Publish curated Unraid-AppOps-Gateway source from ad0a390e431166c3198a2ac3bec010c2b44f2dea

backend/app/schemas/enrollment.py

@@ -29,6 +29,9 @@ DeploymentProfileName = Literal[
     "repopulse-authenticated",
 ]
 
+LEGACY_APPDATA_ROOT = "/srv/example/appdata"
+MANAGED_DOCKER_APPDATA_ROOT = "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+
 
 class _StrictModel(BaseModel):
     model_config = ConfigDict(extra="forbid", frozen=True)
@@ -218,6 +221,10 @@ class EnrollmentPlanV1(_StrictModel):
     storage: EnrollmentStorageV1
     network: EnrollmentNetworkV1
     artifact: EnrollmentArtifactV1
+    trusted_appdata_root: Literal[
+        "/srv/example/appdata",
+        "/var/lib/docker/volumes/itworx-managed-appdata/_data",
+    ] = "/srv/example/appdata"
     exposure: EnrollmentExposureV1 | None = None
     authentication: EnrollmentAuthenticationV1 = EnrollmentAuthenticationV1()
     secrets: EnrollmentSecretsV1 = EnrollmentSecretsV1()
@@ -271,7 +278,8 @@ class EnrollmentPlanV1(_StrictModel):
         if expects_oidc != self.secrets.oidc_client_secret_required:
             raise ValueError("OIDC secret requirement must match the selected profile")
         if self.profile == "repopulse-authenticated" and (
-            self.application_id != "repopulse"
+            self.trusted_appdata_root != "/srv/example/appdata"
+            or self.application_id != "repopulse"
             or self.repository != "jens/repopulse"
             or self.environment != "production"
             or self.target.container_name != "repopulse"
@@ -295,7 +303,7 @@ class EnrollmentPlanV1(_StrictModel):
 
     @property
     def appdata_path(self) -> str:
-        return f"/srv/example/appdata/{self.application_id}"
+        return f"{self.trusted_appdata_root}/{self.application_id}"
 
     @property
     def data_path(self) -> str:
@@ -311,7 +319,11 @@ class EnrollmentTrustConfigV1(_StrictModel):
 
     controller_identity: str
     bootstrap_secret_ref: str
-    trusted_appdata_root: Literal["/srv/example/appdata"] = "/srv/example/appdata"
+    trusted_appdata_root: Literal[
+        LEGACY_APPDATA_ROOT,
+        MANAGED_DOCKER_APPDATA_ROOT,
+    ] = LEGACY_APPDATA_ROOT
+    managed_appdata_backup_acknowledged: bool = Field(default=False, strict=True)
     approved_networks: tuple[str, ...] = ()
     allowed_domain_suffixes: tuple[str, ...] = ()
     autonomous_profiles: tuple[DeploymentProfileName, ...] = ()
@@ -372,4 +384,26 @@ class EnrollmentTrustConfigV1(_StrictModel):
         for group in groups:
             if group is not None and not re.fullmatch(r"[A-Za-z0-9 _.-]{2,100}", group):
                 raise ValueError("OIDC role group name is invalid")
+        managed_root = "/var/lib/docker/volumes/itworx-managed-appdata/_data"
+        if self.trusted_appdata_root == managed_root and not self.managed_appdata_backup_acknowledged:
+            raise ValueError("managed Docker-root storage requires explicit backup acknowledgement")
+        if self.trusted_appdata_root != managed_root and self.managed_appdata_backup_acknowledged:
+            raise ValueError("Docker-root backup acknowledgement is valid only for the managed root")
+        return self
+
+
+class EnrollmentStorageRootSelectionV1(_StrictModel):
+    """Narrow operator selection for the fixed managed storage root."""
+
+    trusted_appdata_root: Literal[
+        LEGACY_APPDATA_ROOT,
+        MANAGED_DOCKER_APPDATA_ROOT,
+    ]
+    managed_appdata_backup_acknowledged: bool = Field(strict=True)
+
+    @model_validator(mode="after")
+    def require_managed_backup_acknowledgement(self) -> EnrollmentStorageRootSelectionV1:
+        managed = self.trusted_appdata_root == MANAGED_DOCKER_APPDATA_ROOT
+        if managed != self.managed_appdata_backup_acknowledged:
+            raise ValueError("managed Docker-root storage requires explicit backup acknowledgement")
         return self