Skip to content

Commit e9c0269

Browse files
djthorpedjthorpe
authored
Merge pull request #71 from mutablelogic/v4
Added certificate management
2 parents e39a8d5 + d9d7a64 commit e9c0269

34 files changed

+2332
-22
lines changed

‎cmd/http-server/main.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ import (
1212
// Packages
1313
server "github.com/mutablelogic/go-server"
1414
ctx "github.com/mutablelogic/go-server/pkg/context"
15+
logger "github.com/mutablelogic/go-server/pkg/handler/logger"
1516
router "github.com/mutablelogic/go-server/pkg/handler/router"
1617
static "github.com/mutablelogic/go-server/pkg/handler/static"
1718
httpserver "github.com/mutablelogic/go-server/pkg/httpserver"
18-
logger "github.com/mutablelogic/go-server/pkg/middleware/logger"
1919
provider "github.com/mutablelogic/go-server/pkg/provider"
2020
)
2121

‎cmd/nginx-server/main.go

+26-2
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,13 @@ import (
1313
server "github.com/mutablelogic/go-server"
1414
ctx "github.com/mutablelogic/go-server/pkg/context"
1515
auth "github.com/mutablelogic/go-server/pkg/handler/auth"
16+
certmanager "github.com/mutablelogic/go-server/pkg/handler/certmanager"
17+
certstore "github.com/mutablelogic/go-server/pkg/handler/certmanager/certstore"
18+
logger "github.com/mutablelogic/go-server/pkg/handler/logger"
1619
nginx "github.com/mutablelogic/go-server/pkg/handler/nginx"
1720
router "github.com/mutablelogic/go-server/pkg/handler/router"
1821
tokenjar "github.com/mutablelogic/go-server/pkg/handler/tokenjar"
1922
httpserver "github.com/mutablelogic/go-server/pkg/httpserver"
20-
logger "github.com/mutablelogic/go-server/pkg/middleware/logger"
2123
provider "github.com/mutablelogic/go-server/pkg/provider"
2224
)
2325

@@ -68,6 +70,21 @@ func main() {
6870
log.Fatal(err)
6971
}
7072

73+
// Cert Storage
74+
certstore, err := certstore.Config{
75+
DataPath: filepath.Join(n.(nginx.Nginx).Config(), "cert"),
76+
Group: *group,
77+
}.New()
78+
if err != nil {
79+
log.Fatal(err)
80+
}
81+
certmanager, err := certmanager.Config{
82+
CertStorage: certstore.(certmanager.CertStorage),
83+
}.New()
84+
if err != nil {
85+
log.Fatal(err)
86+
}
87+
7188
// Location of the FCGI unix socket
7289
socket := filepath.Join(n.(nginx.Nginx).Config(), "run/go-server.sock")
7390

@@ -88,6 +105,13 @@ func main() {
88105
auth.(server.Middleware),
89106
},
90107
},
108+
"cert": { // /api/cert/...
109+
Service: certmanager.(server.ServiceEndpoints),
110+
Middleware: []server.Middleware{
111+
logger.(server.Middleware),
112+
auth.(server.Middleware),
113+
},
114+
},
91115
},
92116
}.New()
93117
if err != nil {
@@ -105,7 +129,7 @@ func main() {
105129
}
106130

107131
// Run until we receive an interrupt
108-
provider := provider.NewProvider(logger, n, jar, auth, router, httpserver)
132+
provider := provider.NewProvider(logger, n, jar, auth, certstore, certmanager, router, httpserver)
109133
provider.Print(ctx, "Press CTRL+C to exit")
110134
if err := provider.Run(ctx); err != nil {
111135
log.Fatal(err)

‎cmd/run/main.go

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
package main
2+
3+
import (
4+
"errors"
5+
"flag"
6+
"fmt"
7+
"os"
8+
"path/filepath"
9+
"strings"
10+
11+
// Packages
12+
"github.com/mutablelogic/go-server/pkg/provider"
13+
)
14+
15+
func main() {
16+
var pluginPath string
17+
name := filepath.Base(os.Args[0])
18+
flags := flag.NewFlagSet(name, flag.ContinueOnError)
19+
flags.StringVar(&pluginPath, "plugin", "*.plugin", "Path to plugins")
20+
if err := flags.Parse(os.Args[1:]); err != nil {
21+
os.Exit(1)
22+
}
23+
24+
// If the path is relative, then make it absolute to either the binary path
25+
// or the current working directory
26+
if !filepath.IsAbs(pluginPath) {
27+
if strings.HasPrefix(pluginPath, ".") || strings.HasPrefix(pluginPath, "..") {
28+
if wd, err := os.Getwd(); err == nil {
29+
pluginPath = filepath.Clean(filepath.Join(wd, pluginPath))
30+
}
31+
} else if exec, err := os.Executable(); err == nil {
32+
pluginPath = filepath.Clean(filepath.Join(filepath.Dir(exec), pluginPath))
33+
}
34+
}
35+
36+
// Create a new provider, load plugins
37+
provider, err := provider.New()
38+
if err != nil {
39+
fmt.Fprintln(os.Stderr, err)
40+
os.Exit(1)
41+
}
42+
if err := provider.LoadPluginsForPattern(pluginPath); err != nil {
43+
fmt.Fprintln(os.Stderr, err)
44+
os.Exit(1)
45+
}
46+
47+
// Create configurations
48+
var result error
49+
for _, plugin := range []string{"logger", "httpserver", "router", "nginx-handler", "auth-handler", "tokenjar-handler"} {
50+
if _, err := provider.New(plugin); err != nil {
51+
result = errors.Join(result, err)
52+
}
53+
}
54+
if result != nil {
55+
fmt.Fprintln(os.Stderr, result)
56+
os.Exit(1)
57+
}
58+
59+
// TODO: Set parameters from a JSON file
60+
provider.Set("logger.flags", []string{"default", "prefix"})
61+
}
62+
63+
/*
64+
{
65+
"logger": {
66+
"flags": ["default", "prefix"]
67+
},
68+
"nginx": {
69+
"binary": "/usr/local/bin/nginx",
70+
"data": "/var/run/nginx",
71+
"group": "www-data",
72+
},
73+
httpserver": {
74+
"listen": "run/go-server.sock",
75+
"group": "www-data",
76+
"router": "${ router }",
77+
},
78+
"router": {
79+
"services": {
80+
"nginx": {
81+
"service": "${ nginx }",
82+
"middleware": ["logger", "auth"]
83+
},
84+
"auth": {
85+
"service": "${ auth }",
86+
"middleware": ["logger", "auth"]
87+
},
88+
"router": {
89+
"service": "${ router }",
90+
"middleware": ["logger", "auth"]
91+
},
92+
},
93+
"auth": {
94+
"tokenjar": "${ tokenjar }",
95+
"tokenbytes": 16,
96+
"bearer": true,
97+
},
98+
"tokenjar": {
99+
"data": "run",
100+
"writeinterval": "30s",
101+
},
102+
}
103+
*/

‎etc/json/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
2+
# JSON configuration files
3+
4+
Examples of JSON configuration files for the run command. This is not yet
5+
implemented, but will be in the future.

‎etc/json/nginx-proxy.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"logger": {
3+
"flags": [
4+
"default",
5+
"prefix"
6+
]
7+
},
8+
"nginx": {
9+
"binary": "/usr/local/bin/nginx",
10+
"data": "/var/run/nginx",
11+
"group": "nginx"
12+
},
13+
"tokenjar": {
14+
"data": "run",
15+
"writeinterval": "30s"
16+
},
17+
"auth": {
18+
"tokenjar": "${ tokenjar }",
19+
"tokenbytes": 16,
20+
"bearer": true
21+
},
22+
"router": {
23+
"services": {
24+
"nginx": {
25+
"service": "${ nginx }",
26+
"middleware": [
27+
"logger",
28+
"auth"
29+
]
30+
},
31+
"auth": {
32+
"service": "${ auth }",
33+
"middleware": [
34+
"logger",
35+
"auth"
36+
]
37+
},
38+
"router": {
39+
"service": "${ router }",
40+
"middleware": [
41+
"logger",
42+
"auth"
43+
]
44+
}
45+
}
46+
},
47+
"httpserver": {
48+
"listen": "run/go-server.sock",
49+
"group": "nginx",
50+
"router": "${ router }"
51+
}
52+
}

‎pkg/handler/auth/middleware.go

+4-10
Original file line numberDiff line numberDiff line change
@@ -47,25 +47,19 @@ func (middleware *auth) Wrap(ctx context.Context, next http.HandlerFunc) http.Ha
4747

4848
// Get token from the jar - check it is found and valid
4949
token := middleware.jar.GetWithValue(tokenValue)
50-
authorized := true
5150
if token.IsZero() {
52-
authorized = false
5351
httpresponse.Error(w, http.StatusUnauthorized, "invalid or missing token")
52+
return
5453
} else if !token.IsValid() {
55-
authorized = false
56-
httpresponse.Error(w, http.StatusUnauthorized, "invalid or missing token")
54+
httpresponse.Error(w, http.StatusUnauthorized, "invalid token")
55+
return
5756
} else if token.IsScope(ScopeRoot) {
5857
// Allow - token is a super-user token
5958
} else if allowedScopes := router.Scope(r.Context()); len(allowedScopes) == 0 {
6059
// Allow - no scopes have been defined on this endpoint
6160
} else if !token.IsScope(allowedScopes...) {
6261
// Deny - token does not have the required scopes
63-
authorized = false
64-
httpresponse.Error(w, http.StatusUnauthorized, "required scope: ", strings.Join(allowedScopes, ","))
65-
}
66-
67-
// Return unauthorized if token is not found or not valid
68-
if !authorized {
62+
httpresponse.Error(w, http.StatusUnauthorized, "required scope "+strings.Join(allowedScopes, ", "))
6963
return
7064
}
7165

0 commit comments

Comments
 (0)