Amnezia-style SSH server connect with verify, ping and server_info

Co-authored-by: Cursor <cursoragent@cursor.com>

app/services/__init__.py

@@ -1,3 +1,3 @@
-from app.services import crypto, vpn
+from app.services import crypto, vpn, ssh
 
-__all__ = ["crypto", "vpn"]
+__all__ = ["crypto", "vpn", "ssh"]

app/services/ssh.py

@@ -0,0 +1,153 @@
+"""SSH manager — similar to Amnezia-Web-Panel (Paramiko)."""
+
+from __future__ import annotations
+
+import io
+import logging
+import socket
+from dataclasses import dataclass
+
+import paramiko
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class SSHProbeResult:
+    online: bool
+    latency_ms: int | None = None
+    error: str | None = None
+
+
+class SSHManager:
+    """SSH connection + command execution on a remote VPS."""
+
+    def __init__(
+        self,
+        host: str,
+        port: int = 22,
+        username: str = "root",
+        password: str | None = None,
+        private_key: str | None = None,
+    ):
+        self.host = host
+        self.port = int(port)
+        self.username = username
+        self.password = password or None
+        self.private_key = private_key or None
+        self.client: paramiko.SSHClient | None = None
+        self._is_root = username == "root"
+
+    def _load_pkey(self) -> paramiko.PKey:
+        assert self.private_key is not None
+        key_file = io.StringIO(self.private_key.strip())
+        errors: list[str] = []
+        for key_cls in (paramiko.Ed25519Key, paramiko.RSAKey, paramiko.ECDSAKey):
+            key_file.seek(0)
+            try:
+                return key_cls.from_private_key(key_file)
+            except Exception as exc:  # noqa: BLE001
+                errors.append(f"{key_cls.__name__}: {exc}")
+        raise ValueError("Не удалось прочитать приватный ключ (" + "; ".join(errors[:2]) + ")")
+
+    def connect(self, timeout: int = 15) -> bool:
+        if not self.password and not self.private_key:
+            raise ValueError("Нужен пароль или приватный ключ SSH")
+
+        self.client = paramiko.SSHClient()
+        self.client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        kwargs: dict = {
+            "hostname": self.host,
+            "port": self.port,
+            "username": self.username,
+            "timeout": timeout,
+            "banner_timeout": timeout,
+            "auth_timeout": timeout,
+            "allow_agent": False,
+            "look_for_keys": False,
+        }
+        if self.private_key:
+            kwargs["pkey"] = self._load_pkey()
+        else:
+            kwargs["password"] = self.password
+
+        self.client.connect(**kwargs)
+        return True
+
+    def disconnect(self) -> None:
+        if self.client:
+            self.client.close()
+            self.client = None
+
+    def run_command(self, command: str, timeout: int = 60) -> tuple[str, str, int]:
+        if not self.client:
+            raise ConnectionError("Not connected to server")
+
+        logger.info("SSH %s: %s", self.host, command[:120])
+        _stdin, stdout, stderr = self.client.exec_command(command, timeout=timeout)
+        stdout.channel.settimeout(timeout)
+        stderr.channel.settimeout(timeout)
+        try:
+            exit_code = stdout.channel.recv_exit_status()
+            out = stdout.read().decode("utf-8", errors="replace").strip()
+            err = stderr.read().decode("utf-8", errors="replace").strip()
+        except Exception as exc:  # noqa: BLE001
+            return "", str(exc), -1
+        return out, err, exit_code
+
+    def run_sudo_command(self, command: str, timeout: int = 60) -> tuple[str, str, int]:
+        clean = command.strip()
+        if clean.startswith("sudo "):
+            clean = clean[5:]
+        if self._is_root:
+            return self.run_command(clean, timeout=timeout)
+        if self.password:
+            escaped = self.password.replace("'", "'\\''")
+            full = f"echo '{escaped}' | sudo -S -p '' {clean}"
+        else:
+            full = f"sudo {clean}"
+        return self.run_command(full, timeout=timeout)
+
+    def test_connection(self) -> str:
+        out, err, code = self.run_command(
+            "uname -sr && cat /etc/os-release 2>/dev/null | head -2"
+        )
+        if code != 0 and not out:
+            raise ConnectionError(err or f"SSH test failed (code {code})")
+        return out
+
+    def __enter__(self) -> SSHManager:
+        self.connect()
+        return self
+
+    def __exit__(self, *args) -> None:
+        self.disconnect()
+
+
+def probe_tcp(host: str, port: int, timeout: float = 2.0) -> SSHProbeResult:
+    """Non-blocking-ish TCP connect probe (run via asyncio.to_thread)."""
+    import time
+
+    started = time.perf_counter()
+    try:
+        with socket.create_connection((host, int(port)), timeout=timeout):
+            latency = int((time.perf_counter() - started) * 1000)
+            return SSHProbeResult(online=True, latency_ms=latency)
+    except OSError as exc:
+        return SSHProbeResult(online=False, error=str(exc))
+
+
+def verify_ssh(
+    host: str,
+    port: int,
+    username: str,
+    password: str | None = None,
+    private_key: str | None = None,
+) -> str:
+    """Connect, run test command, disconnect. Returns server_info text."""
+    ssh = SSHManager(host, port, username, password, private_key)
+    try:
+        ssh.connect()
+        return ssh.test_connection()
+    finally:
+        ssh.disconnect()

app/services/vpn.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import asyncio
+from datetime import datetime, timezone
 from pathlib import Path
 
 from sqlalchemy import func, select
@@ -16,6 +18,7 @@ from app.services.crypto import (
     render_server_config,
     server_address,
 )
+from app.services.ssh import probe_tcp, verify_ssh
 
 
 async def ensure_default_servers(session: AsyncSession) -> None:
@@ -137,6 +140,14 @@ async def create_server(
     if not username:
         raise ValueError("Укажите SSH логин")
 
+    # Like Amnezia-Web-Panel: verify SSH before saving
+    try:
+        server_info = await asyncio.to_thread(
+            verify_ssh, host, ssh_port or 22, username, password, private_key
+        )
+    except Exception as exc:  # noqa: BLE001
+        raise ValueError(f"Подключение не удалось: {exc}") from exc
+
     defaults = _defaults_for_protocol(protocol)
     keys = generate_keypair()
     # Unique interface per server id is assigned after insert; use temp then update
@@ -150,6 +161,7 @@ async def create_server(
         raise ValueError("Слишком много серверов для авто-подсети")
     subnet = f"10.{octet}.0.0/24"
 
+    now = datetime.now(timezone.utc)
     server = VpnServer(
         name=name.strip() or host,
         protocol=protocol,
@@ -165,6 +177,9 @@ async def create_server(
         ssh_username=username,
         ssh_password=password,
         ssh_private_key=private_key,
+        ssh_server_info=server_info,
+        ssh_reachable=True,
+        ssh_last_checked=now,
         jc=defaults["jc"],
         jmin=defaults["jmin"],
         jmax=defaults["jmax"],
@@ -183,6 +198,52 @@ async def create_server(
     return server
 
 
+async def check_server_ssh(session: AsyncSession, server_id: int) -> VpnServer:
+    server = await session.get(VpnServer, server_id)
+    if not server:
+        raise ValueError("Server not found")
+    if not server.ssh_host or not server.ssh_username:
+        raise ValueError("SSH данные не заданы")
+    if not server.ssh_password and not server.ssh_private_key:
+        raise ValueError("Нет пароля и ключа SSH")
+
+    now = datetime.now(timezone.utc)
+    try:
+        info = await asyncio.to_thread(
+            verify_ssh,
+            server.ssh_host,
+            server.ssh_port or 22,
+            server.ssh_username,
+            server.ssh_password,
+            server.ssh_private_key,
+        )
+        server.ssh_server_info = info
+        server.ssh_reachable = True
+        server.ssh_last_checked = now
+    except Exception as exc:  # noqa: BLE001
+        server.ssh_reachable = False
+        server.ssh_last_checked = now
+        await session.commit()
+        raise ValueError(f"Подключение не удалось: {exc}") from exc
+
+    await session.commit()
+    await session.refresh(server)
+    return server
+
+
+async def probe_servers(servers: list[VpnServer]) -> dict[int, dict]:
+    """TCP ping SSH ports for UI online indicators."""
+
+    async def one(s: VpnServer) -> tuple[int, dict]:
+        if not s.ssh_host:
+            return s.id, {"online": False, "latency_ms": None}
+        result = await asyncio.to_thread(probe_tcp, s.ssh_host, s.ssh_port or 22)
+        return s.id, {"online": result.online, "latency_ms": result.latency_ms}
+
+    pairs = await asyncio.gather(*(one(s) for s in servers))
+    return dict(pairs)
+
+
 async def update_server_settings(
     session: AsyncSession,
     server_id: int,