Containr/app/backend/internal/api/ingress.go

package api

import (
	"context"
	"encoding/json"
	"fmt"
	"os"
	"path/filepath"
	"sort"
	"strings"

	"containr/internal/database"
	"containr/internal/database/sqlcdb"
	"containr/internal/deployment"
)

// Remote ingress: replicas on node agents aren't on the hub's
// containr-network, so Traefik's Docker provider can't see them. Instead
// the backend renders one file-provider config per service into
// TRAEFIK_DYNAMIC_DIR (a directory Traefik watches), pointing the
// loadbalancer at the node's reachable IP + the ephemeral host port the
// agent reported back after `create_container`.
//
// Empty dir → feature off (bare-metal dev). Files are best-effort: a
// failed write never fails a reconcile.

func ingressDir() string { return os.Getenv("TRAEFIK_DYNAMIC_DIR") }

func ingressFile(serviceID string) string {
	return filepath.Join(ingressDir(), "containr-"+serviceID+".yml")
}

// jsonInt coerces JSON-ish numbers (int/int32/int64/float64) to int —
// spec fields arrive as int32, agent payloads unmarshal as float64.
func jsonInt(v interface{}) int {
	switch n := v.(type) {
	case int:
		return n
	case int32:
		return int(n)
	case int64:
		return int(n)
	case float64:
		return int(n)
	}
	return 0
}

// reportedHostPorts parses the agent's create_container result —
// {"name": ..., "host_ports": {"80/tcp": "32768"}}. Older agents return a
// bare name string; JSON parse failure means no port info.
func reportedHostPorts(result string) map[string]string {
	var out struct {
		HostPorts map[string]string `json:"host_ports"`
	}
	if json.Unmarshal([]byte(result), &out) != nil {
		return nil
	}
	return out.HostPorts
}

// nodeIngressIP picks the address the hub can reach the node on. Mesh
// overlays first — the agent operator joined a mesh precisely so the hub
// can reach it — then the reported primary IP as a LAN fallback.
func nodeIngressIP(agent sqlcdb.NodeAgent) string {
	var meta struct {
		Mesh map[string]string `json:"mesh"`
	}
	_ = json.Unmarshal(agent.Metadata.RawMessage, &meta)
	for _, prefix := range []string{"tailscale", "netbird", "wg", "zt"} {
		var keys []string
		for name := range meta.Mesh {
			keys = append(keys, name)
		}
		sort.Strings(keys)
		for _, name := range keys {
			if strings.HasPrefix(name, prefix) && meta.Mesh[name] != "" {
				return meta.Mesh[name]
			}
		}
	}
	return agent.IpAddress
}

// syncRemoteIngress rewrites the service's file-provider config from the
// live remote replica set. Called after every remote reconcile so replica
// adds/removals and node retargets converge the upstream list.
func syncRemoteIngress(ctx context.Context, db *database.DB, spec deployment.RuntimeSpec) {
	if ingressDir() == "" {
		return
	}
	domains := spec.Domains
	if len(domains) == 0 && spec.Domain != "" {
		domains = []string{spec.Domain}
	}
	if len(domains) == 0 || spec.Port <= 0 {
		removeServiceIngress(spec.ServiceID)
		return
	}

	q := sqlcdb.New(db.DB)
	rows, err := q.ListServiceContainers(ctx, spec.ServiceID)
	if err != nil {
		return
	}
	type upstream struct{ ip, port string }
	var servers []upstream
	for _, row := range rows {
		var st struct {
			State string `json:"state"`
		}
		_ = json.Unmarshal(row.Status.RawMessage, &st)
		if st.State != "running" {
			continue
		}
		var port string
		var plist []map[string]interface{}
		if err := json.Unmarshal(row.Ports.RawMessage, &plist); err == nil {
			for _, p := range plist {
				if hp, ok := p["host_port"].(float64); ok && hp > 0 {
					port = fmt.Sprintf("%d", int(hp))
				}
			}
		}
		if port == "" {
			continue
		}
		agent, err := q.GetAgent(ctx, row.NodeAgentID)
		if err != nil {
			continue
		}
		if ip := nodeIngressIP(agent); ip != "" {
			servers = append(servers, upstream{ip, port})
		}
	}
	if len(servers) == 0 {
		removeServiceIngress(spec.ServiceID)
		return
	}

	router := "svc-" + spec.ServiceID[:8]
	rules := make([]string, 0, len(domains))
	for _, d := range domains {
		rules = append(rules, "Host(`"+d+"`)")
	}
	var b strings.Builder
	b.WriteString("http:\n  routers:\n    " + router + ":\n")
	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
	b.WriteString("      entrypoints: [web]\n")
	b.WriteString("      service: " + router + "\n")
	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
	for _, s := range servers {
		b.WriteString("          - url: \"http://" + s.ip + ":" + s.port + "\"\n")
	}
	// Atomic-ish: write temp then rename so Traefik's watcher never reads a
	// truncated file.
	tmp := ingressFile(spec.ServiceID) + ".tmp"
	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
		return
	}
	_ = os.Rename(tmp, ingressFile(spec.ServiceID))
}

// removeServiceIngress deletes the service's remote route. Called on
// remote teardown and when a service returns to local placement.
func removeServiceIngress(serviceID string) {
	if ingressDir() == "" {
		return
	}
	_ = os.Remove(ingressFile(serviceID))
}

// wakeUpstreamURL is where a sleeping remote service's route points —
// the backend's wake-page endpoint. Defaults to the compose service name;
// TRAEFIK_BACKEND_URL overrides for custom layouts.
func wakeUpstreamURL(apiPort int) string {
	if v := strings.TrimSpace(os.Getenv("TRAEFIK_BACKEND_URL")); v != "" {
		return strings.TrimRight(v, "/")
	}
	return fmt.Sprintf("http://containr-backend:%d", apiPort)
}

// writeWakeIngress routes the service's domains at the wake-page endpoint —
// first hit triggers the wake reconcile and serves a reloading page.
func writeWakeIngress(serviceID string, domains []string, apiPort int) {
	if ingressDir() == "" {
		return
	}
	sort.Strings(domains)
	router := "svc-" + serviceID[:8] + "-wake"
	rules := make([]string, 0, len(domains))
	for _, d := range domains {
		rules = append(rules, "Host(`"+d+"`)")
	}
	var b strings.Builder
	mw := router + "-rw"
	b.WriteString("http:\n  routers:\n    " + router + ":\n")
	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
	b.WriteString("      entrypoints: [web]\n")
	b.WriteString("      service: " + router + "\n")
	b.WriteString("      priority: 100\n")
	b.WriteString("      middlewares: [" + mw + "]\n")
	b.WriteString("  middlewares:\n    " + mw + ":\n")
	b.WriteString("      replacePath:\n        path: \"/api/v1/internal/wake-page/" + serviceID + "\"\n")
	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
	b.WriteString("          - url: \"" + wakeUpstreamURL(apiPort) + "\"\n")
	tmp := ingressFile(serviceID) + ".tmp"
	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
		return
	}
	_ = os.Rename(tmp, ingressFile(serviceID))
}