better error handling when the btcpay server goes down

return success whn attempting to destroy a capsul that doesnt exist
local variable 'assigned_hosts_string' referenced before assignment
2021-09-02 12:00:48 -05:00 · 2021-08-27 12:18:17 -05:00 · 2021-08-27 12:14:38 -05:00 · 2021-08-16 13:24:11 -05:00 · 2021-07-26 15:29:34 -05:00 · 2021-07-25 09:36:04 -05:00
45 changed files with 972 additions and 336 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,5 +1,6 @@
 notes.txt
 .env
+.env.bak
 .vscode

 *.pyc
--- a/README.md
+++ b/README.md
@ -1,227 +1,51 @@
-# capsulflask
+# capsul-flask

-Python Flask web application for capsul.org
+![screenshot of capsul.org home page](./docs/capsul.webp)

+Python Flask web application implementing user accounts, payment, and virtual machine management for a smol "virtual machine (vm) as a service" aka "cloud compute" provider.  Originally developed by [Cyberia Computer Club](https://cyberia.club) for https://capsul.org

-## how to run locally
+`capsul-flask` integrates with [Stripe](https://stripe.com/) as a credit card processor, and [BTCPay Server](https://github.com/btcpayserver/btcpayserver-docker) as a cryptocurrency payment processor.

-Ensure you have the pre-requisites for the psycopg2 Postgres database adapter package
+`capsul-flask` invokes [shell-scripts](./capsulflask/shell_scripts/) to create/manage [libvirt/qemu](https://www.libvirt.org/manpages/virsh.html) vms, and it depends on `dnsmasq` to act as the DHCP server for the vms.
+
+`capsul-flask` has a ["hub and spoke" architecture](./architecture.md). The "Hub" runs the web application and talks to the Postrges database, while the "Spoke"(s) are responsible for creating/managing virtual machines. In this way, capsul can be scaled to span more than one machine. One instance of the capsul-flask application can run in both hub mode and spoke mode at the same time, however there must only be one instance of the app running in "Hub" mode at any given time.
+
+## Quickstart (run capsul-flask on your computer in development mode)

 ```
-sudo apt install python3-dev libpq-dev
-pg_config --version
-```
+# get an instance of postgres running locally on port 5432
+# (you don't have to use docker, but we thought this might be the easiest for a how-to example)
+docker run --rm -it -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres &

-Ensure you have the wonderful `pipenv` python package management and virtual environment cli
+# install dependencies 
+sudo apt install pipenv python3-dev libpq-dev

-```
-sudo apt install pipenv
-```
-
-Create python virtual environment and install packages
-
-```
-# install deps
+# download and run
+git clone https://giit.cyberia.club/~forest/capsul-flask
+cd capsul-flask
 pipenv install
-```
-
-Run an instance of Postgres (I used docker for this, you can use whatever you want, point is its listening on localhost:5432)
-
-```
-docker run --rm -it -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres
-```
-
-Run the app 
-
-```
 pipenv run flask run
 ```

-Run the app in gunicorn:
-
-```
-pipenv run gunicorn --bind 127.0.0.1:5000 -k gevent --worker-connections 1000 app:app
-```
-
-Once you log in for the first time, you will want to give yourself some free capsulbux so you can create fake capsuls for testing. 
-
-Note that by default when running locally, the `SPOKE_MODEL` is set to `mock`, meaning that it won't actually try to spawn vms.
-
-```
-pipenv run flask cli sql -c "INSERT INTO payments (email, dollars) VALUES ('<your email address here>', 20.00)"
-```
-
-## configuration:
-
-Create a `.env` file to set up the application configuration:
-
-```
-nano .env
-```
-
-You can enter any environment variables referenced in `__init__.py` to this file.
-
-For example you may enter your SMTP credentials like this:
-```
-MAIL_USERNAME=forest@nullhex.com
-MAIL_DEFAULT_SENDER=forest@nullhex.com
-MAIL_PASSWORD=**************
-```
-
-## how to view the logs on the database server (legion.cyberia.club)
-
-`sudo -u postgres pg_dump capsul-flask | gzip -9 > capsul-backup-2021-02-15.gz`
-
-----
-
-## cli 
-
-You can manually mess around with the database like this:
-
-```
-pipenv run flask cli sql -f test.sql
-```
-
-```
-pipenv run flask cli sql -c 'SELECT * FROM vms'
-```
-
-This one selects the vms table with the column name header:
-
-```
-pipenv run flask cli sql -c "SELECT string_agg(column_name::text, ', ') from information_schema.columns WHERE table_name='vms'; SELECT * from vms"
-```
-
-How to modify a payment manually, like if you get a chargeback or to fix customer payment issues:
-
-```
-$ pipenv run flask cli sql -c "SELECT id, created, email, dollars, invalidated from payments"
-1, 2020-05-05T00:00:00, forest.n.johnson@gmail.com, 20.00, FALSE
-
-$ pipenv run flask cli sql -c "UPDATE payments SET invalidated = True WHERE id = 1"
-1 rows affected.
-
-$ pipenv run flask cli sql -c "SELECT id, created, email, dollars, invalidated from payments"
-1, 2020-05-05T00:00:00, forest.n.johnson@gmail.com, 20.00, TRUE
-```
-
-
-How you would kick off the scheduled task:
-
-```
-pipenv run flask cli cron-task
-```
-
-----
-
-## postgres database schema management
-
-capsulflask has a concept of a schema version. When the application starts, it will query the database for a table named
-`schemaversion` that has one row and one column (`version`). If the `version` it finds is not equal to the `desiredSchemaVersion` variable set in `db.py`, it will run  migration scripts from the `schema_migrations` folder one by one until the `schemaversion` table shows the correct version.
-
-For example, the script named `02_up_xyz.sql` should contain code that migrates the database from schema version 1 to schema version 2. Likewise, the script `02_down_xyz.sql` should contain code that migrates from schema version 2 back to schema version 1.
-
-**IMPORTANT: if you need to make changes to the schema, make a NEW schema version. DO NOT EDIT the existing schema versions.**
-
-In general, for safety, schema version upgrades should not delete data. Schema version downgrades will simply throw an error and exit for now. 
-
-----
-
-## hub-and-spoke architecture
-
-![](readme/hub-and-spoke1.png)
-
-This diagram was created with https://app.diagrams.net/.
-To edit it, download the <a download href="readme/hub-and-spoke.xml">diagram file</a> and edit it with the https://app.diagrams.net/ web application, or you may run the application from [source](https://github.com/jgraph/drawio) if you wish.
-
-right now I have 2 types of operations, immediate mode and async.
-
-both types of operations do assignment synchronously. so if the system cant assign the operation to one or more hosts (spokes),
-or whatever the operation requires, then it will fail. 
-
-some operations tolerate partial failures, like, `capacity_avaliable` will succeed if at least one spoke succeeds.
-for immediate mode requests (like `list`, `capacity_avaliable`, `destroy`), assignment and completion of the operation are the same thing.
-
-for async ones, they can be assigned without knowing whether or not they succeeded (`create`).
-
-![](readme/hub-and-spoke2.png)
-
-This diagram was created with https://app.diagrams.net/.
-To edit it, download the <a download href="readme/hub-and-spoke.xml">diagram file</a> and edit it with the https://app.diagrams.net/ web application, or you may run the application from [source](https://github.com/jgraph/drawio) if you wish.
-
-if you issue a create, and it technically could go to any number of hosts, but only one host responds, it will succeed 
-but if you issue a create and somehow 2 hosts both think they own that task, it will fail and throw a big error. cuz it expects exactly 1 to own the create task
-
-currently its not set up to do any polling.  its not really like a queue at all. It's all immediate for the most part 
-
-----
-
-## how to setup btcpay server
-
-Generate a private key and the accompanying bitpay SIN for the btcpay API client. 
-
-  I used this code as an example: https://github.com/bitpay/bitpay-python/blob/master/bitpay/key_utils.py#L6
-
-```
-$ pipenv run python ./readme/generate_btcpay_keys.py
-```
-
-It should output something looking like this:
-
-```
-----BEGIN EC PRIVATE KEY-----
-EXAMPLEIArx/EXAMPLEKH23EXAMPLEsYXEXAMPLE5qdEXAMPLEcFHoAcEXAMPLEK
-oUQDQgAEnWs47PT8+ihhzyvXX6/yYMAWWODluRTR2Ix6ZY7Z+MV7v0W1maJzqeqq
-NQ+cpBvPDbyrDk9+Uf/sEaRCma094g==
-----END EC PRIVATE KEY-----
-
-
-EXAMPLEwzAEXAMPLEEXAMPLEURD7EXAMPLE
-```
-
-In order to register the key with the btcpay server, you have to first generate a pairing token using the btcpay server interface.
-This requires your btcpay server account to have access to the capsul store. Ask Cass about this.
-
-Navigate to `Manage store: Access Tokens` at: `https://btcpay.cyberia.club/stores/<store-id>/Tokens`
-
-![](readme/btcpay_sin_pairing.jpg)
-
-
-Finally, send an http request to the btcpay server to complete the pairing:
-
-```
-curl -H "Content-Type: application/json" https://btcpay.cyberia.club/tokens -d "{'id': 'EXAMPLEwzAEXAMPLEEXAMPLEURD7EXAMPLE', 'pairingCode': 'XXXXXXX'}"
-```
-
-It should respond with a token: 
-
-```
-{"data":[{"policies":[],"pairingCode":"XXXXXXX","pairingExpiration":1589473817597,"dateCreated":1589472917597,"facade":"merchant","token":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","label":"capsulflask"}]}
-```
-
-And you should see the token in the btcpay server UI:
-
-![](readme/paired.jpg)
-
-Now simply set your `BTCPAY_PRIVATE_KEY` variable in `.env`
-
-NOTE: make sure to use single quotes and replace the new lines with \n.
-
-```
-BTCPAY_PRIVATE_KEY='-----BEGIN EC PRIVATE KEY-----\nEXAMPLEIArx/EXAMPLEKH23EXAMPLEsYXEXAMPLE5qdEXAMPLEcFHoAcEXAMPLEK\noUQDQgAEnWs47PT8+ihhzyvXX6/yYMAWWODluRTR2Ix6ZY7Z+MV7v0W1maJzqeqq\nNQ+cpBvPDbyrDk9+Uf/sEaRCma094g==\n-----END EC PRIVATE KEY-----'
-```
-
-
-----
-
-## testing cryptocurrency payments
-
-I used litecoin to test cryptocurrency payments, because its the simplest & lowest fee cryptocurrency that BTCPay server supports. You can download the easy-to-use litecoin SPV wallet `electrum-ltc` from [github.com/pooler/electrum-ltc](https://github.com/pooler/electrum-ltc) or [electrum-ltc.org](https://electrum-ltc.org/), set up a wallet, and then either purchase some litecoin from an exchange, or ask Forest for some litecoin to use for testing.
-
-
-## sequence diagram explaining how BTC payment process works
-
-![btcpayment_process](readme/btcpayment_process.png)
-
-This diagram was created with https://app.diagrams.net/.
-To edit it, download the <a download href="readme/btcpayment_process.drawio">diagram file</a> and edit it with the https://app.diagrams.net/ web application, or you may run the application from [source](https://github.com/jgraph/drawio) if you wish.
+Interested in learning more? How about a trip to the the `docs/` folder:
+
+- [**Setting up capsul-flask locally**](./docs/local-set-up.md)
+  - [Manually](./docs/local-set-up.md#manually)
+  - [With docker-compose](./docs/local-set-up.md#docker_compose)
+- [**Configuring `capsul-flask`**](./docs/configuration.md)
+  - [Example configuration from capsul.org (production)](./docs/configuration.md#example)
+  - [Configuration-type-stuff that lives in the database ](./docs/configuration.md#config_that_lives_in_db)
+  - [Loading variables from files (docker secrets)](./docs/configuration.md#docker_secrets)
+- [**`capsul-flask`'s relationship to its Database Server**](./docs/database.md)
+  - [Database schema management (schema versions)](./docs/database.md#schema_management)
+  - [Running manual database queries](./docs/database.md#manual_queries)
+- [**`capsul-flask`'s hub-and-spoke architecture**](./docs/architecture.md)
+- [**Deploying capsul-flask on a server**](./docs/deployment.md)
+  - [Installing prerequisites for Spoke Mode](./docs/deployment.md#spoke_mode_prerequisites)
+  - [Deploying capsul-flask manually](./docs/deployment.md#deploy_manually)
+  - [Deploying capsul-flask with coop-cloud's docker-swarm configuration](./docs/deployment.md#coop_cloud_docker)
+  - [Deploying capsul-flask with coop-cloud's `abra` deployment tool](./docs/deployment.md#coop_cloud_abra)
+- [**Accepting cryptocurrency payments with BTCPay Server**](./docs/btcpay.md)
+  - [Setting up the BTCPAY_PRIVATE_KEY](./docs/btcpay.md#BTCPAY_PRIVATE_KEY)
+  - [Testing cryptocurrency payments](./docs/btcpay.md#testing)
+  - [Sequence diagram explaining how BTC payment process works (how we accept 0-confirmation transactions 😀)](./docs/btcpay.md#0_conf_diagram)
--- a/capsulflask/init.py
+++ b/capsulflask/init.py
@ -31,7 +31,6 @@ load_dotenv(find_dotenv())
 app = Flask(__name__)

 app.config.from_mapping(
-  
  BASE_URL=os.environ.get("BASE_URL", default="http://localhost:5000"),
  SECRET_KEY=os.environ.get("SECRET_KEY", default="dev"),
  HUB_MODE_ENABLED=os.environ.get("HUB_MODE_ENABLED", default="True").lower() in ['true', '1', 't', 'y', 'yes'],
@ -56,7 +55,7 @@ app.config.from_mapping(

  MAIL_SERVER=os.environ.get("MAIL_SERVER", default=""),
  MAIL_PORT=os.environ.get("MAIL_PORT", default="465"),
-  MAIL_USE_TLS=os.environ.get("MAIL_USE_TLS", default="True").lower() in ['true', '1', 't', 'y', 'yes'],
+  MAIL_USE_TLS=os.environ.get("MAIL_USE_TLS", default="False").lower() in ['true', '1', 't', 'y', 'yes'],
  MAIL_USE_SSL=os.environ.get("MAIL_USE_SSL", default="True").lower() in ['true', '1', 't', 'y', 'yes'],
  MAIL_USERNAME=os.environ.get("MAIL_USERNAME", default=""),
  MAIL_PASSWORD=os.environ.get("MAIL_PASSWORD", default=""),
@ -72,7 +71,7 @@ app.config.from_mapping(
  #STRIPE_WEBHOOK_SECRET=os.environ.get("STRIPE_WEBHOOK_SECRET", default="")

  BTCPAY_PRIVATE_KEY=os.environ.get("BTCPAY_PRIVATE_KEY", default="").replace("\\n", "\n"),
-  BTCPAY_URL=os.environ.get("BTCPAY_URL", default="https://btcpay.cyberia.club")
+  BTCPAY_URL=os.environ.get("BTCPAY_URL", default="")
 )

 app.config['HUB_URL'] = os.environ.get("HUB_URL", default=app.config['BASE_URL'])
@ -140,10 +139,17 @@ else:

 app.config['HTTP_CLIENT'] = MyHTTPClient(timeout_seconds=int(app.config['INTERNAL_HTTP_TIMEOUT_SECONDS']))

-try:
-  app.config['BTCPAY_CLIENT'] = btcpay.Client(api_uri=app.config['BTCPAY_URL'], pem=app.config['BTCPAY_PRIVATE_KEY'])
-except:
-  app.logger.warning("unable to create btcpay client. Capsul will work fine except cryptocurrency payments will not work. The error was: " + my_exec_info_message(sys.exc_info()))
+app.config['BTCPAY_ENABLED'] = False
+if app.config['BTCPAY_URL'] != "":
+  try:
+    response = requests.get(app.config['BTCPAY_URL'])
+    if response.status_code == 200:
+      app.config['BTCPAY_CLIENT'] = btcpay.Client(api_uri=app.config['BTCPAY_URL'], pem=app.config['BTCPAY_PRIVATE_KEY'])
+      app.config['BTCPAY_ENABLED'] = True
+    else:
+      app.logger.warning(f"Can't reach BTCPAY_URL {app.config['BTCPAY_URL']}: Response status code: {response.status_code}. Capsul will work fine except cryptocurrency payments will not work.")
+  except:
+    app.logger.warning("unable to create btcpay client. Capsul will work fine except cryptocurrency payments will not work. The error was: " + my_exec_info_message(sys.exc_info()))

 # only start the scheduler and attempt to migrate the database if we are running the app.
 # otherwise we are running a CLI command.
@ -219,7 +225,6 @@ def override_url_for():
  return dict(url_for=url_for_with_cache_bust)


-
 def url_for_with_cache_bust(endpoint, **values):
  """
  Add a query parameter based on the hash of the file, this acts as a cache bust
@ -244,7 +249,3 @@ def url_for_with_cache_bust(endpoint, **values):
      values['q'] = current_app.config['STATIC_FILE_HASH_CACHE'][filename]

  return url_for(endpoint, **values)
-
-
-
-  
--- a/capsulflask/admin.py
+++ b/capsulflask/admin.py
@ -17,9 +17,9 @@ bp = Blueprint("admin", __name__, url_prefix="/admin")
@bp.route("/")
@admin_account_required
 def index():
-  hosts = get_model().list_hosts_with_networks()
-  vms_by_host_and_network = get_model().all_non_deleted_vms_by_host_and_network()
-  network_display_width_px = float(500);
+  hosts = get_model().list_hosts_with_networks(None)
+  vms_by_host_and_network = get_model().non_deleted_vms_by_host_and_network(None)
+  network_display_width_px = float(270)
  #operations = get_model().list_all_operations()

  display_hosts = []
@ -35,26 +35,18 @@ def index():
    display_host = dict(name=host_id, networks=value['networks'])

    for network in display_host['networks']:
-      ipv4_network = ipaddress.ip_network(network["public_ipv4_cidr_block"], False)
-      network_start_int = -1
-      network_end_int = -1
-      i = 0
-      for ipv4_address in ipv4_network: 
-        i += 1
-        if i > 2:
-          if network_start_int == -1:
-            network_start_int = int(ipv4_address)
-          
-          network_end_int = int(ipv4_address)
-      
+
+      network_start_int = int(ipaddress.ip_address(network["public_ipv4_first_usable_ip"]))
+      network_end_int = int(ipaddress.ip_address(network["public_ipv4_last_usable_ip"]))
+
      network['allocations'] = []
-      network_addresses_width = float((network_end_int-network_start_int))
+      network_addresses_width = float((network_end_int-network_start_int)+1)

      if host_id in vms_by_host_and_network:
        if network['network_name'] in vms_by_host_and_network[host_id]:
          for vm in vms_by_host_and_network[host_id][network['network_name']]:
            ip_address_int = int(ipaddress.ip_address(vm['public_ipv4']))
-            if network_start_int < ip_address_int and ip_address_int < network_end_int:
+            if network_start_int <= ip_address_int and ip_address_int <= network_end_int:
              allocation = f"{host_id}_{network['network_name']}_{len(network['allocations'])}"
              inline_styles.append(
                f"""
--- a/capsulflask/cli.py
+++ b/capsulflask/cli.py
@ -62,6 +62,18 @@ def sql_script(f, c):

    model.connection.commit()

+@bp.cli.command('account-balance')
+@click.option('-u', help='users email address')
+@with_appcontext
+def account_balance(u):
+  vms = get_model().list_vms_for_account(u)
+  payments = get_model().list_payments_for_account(u)
+  click.echo(".")
+  click.echo(".")
+  click.echo(get_account_balance(vms, payments, datetime.utcnow()))
+  click.echo(".")
+
+

@bp.cli.command('cron-task')
@with_appcontext
--- a/capsulflask/console.py
+++ b/capsulflask/console.py
@ -199,6 +199,14 @@ def create():
  capacity_avaliable = current_app.config["HUB_MODEL"].capacity_avaliable(512*1024*1024)
  errors = list()

+  affordable_vm_sizes = dict()
+  for key, vm_size in vm_sizes.items():
+    # if a user deposits $7.50 and then creates an f1-s vm which costs 7.50 a month, 
+    # then they have to delete the vm and re-create it, they will not be able to, they will have to pay again.
+    # so for UX it makes a lot of sense to give a small margin of 25 cents for usability sake
+    if vm_size["dollars_per_month"] <= account_balance+0.25:
+      affordable_vm_sizes[key] = vm_size
+
  if request.method == "POST":
    if "csrf-token" not in request.form or request.form['csrf-token'] != session['csrf-token']:
      return abort(418, f"u want tea")
@ -209,6 +217,8 @@ def create():
      errors.append("Size is required")
    elif size not in vm_sizes:
      errors.append(f"Invalid size {size}")
+    elif size not in affordable_vm_sizes:
+      errors.append(f"Your account must have enough credit to run an {size} for 1 month before you will be allowed to create it")

    if not os:
      errors.append("OS is required")
@ -245,31 +255,21 @@ def create():

    if len(errors) == 0:
      id = make_capsul_id()
-      get_model().create_vm(
-        email=session["account"], 
-        id=id, 
-        size=size, 
-        os=os,
-        ssh_authorized_keys=list(map(lambda x: x["name"], posted_keys))
-      )
+      # we can't create the vm record in the DB yet because its IP address needs to be allocated first.
+      # so it will be created when the allocation happens inside the hub_api.
      current_app.config["HUB_MODEL"].create(
        email = session["account"],
        id=id,
+        os=os,
+        size=size,
        template_image_file_name=operating_systems[os]['template_image_file_name'],
        vcpus=vm_sizes[size]['vcpus'],
        memory_mb=vm_sizes[size]['memory_mb'],
-        ssh_authorized_keys=list(map(lambda x: x["content"], posted_keys))
+        ssh_authorized_keys=list(map(lambda x: dict(name=x['name'], content=x['content']), posted_keys)) 
      )
      
      return redirect(f"{url_for('console.index')}?created={id}")
  
-  affordable_vm_sizes = dict()
-  for key, vm_size in vm_sizes.items():
-    # if a user deposits $7.50 and then creates an f1-s vm which costs 7.50 a month, 
-    # then they have to delete the vm and re-create it, they will not be able to, they will have to pay again.
-    # so for UX it makes a lot of sense to give a small margin of 25 cents for usability sake
-    if vm_size["dollars_per_month"] <= account_balance+0.25:
-      affordable_vm_sizes[key] = vm_size

  for error in errors:
    flash(error)
@ -426,6 +426,7 @@ def account_balance():
    has_vms=len(vms_billed)>0, 
    vms_billed=vms_billed,
    warning_text=warning_text,
+    btcpay_enabled=current_app.config["BTCPAY_ENABLED"],
    payments=list(map(
      lambda x: dict(
        dollars=x["dollars"], 
--- a/capsulflask/db.py
+++ b/capsulflask/db.py
@ -43,7 +43,7 @@ def init_app(app, is_running_server):
  hasSchemaVersionTable = False
  actionWasTaken = False
  schemaVersion = 0
-  desiredSchemaVersion = 16
+  desiredSchemaVersion = 20

  cursor = connection.cursor()

--- a/capsulflask/db_model.py
+++ b/capsulflask/db_model.py
@ -1,4 +1,6 @@

+import re
+
 # I was never able to get this type hinting to work correctly 
 # from psycopg2.extensions import connection as Psycopg2Connection, cursor as Psycopg2Cursor
 from nanoid import generate
@ -56,8 +58,18 @@ class DBModel:

  #     ------    VM & ACCOUNT MANAGEMENT     ---------  

-  def all_non_deleted_vms_by_host_and_network(self):
-    self.cursor.execute("SELECT id, host, network_name, public_ipv4, public_ipv6 FROM vms WHERE deleted IS NULL")
+  def non_deleted_vms_by_host_and_network(self, host_id):
+    query = "SELECT id, host, network_name, public_ipv4, public_ipv6 FROM vms WHERE deleted IS NULL"
+    if host_id is None: 
+      self.cursor.execute(query)
+    else:
+      if not re.match(r"^[a-zA-Z0-9_-]+$", host_id):
+        raise ValueError(f"host_id \"{host_id}\" must match \"^[a-zA-Z0-9_-]+\"")
+
+      # I kept getting "TypeError: not all arguments converted during string formatting"
+      # when I was trying to mix python string templating with psycopg2 safe parameter passing. 
+      # so i just did all of it in python and check the user-provided data for safety myself (no sql injection).
+      self.cursor.execute(f"{query} AND host = '{host_id}'")

    hosts = dict()
    for row in self.cursor.fetchall():
@ -146,12 +158,12 @@ class DBModel:
      )
    self.connection.commit()

-  def create_vm(self, email, id, size, os, ssh_authorized_keys):
+  def create_vm(self, email, id, size, os, host, network_name, public_ipv4, ssh_authorized_keys):
    self.cursor.execute(""" 
-      INSERT INTO vms (email, id, size, os)
-      VALUES  (%s, %s, %s, %s)
+      INSERT INTO vms (email, id, size, os, host, network_name, public_ipv4)
+      VALUES  (%s, %s, %s, %s, %s, %s, %s)
      """, 
-      (email, id, size, os)
+      (email, id, size, os, host, network_name, public_ipv4)
    )
    
    for ssh_authorized_key in ssh_authorized_keys:
@ -318,18 +330,35 @@ class DBModel:

  #     ------    HOSTS     ---------  

-  def list_hosts_with_networks(self):
-    self.cursor.execute("""
-    SELECT hosts.id, hosts.last_health_check, host_network.network_name, host_network.public_ipv4_cidr_block FROM hosts
+  def list_hosts_with_networks(self, host_id: str):
+    query = """
+    SELECT hosts.id, hosts.last_health_check, host_network.network_name, 
+    host_network.public_ipv4_cidr_block, host_network.public_ipv4_first_usable_ip, host_network.public_ipv4_last_usable_ip
+    FROM hosts
    JOIN host_network ON host_network.host = hosts.id
-    """)
+    """
+    if host_id is None: 
+      self.cursor.execute(query)
+    else:
+      if not re.match(r"^[a-zA-Z0-9_-]+$", host_id):
+        raise ValueError(f"host_id \"{host_id}\" must match \"^[a-zA-Z0-9_-]+\"")
+
+      # I kept getting "TypeError: not all arguments converted during string formatting"
+      # when I was trying to mix python query string templating with psycopg2 safe parameter passing. 
+      # so i just did all of it in python and check the user-provided data for safety myself (no sql injection).
+      self.cursor.execute(f"{query} WHERE hosts.id = '{host_id}'")

    hosts = dict()
    for row in self.cursor.fetchall():
      if row[0] not in hosts:
        hosts[row[0]] = dict(last_health_check=row[1], networks=[])

-      hosts[row[0]]["networks"].append(dict(network_name=row[2], public_ipv4_cidr_block=row[3]))
+      hosts[row[0]]["networks"].append(dict(
+        network_name=row[2], 
+        public_ipv4_cidr_block=row[3], 
+        public_ipv4_first_usable_ip=row[4], 
+        public_ipv4_last_usable_ip=row[5]
+      ))

    return hosts

@ -379,6 +408,13 @@ class DBModel:
    self.connection.commit()
    return operation_id

+  def update_operation(self, operation_id: int, payload: str):
+    self.cursor.execute(
+      "UPDATE operations SET payload = %s WHERE id = %s", 
+      (payload, operation_id)
+    )
+    self.connection.commit()
+
  def update_host_operation(self, host_id: str, operation_id: int, assignment_status: str, result: str):
    if assignment_status and not result:
      self.cursor.execute(
@ -405,9 +441,20 @@ class DBModel:
    else:
      return None

-  def host_operation_exists(self, operation_id: int, host_id: str) -> bool:
-    self.cursor.execute("SELECT operation FROM host_operation WHERE host = %s AND operation = %s",(host_id, operation_id))
-    return len(self.cursor.fetchall()) != 0
+  def get_payload_json_from_host_operation(self, operation_id: int, host_id: str) -> str:
+    self.cursor.execute(
+      """
+        SELECT operations.payload FROM operations 
+          JOIN host_operation ON host_operation.operation = operations.id
+          WHERE host_operation.host = %s AND host_operation.operation = %s
+      """,
+      (host_id, operation_id)
+    )
+    row = self.cursor.fetchone()
+    if row:
+      return row[0]
+    else:
+      return None

  def claim_operation(self, operation_id: int, host_id: str) -> bool:
    # have to make a new cursor to set isolation level
--- a/capsulflask/hub_api.py
+++ b/capsulflask/hub_api.py
@ -1,7 +1,9 @@
+import json
+import ipaddress

 from flask import Blueprint
 from flask import current_app
-from flask import request
+from flask import request, make_response
 from werkzeug.exceptions import abort

 from capsulflask.db import get_model
@ -46,15 +48,134 @@ def heartbeat(host_id):
@bp.route("/claim-operation/<int:operation_id>/<string:host_id>", methods=("POST",))
 def claim_operation(operation_id: int, host_id: str):
  if authorized_for_host(host_id):
-    exists = get_model().host_operation_exists(operation_id, host_id)
-    if not exists:
-      return abort(404, "host operation not found")
+    payload_json = get_model().get_payload_json_from_host_operation(operation_id, host_id)
+    if payload_json is None:
+      error_message = f"{host_id} can't claim operation {operation_id} because host_operation row not found"
+      current_app.logger.error(error_message)
+      return abort(404, error_message)
+
+    # right now if there is a can_claim_handler there needs to be a corresponding on_claimed_handler.
+    # this is sole-ly due to laziness in error handling.
+    can_claim_handlers = {
+      "create": can_claim_create,
+    }
+    on_claimed_handlers = {
+      "create": on_create_claimed,
+    }
+    error_message = ""
+    payload = None
+    payload_is_dict = False
+    payload_has_type = False
+    payload_has_valid_type = False
+    try:
+      payload = json.loads(payload_json)
+      payload_is_dict = isinstance(payload, dict)
+      payload_has_type = payload_is_dict and 'type' in payload
+      payload_has_valid_type = payload_has_type and payload['type'] in can_claim_handlers
+      
+      if not payload_is_dict:
+        error_message = "invalid json: expected an object"
+      elif not payload_has_type:
+        error_message = "invalid json: 'type' field is required"
+      elif not payload_has_valid_type:
+        error_message = f"invalid json: expected type \"{payload['type']}\" to be one of [{', '.join(can_claim_handlers.keys())}]"
+    except:
+      error_message = "could not parse payload as json"
+
+    if error_message != "":
+      error_message = f"{host_id} can't claim operation {operation_id} because {error_message}"
+      current_app.logger.error(error_message)
+      return abort(400, error_message)
+
+    # we will only return this payload as json if claiming succeeds, so might as well do this now...
+    payload['assignment_status'] = 'assigned'
+
+    # invoke the appropriate can_claim_handler for this operation type
+    result_tuple = can_claim_handlers[payload['type']](payload, host_id)
+    modified_payload = result_tuple[0]
+    error_message = result_tuple[1]
+
+    if error_message != "":
+      error_message = f"{host_id} can't claim operation {operation_id} because {error_message}"
+      current_app.logger.error(error_message)
+      return abort(400, error_message)
+
    claimed = get_model().claim_operation(operation_id, host_id)
    if claimed:
-      return "ok"
+      modified_payload_json = json.dumps(modified_payload)
+      get_model().update_operation(operation_id, modified_payload_json)
+      on_claimed_handlers[payload['type']](modified_payload, host_id)
+      
+      response = make_response(modified_payload_json)
+      response.headers.set("Content-Type", "application/json")
+
+      return response
    else:
-      return abort(409, "operation was already assigned to another host")
+      return abort(409, f"operation was already assigned to another host")
  else:
    current_app.logger.warning(f"/hub/claim-operation/{operation_id}/{host_id} returned 401: invalid token")
    return abort(401, "invalid host id or token")

+def can_claim_create(payload, host_id) -> (str, str):
+
+  hosts = get_model().list_hosts_with_networks(host_id)
+
+  if host_id not in hosts:
+    return "", f"the host \"{host_id}\" does not appear to have any networks."
+
+  networks = hosts[host_id]['networks']
+
+  vms_by_host_and_network = get_model().non_deleted_vms_by_host_and_network(host_id)
+
+  vms_by_network = dict()
+  if host_id in vms_by_host_and_network:
+    vms_by_network = vms_by_host_and_network[host_id]
+
+  allocated_ipv4_address = None
+  allocated_network_name = None
+  for network in networks:
+    vms = []
+    if network["network_name"] in vms_by_network:
+      vms = vms_by_network[network["network_name"]]
+
+    claimed_ipv4s = dict()
+    for vm in vms:
+      claimed_ipv4s[vm['public_ipv4']] = True
+
+
+    ipv4_network = ipaddress.ip_network(network["public_ipv4_cidr_block"], False)
+    ipv4_first_usable_ip = network["public_ipv4_first_usable_ip"]
+    ipv4_last_usable_ip = network["public_ipv4_last_usable_ip"]
+        
+    for ipv4_address in ipv4_network: 
+      within_usable_range = ipv4_first_usable_ip <= str(ipv4_address) and str(ipv4_address) <= ipv4_last_usable_ip
+      if within_usable_range and str(ipv4_address) not in claimed_ipv4s:
+        allocated_ipv4_address = str(ipv4_address)
+        break 
+
+    if allocated_ipv4_address is not None:
+      allocated_network_name = network["network_name"]
+      break
+        
+  if allocated_network_name is None or allocated_ipv4_address is None:
+    return "", f"host \"{host_id}\" does not have any avaliable IP addresses on any of its networks."
+
+  # payload["network_name"] = allocated_network_name
+  # hard-code the network name for now until we can fix the phantom dhcp lease issues.
+
+  payload["network_name"] = 'public3'
+  payload["public_ipv4"] = allocated_ipv4_address
+
+  return payload, ""
+
+def on_create_claimed(payload, host_id):
+  get_model().create_vm(
+    email=payload['email'], 
+    id=payload['id'], 
+    size=payload['size'], 
+    os=payload['os'],
+    host=host_id,
+    network_name=payload['network_name'],
+    public_ipv4=payload['public_ipv4'],
+    ssh_authorized_keys=list(map(lambda x: x["name"], payload['ssh_authorized_keys'])),
+  )
--- a/capsulflask/hub_model.py
+++ b/capsulflask/hub_model.py
@ -17,6 +17,10 @@ from capsulflask.http_client import HTTPResult
 from capsulflask.shared import VirtualizationInterface, VirtualMachine, OnlineHost, validate_capsul_id, my_exec_info_message

 class MockHub(VirtualizationInterface):
+  def __init__(self):
+    self.default_network = "public1"
+    self.default_ipv4 = "1.1.1.1"
+
  def capacity_avaliable(self, additional_ram_bytes):
    return True

@ -29,17 +33,27 @@ class MockHub(VirtualizationInterface):
        {"key_type":"RSA", "content":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvotgzgEP65JUQ8S8OoNKy1uEEPEAcFetSp7QpONe6hj4wPgyFNgVtdoWdNcU19dX3hpdse0G8OlaMUTnNVuRlbIZXuifXQ2jTtCFUA2mmJ5bF+XjGm3TXKMNGh9PN+wEPUeWd14vZL+QPUMev5LmA8cawPiU5+vVMLid93HRBj118aCJFQxLgrdP48VPfKHFRfCR6TIjg1ii3dH4acdJAvlmJ3GFB6ICT42EmBqskz2MPe0rIFxH8YohCBbAbrbWYcptHt4e48h4UdpZdYOhEdv89GrT8BF2C5cbQ5i9qVpI57bXKrj8hPZU5of48UHLSpXG8mbH0YDiOQOfKX/Mt", "sha256":"ghee6KzRnBJhND2kEUZSaouk7CD6o6z2aAc8GPkV+GQ"},
        {"key_type":"ECDSA", "content":"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLLgOoATz9R4aS2kk7vWoxX+lshK63t9+5BIHdzZeFE1o+shlcf0Wji8cN/L1+m3bi0uSETZDOAWMP3rHLJj9Hk=", "sha256":"aCYG1aD8cv/TjzJL0bi9jdabMGksdkfa7R8dCGm1yYs"}
      ]""")
-      return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4="1.1.1.1", ssh_host_keys=ssh_host_keys)
+      return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4=self.default_ipv4, ssh_host_keys=ssh_host_keys)

-    return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4="1.1.1.1")
+    return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4=self.default_ipv4)

  def list_ids(self) -> list:
    return get_model().all_non_deleted_vm_ids()

-  def create(self, email: str, id: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list):
+  def create(self, email: str, id: str, os: str, size: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list):
    validate_capsul_id(id)
    current_app.logger.info(f"mock create: {id} for {email}")
    sleep(1)
+    get_model().create_vm(
+      email=email, 
+      id=id, 
+      size=size, 
+      os=os,
+      host=current_app.config["SPOKE_HOST_ID"],
+      network_name=self.default_network,
+      public_ipv4=self.default_ipv4,
+      ssh_authorized_keys=list(map(lambda x: x["name"], ssh_authorized_keys)),
+    )

  def destroy(self, email: str, id: str):
    current_app.logger.info(f"mock destroy: {id} for {email}")
@ -49,7 +63,6 @@ class MockHub(VirtualizationInterface):


 class CapsulFlaskHub(VirtualizationInterface):
-
  def synchronous_operation(self, hosts: List[OnlineHost], email: str, payload: str) -> List[HTTPResult]:
    return self.generic_operation(hosts, email, payload, True)[1]
  
@ -180,7 +193,7 @@ class CapsulFlaskHub(VirtualizationInterface):

    return to_return

-  def create(self, email: str, id: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list):
+  def create(self, email: str, id: str, os: str, size: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list):
    validate_capsul_id(id)
    online_hosts = get_model().get_online_hosts()
    #current_app.logger.debug(f"hub_model.create(): ${len(online_hosts)} hosts")
@ -188,6 +201,8 @@ class CapsulFlaskHub(VirtualizationInterface):
      type="create", 
      email=email, 
      id=id, 
+      os=os,
+      size=size,
      template_image_file_name=template_image_file_name, 
      vcpus=vcpus,
      memory_mb=memory_mb,
@ -213,8 +228,8 @@ class CapsulFlaskHub(VirtualizationInterface):
        # no need to do anything here since if it cant be parsed then generic_operation will handle it.
        pass
      
+    assigned_hosts_string = ", ".join(assigned_hosts)
    if number_of_assigned != 1:
-      assigned_hosts_string = ", ".join(assigned_hosts)
      raise ValueError(f"expected create capsul operation {operation_id} to be assigned to one host, it was assigned to {number_of_assigned} ({assigned_hosts_string})")
    if error_message != "":
      raise ValueError(f"create capsul operation {operation_id} on {assigned_hosts_string} failed with {error_message}")
@ -260,4 +275,3 @@ class CapsulFlaskHub(VirtualizationInterface):

    if not result_status == "success":
      raise ValueError(f"""failed to {command} vm "{id}" on host "{host.id}" for {email}: {result_json_string}""")
-
--- a/capsulflask/landing.py
+++ b/capsulflask/landing.py
@ -12,9 +12,11 @@ def index():

@bp.route("/pricing")
 def pricing():
+  vm_sizes = get_model().vm_sizes_dict()
  operating_systems = get_model().operating_systems_dict()
  return render_template(
    "pricing.html", 
+    vm_sizes=vm_sizes,
    operating_systems=operating_systems
  )

--- a/capsulflask/payment.py
+++ b/capsulflask/payment.py
@ -48,20 +48,29 @@ def validate_dollars():
 def btcpay_payment():
  errors = list()

+  if not current_app.config['BTCPAY_ENABLED']:
+    flash("BTCPay is not enabled on this server")
+    return redirect(url_for("console.account_balance"))
+
  if request.method == "POST":
    result = validate_dollars()
    errors = result[0]
    dollars = result[1]

    if len(errors) == 0:
-      invoice = current_app.config['BTCPAY_CLIENT'].create_invoice(dict(
-        price=float(dollars), 
-        currency="USD",
-        itemDesc="Capsul Cloud Compute",
-        transactionSpeed="high",
-        redirectURL=f"{current_app.config['BASE_URL']}/console/account-balance",
-        notificationURL=f"{current_app.config['BASE_URL']}/payment/btcpay/webhook"
-      ))
+      try:
+        invoice = current_app.config['BTCPAY_CLIENT'].create_invoice(dict(
+          price=float(dollars), 
+          currency="USD",
+          itemDesc="Capsul Cloud Compute",
+          transactionSpeed="high",
+          redirectURL=f"{current_app.config['BASE_URL']}/console/account-balance",
+          notificationURL=f"{current_app.config['BASE_URL']}/payment/btcpay/webhook"
+        ))
+      except:
+        current_app.logger.error(f"An error occurred while attempting to reach BTCPay Server: {my_exec_info_message(sys.exc_info())}")
+        flash("An error occurred while attempting to reach BTCPay Server.")
+        return redirect(url_for("console.account_balance"))

      current_app.logger.info(f"created btcpay invoice: {invoice}")

@ -289,4 +298,4 @@ def success():
 #   except stripe.error.SignatureVerificationError:
 #     print("/payment/stripe/webhook returned 400: invalid signature")
 #     abort(400, "invalid signature")
-      
+      
--- a/capsulflask/schema_migrations/16_up_managed_ips.sql
+++ b/capsulflask/schema_migrations/16_up_managed_ips.sql
@ -3,12 +3,12 @@ CREATE TABLE host_network (
  public_ipv4_cidr_block  TEXT NOT NULL,
  network_name       TEXT NOT NULL,
  host               TEXT NOT NULL REFERENCES hosts(id) ON DELETE RESTRICT,
-  PRIMARY KEY (host, network_name)
+  CONSTRAINT host_network_pkey PRIMARY KEY (host, network_name)
 );

-
 INSERT INTO host_network (host, network_name, public_ipv4_cidr_block) VALUES ('baikal', 'virbr1', '69.61.2.162/27'),
-                                                                             ('baikal', 'virbr2', '69.61.2.194/26');
+                                                                             ('baikal', 'virbr2', '69.61.2.194/26'),
+                                                                             ('baikal', 'virbr3', '69.61.38.193/26');
 ALTER TABLE vms RENAME COLUMN last_seen_ipv4 TO public_ipv4;
 ALTER TABLE vms RENAME COLUMN last_seen_ipv6 TO public_ipv6;
 ALTER TABLE vms ADD COLUMN network_name TEXT;
@ -18,7 +18,8 @@ UPDATE vms SET network_name = 'virbr2' WHERE public_ipv4 >= '69.61.2.192';

 ALTER TABLE vms ALTER COLUMN network_name SET NOT NULL;

-ALTER TABLE vms ADD FOREIGN KEY (host, network_name) REFERENCES host_network(host, network_name) ON DELETE RESTRICT;
+ALTER TABLE vms ADD CONSTRAINT vms_host_network_name_fkey FOREIGN KEY (host, network_name) 
+                                               REFERENCES host_network(host, network_name) ON DELETE RESTRICT;


 UPDATE schemaversion SET version = 16;
--- a/capsulflask/schema_migrations/17_down_bridge_and_network_name.sql
+++ b/capsulflask/schema_migrations/17_down_bridge_and_network_name.sql
@ -0,0 +1,18 @@
+
+
+ALTER TABLE vms DROP CONSTRAINT vms_host_network_name_fkey;
+
+UPDATE host_network SET network_name = 'virbr1' WHERE virtual_bridge_name = "virbr1";
+UPDATE host_network SET network_name = 'virbr2' WHERE virtual_bridge_name = "virbr1";
+UPDATE host_network SET network_name = 'virbr3' WHERE virtual_bridge_name = "virbr2";
+
+UPDATE vms SET network_name = 'virbr1' WHERE network_name = "public1";
+UPDATE vms SET network_name = 'virbr2' WHERE network_name = "public2";
+UPDATE vms SET network_name = 'virbr3' WHERE network_name = "public3";
+
+ALTER TABLE host_network DROP COLUMN virtual_bridge_name;
+
+ALTER TABLE vms ADD CONSTRAINT vms_host_network_name_fkey FOREIGN KEY (host, network_name) 
+                                               REFERENCES host_network(host, network_name) ON DELETE RESTRICT;
+
+UPDATE schemaversion SET version = 16;
--- a/capsulflask/schema_migrations/17_up_bridge_and_network_name.sql
+++ b/capsulflask/schema_migrations/17_up_bridge_and_network_name.sql
@ -0,0 +1,26 @@
+
+
+ALTER TABLE vms DROP CONSTRAINT vms_host_network_name_fkey;
+
+ALTER TABLE host_network RENAME COLUMN network_name TO virtual_bridge_name;
+
+ALTER TABLE host_network ADD COLUMN network_name TEXT;
+
+UPDATE host_network SET network_name = 'public1' WHERE virtual_bridge_name = 'virbr1';
+UPDATE host_network SET network_name = 'public2' WHERE virtual_bridge_name = 'virbr2';
+UPDATE host_network SET network_name = 'public3' WHERE virtual_bridge_name = 'virbr3';
+
+UPDATE vms SET network_name = 'public1' WHERE network_name = 'virbr1';
+UPDATE vms SET network_name = 'public2' WHERE network_name = 'virbr2';
+UPDATE vms SET network_name = 'public3' WHERE network_name = 'virbr3';
+
+ALTER TABLE host_network ALTER COLUMN network_name SET NOT NULL;
+
+ALTER TABLE host_network DROP CONSTRAINT host_network_pkey;
+ALTER TABLE host_network ADD CONSTRAINT host_network_pkey PRIMARY KEY (host, network_name);
+
+ALTER TABLE vms ADD CONSTRAINT vms_host_network_name_fkey FOREIGN KEY (host, network_name) 
+                                               REFERENCES host_network(host, network_name) ON DELETE RESTRICT;
+
+UPDATE schemaversion SET version = 17;
+
--- a/capsulflask/schema_migrations/18_down_start_ip_end_ip.sql
+++ b/capsulflask/schema_migrations/18_down_start_ip_end_ip.sql
@ -0,0 +1,6 @@
+
+
+ALTER TABLE host_network DROP COLUMN public_ipv4_first_usable_ip;
+ALTER TABLE host_network DROP COLUMN public_ipv4_last_usable_ip;
+
+UPDATE schemaversion SET version = 17;
--- a/capsulflask/schema_migrations/18_up_start_ip_end_ip.sql
+++ b/capsulflask/schema_migrations/18_up_start_ip_end_ip.sql
@ -0,0 +1,25 @@
+
+
+ALTER TABLE host_network ADD COLUMN public_ipv4_first_usable_ip TEXT;
+ALTER TABLE host_network ADD COLUMN public_ipv4_last_usable_ip TEXT;
+
+-- public1, 69.61.2.162/27
+UPDATE host_network 
+SET public_ipv4_first_usable_ip = '69.61.2.163', public_ipv4_last_usable_ip = '69.61.2.190' 
+WHERE network_name = 'public1';
+
+-- public2, 69.61.2.194/26
+UPDATE host_network 
+SET public_ipv4_first_usable_ip = '69.61.2.195', public_ipv4_last_usable_ip = '69.61.2.254' 
+WHERE network_name = 'public2';
+
+-- public3, 69.61.38.193/26
+UPDATE host_network 
+SET public_ipv4_first_usable_ip = '69.61.38.194', public_ipv4_last_usable_ip = '69.61.38.254' 
+WHERE network_name = 'public3';
+
+ALTER TABLE host_network ALTER COLUMN public_ipv4_first_usable_ip SET NOT NULL;
+ALTER TABLE host_network ALTER COLUMN public_ipv4_last_usable_ip SET NOT NULL;
+
+UPDATE schemaversion SET version = 18;
+
--- a/capsulflask/schema_migrations/19_down_os_updates.sql
+++ b/capsulflask/schema_migrations/19_down_os_updates.sql
@ -0,0 +1,8 @@
+DELETE FROM os_images WHERE id = 'guixsystem130';
+DELETE FROM os_images WHERE id = 'archlinux';
+UPDATE os_images SET deprecated = FALSE WHERE id = 'guixsystem120';
+UPDATE os_images SET deprecated = FALSE WHERE id = 'centos7';
+UPDATE os_images SET deprecated = FALSE WHERE id = 'centos8';
+UPDATE os_images SET description = 'Ubuntu 20.04 LTS (Fossa)' WHERE id = 'ubuntu20';
+
+UPDATE schemaversion SET version = 18;
--- a/capsulflask/schema_migrations/19_up_os_updates.sql
+++ b/capsulflask/schema_migrations/19_up_os_updates.sql
@ -0,0 +1,12 @@
+INSERT INTO os_images (id, template_image_file_name, description, deprecated)
+VALUES  ('guixsystem130', 'guixsystem/1.3.0/root.img.qcow2', 'Guix System 1.3.0', FALSE);
+INSERT INTO os_images (id, template_image_file_name, description, deprecated)
+VALUES  ('archlinux', 'archlinux/root.img.qcow2', 'Arch Linux', FALSE);
+
+UPDATE os_images SET deprecated = TRUE WHERE id = 'guixsystem120';
+UPDATE os_images SET deprecated = TRUE WHERE id = 'centos7';
+UPDATE os_images SET deprecated = TRUE WHERE id = 'centos8';
+UPDATE os_images SET description = 'Ubuntu 20.04 (Focal)' WHERE id = 'ubuntu20';
+
+
+UPDATE schemaversion SET version = 19;
--- a/capsulflask/schema_migrations/20_down_deferrable_constraints.sql
+++ b/capsulflask/schema_migrations/20_down_deferrable_constraints.sql
@ -0,0 +1,21 @@
+
+ALTER TABLE host_network ALTER CONSTRAINT host_network_host_fkey NOT DEFERRABLE;
+ALTER TABLE host_operation ALTER CONSTRAINT host_operation_host_fkey NOT DEFERRABLE;
+ALTER TABLE host_operation ALTER CONSTRAINT host_operation_operation_fkey NOT DEFERRABLE;
+ALTER TABLE login_tokens ALTER CONSTRAINT login_tokens_email_fkey NOT DEFERRABLE;
+ALTER TABLE operations ALTER CONSTRAINT operations_email_fkey NOT DEFERRABLE;
+ALTER TABLE payment_sessions ALTER CONSTRAINT payment_sessions_email_fkey NOT DEFERRABLE;
+ALTER TABLE payments ALTER CONSTRAINT payments_email_fkey NOT DEFERRABLE;
+ALTER TABLE ssh_public_keys ALTER CONSTRAINT ssh_public_keys_email_fkey NOT DEFERRABLE;
+ALTER TABLE unresolved_btcpay_invoices ALTER CONSTRAINT unresolved_btcpay_invoices_email_fkey NOT DEFERRABLE;
+ALTER TABLE unresolved_btcpay_invoices ALTER CONSTRAINT unresolved_btcpay_invoices_email_payment_id_fkey NOT DEFERRABLE;
+ALTER TABLE vm_ssh_authorized_key ALTER CONSTRAINT vm_ssh_public_key_email_ssh_public_key_name_fkey NOT DEFERRABLE;
+ALTER TABLE vm_ssh_authorized_key ALTER CONSTRAINT vm_ssh_public_key_email_vm_id_fkey NOT DEFERRABLE;
+ALTER TABLE vm_ssh_host_key ALTER CONSTRAINT vm_ssh_host_key_email_vm_id_fkey NOT DEFERRABLE;
+ALTER TABLE vms ALTER CONSTRAINT vms_email_fkey NOT DEFERRABLE;
+ALTER TABLE vms ALTER CONSTRAINT vms_host_network_name_fkey NOT DEFERRABLE;
+ALTER TABLE vms ALTER CONSTRAINT vms_host_fkey NOT DEFERRABLE;
+ALTER TABLE vms ALTER CONSTRAINT vms_os_fkey NOT DEFERRABLE;
+ALTER TABLE vms ALTER CONSTRAINT vms_size_fkey NOT DEFERRABLE;
+
+UPDATE schemaversion SET version = 19;
--- a/capsulflask/schema_migrations/20_up_deferrable_constraints.sql
+++ b/capsulflask/schema_migrations/20_up_deferrable_constraints.sql
@ -0,0 +1,21 @@
+
+ALTER TABLE host_network ALTER CONSTRAINT host_network_host_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE host_operation ALTER CONSTRAINT host_operation_host_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE host_operation ALTER CONSTRAINT host_operation_operation_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE login_tokens ALTER CONSTRAINT login_tokens_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE operations ALTER CONSTRAINT operations_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE payment_sessions ALTER CONSTRAINT payment_sessions_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE payments ALTER CONSTRAINT payments_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE ssh_public_keys ALTER CONSTRAINT ssh_public_keys_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE unresolved_btcpay_invoices ALTER CONSTRAINT unresolved_btcpay_invoices_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE unresolved_btcpay_invoices ALTER CONSTRAINT unresolved_btcpay_invoices_email_payment_id_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vm_ssh_authorized_key ALTER CONSTRAINT vm_ssh_public_key_email_ssh_public_key_name_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vm_ssh_authorized_key ALTER CONSTRAINT vm_ssh_public_key_email_vm_id_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vm_ssh_host_key ALTER CONSTRAINT vm_ssh_host_key_email_vm_id_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vms ALTER CONSTRAINT vms_email_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vms ALTER CONSTRAINT vms_host_network_name_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vms ALTER CONSTRAINT vms_host_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vms ALTER CONSTRAINT vms_os_fkey DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE vms ALTER CONSTRAINT vms_size_fkey DEFERRABLE INITIALLY DEFERRED;
+
+UPDATE schemaversion SET version = 20;
--- a/capsulflask/shell_scripts/capacity-avaliable.sh
+++ b/capsulflask/shell_scripts/capacity-avaliable.sh
@ -19,9 +19,9 @@ if [ "$ram_bytes_remainder" -le $((20 * 1024 * 1024 * 1024)) ]; then
  exit 1
 fi

-ipv4_limit=28
-used_ips=$(grep ip-add "/var/lib/libvirt/dnsmasq/virbr1.status" | cut -d '"' -f 4)
-reserved_ips=$(cat "/var/lib/libvirt/dnsmasq/public1.hostsfile" | cut -d ',' -f 2)
+ipv4_limit=61
+used_ips=$(grep ip-add "/var/lib/libvirt/dnsmasq/virbr3.status" | cut -d '"' -f 4)
+reserved_ips=$(cat "/var/lib/libvirt/dnsmasq/public3.hostsfile" | cut -d ',' -f 2)
 total_addresses_used=$(printf "$used_ips\n$reserved_ips" | sort | uniq | wc -l)
 ipv4_count=$(printf "$total_addresses_used")

--- a/capsulflask/shell_scripts/create.sh
+++ b/capsulflask/shell_scripts/create.sh
@ -9,6 +9,8 @@ template_file="/tank/img/$2"
 vcpus="$3"
 memory="$4"
 pubkeys="$5"
+network_name="$6"
+public_ipv4="$7"
 root_volume_size="25G"

 if echo "$vmname" | grep -vqE '^capsul-[a-z0-9]{10}$'; then
@ -38,6 +40,16 @@ echo "$pubkeys" | while IFS= read -r line; do
  fi
 done

+if echo "$network_name" | grep -vqE "^[a-zA-Z0-9_-]+"; then
+  echo "network_name \"$network_name\" must match ^[a-zA-Z0-9_-]+"
+  exit 1
+fi
+
+if echo "$public_ipv4" | grep -vqE "^[0-9.]+$"; then
+  echo "public_ipv4 \"$public_ipv4\" must match ^[0-9.]+$"
+  exit 1
+fi
+
 disk="/tank/vm/$vmname.qcow2"
 cdrom="/tank/vm/$vmname.iso"
 xml="/tank/vm/$vmname.xml"
@ -66,7 +78,7 @@ virt-install \
    --os-variant generic \
    --virt-type kvm \
    --graphics vnc,listen=127.0.0.1 \
-    --network network=public1,filterref=clean-traffic,model=virtio \
+    --network network=$network_name,filterref=clean-traffic,model=virtio \
    --import \
    --print-xml > "$xml"

--- a/capsulflask/spoke_api.py
+++ b/capsulflask/spoke_api.py
@ -104,7 +104,7 @@ def handle_create(operation_id, request_body):
    current_app.logger.error(f"/hosts/operation returned 400: operation_id is required for create ")
    return abort(400, f"bad request; operation_id is required. try POST /spoke/operation/<id>")

-  parameters = ["email", "id", "template_image_file_name", "vcpus", "memory_mb", "ssh_authorized_keys"]
+  parameters = ["email", "id", "os", "size", "template_image_file_name", "vcpus", "memory_mb", "ssh_authorized_keys"]
  error_message = ""
  for parameter in parameters:
    if parameter not in request_body:
@ -115,14 +115,28 @@ def handle_create(operation_id, request_body):
    return abort(400, f"bad request; {error_message}")

  # only one host should create the vm, so we first race to assign this create operation to ourselves.
-  # only one host will win this race
+  # only one host will win this race.
  authorization_header = f"Bearer {current_app.config['SPOKE_HOST_TOKEN']}"
  url = f"{current_app.config['HUB_URL']}/hub/claim-operation/{operation_id}/{current_app.config['SPOKE_HOST_ID']}"
  result = current_app.config['HTTP_CLIENT'].do_http_sync(url, body=None, authorization_header=authorization_header)

  assignment_status = ""
  if result.status_code == 200:
-    assignment_status = "assigned"
+    try:
+      assignment_info = json.loads(result.body)
+      if not isinstance(assignment_info, dict):
+        return abort(503, f"hub at '{url}' returned 200, but did not return assignment_info json object")
+      if 'network_name' not in assignment_info:
+        return abort(503, f"hub at '{url}' returned 200, but the returned assignment_info object did not include network_name")
+      if 'public_ipv4' not in assignment_info:
+        return abort(503, f"hub at '{url}' returned 200, but the returned assignment_info object did not include public_ipv4")
+
+      assignment_status = "assigned"
+      request_body['network_name'] = assignment_info['network_name']
+      request_body['public_ipv4'] = assignment_info['public_ipv4']
+    except:
+      return abort(503, f"hub at '{url}' returned 200, but did not return valid json")
+    
  elif result.status_code == 409:
    assignment_status = "assigned_to_other_host"
  else:
@ -137,7 +151,9 @@ def handle_create(operation_id, request_body):
        template_image_file_name=request_body['template_image_file_name'],
        vcpus=request_body['vcpus'],
        memory_mb=request_body['memory_mb'],
-        ssh_authorized_keys=request_body['ssh_authorized_keys'],
+        ssh_authorized_keys=list(map(lambda x: x['content'], request_body['ssh_authorized_keys'])),
+        network_name=request_body['network_name'],
+        public_ipv4=request_body['public_ipv4'],
      )
    except:
      error_message = my_exec_info_message(sys.exc_info())
@ -147,7 +163,11 @@ def handle_create(operation_id, request_body):
      params=  f"{params} vcpus='{request_body['vcpus'] if 'vcpus' in request_body else 'KeyError'}', "
      params=  f"{params} memory_mb='{request_body['memory_mb'] if 'memory_mb' in request_body else 'KeyError'}', "
      params=  f"{params} ssh_authorized_keys='{request_body['ssh_authorized_keys'] if 'ssh_authorized_keys' in request_body else 'KeyError'}', "
+      params=  f"{params} network_name='{request_body['network_name'] if 'network_name' in request_body else 'KeyError'}', "
+      params=  f"{params} public_ipv4='{request_body['public_ipv4'] if 'public_ipv4' in request_body else 'KeyError'}', "
+      
      current_app.logger.error(f"spoke_model.create({params}) failed: {error_message}")
+
      return jsonify(dict(assignment_status=assignment_status, error_message=error_message))

  return jsonify(dict(assignment_status=assignment_status))
@ -162,7 +182,10 @@ def handle_destroy(operation_id, request_body):
    return abort(400, f"bad request; email is required for destroy")

  try:
-    current_app.config['SPOKE_MODEL'].destroy(id=request_body['id'], email=request_body['email'])
+    vm = current_app.config['SPOKE_MODEL'].get(request_body['id'], False)
+    current_app.logger.warning(f"destroy {request_body['id']} was called for {request_body['email']}, however the vm does not exist. returning success. ")
+    if vm is not None:
+      current_app.config['SPOKE_MODEL'].destroy(id=request_body['id'], email=request_body['email'])
  except:
    error_message = my_exec_info_message(sys.exc_info())
    params =          f"email='{request_body['email'] if 'email' in request_body else 'KeyError'}', "
--- a/capsulflask/spoke_model.py
+++ b/capsulflask/spoke_model.py
@ -14,28 +14,37 @@ from capsulflask.shared import VirtualizationInterface, VirtualMachine, validate


 class MockSpoke(VirtualizationInterface):
+
+  def __init__(self):
+    self.capsuls = dict()
+
  def capacity_avaliable(self, additional_ram_bytes):
    return True

  def get(self, id, get_ssh_host_keys):
    validate_capsul_id(id)

+    ipv4 = "1.1.1.1"
+    if id in self.capsuls:
+      ipv4 = self.capsuls[id]['public_ipv4']
+
    if get_ssh_host_keys:
      ssh_host_keys = json.loads("""[
        {"key_type":"ED25519", "content":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8cna0zeKSKl/r8whdn/KmDWhdzuWRVV0GaKIM+eshh", "sha256":"V4X2apAF6btGAfS45gmpldknoDX0ipJ5c6DLfZR2ttQ"},
        {"key_type":"RSA", "content":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvotgzgEP65JUQ8S8OoNKy1uEEPEAcFetSp7QpONe6hj4wPgyFNgVtdoWdNcU19dX3hpdse0G8OlaMUTnNVuRlbIZXuifXQ2jTtCFUA2mmJ5bF+XjGm3TXKMNGh9PN+wEPUeWd14vZL+QPUMev5LmA8cawPiU5+vVMLid93HRBj118aCJFQxLgrdP48VPfKHFRfCR6TIjg1ii3dH4acdJAvlmJ3GFB6ICT42EmBqskz2MPe0rIFxH8YohCBbAbrbWYcptHt4e48h4UdpZdYOhEdv89GrT8BF2C5cbQ5i9qVpI57bXKrj8hPZU5of48UHLSpXG8mbH0YDiOQOfKX/Mt", "sha256":"ghee6KzRnBJhND2kEUZSaouk7CD6o6z2aAc8GPkV+GQ"},
        {"key_type":"ECDSA", "content":"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLLgOoATz9R4aS2kk7vWoxX+lshK63t9+5BIHdzZeFE1o+shlcf0Wji8cN/L1+m3bi0uSETZDOAWMP3rHLJj9Hk=", "sha256":"aCYG1aD8cv/TjzJL0bi9jdabMGksdkfa7R8dCGm1yYs"}
      ]""")
-      return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4="1.1.1.1", state="running", ssh_host_keys=ssh_host_keys)
+      return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4=ipv4, state="running", ssh_host_keys=ssh_host_keys)

-    return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4="1.1.1.1", state="running")
+    return VirtualMachine(id, current_app.config["SPOKE_HOST_ID"], ipv4=ipv4, state="running")

  def list_ids(self) -> list:
    return get_model().all_non_deleted_vm_ids()

-  def create(self, email: str, id: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list):
+  def create(self, email: str, id: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list, network_name: str, public_ipv4: str):
    validate_capsul_id(id)
    current_app.logger.info(f"mock create: {id} for {email}")
+    self.capsuls[id] = dict(email=email, id=id, network_name=network_name, public_ipv4=public_ipv4)
    sleep(1)

  def destroy(self, email: str, id: str):
@ -129,7 +138,7 @@ class ShellScriptSpoke(VirtualizationInterface):
    self.validate_completed_process(completedProcess)
    return list(map(lambda x: x.decode("utf-8"), completedProcess.stdout.splitlines() ))

-  def create(self, email: str, id: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list):
+  def create(self, email: str, id: str, template_image_file_name: str, vcpus: int, memory_mb: int, ssh_authorized_keys: list, network_name: str, public_ipv4: str):
    validate_capsul_id(id)

    if not re.match(r"^[a-zA-Z0-9/_.-]+$", template_image_file_name):
@ -139,12 +148,18 @@ class ShellScriptSpoke(VirtualizationInterface):
      if not re.match(r"^(ssh|ecdsa)-[0-9A-Za-z+/_=@:. -]+$", ssh_authorized_key):
        raise ValueError(f"ssh_authorized_key \"{ssh_authorized_key}\" must match \"^(ssh|ecdsa)-[0-9A-Za-z+/_=@:. -]+$\"")

-    if vcpus < 1 or vcpus > 8:
+    if isinstance(vcpus, int) and (vcpus < 1 or vcpus > 8):
      raise ValueError(f"vcpus \"{vcpus}\" must match 1 <= vcpus <= 8")

-    if memory_mb < 512 or memory_mb > 16384:
+    if isinstance(memory_mb, int) and (memory_mb < 512 or memory_mb > 16384):
      raise ValueError(f"memory_mb \"{memory_mb}\" must match 512 <= memory_mb <= 16384")

+    if not re.match(r"^[a-zA-Z0-9_-]+$", network_name):
+      raise ValueError(f"network_name \"{network_name}\" must match \"^[a-zA-Z0-9_-]+\"")
+
+    if not re.match(r"^[0-9.]+$", public_ipv4):
+      raise ValueError(f"public_ipv4 \"{public_ipv4}\" must match \"^[0-9.]+$\"")
+
    ssh_keys_string = "\n".join(ssh_authorized_keys)

    completedProcess = run([
@ -153,7 +168,9 @@ class ShellScriptSpoke(VirtualizationInterface):
      template_image_file_name,
      str(vcpus),
      str(memory_mb),
-      ssh_keys_string
+      ssh_keys_string,
+      network_name,
+      public_ipv4
    ], capture_output=True)

    self.validate_completed_process(completedProcess, email)
@ -166,6 +183,8 @@ class ShellScriptSpoke(VirtualizationInterface):
      vcpus={str(vcpus)}
      memory={str(memory_mb)}
      ssh_authorized_keys={ssh_keys_string}
+      network_name={network_name}
+      public_ipv4={public_ipv4}
    """

    if not status == "success":
--- a/capsulflask/static/style.css
+++ b/capsulflask/static/style.css
@ -241,7 +241,6 @@ thead {
  background: #bdc7b812;
 }
 td, th {
-
  padding: 0.1em 1em;
 }
 table.small td, table.small th {
@ -378,4 +377,4 @@ footer {
  border: 1px solid rgba(255, 223, 155, 0.8);
  box-sizing: border-box;
  position: relative;
-}
+}
--- a/capsulflask/templates/account-balance.html
+++ b/capsulflask/templates/account-balance.html
@ -46,7 +46,9 @@
            <a href="/payment/stripe">Add funds with Credit/Debit (stripe)</a>
            <ul><li>notice: stripe will load nonfree javascript </li></ul>
          </li>
+          {% if btcpay_enabled %}
          <li><a href="/payment/btcpay">Add funds with Bitcoin/Litecoin/Monero (btcpay)</a></li>
+          {% endif %}
    
          <li>Cash: email <a href="mailto:treasurer@cyberia.club">treasurer@cyberia.club</a></li>
        </ul>
--- a/capsulflask/templates/faq.html
+++ b/capsulflask/templates/faq.html
@ -23,6 +23,7 @@
     How do I log in?
     <p>ssh to the ip provided to you using the cyberian user.</p>
     <pre class='code'>$ ssh cyberian@1.2.3.4</pre>
+     <p>For more information, see <a href="/about-ssh">Understanding the Secure Shell Protocol (SSH)</a>.</p>
   </li>
   <li>
     How do I change to the root user?
--- a/capsulflask/templates/pricing.html
+++ b/capsulflask/templates/pricing.html
@ -6,21 +6,37 @@
  <div class="row third-margin">
    <h1>CAPSUL TYPES & PRICING</h1>
  </div>
+  <div class="row half-margin">
+    <table>
+      <thead>
+        <tr>
+          <th>type</th>
+          <th>monthly*</th>
+          <th>cpus</th>
+          <th>mem</th>
+          <th>ssd</th>
+          <th>net</th>
+        </tr>
+      </thead>
+      <tbody>
+      {% for vm_size_key, vm_size in vm_sizes.items() %}
+        <tr>
+          <td>{{ vm_size_key }}</td>
+          <td>${{ vm_size['dollars_per_month'] }}</td>
+          <td>{{ vm_size['vcpus'] }}</td>
+          <td>{{ vm_size['memory_mb'] }}</td>
+          <td>25G</td>
+          <td>{{ vm_size['bandwidth_gb_per_month'] }}</td>
+        </tr>
+      {% endfor %}
+      </tbody>
+    </table>
+  </div>
  <div class="row half-margin">
    <pre>
-    type     monthly*  cpus  mem     ssd   net*
-    -----    -------   ----  ---     ---   ---
-    f1-xs    $5.00     1     512M    25G   .5TB
-    f1-s     $7.50     1     1024M   25G   1TB
-    f1-m     $12.50    1     2048M   25G   2TB
-    f1-l     $20.00    2     3072M   25G   3TB
-    f1-x     $27.50    3     4096M   25G   4TB
-    f1-xx    $50.00    4     8192M   25G   5TB
-
    * net is calculated as a per-month average
    * vms are billed for a minimum of 24 hours upon creation
    * all VMs come standard with one public IPv4 address
-  
    
    SUPPORTED OPERATING SYSTEMS:

--- a/capsulflask/templates/support.html
+++ b/capsulflask/templates/support.html
@ -7,18 +7,11 @@
    <h1>SUPPORT</h1>
  </div>
  <div class="row half-margin">
-    <a href="mailto:support@cyberia.club?subject=Please%20help!">support@cyberia.club</a> 
+    <a href="mailto:support@cyberia.club?subject=capsul%20support%20request">support@cyberia.club</a>
  </div>
 {% endblock %}

 {% block subcontent %}
-<p>
-  Note: We maintain a searchable archive of all support emails at 
-  <a href="https://lists.cyberia.club/~cyberia/support">https://lists.cyberia.club/~cyberia/support</a>
-</p>
-<p>
-  If you do not want your mail to appear in a public archive, email <a href="mailto:capsul@cyberia.club?subject=Please%20help!">capsul@cyberia.club</a> instead.
-</p>
 <p>
  Please describe your problem or feature request, and we will do our best to get back to you promptly. Thank you very much.
 </p>
--- a/docs/architecture.md
+++ b/docs/architecture.md
@ -0,0 +1,30 @@
+# hub-and-spoke architecture
+
+The "Hub" runs the web application and talks to the Postrges database, while the "Spoke"s are responsible for creating/managing virtual machines. One instance of the capsul-flask application can run in hub mode and spoke mode at the same time. 
+
+The Hub and the Spoke must be configured to communicate securely with each-other over HTTPS. They both have to be able to dial each-other directly.  The URLs / auth tokens they use are configured both in the config file (`HUB_URL`, `SPOKE_HOST_ID`, `SPOKE_HOST_TOKEN` and `HUB_TOKEN`) and in the database (the `id`, `https_url`, and `token` columns in the `hosts` table).
+
+![](images/hub-and-spoke1.png)
+
+This diagram was created with https://app.diagrams.net/.
+To edit it, download the <a download href="readme/hub-and-spoke.xml">diagram file</a> and edit it with the https://app.diagrams.net/ web application, or you may run the application from [source](https://github.com/jgraph/drawio) if you wish.
+
+right now I have 2 types of operations, immediate mode and async.
+
+both types of operations do assignment synchronously. so if the system cant assign the operation to one or more hosts (spokes),
+or whatever the operation requires, then it will fail. 
+
+some operations tolerate partial failures, like, `capacity_avaliable` will succeed if at least one spoke succeeds.
+for immediate mode requests (like `list`, `capacity_avaliable`, `destroy`), assignment and completion of the operation are the same thing.
+
+for async ones, they can be assigned without knowing whether or not they succeeded (`create`).
+
+![](images/hub-and-spoke2.png)
+
+This diagram was created with https://app.diagrams.net/.
+To edit it, download the <a download href="readme/hub-and-spoke.xml">diagram file</a> and edit it with the https://app.diagrams.net/ web application, or you may run the application from [source](https://github.com/jgraph/drawio) if you wish.
+
+if you issue a create, and it technically could go to any number of hosts, but only one host responds, it will succeed 
+but if you issue a create and somehow 2 hosts both think they own that task, it will fail and throw a big error. cuz it expects exactly 1 to own the create task
+
+currently its not set up to do any polling.  its not really like a queue at all. It's all immediate for the most part 
--- a/docs/btcpay.md
+++ b/docs/btcpay.md
@ -0,0 +1,68 @@
+## <a name="BTCPAY_PRIVATE_KEY"></a>Setting up the BTCPAY_PRIVATE_KEY 
+
+Generate a private key and the accompanying bitpay SIN for the btcpay API client. 
+
+I used this code as an example: https://github.com/bitpay/bitpay-python/blob/master/bitpay/key_utils.py#L6
+
+```
+$ pipenv run python ./readme/generate_btcpay_keys.py
+```
+
+It should output something looking like this:
+
+```
+-----BEGIN EC PRIVATE KEY-----
+EXAMPLEIArx/EXAMPLEKH23EXAMPLEsYXEXAMPLE5qdEXAMPLEcFHoAcEXAMPLEK
+oUQDQgAEnWs47PT8+ihhzyvXX6/yYMAWWODluRTR2Ix6ZY7Z+MV7v0W1maJzqeqq
+NQ+cpBvPDbyrDk9+Uf/sEaRCma094g==
+-----END EC PRIVATE KEY-----
+
+
+EXAMPLEwzAEXAMPLEEXAMPLEURD7EXAMPLE
+```
+
+In order to register the key with the btcpay server, you have to first generate a pairing token using the btcpay server interface.
+This requires your btcpay server account to have access to the capsul store. Ask Cass about this.
+
+Navigate to `Manage store: Access Tokens` at: `https://btcpay.cyberia.club/stores/<store-id>/Tokens`
+
+![](images/btcpay_sin_pairing.jpg)
+
+
+Finally, send an http request to the btcpay server to complete the pairing:
+
+```
+curl -H "Content-Type: application/json" https://btcpay.cyberia.club/tokens -d "{'id': 'EXAMPLEwzAEXAMPLEEXAMPLEURD7EXAMPLE', 'pairingCode': 'XXXXXXX'}"
+```
+
+It should respond with a token: 
+
+```
+{"data":[{"policies":[],"pairingCode":"XXXXXXX","pairingExpiration":1589473817597,"dateCreated":1589472917597,"facade":"merchant","token":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","label":"capsulflask"}]}
+```
+
+And you should see the token in the btcpay server UI:
+
+![](images/paired.jpg)
+
+Now simply set your `BTCPAY_PRIVATE_KEY` variable in `.env`
+
+NOTE: make sure to use single quotes and replace the new lines with \n.
+
+```
+BTCPAY_PRIVATE_KEY='-----BEGIN EC PRIVATE KEY-----\nEXAMPLEIArx/EXAMPLEKH23EXAMPLEsYXEXAMPLE5qdEXAMPLEcFHoAcEXAMPLEK\noUQDQgAEnWs47PT8+ihhzyvXX6/yYMAWWODluRTR2Ix6ZY7Z+MV7v0W1maJzqeqq\nNQ+cpBvPDbyrDk9+Uf/sEaRCma094g==\n-----END EC PRIVATE KEY-----'
+```
+
+-----
+
+## <a name="testing"></a>testing cryptocurrency payments
+
+I used litecoin to test cryptocurrency payments, because its the simplest & lowest fee cryptocurrency that BTCPay server supports. You can download the easy-to-use litecoin SPV wallet `electrum-ltc` from [github.com/pooler/electrum-ltc](https://github.com/pooler/electrum-ltc) or [electrum-ltc.org](https://electrum-ltc.org/), set up a wallet, and then either purchase some litecoin from an exchange, or [ask Forest for some litecoin](https://sequentialread.com/capsul-rollin-onwards-with-a-web-application/#sqr-comment-container) to use for testing.
+
+
+## <a name="0_conf_diagram"></a>sequence diagram explaining how BTC payment process works (how we accept 0-confirmation transactions 😀)
+
+![btcpayment_process](images/btcpayment_process.png)
+
+This diagram was created with https://app.diagrams.net/.
+To edit it, download the <a download href="readme/btcpayment_process.drawio">diagram file</a> and edit it with the https://app.diagrams.net/ web application, or you may run the application from [source](https://github.com/jgraph/drawio) if you wish.
--- a/docs/capsul.webp
+++ b/docs/capsul.webp
--- a/docs/configuration.md
+++ b/docs/configuration.md
@ -0,0 +1,89 @@
+# Configuring Capsul-Flask
+
+Create a `.env` file to set up the application configuration:
+
+```
+nano .env
+```
+
+You can enter any environment variables referenced in [`__init__.py`](../capsulflask/__init__.py) to this file.
+
+For example you may enter your SMTP credentials like this:
+```
+MAIL_USERNAME=forest@nullhex.com
+MAIL_DEFAULT_SENDER=forest@nullhex.com
+MAIL_PASSWORD=**************
+```
+
+## <a name="example"></a>Example configuration from capsul.org (production):
+
+```
+#LOG_LEVEL=DEBUG
+
+BASE_URL="https://capsul.org"
+
+# hub url is used by the SPOKE_MODE to contact the hub. Since this server is the hub,
+# this is fine. In fact it runs into problems (routing related?) when I set it to capsul.org.
+# similarly the baikal "spoke" (set up in the hosts table in the db) has "http://localhost:5000" as the https_url
+HUB_URL="http://localhost:5000"
+
+HUB_MODE_ENABLED="t"
+SPOKE_MODE_ENABLED="t"
+HUB_MODEL="capsul-flask"
+SPOKE_MODEL="shell-scripts"
+SPOKE_HOST_ID="baikal"
+SPOKE_HOST_TOKEN="<redacted>"
+HUB_TOKEN="<redacted>"
+
+# smtp.. see https://flask-mail.readthedocs.io/en/latest/#configuring-flask-mail
+MAIL_SERVER="smtp.nullhex.com"
+
+# MAIL_USE_SSL means SMTP with STARTTLS
+MAIL_USE_SSL=true
+
+# MAIL_USE_TLS means SMTP wrapped in TLS
+MAIL_USE_TLS=false
+
+MAIL_PORT="465"
+MAIL_USERNAME="capsul@nullhex.com"
+MAIL_PASSWORD="<redacted>"
+MAIL_DEFAULT_SENDER="capsul@nullhex.com"
+
+# stripe
+STRIPE_SECRET_KEY="sk_live_<redacted>"
+STRIPE_PUBLISHABLE_KEY="pk_live_tGDHY7kBwqC71b4F0N7LZdGl00GZOw0iNJ"
+
+# internal
+SECRET_KEY="<redacted>"
+POSTGRES_CONNECTION_PARAMETERS="sslmode=verify-full sslrootcert=letsencrypt-root-ca.crt host=postgres.cyberia.club port=5432 ...<redacted>"
+
+
+# btcpay server
+BTCPAY_URL="https://beeteeceepae2.cyberia.club"
+BTCPAY_PRIVATE_KEY='-----BEGIN EC PRIVATE KEY-----\n<redacted>\n-----END EC PRIVATE KEY-----'
+```
+
+## <a name="config_that_lives_in_db"></a>Configuration-type-stuff that lives in the database 
+
+  - `hosts` table:
+    - `id` (corresponds to `SPOKE_HOST_ID` in the config)
+    - `https_url`
+    - `token` (corresponds to `SPOKE_HOST_TOKEN` in the config)
+  - `os_images` table:
+    - `id` 
+    - `template_image_file_name`
+    - `description`
+    - `deprecated`
+  - `vm_sizes` table:
+    - `id` 
+    - `dollars_per_month`
+    - `memory_mb`
+    - `vcpus`
+    - `bandwidth_gb_per_month`
+    
+## <a name="docker_secrets"></a>Loading variables from files (docker secrets)
+
+To support [Docker Secrets](https://docs.docker.com/engine/swarm/secrets/), you can also load secret values from files – for example, to load `MAIL_PASSWORD` from `/run/secrets/mail_password`, set
+```sh
+MAIL_PASSWORD_FILE=/run/secrets/mail_password
+```
--- a/docs/database.md
+++ b/docs/database.md
@ -0,0 +1,67 @@
+# capsul-flask's relationship to its Database Server
+
+Capsul has a ["hub and spoke" architecture](./architecture.md). The "Hub" runs the web application and talks to the Postrges database, while the "Spoke"s are responsible for creating/managing virtual machines. One instance of the capsul-flask application can run in both hub mode and spoke mode at the same time, however there must only be one instance of the app running in "Hub" mode at any given time.
+
+The Postgres connections parameters are [configurable](./configuration.md).
+
+## <a name="schema_management"></a>Database schema management (schema versions)
+
+capsul-flask has a concept of a schema version. When the application starts, it will query the database for a table named `schemaversion` that has one row and one column (`version`). If the `version` it finds is not equal to the `desiredSchemaVersion` variable set in `db.py`, it will run  migration scripts from the `schema_migrations` folder one by one until the `schemaversion` table shows the correct version.
+
+For example, the script named `02_up_xyz.sql` should contain code that migrates the database from schema version 1 to schema version 2. Likewise, the script `02_down_xyz.sql` should contain code that migrates from schema version 2 back to schema version 1.
+
+**IMPORTANT: if you need to make changes to the schema, make a NEW schema version. DO NOT EDIT the existing schema versions.**
+
+In general, for safety, schema version upgrades should not delete data. Schema version downgrades will simply throw an error and exit for now. 
+
+## <a name="manual_queries"></a>Running manual database queries
+
+You can manually mess around with the database like this:
+
+```
+pipenv run flask cli sql -f test.sql
+```
+
+```
+pipenv run flask cli sql -c 'SELECT * FROM vms'
+```
+
+This one selects the vms table with the column name header:
+
+```
+pipenv run flask cli sql -c "SELECT string_agg(column_name::text, ', ') from information_schema.columns WHERE table_name='vms'; SELECT * from vms"
+```
+
+How to modify a payment manually, like if you get a chargeback or to fix customer payment issues:
+
+```
+$ pipenv run flask cli sql -c "SELECT id, created, email, dollars, invalidated from payments"
+1, 2020-05-05T00:00:00, forest.n.johnson@gmail.com, 20.00, FALSE
+
+$ pipenv run flask cli sql -c "UPDATE payments SET invalidated = True WHERE id = 1"
+1 rows affected.
+
+$ pipenv run flask cli sql -c "SELECT id, created, email, dollars, invalidated from payments"
+1, 2020-05-05T00:00:00, forest.n.johnson@gmail.com, 20.00, TRUE
+```
+
+## how to view the logs on the database server (legion.cyberia.club)
+
+`sudo -u postgres pg_dump capsul-flask | gzip -9 > capsul-backup-2021-02-15.gz`
+
+
+## changing the email address on an account
+
+```
+UPDATE accounts SET lower_case_email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE accounts SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE login_tokens SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE operations SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE payment_sessions SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE payments SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE ssh_public_keys SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE unresolved_btcpay_invoices SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE vm_ssh_authorized_key SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE vm_ssh_host_key SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+UPDATE vms SET email = 'new@email.address' WHERE email = 'old@email.address' ;
+```
--- a/docs/deployment.md
+++ b/docs/deployment.md
@ -0,0 +1,87 @@
+# Deploying Capsul on a server
+
+Capsul has a ["hub and spoke" architecture](./architecture.md). The "Hub" runs the web application and talks to the Postrges database, while the "Spoke"s are responsible for creating/managing virtual machines. One instance of the capsul-flask application can run in both hub mode and spoke mode at the same time, however there must only be one instance of the app running in "Hub" mode at any given time.
+
+## <a name="spoke_mode_prerequisites"></a>Installing prerequisites for Spoke Mode
+
+On your spoke (see [Architecture](./architecture.md) You'll need `libvirtd`, `dnsmasq`, and `qemu-kvm`, plus a `/tank` diectory with some operating system images in it:
+
+```
+sudo apt install libvirt-daemon-system virtinst git dnsmasq qemu qemu-kvm
+sudo mkdir -p /var/www /tank/{vm,img,config}
+sudo mkdir -p /tank/img/debian/10
+cd !$
+sudo wget https://cloud.debian.org/images/cloud/buster/20201023-432/debian-10-genericcloud-amd64-20201023-432.qcow2 -O root.img.qcow2
+```
+
+TODO: network set-up
+TODO: cyberia-cloudinit.yml
+
+## Deploying capsul-flask
+
+### <a name="deploy_manually"></a>Manually
+
+Follow the [local set-up instructions](./local-set-up.md) on your server. 
+
+Make sure to set `BASE_URL` correctly, generate your own secret tokens, and
+configure your own daemon management for the capsul-flask server (e.g. writing
+init scripts, or SystemD unit files).
+
+Use the suggested `gunicorn` command (with appropriately-set address and port),
+instead of `flask run`, to launch the server.
+
+For example, here is the SystemD service unit file we use in production for `capsul.org`:
+
+```
+[Unit]
+Description=capsul-flask virtual machines as a service
+After=network.target
+
+[Service]
+ExecStart=/usr/local/bin/pipenv run gunicorn --bind 127.0.0.1:5000 -k gevent --worker-connections 1000 app:app
+Restart=on-failure
+WorkingDirectory=/opt/capsul-flask
+
+[Install]
+WantedBy=multi-user.target
+
+```
+
+TODO: cron runner is required to run maintenance tasks for now, but in the future we want to build this into the python based task scheduler. 
+
+### <a name="coop_cloud_docker"></a> Using Co-op Cloud's vanilla Docker Swarm configuration
+
+Download the Co-op Cloud swarm `compose.yml`:
+
+```sh
+wget https://git.autonomic.zone/coop-cloud/capsul/src/branch/main/compose.yml
+```
+
+Optionally, download add-on compose files for Stripe, BTCPay, and Spoke Mode:
+
+```sh
+wget https://git.autonomic.zone/coop-cloud/capsul/src/branch/main/compose.{stripe,btcpay,spoke}.yml
+```
+
+Then, create a `.env` file and configure appropriately -- you probably want to
+define most settings in [the Co-op Cloud `.envrc.sample`
+file](https://git.autonomic.zone/coop-cloud/capsul/src/branch/main/.envrc.sample).
+
+Load the environment variables (using Python `direnv`, or a manual `set -a && source .env && set +a`), insert any necessary secrets, then run the deployment:
+
+```sh
+docker stack deploy -c compose.yml -c compose.stripe.yml your_capsul
+```
+
+(where you'd add an extra `-c compose.btcpay.yml` for each optional compose file
+you want, and set `your_capsul` to the "stack name" you want).
+
+TODO: cron runner
+
+### <a name="coop_cloud_abra"></a> Using Co-op Cloud's `abra` deployment tool
+
+Follow [the guide in the README for the Co-op Cloud capsul package](https://git.autonomic.zone/coop-cloud/capsul/).
+
+### Using docker-compose
+
+TODO
--- a/docs/images/btcpay_sin_pairing.jpg
+++ b/docs/images/btcpay_sin_pairing.jpg
--- a/docs/images/btcpayment_process.drawio
+++ b/docs/images/btcpayment_process.drawio
--- a/docs/images/btcpayment_process.png
+++ b/docs/images/btcpayment_process.png
--- a/docs/images/generate_btcpay_keys.py
+++ b/docs/images/generate_btcpay_keys.py
--- a/docs/images/hub-and-spoke.xml
+++ b/docs/images/hub-and-spoke.xml
--- a/docs/images/hub-and-spoke1.png
+++ b/docs/images/hub-and-spoke1.png
--- a/docs/images/hub-and-spoke2.png
+++ b/docs/images/hub-and-spoke2.png
--- a/docs/images/paired.jpg
+++ b/docs/images/paired.jpg
--- a/docs/local-set-up.md
+++ b/docs/local-set-up.md
@ -0,0 +1,68 @@
+# How to run Capsul locally
+
+## <a name="manually"></a>Manually
+
+Ensure you have the pre-requisites for the psycopg2 Postgres database adapter package:
+
+```sh
+sudo apt install python3-dev libpq-dev
+pg_config --version
+```
+
+Ensure you have the wonderful `pipenv` python package management and virtual environment cli:
+
+```sh
+sudo apt install pipenv
+```
+
+Create python virtual environment and install packages:
+
+```sh
+pipenv install
+```
+
+Run an instance of Postgres (I used docker for this, you can use whatever you want, point is its listening on `localhost:5432`):
+
+```sh
+docker run --rm -it -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres
+```
+
+Run the app 
+
+```sh
+pipenv run flask run
+```
+
+or, using Gunicorn:
+
+```sh
+pipenv run gunicorn --bind 127.0.0.1:5000 -k gevent --worker-connections 1000 app:app
+```
+
+Note that by default when running locally, the `SPOKE_MODEL` is set to `mock`, meaning that it won't actually try to spawn vms.
+
+## Crediting your account
+
+Once you log in for the first time, you will want to give yourself some free capsulbux so you can create fake capsuls for testing. 
+
+```sh
+pipenv run flask cli sql -c "INSERT INTO payments (email, dollars) VALUES ('<your email address here>', 20.00)"
+```
+
+## Running scheduled tasks:
+
+```sh
+pipenv run flask cli cron-task
+```
+
+## <a name="docker_compose"></a>Run locally with docker-compose
+
+If you have Docker and Docker-Compose installed, you can use the
+`3wordchant/capsul-flask` Docker image to launch capsul-flask, and a Postgres
+database server, for you:
+
+```sh
+docker-compose up
+```
+
+`capsul-flask` will read settings from your `.env` file as usual; you can set any of the options mentioned in the [configuration documentation](./configuration.md).
Author	SHA1	Message	Date
forest	5a67a58f98	better error handling when the btcpay server goes down	2021-09-02 12:00:48 -05:00
forest	3346a45ed4	return success whn attempting to destroy a capsul that doesnt exist	2021-08-27 12:18:17 -05:00
forest	f8e187ff84	local variable 'assigned_hosts_string' referenced before assignment	2021-08-27 12:14:38 -05:00
forest	ba997bb3ff	defer fkey constraints until end of txn -- allow change email	2021-08-16 13:24:11 -05:00
forest	f3630fbacf	account-balance cli command	2021-07-26 15:29:34 -05:00
j3s	f94d3aa1d3	Add centos deprecation yeet	2021-07-25 09:36:04 -05:00
j3s	a9c4ae7572	Add archlinux, bump everything'	2021-07-25 09:33:32 -05:00
j3s	dc8da3170b	Remove ops linky	2021-07-25 08:29:33 -05:00
j3s	59b72adefb	Add linebreak to support page	2021-07-25 08:28:21 -05:00
j3s	c6380f292f	Add ops	2021-07-25 08:27:38 -05:00
j3s	dbe75dd868	*	2021-07-25 08:26:25 -05:00
j3s	ae5f57645f	Update support wording	2021-07-25 08:24:18 -05:00
forest	8c0c613392	Merge remote-tracking branch 'threewordchant/master'	2021-07-21 16:47:46 -05:00
forest	50ee1144f9	Merge remote-tracking branch 'threewordchant/master'	2021-07-21 16:46:50 -05:00
3wc	c4ba5ea197	Merge branch 'master' of ssh://git.autonomic.zone:2222/3wordchant/capsul-flask	2021-07-21 23:46:37 +02:00
forest	08eb38dc57	correctly enforce affordable_vm_sizes post form submission	2021-07-21 16:45:53 -05:00
3wc	33f4551cf4	Merge branch 'docs-reshuffle'	2021-07-21 23:44:42 +02:00
3wc	0fa7fb28b5	Split README up into separate files, plus: * forest's ReadMe docs changes * add Configuration-type-stuff that lives in the database	2021-07-21 23:43:44 +02:00
forest	be6e72028c	define BTCPAY_ENABLED based on URL and btcpay key, pass it explicitly	2021-07-21 23:43:44 +02:00
3wc	bf7487f4f0	Don't load /btcpay if BTCPAY_PRIVATE_KEY un-set	2021-07-21 23:43:44 +02:00
3wc	8b0ce0ba71	Hide the BTCPay link if BTCPAY_PRIVATE_KEY un-set	2021-07-21 23:43:44 +02:00
3wc	bca570882e	Add load_config_vars context processor.. ..to allow accessing config variables in the templates. This removes the need for adding config variables manually to template contexts.	2021-07-21 23:43:44 +02:00
forest	f3ae9aae23	remove class="small" from pricing table cuz normal size fits fine	2021-07-21 23:43:44 +02:00
3wc	827ca4a50b	Auto-generate the pricing table from the database	2021-07-21 23:43:44 +02:00
3wordchant	f999adaf71	Add VMs to the database even with HUB_MODE=mock (#6 ) https://todo.cyberia.club/~cyberia/services/83 Co-authored-by: 3wc <3wc.cyberia@doesthisthing.work> Co-authored-by: forest <forest.n.johnson@gmail.com> Reviewed-on: #6 Co-authored-by: 3wordchant <3wordchant@noreply.git.autonomic.zone> Co-committed-by: 3wordchant <3wordchant@noreply.git.autonomic.zone>	2021-07-21 23:26:10 +02:00
3wc	8f2becb9ee	Fix SyntaxWarning on `is not ""` `capsulflask/__init__.py:143: SyntaxWarning: "is not" with a literal. Did you mean "!="?`	2021-07-21 21:51:50 +02:00
3wordchant	f848eda931	Merge pull request 'Disable BTCPay in the interface, if BTCPAY_PRIVATE_KEY is un-set' (#3 ) from optional-btcpay into master Reviewed-on: #3	2021-07-21 20:20:40 +02:00
3wordchant	46f49e8d8f	Merge pull request 'Auto-generate the pricing table from the database' (#4 ) from generated-prices into master Reviewed-on: #4	2021-07-21 19:32:09 +02:00
forest	36329796f0	define BTCPAY_ENABLED based on URL and btcpay key, pass it explicitly	2021-07-21 12:12:41 -05:00
forest	28271ee852	remove class="small" from pricing table cuz normal size fits fine	2021-07-21 11:53:44 -05:00
3wc	7923f3a99f	Auto-generate the pricing table from the database	2021-07-21 12:19:28 +02:00
3wc	7ed847251f	Don't load /btcpay if BTCPAY_PRIVATE_KEY un-set	2021-07-21 00:22:58 +02:00
3wc	e3a4776a5d	Hide the BTCPay link if BTCPAY_PRIVATE_KEY un-set	2021-07-21 00:20:38 +02:00
3wc	357d99cb91	Add load_config_vars context processor.. ..to allow accessing config variables in the templates. This removes the need for adding config variables manually to template contexts.	2021-07-21 00:19:38 +02:00
forest	b8279d7491	add about ssh link to faq	2021-07-19 18:09:02 -05:00
forest	908d02803f	move hardcoding public3 to the right place	2021-07-12 16:10:28 -05:00
forest	6e6bd2b143	fix syntax error	2021-07-12 16:00:37 -05:00
forest	47fbaab403	hardcode network_name=public3 to sidestep phantom dhcp lease issues	2021-07-12 15:59:20 -05:00
forest	06a2bd3a6f	add public_ipv4_first_usable_ip, public_ipv4_last_usable_ip	2021-07-12 14:38:56 -05:00
forest	fbe9c7fca4	fix last IP address hanging off the end of the display on admin page	2021-07-12 12:27:07 -05:00
forest	6bdb133153	make admin display work better on phones	2021-07-12 12:23:27 -05:00
forest	b459e56f3a	use the provided network_name when creating a capsul	2021-07-12 12:19:56 -05:00
forest	be54117736	migration 17: network_name -> virtual_bridge_name, add network_name col	2021-07-12 12:16:32 -05:00
forest	aaf33a245b	point capsul at new public3/virbr3 network	2021-07-12 11:29:37 -05:00
forest	ad9c3476c7	simplify cidr block logic a little bit	2021-07-12 11:29:33 -05:00
forest	fcbea1e29b	fixing capsul creation after I broke it with the pre-allocated IP address changes	2021-07-11 12:18:58 -05:00
forest	a2f2e744e4	MAIL_USE_TLS=False, MAIL_USE_SSL=True defaults	2021-07-11 10:28:47 -05:00
forest	79ef90c380	hub allocate capsul IP addr when the create operation is being claimed create.sh will now be passed two extra arguments from the web app: network_name and public_ipv4_address network_name will be virbr1 or virbr2 or whatever the network is called and public_ipv4_address will be an ipv4 from that network which is not currently being used	2021-07-09 17:08:51 -05:00