creator/monlet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden production workflows and agent admission

Browse Source
This commit is contained in:
Stanislav Rossovskii
2026-05-28 14:19:27 +04:00
parent a2e88b4e76
commit 37b1a1d6d6
109 changed files with 4927 additions and 894 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
server/alembic/versions/0001_baseline.py
View File

@@ -20,18 +20,53 @@ def upgrade() -> None:
op.execute(
"""
CREATE TABLE agents (
agent_id TEXT PRIMARY KEY,
hostname TEXT NOT NULL,
status TEXT NOT NULL CHECK (status IN ('alive','stale','dead')) DEFAULT 'alive',
last_seen_at TIMESTAMPTZ NOT NULL,
features JSONB NOT NULL DEFAULT jsonb_build_object('push', false, 'metrics', false),
labels JSONB NOT NULL DEFAULT '{}'::jsonb,
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
agent_id TEXT PRIMARY KEY,
hostname TEXT NOT NULL,
status TEXT NOT NULL CHECK (status IN ('alive','stale','dead')) DEFAULT 'alive',
last_seen_at TIMESTAMPTZ NOT NULL,
features JSONB NOT NULL DEFAULT jsonb_build_object('push', false, 'metrics', false),
labels JSONB NOT NULL DEFAULT '{}'::jsonb,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
accepted_key_hash TEXT,
accepted_key_fingerprint TEXT,
accepted_at TIMESTAMPTZ,
pending_key_hash TEXT,
pending_key_fingerprint TEXT,
pending_hostname TEXT,
pending_seen_at TIMESTAMPTZ,
pending_features JSONB,
pending_labels JSONB,
admission_rank INTEGER NOT NULL GENERATED ALWAYS AS (
CASE WHEN pending_key_hash IS NOT NULL THEN 0 ELSE 1 END
) STORED
);
"""
)
op.execute("CREATE INDEX agents_status_idx ON agents (status);")
op.execute("CREATE INDEX agents_last_seen_idx ON agents (last_seen_at);")
op.execute("CREATE INDEX agents_admission_rank_idx ON agents (admission_rank, agent_id);")
op.execute("CREATE UNIQUE INDEX agents_hostname_idx ON agents (hostname);")
op.execute(
"CREATE UNIQUE INDEX agents_accepted_key_hash_idx ON agents (accepted_key_hash) WHERE accepted_key_hash IS NOT NULL;"
)
op.execute(
"CREATE UNIQUE INDEX agents_pending_key_hash_idx ON agents (pending_key_hash) WHERE pending_key_hash IS NOT NULL;"
)
op.execute(
"""
CREATE TABLE agent_blacklist (
key_hash TEXT PRIMARY KEY,
key_fingerprint TEXT NOT NULL,
agent_id TEXT NOT NULL,
hostname TEXT NOT NULL,
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
last_seen_at TIMESTAMPTZ NOT NULL
);
"""
)
op.execute("CREATE INDEX agent_blacklist_fingerprint_idx ON agent_blacklist (key_fingerprint);")
op.execute("CREATE INDEX agent_blacklist_last_seen_idx ON agent_blacklist (last_seen_at);")
op.execute(
"""
@@ -76,6 +111,18 @@ def upgrade() -> None:
)
op.execute("CREATE INDEX events_observed_at_idx ON events (observed_at DESC);")
op.execute("CREATE INDEX events_received_at_idx ON events (received_at DESC);")
# PH-010: pagination uses ORDER BY (received_at DESC, event_id DESC). Compound
# indexes match the unfiltered and per-agent/per-check filtered queries so the
# planner does not fall back to seq-scan + sort on hot partitions.
op.execute(
"CREATE INDEX events_received_event_idx ON events (received_at DESC, event_id DESC);"
)
op.execute(
"CREATE INDEX events_agent_received_event_idx ON events (agent_id, received_at DESC, event_id DESC);"
)
op.execute(
"CREATE INDEX events_check_received_event_idx ON events (check_id, received_at DESC, event_id DESC);"
)
# Global idempotency table: server enforces event_id uniqueness here, not on the
# partitioned events table. Pruned by retention TTL (event_dedup_retention_days).
@@ -91,6 +138,10 @@ def upgrade() -> None:
"CREATE INDEX event_ingest_dedup_received_at_idx ON event_ingest_dedup (received_at);"
)
# PH-review: status_rank is a STORED generated column so the default UI sort
# (status_rank, opened_at, id) maps to a trivial B-tree index. Keep the
# CASE expression in sync with `_STATUS_RANK` in
# server/monlet_server/api/incidents.py.
op.execute(
"""
CREATE TABLE incidents (
@@ -103,14 +154,26 @@ def upgrade() -> None:
opened_at TIMESTAMPTZ NOT NULL,
resolved_at TIMESTAMPTZ,
summary TEXT,
last_event_id UUID NOT NULL
last_event_id UUID NOT NULL,
status_rank INTEGER NOT NULL GENERATED ALWAYS AS (
CASE
WHEN state = 'open' AND severity = 'critical' THEN 5
WHEN state = 'open' AND severity = 'warning' THEN 4
WHEN state = 'open' AND severity = 'unknown' THEN 3
WHEN state = 'resolved' AND severity = 'critical' THEN 2
WHEN state = 'resolved' AND severity = 'warning' THEN 1
WHEN state = 'resolved' AND severity = 'unknown' THEN 0
END
) STORED
);
"""
)
op.execute(
"CREATE UNIQUE INDEX incidents_open_key_idx ON incidents (incident_key) WHERE state = 'open';"
)
op.execute("CREATE INDEX incidents_state_opened_idx ON incidents (state, opened_at DESC);")
op.execute(
"CREATE INDEX incidents_status_rank_idx ON incidents (status_rank DESC, opened_at DESC, id DESC);"
)
op.execute(
"""
@@ -132,6 +195,13 @@ def upgrade() -> None:
op.execute(
"CREATE INDEX outbox_pending_idx ON notification_outbox (state, next_attempt_at) WHERE state IN ('pending','retry');"
)
# PH-review: UI lists outbox with cursor pagination ordered by created_at/updated_at.
op.execute(
"CREATE INDEX outbox_created_at_idx ON notification_outbox (created_at DESC, id DESC);"
)
op.execute(
"CREATE INDEX outbox_updated_at_idx ON notification_outbox (updated_at DESC, id DESC);"
)
def downgrade() -> None:
@@ -140,4 +210,5 @@ def downgrade() -> None:
op.execute("DROP TABLE IF EXISTS event_ingest_dedup CASCADE;")
op.execute("DROP TABLE IF EXISTS events CASCADE;")
op.execute("DROP TABLE IF EXISTS checks CASCADE;")
op.execute("DROP TABLE IF EXISTS agent_blacklist CASCADE;")
op.execute("DROP TABLE IF EXISTS agents CASCADE;")