Adding Multi-Tenant Functionality

[xTITUSMAXIMUSX]

1. Instance/Session Model

• Postgres: Store all persistent VyOS instance metadata (host, port, credentials, tenant, etc.) as you described.
• Redis: Use as a fast, per-instance, per-user cache for ephemeral/session data (config, diffs, etc.).

---

2. API Endpoint Design

• All instance-specific endpoints should be namespaced:

  /vyos/instances/{instance_id}/config/diff
  /vyos/instances/{instance_id}/config
  /vyos/instances/{instance_id}/firewall
  

• The backend always looks up the instance by instance_id (and checks user/tenant permissions).

---

3. Session/Cache Isolation

• Never store per-user or per-instance state in Python module-level variables (these are global and shared across all users/requests).
• Instead, use Redis for all cache/session data:
  • Key pattern: vyos:{instance_id}:{cache_type} (optionally add user/tenant if needed)
  • Example: vyos:1234:config, vyos:1234:diff
• For user-specific session data (e.g., UI state, tokens), use JWT or FastAPI session middleware, or store in Redis with a user/session key.

---

4. Backend Request Flow

1. Frontend: User selects an instance (from DB list).
2. Frontend: Sends requests to /vyos/instances/{instance_id}/...
3. Backend:
   • Looks up instance in Postgres.
   • Checks user/tenant permissions.
   • Uses credentials to connect to VyOS API.
   • Caches config/diff/etc. in Redis using the instance_id as part of the key.
   • Returns data to frontend.

---

5. Concurrency & Scaling

• With this model, you can horizontally scale your FastAPI backend (multiple containers) because all state is in Redis/Postgres, not in Python memory.
• Each request is stateless except for the cache/session in Redis.

---

6. Security

• Encrypt credentials in Postgres.
• Never expose credentials to the frontend.
• Use proper RBAC: only allow users to access instances they own/have rights to.

---

7. Example Redis Usage (Python/FastAPI)

import redis
import json

r = redis.Redis(host='redis', port=6379, db=0)

def cache_config(instance_id, config):
    r.set(f'vyos:{instance_id}:config', json.dumps(config), ex=300)  # 5 min expiry

def get_cached_config(instance_id):
    val = r.get(f'vyos:{instance_id}:config')
    return json.loads(val) if val else None

---

8. Frontend

• User logs in, sees a list of instances (filtered by tenant/user).
• When switching instances, the frontend just changes the instance_id in API calls.
• No need for the frontend to know about backend session state.

---

9. Summary of Steps

1. Refactor all backend cache/session logic to use Redis, keyed by instance_id (and user/tenant if needed).
2. Move all instance metadata to Postgres.
3. Namespace all API endpoints by instance_id.
4. Never use Python module-level variables for per-user or per-instance state.
5. Add RBAC checks on every instance-specific endpoint.
6. Frontend: always pass instance_id in API calls.

---

10. Why this works

• Multi-tenant: Each tenant’s data is isolated in Postgres and Redis.
• Multi-user: Each user’s access is checked per request.
• Multi-instance: Each instance is isolated by instance_id.
• Scalable: No in-memory state, so you can run many backend containers.
• Fast: Redis provides low-latency caching for config/diff/etc.