feat(dashboard): fixes #50 - git ops

Author: RustyRory

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [0.5.0] — 2026-05-19
+
+### Phase 5 — GitOps Dashboard
+
+#### Added
+
+- `app/api/services/git.js` : service GitOps — `listEditableFiles()` (scan `nginx/sites-enabled/` + `apps/*/docker-compose.yml`), `getFileContent(path)`, `writeAndCommit(path, content)` (écrit + `git add` + `git commit` + `git push`) — utilise `execFile` (pas de shell) + validation path traversal
+- `app/api/services/nginx.js` : `testConfig()` (`sudo nginx -t`, retourne `{ ok, output }`) et `reload()` (`sudo systemctl reload nginx`) — capture stdout + stderr car nginx -t écrit sur stderr même en succès
+- `app/api/services/deploy.js` : `listApps()`, `getAppStatus(name)`, `cloneApp(name, url)`, `updateApp(name)` — détection déployée/running via `docker compose ps --quiet`, `execFile` avec `cwd` pour éviter `-f`, whitelist `[a-zA-Z0-9_-]` sur les noms d'app
+- Routes `/api/config/*` dans `server.js` (protégées `requireAuth`) : `GET /api/config/files`, `GET /api/config/file?path=`, `POST /api/config/file`, `POST /api/config/nginx/reload` (teste avant de recharger, 422 si config invalide)
+- Routes `/api/deploy/*` dans `server.js` (protégées `requireAuth`) : `GET /api/deploy/apps`, `GET /api/deploy/status/:app`, `POST /api/deploy/clone`, `POST /api/deploy/update`
+- Onglet "Configs" dans le dashboard : liste des fichiers éditables, clic → modale textarea pré-remplie, bouton "Sauvegarder" (commit + push automatique), bouton "Recharger Nginx" visible uniquement sur les fichiers `nginx/…`
+- Onglet "Déploiement" dans le dashboard : cards avec badge `running` / `stopped` / `absent`, bouton "Mettre à jour" sur les apps déployées, formulaire "Déployer une nouvelle app" (nom + URL git)
+- Navigation par onglets (Monitoring / Configs / Déploiement) avec chargement lazy des données à l'ouverture de chaque onglet
+
+#### Changed
+
+- `vps-monitor-app/` renommé en `app/` — mise à jour du `docker-compose.yml` et du workflow de déploiement en conséquence
+- Variable d'environnement `VPSCONFIG_PATH` ajoutée (chemin racine du repo sur le VPS, défaut `/var/www/vps-monitor`) — utilisée par `git.js` et `deploy.js`
+- `staging.yml` : chemin de déploiement SSH corrigé (`/var/www/VPS-monitor` → `/var/www/vps-monitor`)
+
+#### Infrastructure (hors code)
+
+- Fusion `vps-config` → `VPS-monitor` : `nginx/sites-enabled/` et `apps/*/docker-compose.yml` désormais versionnés dans ce repo
+- GitHub PAT configuré via `GITHUB_TOKEN` dans `.env` et encodé dans le remote URL pour les push automatiques depuis le VPS
+- Règle `sudoers` ajoutée pour `nginx -t` et `systemctl reload nginx` sans mot de passe
+
+---
+
 ## [0.4.2] — 2026-05-19
 
 ### Phase 4 — Logs en temps réel via WebSocket

vps-monitor-app/.dockerignore app/.dockerignorevps-monitor-app/.dockerignore renamed to app/.dockerignore

@@ -7,6 +7,9 @@ import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { getContainers, restartContainer, stopContainer, startContainer, streamContainerLogs } from './services/docker.js';
 import { checkWebsites } from './services/http.js';
+import { listEditableFiles, getFileContent, writeAndCommit } from './services/git.js';
+import { testConfig, reload as reloadNginx } from './services/nginx.js';
+import { listApps, cloneApp, updateApp, getAppStatus } from './services/deploy.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -117,6 +120,89 @@ app.post('/api/container/start', requireAuth, async (req, res) => {
   }
 });
 
+// --- API Config (protégée) ---
+
+app.get('/api/config/files', requireAuth, async (_req, res) => {
+  try {
+    res.json(await listEditableFiles());
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+app.get('/api/config/file', requireAuth, async (req, res) => {
+  const { path } = req.query;
+  if (!path) return res.status(400).json({ error: 'path requis' });
+  try {
+    res.json({ content: await getFileContent(path) });
+  } catch (err) {
+    res.status(err.message === 'Chemin non autorisé' ? 403 : 500).json({ error: err.message });
+  }
+});
+
+app.post('/api/config/file', requireAuth, async (req, res) => {
+  const { path, content } = req.body;
+  if (!path || content === undefined) return res.status(400).json({ error: 'path et content requis' });
+  try {
+    await writeAndCommit(path, content);
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(err.message === 'Chemin non autorisé' ? 403 : 500).json({ error: err.message });
+  }
+});
+
+app.post('/api/config/nginx/reload', requireAuth, async (_req, res) => {
+  try {
+    const test = await testConfig();
+    if (!test.ok) return res.status(422).json({ ok: false, output: test.output });
+    await reloadNginx();
+    res.json({ ok: true, output: test.output });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// --- API Deploy (protégée) ---
+
+app.get('/api/deploy/apps', requireAuth, async (_req, res) => {
+  try {
+    res.json(await listApps());
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+app.get('/api/deploy/status/:app', requireAuth, async (req, res) => {
+  try {
+    res.json(await getAppStatus(req.params.app));
+  } catch (err) {
+    res.status(err.message === 'Nom d\'app invalide' ? 400 : 500).json({ error: err.message });
+  }
+});
+
+app.post('/api/deploy/clone', requireAuth, async (req, res) => {
+  const { name, url } = req.body;
+  if (!name || !url) return res.status(400).json({ error: 'name et url requis' });
+  try {
+    await cloneApp(name, url);
+    res.json({ ok: true });
+  } catch (err) {
+    const status = ['Nom d\'app invalide', 'URL invalide'].includes(err.message) ? 400 : 500;
+    res.status(status).json({ error: err.message });
+  }
+});
+
+app.post('/api/deploy/update', requireAuth, async (req, res) => {
+  const { name } = req.body;
+  if (!name) return res.status(400).json({ error: 'name requis' });
+  try {
+    await updateApp(name);
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(err.message === 'Nom d\'app invalide' ? 400 : 500).json({ error: err.message });
+  }
+});
+
 // --- WebSocket : logs en temps réel ---
 
 const wsTokens = new Map();

vps-monitor-app/.gitignore app/.gitignorevps-monitor-app/.gitignore renamed to app/.gitignore

@@ -0,0 +1,60 @@
+import { readdir, access } from 'fs/promises';
+import { join } from 'path';
+import { execFile as execFileCb } from 'child_process';
+import { promisify } from 'util';
+
+const execFile = promisify(execFileCb);
+
+const REPO_ROOT = process.env.VPSCONFIG_PATH || '/var/www/vps-monitor';
+const APPS_ROOT = '/var/www';
+
+function safeName(name) {
+  if (!/^[a-zA-Z0-9_-]+$/.test(name)) throw new Error('Nom d\'app invalide');
+  return name;
+}
+
+function compose(appPath, ...args) {
+  return execFile('docker', ['compose', ...args], { cwd: appPath });
+}
+
+export async function getAppStatus(name) {
+  safeName(name);
+  const appPath = join(APPS_ROOT, name);
+
+  try {
+    await access(appPath);
+  } catch {
+    return { name, deployed: false, running: false };
+  }
+
+  try {
+    const { stdout } = await compose(appPath, 'ps', '--quiet');
+    return { name, deployed: true, running: stdout.trim().length > 0 };
+  } catch {
+    return { name, deployed: true, running: false };
+  }
+}
+
+export async function listApps() {
+  try {
+    const entries = await readdir(join(REPO_ROOT, 'apps'));
+    return Promise.all(entries.map(getAppStatus));
+  } catch {
+    return [];
+  }
+}
+
+export async function cloneApp(name, url) {
+  safeName(name);
+  if (!/^https?:\/\//.test(url)) throw new Error('URL invalide');
+  const appPath = join(APPS_ROOT, name);
+  await execFile('git', ['clone', url, appPath]);
+  await compose(appPath, 'up', '-d');
+}
+
+export async function updateApp(name) {
+  safeName(name);
+  const appPath = join(APPS_ROOT, name);
+  await execFile('git', ['-C', appPath, 'pull']);
+  await compose(appPath, 'up', '-d', '--build');
+}

vps-monitor-app/Dockerfile app/Dockerfilevps-monitor-app/Dockerfile renamed to app/Dockerfile

@@ -0,0 +1,61 @@
+import { readFile, writeFile, readdir } from 'fs/promises';
+import { join, normalize } from 'path';
+import { execFile as execFileCb } from 'child_process';
+import { promisify } from 'util';
+
+const execFile = promisify(execFileCb);
+
+const REPO_ROOT = process.env.VPSCONFIG_PATH || '/var/www/vps-monitor';
+
+function safePath(relativePath) {
+  const abs = normalize(join(REPO_ROOT, relativePath));
+  if (!abs.startsWith(REPO_ROOT + '/')) {
+    throw new Error('Chemin non autorisé');
+  }
+  return abs;
+}
+
+function git(...args) {
+  return execFile('git', ['-C', REPO_ROOT, ...args]);
+}
+
+export async function getFileContent(relativePath) {
+  return readFile(safePath(relativePath), 'utf8');
+}
+
+export async function writeAndCommit(relativePath, content) {
+  await writeFile(safePath(relativePath), content, 'utf8');
+  await git('add', relativePath);
+  await git('commit', '-m', `chore(config): update ${relativePath}`);
+  await git('push');
+}
+
+export async function listEditableFiles() {
+  const files = [];
+
+  try {
+    const entries = await readdir(join(REPO_ROOT, 'nginx', 'sites-enabled'));
+    for (const entry of entries) {
+      files.push(`nginx/sites-enabled/${entry}`);
+    }
+  } catch {
+    // dossier absent
+  }
+
+  try {
+    const apps = await readdir(join(REPO_ROOT, 'apps'));
+    for (const app of apps) {
+      const rel = `apps/${app}/docker-compose.yml`;
+      try {
+        await readFile(join(REPO_ROOT, rel));
+        files.push(rel);
+      } catch {
+        // pas de compose pour cette app
+      }
+    }
+  } catch {
+    // dossier absent
+  }
+
+  return files;
+}