feat(madmail): print admin token and info, and introduce "--with-admin" option

Author: hpk42

README.md

@@ -61,8 +61,10 @@ The `--source` argument controls where the code comes from:
 
     cmlxc deploy-cmdeploy --source @main cm0
     cmlxc deploy-madmail  --source @main mad1
+    cmlxc deploy-madmail  --source @main --with-webadmin mad1
     cmlxc deploy-madmail  --source @main --ipv4-only mad1
 
+
 | Form | Meaning |
 |---------|---------|
 | `@ref` | Clone default remote at branch/tag `ref` |

src/cmlxc/cli.py

@@ -21,7 +21,7 @@
 )
 from cmlxc.driver_base import __version__
 from cmlxc.driver_cmdeploy import CmdeployDriver
-from cmlxc.driver_madmail import MadmailDriver
+from cmlxc.driver_madmail import MadmailDriver, print_admin_info
 from cmlxc.incus import Incus, _is_ip_address, check_cgroup_compat
 from cmlxc.output import Out
 
@@ -435,6 +435,9 @@ def _print_container_status(out, c, ix):
                 detail_out.print(f"source: {source_ref}")
                 detail_out.print(f"        {status}")
                 detail_out.print(f"builder: {repo_path}")
+        if driver == "madmail":
+            ct = ix.get_relay_container(cname)
+            print_admin_info(detail_out, ct, ip)
 
     elif cname == BUILDER_CONTAINER_NAME and is_running:
         _print_builder_repos(detail_out, BuilderContainer(ix))

src/cmlxc/container.py

@@ -488,7 +488,6 @@ def setup_repo(self, dest, out, source):
         self.bash(f"rm -rf {dest}")
         out.print(f"  Initial clone of {name} ...")
         self.bash(f"git clone {source.url} {dest}")
-        self.bash(f"git config --global --add safe.directory {dest}")
 
     def get_repo_status(self, repo_path):
         """Return a one-line string describing the git repo at repo_path."""

src/cmlxc/driver_base.py

@@ -153,6 +153,10 @@ def add_cli_options(cls, parser, completer=None):
             help="Create containers without IPv6 connectivity.",
         )
 
+
+    def configure_from_args(self, args):
+        """Apply driver-specific CLI arguments. Override in subclasses."""
+
     # ------------------------------------------------------------------
     # Deploy protocol (override in subclasses)
     # ------------------------------------------------------------------
@@ -191,6 +195,8 @@ def get_git_main_path(self):
     @classmethod
     def prep_builder(cls, ix, out, bld_ct):
         """Hook called by ``cmlxc init`` to prepare toolchains and main checkout."""
+        # Trust all repo paths inside the builder (ownership differs from host).
+        bld_ct.bash("git config --global --add safe.directory '*'", check=False)
         tmp_dest = f"/root/{cls.REPO_NAME}-git-main"
         if bld_ct.bash(f"test -d {tmp_dest}", check=False) is None:
             source = parse_source("@main", cls.DEFAULT_SOURCE_URL)
@@ -275,6 +281,8 @@ def cmd(args, out):
             if not driver.check_local_source(source):
                 return 1
 
+            driver.configure_from_args(args)
+
             out.print(f"cmlxc {__version__}")
             with out.section(f"Preparing {cls.CLI_NAME} source in builder"):
                 out.print(f"  Source: {source.description}")

src/cmlxc/driver_madmail.py

@@ -23,6 +23,22 @@ class MadmailDriver(Driver):
     REPO_NAME = MADMAIL
     REQUIRED_SOURCE_PATHS = ["go.mod", "Makefile"]
 
+    @classmethod
+    def add_cli_options(cls, parser, completer=None):
+        """Register madmail-specific deploy options."""
+        super().add_cli_options(parser, completer=completer)
+        parser.add_argument(
+            "--with-webadmin",
+            action="store_true",
+            help=(
+                "Build and enable the embedded admin web UI at /admin. "
+                "Disabled by default."
+            ),
+        )
+
+    def configure_from_args(self, args):
+        self.with_admin = bool(args.with_webadmin)
+
     @classmethod
     def on_prep_builder(cls, out, bld_ct, tmp_dest):
         """Hook called by ``prep_builder`` to ensure the Go toolchain is ready."""
@@ -31,19 +47,56 @@ def on_prep_builder(cls, out, bld_ct, tmp_dest):
 
     def on_init_relay(self, repo_path):
         """Hook called by ``init_builder`` to build the maddy binary."""
-        with self.out.section(f"Building maddy binary for {self.ct.shortname}"):
-            self.bld_ct.bash(f"""
-                if [ -f '{repo_path}/admin-web/package.json' ]; then
-                    cd '{repo_path}/admin-web' && bun install
-                fi
-            """)
-            self.out.print(f"Compiling maddy in {repo_path} (make build) ...")
-            ret = self.out.shell(
-                f"incus exec {self.bld_ct.name} -- bash -c 'cd {repo_path} && make build'"
-            )
+        mode = "with admin web UI" if self.with_admin else "without admin web UI"
+        with self.out.section(
+            f"Building maddy binary for {self.ct.shortname} ({mode})"
+        ):
+            if self.with_admin:
+                # Ensure admin-web submodule is populated and dependencies installed;
+                # build.sh copy_admin_web() handles the actual SPA build.
+                self.bld_ct.bash(f"""
+                    if [ ! -f '{repo_path}/admin-web/package.json' ]; then
+                        cd '{repo_path}' && git submodule update --init admin-web
+                    fi
+                    cd '{repo_path}/admin-web'
+                    if command -v bun >/dev/null 2>&1; then
+                        bun install
+                    elif command -v npm >/dev/null 2>&1; then
+                        npm install
+                    fi
+                """)
+            else:
+                # Hide package.json so build.sh creates a placeholder instead.
+                self.bld_ct.bash(f"""
+                    PKG='{repo_path}/admin-web/package.json'
+                    BAK='{repo_path}/admin-web/package.json.cmlxc-disabled'
+                    if [ -f "$PKG" ]; then mv "$PKG" "$BAK"; fi
+                """)
+
+            try:
+                ret = self.out.shell(
+                    f"incus exec {self.bld_ct.name} -- bash -c "
+                    f"'cd {repo_path} && make clean build'"
+                )
+            finally:
+                # Restore package.json if we hid it.
+                self.bld_ct.bash(f"""
+                    BAK='{repo_path}/admin-web/package.json.cmlxc-disabled'
+                    PKG='{repo_path}/admin-web/package.json'
+                    if [ -f "$BAK" ] && [ ! -f "$PKG" ]; then mv "$BAK" "$PKG"; fi
+                """)
+
             if ret:
                 raise SetupError(f"maddy build failed in {repo_path} (exit {ret})")
 
+            if self.with_admin:
+                check = self.bld_ct.bash(
+                    f"test -f {repo_path}/internal/adminweb/build/index.html",
+                    check=False,
+                )
+                if check is None:
+                    raise SetupError("admin-web build produced no index.html")
+
     def get_test_domain_or_ip(self):
         if not self.ct.ipv4:
             self.ct.wait_ready()
@@ -94,15 +147,57 @@ def deploy(self, source=None):
             self.ct.bash("systemctl daemon-reload")
             self.ct.bash("systemctl enable madmail")
             self.ct.bash("systemctl start madmail")
+
+            if self.with_admin:
+                self.out.print("Configuring admin web interface at /admin ...")
+                self.ct.bash("madmail admin-web path /admin")
+                self.ct.bash("madmail admin-web enable")
+                # Path changes are applied at startup.
+                self.ct.bash("systemctl restart madmail")
+            else:
+                self.out.print("Disabling admin web interface ...")
+                self.ct.bash("madmail admin-web disable")
+
             self.ct.bash("rm -f /tmp/madmail")
 
             self.ct.write_deploy_state(MADMAIL, source=source)
             self.out.green(f"madmail deployed to {self.ct.shortname} ({ip})")
+            print_admin_info(self.out, self.ct, ip)
 
         elapsed = time.time() - t_total
         self.out.section_line(f"deploy madmail complete ({elapsed:.1f}s)")
 
 
+def print_admin_info(out, ct, ip):
+    """Print admin API token and admin-web endpoint state."""
+    try:
+        token = ct.bash("madmail admin-token --raw", check=False).strip()
+        if token:
+            out.print(f"admin-token: {token}")
+
+        status = ct.bash("madmail admin-web status", check=False) or ""
+        enabled, path = _parse_admin_web_status(status)
+        if enabled and path:
+            out.print(f"admin-url: https://{ip}{path}/")
+        else:
+            out.print("admin-url: disabled")
+    except Exception:
+        pass
+
+
+def _parse_admin_web_status(status):
+    enabled = "Admin Web Dashboard:  enabled" in status
+    path = None
+    for line in status.splitlines():
+        if "Admin Web Path:" in line:
+            _, _, value = line.partition("Admin Web Path:")
+            value = value.strip()
+            if value.startswith("/"):
+                path = value.rstrip("/")
+            break
+    return enabled, path
+
+
 def prepare_build_container(bld_ct, go_mod_path):
     """Install or update Go inside the builder according to go.mod."""
     bld_ct.bash("""