feat(telemetry): add portable local telemetry plane

2026-07-28 00:54:11 +03:00
parent 9fc002d86f
commit b8a008b50e
16 changed files with 1486 additions and 0 deletions
@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+import argparse
+import ipaddress
+import os
+import secrets
+import subprocess
+from pathlib import Path
+from typing import Final
+
+ROOT: Final = Path(__file__).resolve().parent
+ENV_PATH: Final = ROOT / ".env"
+RUNTIME: Final = ROOT / "runtime" / "mosquitto"
+IMAGE: Final = "eclipse-mosquitto:2.1.2-alpine"
+PLACEHOLDER: Final = "replace-with-"
+
+
+def _initialize_environment(bind_address: str, *, overwrite: bool = False) -> None:
+    if ENV_PATH.exists() and not overwrite:
+        raise RuntimeError(".env already exists; refusing to overwrite local credentials")
+    normalized_bind_address = str(ipaddress.ip_address(bind_address))
+    values = {
+        "MISSIONCORE_MQTT_BIND_ADDRESS": normalized_bind_address,
+        "MISSIONCORE_MQTT_PORT": "1883",
+        "MISSIONCORE_TELEMETRY_QUERY_PORT": "18030",
+        "MISSIONCORE_DB_NAME": "missioncore_telemetry",
+        "MISSIONCORE_DB_USER": "missioncore_ingest",
+        "MISSIONCORE_DB_PASSWORD": secrets.token_urlsafe(36),
+        "MISSIONCORE_MQTT_INGEST_USER": "missioncore-ingest",
+        "MISSIONCORE_MQTT_INGEST_PASSWORD": secrets.token_urlsafe(36),
+        "MISSIONCORE_MQTT_WORKER_006_USER": "worker-006",
+        "MISSIONCORE_MQTT_WORKER_006_PASSWORD": secrets.token_urlsafe(36),
+    }
+    ENV_PATH.write_text(
+        "".join(f"{name}={value}\n" for name, value in values.items()),
+        encoding="utf-8",
+    )
+    os.chmod(ENV_PATH, 0o600)
+
+
+def _environment() -> dict[str, str]:
+    if not ENV_PATH.is_file():
+        raise RuntimeError("copy .env.example to .env and set unique secrets first")
+    values: dict[str, str] = {}
+    for raw_line in ENV_PATH.read_text(encoding="utf-8").splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        name, value = line.split("=", 1)
+        values[name.strip()] = value.strip()
+    return values
+
+
+def _required(values: dict[str, str], name: str) -> str:
+    value = values.get(name, "")
+    if not value or value.startswith(PLACEHOLDER):
+        raise RuntimeError(f"{name} must contain a non-placeholder value")
+    return value
+
+
+def _password_entry(path: Path, username: str, password: str, *, create: bool) -> None:
+    command = [
+        "docker",
+        "run",
+        "--rm",
+        "-i",
+        "-v",
+        f"{RUNTIME}:/out",
+        IMAGE,
+        "mosquitto_passwd",
+    ]
+    if create:
+        command.append("-c")
+    command.extend([f"/out/{path.name}", username])
+    subprocess.run(
+        command,
+        check=True,
+        input=f"{password}\n{password}\n",
+        text=True,
+    )
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--initialize",
+        action="store_true",
+        help="create a private .env with generated local credentials",
+    )
+    parser.add_argument(
+        "--mqtt-bind-address",
+        default="127.0.0.1",
+        help="host IP exposed to telemetry agents",
+    )
+    arguments = parser.parse_args()
+    if arguments.initialize:
+        _initialize_environment(arguments.mqtt_bind_address)
+    values = _environment()
+    ingest_user = _required(values, "MISSIONCORE_MQTT_INGEST_USER")
+    ingest_password = _required(values, "MISSIONCORE_MQTT_INGEST_PASSWORD")
+    worker_user = _required(values, "MISSIONCORE_MQTT_WORKER_006_USER")
+    worker_password = _required(values, "MISSIONCORE_MQTT_WORKER_006_PASSWORD")
+    _required(values, "MISSIONCORE_DB_PASSWORD")
+
+    RUNTIME.mkdir(parents=True, exist_ok=True)
+    password_path = RUNTIME / "passwords"
+    _password_entry(password_path, ingest_user, ingest_password, create=True)
+    _password_entry(password_path, worker_user, worker_password, create=False)
+    acl_path = RUNTIME / "acl"
+    acl_path.write_text(
+        "\n".join(
+            [
+                f"user {ingest_user}",
+                "topic read mission-core/v1/contours/+/agents/+/+",
+                "topic read $SYS/broker/uptime",
+                "",
+                "# Agent username must equal its stable agent id.",
+                "pattern write mission-core/v1/contours/+/agents/%u/+",
+                "",
+            ]
+        ),
+        encoding="utf-8",
+    )
+    os.chmod(password_path, 0o600)
+    os.chmod(acl_path, 0o600)
+    print("Mosquitto password and ACL files prepared.", flush=True)
+
+
+if __name__ == "__main__":
+    main()