anti
5dad1bb315
Agents already exposed POST /teardown; the master was missing the plumbing
to reach it. Add:
- POST /api/v1/swarm/hosts/{uuid}/teardown — admin-gated. Body
{decky_id: str|null}: null tears the whole host, a value tears one decky.
On worker failure the master returns 502 and leaves DB shards intact so
master and agent stay aligned.
- BaseRepository.delete_decky_shard(name) + sqlmodel impl for per-decky
cleanup after a single-decky teardown.
- SwarmHosts page: "Teardown all" button (keeps host enrolled).
- SwarmDeckies page: per-row "Teardown" button.
Also exclude setuptools' build/ staging dir from the enrollment tarball —
`pip install -e` on the master generates build/lib/decnet_web/node_modules
and the bundle walker was leaking it to agents. Align pyproject's bandit
exclude with the git-hook invocation so both skip decnet/templates/.
120 lines
3.2 KiB
TOML
120 lines
3.2 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=68", "wheel"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "decnet"
|
|
version = "0.2.0"
|
|
description = "Deception network: deploy honeypot deckies that appear as real LAN hosts"
|
|
requires-python = ">=3.11"
|
|
dependencies = [
|
|
"typer[all]>=0.12",
|
|
"pydantic>=2.0",
|
|
"docker>=7.0",
|
|
"pyyaml>=6.0",
|
|
"jinja2>=3.1",
|
|
"fastapi>=0.110.0",
|
|
"uvicorn>=0.29.0",
|
|
"aiosqlite>=0.20.0",
|
|
"asyncmy>=0.2.11",
|
|
"PyJWT>=2.8.0",
|
|
"bcrypt>=4.1.0",
|
|
"psutil>=5.9.0",
|
|
"python-dotenv>=1.0.0",
|
|
"sqlmodel>=0.0.16",
|
|
"scapy>=2.6.1",
|
|
"orjson>=3.10",
|
|
"cryptography>=46.0.7",
|
|
"python-multipart>=0.0.20",
|
|
"httpx>=0.28.1",
|
|
"requests>=2.33.1"
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
tracing = [
|
|
"opentelemetry-api>=1.20.0",
|
|
"opentelemetry-sdk>=1.20.0",
|
|
"opentelemetry-exporter-otlp>=1.20.0",
|
|
"opentelemetry-instrumentation-fastapi>=0.41b0",
|
|
]
|
|
profile = [
|
|
"py-spy>=0.4.1",
|
|
"pyinstrument>=4.7",
|
|
"pytest-benchmark>=4.0",
|
|
"memray>=1.14 ; sys_platform == 'linux'",
|
|
"snakeviz>=2.2",
|
|
]
|
|
dev = [
|
|
"decnet[tracing,profile]",
|
|
"pytest>=9.0.3",
|
|
"ruff>=0.15.10",
|
|
"bandit>=1.9.4",
|
|
"pip>=26.0",
|
|
"pip-audit>=2.10.0",
|
|
"httpx>=0.28.1",
|
|
"hypothesis>=6.151.14",
|
|
"pytest-cov>=7.1.0",
|
|
"pytest-asyncio>=1.3.0",
|
|
"freezegun>=1.5.5",
|
|
"schemathesis>=4.15.1",
|
|
"pytest-xdist>=3.8.0",
|
|
"flask>=3.1.3",
|
|
"twisted>=25.5.0",
|
|
"requests>=2.33.1",
|
|
"redis>=7.4.0",
|
|
"pymysql>=1.1.2",
|
|
"psycopg2-binary>=2.9.11",
|
|
"paho-mqtt>=2.1.0",
|
|
"pymongo>=4.16.0",
|
|
"locust>=2.29",
|
|
"gevent>=24.0",
|
|
]
|
|
|
|
[project.scripts]
|
|
decnet = "decnet.cli:app"
|
|
|
|
[tool.pytest.ini_options]
|
|
asyncio_mode = "auto"
|
|
asyncio_debug = "true"
|
|
addopts = "-m 'not fuzz and not live and not stress and not bench and not docker' -v -q -x -n logical --dist loadscope"
|
|
markers = [
|
|
"fuzz: hypothesis-based fuzz tests (slow, run with -m fuzz or -m '' for all)",
|
|
"live: live subprocess service tests (run with -m live)",
|
|
"live_docker: live Docker container tests (requires DECNET_LIVE_DOCKER=1)",
|
|
"stress: locust-based stress tests (run with -m stress)",
|
|
"bench: pytest-benchmark micro-benchmarks (run with -m bench)",
|
|
"docker: tests that build and run docker images (run with -m docker)",
|
|
]
|
|
filterwarnings = [
|
|
"ignore::pytest.PytestUnhandledThreadExceptionWarning",
|
|
"ignore::DeprecationWarning",
|
|
"ignore::RuntimeWarning",
|
|
]
|
|
|
|
[tool.coverage.run]
|
|
source = ["decnet"]
|
|
omit = ["*/tests/*", "*/templates/*"]
|
|
parallel = true
|
|
|
|
[tool.coverage.report]
|
|
show_missing = true
|
|
skip_covered = false
|
|
# Run with: pytest --cov --cov-report=term-missing
|
|
|
|
[tool.setuptools.packages.find]
|
|
where = ["."]
|
|
include = ["decnet*"]
|
|
|
|
[tool.setuptools.package-data]
|
|
# Ship docker build contexts + syslog_bridge.py as package data so they land
|
|
# in site-packages when agents install the bundle via `pip install`.
|
|
decnet = ["templates/**/*"]
|
|
|
|
[tool.bandit]
|
|
# Docker build contexts — code runs inside decoy containers, not in the
|
|
# master/agent process. Skipping keeps honeypot service scripts (hashlib.md5
|
|
# for JA3, /tmp/build in Dockerfile helpers, etc.) out of the scan.
|
|
exclude_dirs = [
|
|
"decnet/templates",
|
|
]
|