices.go — CRUD устройств на PostgreSQL.
//
// Endpoints:
//
// POST /v1/namespaces/{ns}/iot/devices — создать
// GET /v1/namespaces/{ns}/iot/devices — список (без паролей)
// GET /v1/namespaces/{ns}/iot/devices/{name} — одно (с паролем)
// DELETE /v1/namespaces/{ns}/iot/devices/{name} — удалить
// PATCH /v1/namespaces/{ns}/iot/devices/{name} — enabled
package handler
import (
"crypto/rand"
"encoding/hex"
"encoding/json"
"errors"
"net/http"
"time"
"gitea.services.ngcloud.ru/Nail/IoT/internal/service/store"
)
// iotDeviceCreateRequest — тело POST.
type iotDeviceCreateRequest struct {
Name string `json:"name"`
DeviceID string `json:"device_id"`
Enabled *bool `json:"enabled"`
Metadata map[string]string `json:"metadata,omitempty"`
}
// iotDeviceUpdateRequest — тело PATCH.
type iotDeviceUpdateRequest struct {
Enabled *bool `json:"enabled"`
}
// iotDeviceResponse — ответ API. MQTTPassword — только в GET по имени.
type iotDeviceResponse struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
DeviceID string `json:"device_id"`
Enabled bool `json:"enabled"`
Phase string `json:"phase"`
MQTTUsername string `json:"mqtt_username,omitempty"`
MQTTPassword string `json:"mqtt_password,omitempty"`
TopicPrefix string `json:"topic_prefix,omitempty"`
LastConnected string `json:"last_connected,omitempty"`
Metadata map[string]string `json:"metadata,omitempty"`
CreatedAt string `json:"created_at,omitempty"`
}
// deviceToResponse конвертирует устройство из БД в ответ API.
// password отдаётся только если непустая (передаётся явно из Get).
func deviceToResponse(d *store.Device, password string) iotDeviceResponse {
resp := iotDeviceResponse{
Name: d.Name,
Namespace: d.Namespace,
DeviceID: d.DeviceID,
Enabled: d.Enabled,
Phase: d.Phase,
MQTTUsername: d.Namespace + "_" + d.DeviceID,
MQTTPassword: password,
TopicPrefix: d.Namespace + "/",
Metadata: d.Metadata,
}
if d.LastConnected != nil && !d.LastConnected.IsZero() {
resp.LastConnected = d.LastConnected.UTC().Format(time.RFC3339)
}
if !d.CreatedAt.IsZero() {
resp.CreatedAt = d.CreatedAt.UTC().Format("2006-01-02 15:04:05 UTC")
}
return resp
}
// generateMQTTPassword — 32 случайных байта в hex (как старый контроллер).
func generateMQTTPassword() (string, error) {
buf := make([]byte, 32)
if _, err := rand.Read(buf); err != nil {
return "", err
}
return hex.EncodeToString(buf), nil
}
// CreateIoTDevice — POST /v1/namespaces/{ns}/iot/devices.
func (h *Handler) CreateIoTDevice(w http.ResponseWriter, r *http.Request) {
ns := pathVar(r, "namespace")
if ns == "" {
ns = "default"
}
var req iotDeviceCreateRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
writeJSON(w, http.StatusBadRequest, errResp("invalid JSON: "+err.Error()))
return
}
if req.Name == "" {
writeJSON(w, http.StatusBadRequest, errResp("name is required"))
return
}
if req.DeviceID == "" {
writeJSON(w, http.StatusBadRequest, errResp("device_id is required"))
return
}
enabled := true
if req.Enabled != nil {
enabled = *req.Enabled
}
password, err := generateMQTTPassword()
if err != nil {
h.Log.Error("generate device password", "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to generate credentials"))
return
}
phase := "Active"
if !enabled {
phase = "Disabled"
}
device := &store.Device{
Namespace: ns,
Name: req.Name,
DeviceID: req.DeviceID,
Enabled: enabled,
MQTTPassword: password,
Metadata: req.Metadata,
Phase: phase,
}
if err := h.Devices.Create(r.Context(), device); err != nil {
if errors.Is(err, store.ErrAlreadyExists) {
writeJSON(w, http.StatusConflict, errResp("iot device already exists"))
return
}
h.Log.Error("create device", "namespace", ns, "name", req.Name, "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to create device"))
return
}
writeJSON(w, http.StatusCreated, deviceToResponse(device, ""))
}
// ListIoTDevices — GET /v1/namespaces/{ns}/iot/devices (без паролей).
func (h *Handler) ListIoTDevices(w http.ResponseWriter, r *http.Request) {
ns := pathVar(r, "namespace")
if ns == "" {
ns = "default"
}
devices, err := h.Devices.List(r.Context(), ns)
if err != nil {
h.Log.Error("list devices", "namespace", ns, "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to list devices"))
return
}
result := make([]iotDeviceResponse, 0, len(devices))
for i := range devices {
result = append(result, deviceToResponse(&devices[i], ""))
}
writeJSON(w, http.StatusOK, result)
}
// GetIoTDevice — GET /v1/namespaces/{ns}/iot/devices/{name} (с паролем).
func (h *Handler) GetIoTDevice(w http.ResponseWriter, r *http.Request) {
ns := pathVar(r, "namespace")
if ns == "" {
ns = "default"
}
name := pathVar(r, "name")
device, err := h.Devices.GetByName(r.Context(), ns, name)
if err != nil {
if errors.Is(err, store.ErrNotFound) {
writeJSON(w, http.StatusNotFound, errResp("iot device not found"))
return
}
h.Log.Error("get device", "namespace", ns, "name", name, "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to get device"))
return
}
writeJSON(w, http.StatusOK, deviceToResponse(device, device.MQTTPassword))
}
// DeleteIoTDevice — DELETE /v1/namespaces/{ns}/iot/devices/{name}.
func (h *Handler) DeleteIoTDevice(w http.ResponseWriter, r *http.Request) {
ns := pathVar(r, "namespace")
if ns == "" {
ns = "default"
}
name := pathVar(r, "name")
err := h.Devices.Delete(r.Context(), ns, name)
if err != nil {
if errors.Is(err, store.ErrNotFound) {
writeJSON(w, http.StatusNotFound, errResp("iot device not found"))
return
}
h.Log.Error("delete device", "namespace", ns, "name", name, "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to delete device"))
return
}
w.WriteHeader(http.StatusNoContent)
}
// UpdateIoTDevice — PATCH /v1/namespaces/{ns}/iot/devices/{name} (enabled).
func (h *Handler) UpdateIoTDevice(w http.ResponseWriter, r *http.Request) {
ns := pathVar(r, "namespace")
if ns == "" {
ns = "default"
}
name := pathVar(r, "name")
var req iotDeviceUpdateRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
writeJSON(w, http.StatusBadRequest, errResp("invalid JSON: "+err.Error()))
return
}
if req.Enabled == nil {
writeJSON(w, http.StatusBadRequest, errResp("enabled field is required"))
return
}
err := h.Devices.UpdateEnabled(r.Context(), ns, name, *req.Enabled)
if err != nil {
if errors.Is(err, store.ErrNotFound) {
writeJSON(w, http.StatusNotFound, errResp("iot device not found"))
return
}
h.Log.Error("update device", "namespace", ns, "name", name, "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to update device"))
return
}
device, err := h.Devices.GetByName(r.Context(), ns, name)
if err != nil {
writeJSON(w, http.StatusInternalServerError, errResp("failed to reload device"))
return
}
writeJSON(w, http.StatusOK, deviceToResponse(device, ""))
}
internal/service/api/handler/handler.go
+49
View File
@@ -0,0 +1,49 @@
// Package handler — HTTP-обработчики IoT REST API (новый монолит).
//
// Отличие от старого кода: устройства — в PostgreSQL (таблица iot_devices),
// без k8s-клиента и CRD. Телеметрия — через iotpg, как раньше.
package handler
import (
"encoding/json"
"log/slog"
"net/http"
"time"
"github.com/aws/aws-sdk-go-v2/service/sqs"
"github.com/gorilla/mux"
"gitea.services.ngcloud.ru/Nail/IoT/internal/service/config"
"gitea.services.ngcloud.ru/Nail/IoT/internal/service/store"
"gitea.services.ngcloud.ru/Nail/IoT/internal/storage/iotpg"
)
// Handler — зависимости всех HTTP-обработчиков.
type Handler struct {
Devices *store.DeviceStore
IoTPG *iotpg.IoTPostgresStore
SQS *sqs.Client
Cfg *config.Config
Log *slog.Logger
// Version — версия бинарника (ldflags), StartedAt — для админ-статистики.
Version string
StartedAt time.Time
}
// writeJSON отправляет JSON-ответ с указанным статусом.
func writeJSON(w http.ResponseWriter, status int, v any) {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(status)
_ = json.NewEncoder(w).Encode(v)
}
// errResp возвращает структуру ошибки для JSON.
func errResp(msg string) map[string]string {
return map[string]string{"error": msg}
}
// pathVar читает переменную пути из gorilla/mux.
func pathVar(r *http.Request, key string) string {
return mux.Vars(r)[key]
}
internal/service/api/handler/mqtt_auth.go
+167
View File
@@ -0,0 +1,167 @@
// mqtt_auth.go — HTTP-auth и ACL для EMQX (MQTT CONNECT / pub-sub).
//
// Endpoints (без JWT, вызываются EMQX внутри платформы):
//
// POST /internal/mqtt/auth — аутентификация: всегда HTTP 200, {"result":"allow"|"deny"}
// POST /internal/mqtt/acl — авторизация pub/sub
//
// Источник устройств — таблица iot_devices (не k8s Secrets).
package handler
import (
"crypto/subtle"
"encoding/json"
"errors"
"net/http"
"strings"
"gitea.services.ngcloud.ru/Nail/IoT/internal/service/store"
)
// mqttAuthRequest — тело запроса от EMQX 5.x (username, password, clientid, peerhost).
type mqttAuthRequest struct {
Username string `json:"username"`
Password string `json:"password"`
ClientID string `json:"clientid"`
PeerHost string `json:"peerhost"`
}
// mqttAuthResponse — ответ для EMQX (всегда HTTP 200).
type mqttAuthResponse struct {
Result string `json:"result"`
ACL []aclRule `json:"acl,omitempty"`
}
// aclRule — правило ACL для EMQX HTTP auth.
type aclRule struct {
Permission string `json:"permission"`
Action string `json:"action"`
Topic string `json:"topic"`
}
// mqttAclRequest — тело запроса ACL от EMQX.
type mqttAclRequest struct {
Username string `json:"username"`
ClientID string `json:"clientid"`
Action string `json:"action"`
Topic string `json:"topic"`
}
// MQTTAuth — POST /internal/mqtt/auth.
//
// Логика:
// 1. bridge-креды (MQTT_USERNAME/MQTT_PASSWORD из env) — проверяются до парсинга;
// 2. username "{ns}_{deviceId}" → поиск устройства в iot_devices;
// 3. constant-time сравнение пароля; проверка enabled;
// 4. best-effort last_connected; ACL по топику устройства.
func (h *Handler) MQTTAuth(w http.ResponseWriter, r *http.Request) {
var req mqttAuthRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
// Внутренний bridge-клиент: фиксированные креды, ACL выдаётся ниже.
if h.Cfg.MQTTUsername != "" && req.Username == h.Cfg.MQTTUsername {
if subtle.ConstantTimeCompare([]byte(h.Cfg.MQTTPassword), []byte(req.Password)) == 1 {
writeJSON(w, http.StatusOK, mqttAuthResponse{
Result: "allow",
ACL: bridgeACLRules(),
})
return
}
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
// Парсим username: "{namespace}_{deviceId}" (первый '_' — разделитель).
idx := strings.Index(req.Username, "_")
if idx <= 0 || idx == len(req.Username)-1 {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
ns := req.Username[:idx]
deviceID := req.Username[idx+1:]
device, err := h.Devices.GetByDeviceID(r.Context(), ns, deviceID)
if err != nil {
if !errors.Is(err, store.ErrNotFound) {
h.Log.Error("mqtt auth: device lookup", "namespace", ns, "device", deviceID, "err", err)
}
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
if !device.Enabled {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
if subtle.ConstantTimeCompare([]byte(device.MQTTPassword), []byte(req.Password)) != 1 {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
// best-effort: обновляем время последнего подключения
h.Devices.TouchLastConnected(r.Context(), ns, deviceID)
writeJSON(w, http.StatusOK, mqttAuthResponse{
Result: "allow",
ACL: deviceACLRules(ns, deviceID),
})
}
// MQTTAcl — POST /internal/mqtt/acl.
//
// Bridge (clientID из env MQTT_CLIENT_ID): только subscribe.
// Устройство ({ns}_{deviceId}): pub/sub в своём топике.
func (h *Handler) MQTTAcl(w http.ResponseWriter, r *http.Request) {
var req mqttAclRequest
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
if req.ClientID == h.Cfg.MQTTClientID {
if req.Action == "subscribe" {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "allow"})
return
}
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
idx := strings.Index(req.Username, "_")
if idx <= 0 || idx == len(req.Username)-1 {
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
return
}
ns := req.Username[:idx]
deviceID := req.Username[idx+1:]
deviceTopic := ns + "/telemetry/" + deviceID
switch {
case req.Action == "publish" && req.Topic == deviceTopic:
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "allow"})
case req.Action == "subscribe" && (req.Topic == deviceTopic || req.Topic == "#"):
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "allow"})
default:
writeJSON(w, http.StatusOK, mqttAuthResponse{Result: "deny"})
}
}
// bridgeACLRules — ACL для внутреннего bridge: subscribe на все telemetry-топики.
func bridgeACLRules() []aclRule {
return []aclRule{
{Permission: "allow", Action: "subscribe", Topic: "+/telemetry/+"},
{Permission: "deny", Action: "all", Topic: "#"},
}
}
// deviceACLRules — ACL для устройства: только свой топик телеметрии.
func deviceACLRules(ns, deviceID string) []aclRule {
topic := ns + "/telemetry/" + deviceID
return []aclRule{
{Permission: "allow", Action: "publish", Topic: topic},
{Permission: "allow", Action: "subscribe", Topic: topic},
{Permission: "deny", Action: "all", Topic: "#"},
}
}
internal/service/api/handler/sqsstats.go
+52
View File
@@ -0,0 +1,52 @@
// sqsstats.go — сбор статистики очереди shared-SQS для админ-страницы.
package handler
import (
"context"
"fmt"
"strconv"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/sqs"
sqstypes "github.com/aws/aws-sdk-go-v2/service/sqs/types"
)
// iotAdminSQSStats — информация об очереди для мониторинга.
type iotAdminSQSStats struct {
ApproximateMessages int64 `json:"approximate_messages"`
ApproximateMessagesNotVisible int64 `json:"approximate_messages_not_visible"`
Error string `json:"error,omitempty"`
}
// collectSQSStats получает ApproximateNumberOfMessages из очереди телеметрии.
func (h *Handler) collectSQSStats(ctx context.Context) iotAdminSQSStats {
if h.SQS == nil {
return iotAdminSQSStats{Error: "SQS client not configured"}
}
queueUrlOut, err := h.SQS.GetQueueUrl(ctx, &sqs.GetQueueUrlInput{
QueueName: aws.String(h.Cfg.SQSQueueName),
})
if err != nil {
return iotAdminSQSStats{Error: fmt.Sprintf("GetQueueUrl: %v", err)}
}
attrsOut, err := h.SQS.GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
QueueUrl: queueUrlOut.QueueUrl,
AttributeNames: []sqstypes.QueueAttributeName{
sqstypes.QueueAttributeNameApproximateNumberOfMessages,
sqstypes.QueueAttributeNameApproximateNumberOfMessagesNotVisible,
},
})
if err != nil {
return iotAdminSQSStats{Error: fmt.Sprintf("GetQueueAttributes: %v", err)}
}
approxMsg, _ := strconv.ParseInt(attrsOut.Attributes["ApproximateNumberOfMessages"], 10, 64)
approxNotVisible, _ := strconv.ParseInt(attrsOut.Attributes["ApproximateNumberOfMessagesNotVisible"], 10, 64)
return iotAdminSQSStats{
ApproximateMessages: approxMsg,
ApproximateMessagesNotVisible: approxNotVisible,
}
}
internal/service/api/handler/telemetry.go
+43
View File
@@ -0,0 +1,43 @@
// telemetry.go — REST-чтение телеметрии из per-tenant PostgreSQL.
//
// Endpoint: GET /v1/namespaces/{ns}/iot/telemetry?device_id={id}&limit={n}
package handler
import (
"net/http"
"strconv"
"gitea.services.ngcloud.ru/Nail/IoT/internal/storage/iotpg"
)
// ListIoTTelemetry — GET /v1/namespaces/{ns}/iot/telemetry.
func (h *Handler) ListIoTTelemetry(w http.ResponseWriter, r *http.Request) {
if h.IoTPG == nil {
writeJSON(w, http.StatusServiceUnavailable, errResp("IoT telemetry storage not configured"))
return
}
ns := pathVar(r, "namespace")
deviceID := r.URL.Query().Get("device_id")
limit := 50
if ls := r.URL.Query().Get("limit"); ls != "" {
if n, err := strconv.Atoi(ls); err == nil && n > 0 {
limit = n
}
}
rows, err := h.IoTPG.QueryTelemetry(r.Context(), ns, deviceID, limit)
if err != nil {
h.Log.Error("query IoT telemetry", "namespace", ns, "device", deviceID, "err", err)
writeJSON(w, http.StatusInternalServerError, errResp("failed to query telemetry"))
return
}
if rows == nil {
rows = []iotpg.TelemetryRow{}
}
writeJSON(w, http.StatusOK, map[string]any{
"items": rows,
"count": len(rows),
})
}