vps-action

VPS Control Room — Action Pipeline Pattern

Gunakan skill ini saat menambahkan action baru ke pipeline executor.

Menambah Action Baru — 4 Langkah

1. Daftarkan di Allowlist

// agent/src/executor/allowlist.ts

export interface ActionDefinition {
  command_template: string;      // {target_id} dan {payload.*} akan di-replace
  target_type: "container" | "service" | "agent" | "dokploy-app" | "fail2ban";
  sensitive: boolean;            // true = butuh confirm dialog di frontend
  timeout_ms: number;
  validate_payload?: (payload: any) => boolean;
}

export const ALLOWLIST: Record<string, ActionDefinition> = {
  "container.restart": {
    command_template: "docker container restart {target_id}",
    target_type: "container",
    sensitive: false,
    timeout_ms: 30000,
  },
  "container.stop": {
    command_template: "docker container stop {target_id}",
    target_type: "container",
    sensitive: true,     // <-- sensitive, butuh konfirmasi
    timeout_ms: 30000,
  },
  "container.logs": {
    command_template: "docker logs --tail {payload.lines} {target_id}",
    target_type: "container",
    sensitive: false,
    timeout_ms: 10000,
    validate_payload: (p) => typeof p?.lines === "number" && p.lines > 0 && p.lines <= 500,
  },
  "service.restart": {
    command_template: "sudo systemctl restart {target_id}",
    target_type: "service",
    sensitive: true,
    timeout_ms: 30000,
  },
  "fail2ban.unban": {
    command_template: "sudo fail2ban-client set sshd unbanip {target_id}",
    target_type: "fail2ban",
    sensitive: true,
    timeout_ms: 10000,
    validate_payload: (p) => true, // target_id divalidasi sebagai IP di validator
  },
  // Dokploy redeploy = HTTP call, bukan shell command
  "dokploy.redeploy": {
    command_template: "__HTTP__", // marker bahwa ini bukan shell command
    target_type: "dokploy-app",
    sensitive: true,
    timeout_ms: 60000,
  },
};

2. Tambah Validator

// agent/src/executor/validators.ts

import { ALLOWLIST } from "./allowlist";

interface ValidationResult {
  valid: boolean;
  reason?: string;
}

// knownTargets di-maintain dari collector results
export function validateCommand(
  action: string,
  targetType: string,
  targetId: string,
  payload: any,
  knownTargets: Map<string, Set<string>> // target_type → Set<target_id>
): ValidationResult {
  // 1. Action ada di allowlist?
  const def = ALLOWLIST[action];
  if (!def) return { valid: false, reason: `unknown action: ${action}` };

  // 2. Target type cocok?
  if (def.target_type !== targetType) {
    return { valid: false, reason: `action ${action} expects target_type ${def.target_type}, got ${targetType}` };
  }

  // 3. Target ID dikenali? (dari collector)
  const targets = knownTargets.get(targetType);
  if (!targets?.has(targetId)) {
    return { valid: false, reason: `unknown target: ${targetType}/${targetId}` };
  }

  // 4. Validasi IP format untuk fail2ban
  if (targetType === "fail2ban") {
    const ipRegex = /^(\d{1,3}\.){3}\d{1,3}$/;
    if (!ipRegex.test(targetId)) {
      return { valid: false, reason: `invalid IP format: ${targetId}` };
    }
  }

  // 5. Payload valid?
  if (def.validate_payload && !def.validate_payload(payload)) {
    return { valid: false, reason: `invalid payload for action ${action}` };
  }

  return { valid: true };
}