212 lines
9.7 KiB
Go
212 lines
9.7 KiB
Go
package stacks
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec"
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/infra"
|
|
)
|
|
|
|
// R-1126 (operator decision D11 = A, 2026-10-17): FileBrowser is never reachable from outside on its default password.
|
|
//
|
|
// WHY THIS SHAPE. The tunnel runs before the claim (the claim mail links https://felhom.<domain>), and files.<domain> is
|
|
// published through it. A new FileBrowser database starts on admin/admin. FileBrowser's own admin-password setting
|
|
// (config `auth.adminPassword` / env FILEBROWSER_ADMIN_PASSWORD) is RE-APPLIED AT EVERY START (gtstef/filebrowser
|
|
// 1.5.6-stable backend/cmd/user.go:50-57, called from cmd/root.go:144 each start) — measured on scratch 9202: a password
|
|
// the household set in FileBrowser was replaced at the next restart. So the box cannot hand FileBrowser its password up
|
|
// front without overwriting the household's own (R-513's reason, re-proven). Instead FileBrowser starts OFF the
|
|
// traefik-public network (infra.RenderFileBrowserCompose) and the box joins it there only after it has checked THIS run:
|
|
// the default login refused, or replaced and verified (EnsureFileBrowserAdminPassword sets fbProbedRun). A re-created
|
|
// container — the only way a new database appears — always starts unreachable from outside, whoever re-created it.
|
|
// Pinned by TestFileBrowserGate_*.
|
|
|
|
// fbNetOn reports whether container is on network (test seam: fbNetOnFn; a test FileBrowser and no seam → false).
|
|
func (m *Manager) fbNetOn(container, network string) bool {
|
|
if m.fbNetOnFn != nil {
|
|
return m.fbNetOnFn(container, network)
|
|
}
|
|
if m.fbHTTP != nil || m.fbBaseURL != "" {
|
|
return false
|
|
}
|
|
return containerOnNetwork(container, network)
|
|
}
|
|
|
|
// fbNetConnect attaches container to network (test seam: fbNetConnectFn; a test FileBrowser and no seam → no-op).
|
|
func (m *Manager) fbNetConnect(container, network string) error {
|
|
if m.fbNetConnectFn != nil {
|
|
return m.fbNetConnectFn(container, network)
|
|
}
|
|
if m.fbHTTP != nil || m.fbBaseURL != "" {
|
|
return nil
|
|
}
|
|
out, err := dockerexec.Command("docker", "network", "connect", network, container).CombinedOutput()
|
|
if err != nil && !strings.Contains(string(out), "already exists") {
|
|
return &netConnectError{out: strings.TrimSpace(string(out)), err: err}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
type netConnectError struct {
|
|
out string
|
|
err error
|
|
}
|
|
|
|
func (e *netConnectError) Error() string { return e.out + ": " + e.err.Error() }
|
|
|
|
// joinFileBrowserNetwork puts the controller on FileBrowser's own network, so the default-login check reaches it before
|
|
// FileBrowser is public. Missing network (FileBrowser not deployed yet) → nothing, the next round tries again.
|
|
func (m *Manager) joinFileBrowserNetwork() {
|
|
if m.fbNetOn(controllerContainer, infra.FileBrowserNetwork) {
|
|
return
|
|
}
|
|
if err := m.fbNetConnect(controllerContainer, infra.FileBrowserNetwork); err != nil {
|
|
if m.isDebug() {
|
|
m.logger.Printf("[DEBUG] [infra] filebrowser: controller not joined to %s yet: %v", infra.FileBrowserNetwork, err)
|
|
}
|
|
return
|
|
}
|
|
m.logger.Printf("[INFO] [infra] connected %s to %s (the FileBrowser default-login check, R-1126)", controllerContainer, infra.FileBrowserNetwork)
|
|
}
|
|
|
|
// ensureFileBrowserPublic serves files.<domain> only when THIS run was checked and its default login is refused:
|
|
// traefik joins infra.FilesNetwork, then the checked FileBrowser container does — never traefik-public, where every app
|
|
// container is (R-1281). A FileBrowser an earlier controller joined to traefik-public leaves it once it is on the files
|
|
// network. OnlyOffice joins the files network only while its FileBrowser link is on. Anything less than a checked run
|
|
// leaves FileBrowser unreachable from outside, as R-1126 requires.
|
|
//
|
|
// TOCTOU (found by the commit's security review, 2026-10-17): the connect targets the CONTAINER ID read with the run,
|
|
// never the name — web.SyncFileBrowserMounts can re-create FileBrowser between the check and the connect, and a
|
|
// connect by name would publish the new, unchecked container. By id, a replaced container's connect simply fails.
|
|
// Pinned by TestFileBrowserGate_ConnectsTheCheckedContainerById and TestR1281_*.
|
|
func (m *Manager) ensureFileBrowserPublic() {
|
|
run := m.fbStartedAt()
|
|
if run == "" || run != m.fbProbedRun {
|
|
return
|
|
}
|
|
target := fileBrowserContainer // tests' runs carry no id
|
|
if f := strings.Fields(run); len(f) == 2 {
|
|
target = f[0]
|
|
}
|
|
if err := m.fbNetEnsure(infra.FilesNetwork); err != nil {
|
|
m.logger.Printf("[WARN] [infra] filebrowser: the %s network is not there (files.<domain> stays as it is): %v", infra.FilesNetwork, err)
|
|
return
|
|
}
|
|
if !m.fbNetOn(traefikContainer, infra.FilesNetwork) {
|
|
if err := m.fbNetConnect(traefikContainer, infra.FilesNetwork); err != nil {
|
|
m.logger.Printf("[WARN] [infra] filebrowser: traefik could not join %s (files.<domain> stays as it is): %v", infra.FilesNetwork, err)
|
|
return
|
|
}
|
|
m.logger.Printf("[INFO] [infra] filebrowser: traefik joined %s — the only route to FileBrowser (R-1281)", infra.FilesNetwork)
|
|
}
|
|
if !m.fbNetOn(target, infra.FilesNetwork) {
|
|
if err := m.fbNetConnect(target, infra.FilesNetwork); err != nil {
|
|
m.logger.Printf("[WARN] [infra] filebrowser: could not join %s (files.<domain> stays unreachable): %v", infra.FilesNetwork, err)
|
|
return
|
|
}
|
|
m.logger.Printf("[INFO] [infra] filebrowser: default login refused for this run — joined %s, files.<domain> served (R-1126, R-1281)", infra.FilesNetwork)
|
|
}
|
|
if m.fbNetOn(target, traefikNetwork) {
|
|
if err := m.fbNetDisconnect(target, traefikNetwork); err != nil {
|
|
m.logger.Printf("[WARN] [infra] filebrowser: could not leave %s — every app can still reach it (R-1281): %v", traefikNetwork, err)
|
|
} else {
|
|
m.logger.Printf("[INFO] [infra] filebrowser: left %s — no app container reaches it any more (R-1281)", traefikNetwork)
|
|
}
|
|
}
|
|
m.ensureOfficeOnFilesNetwork()
|
|
}
|
|
|
|
// traefikContainer is traefik's container (infra/templates/traefik-compose.yml.tmpl container_name).
|
|
const traefikContainer = "traefik"
|
|
|
|
// officeContainer is OnlyOffice's container (the catalog's container_name).
|
|
const officeContainer = "onlyoffice"
|
|
|
|
// ensureOfficeOnFilesNetwork (R-1281): OnlyOffice shares the files network while — and only while — its FileBrowser
|
|
// link is on (FileBrowser's config holds the office block). Called after FileBrowser was published, so it never reaches
|
|
// an unchecked FileBrowser.
|
|
func (m *Manager) ensureOfficeOnFilesNetwork() {
|
|
linked, running := m.fbOfficeLinked()
|
|
on := m.fbNetOn(officeContainer, infra.FilesNetwork)
|
|
switch {
|
|
case linked && running && !on:
|
|
if err := m.fbNetConnect(officeContainer, infra.FilesNetwork); err != nil {
|
|
m.logger.Printf("[WARN] [infra] filebrowser: OnlyOffice could not join %s (documents do not open in the file manager): %v", infra.FilesNetwork, err)
|
|
return
|
|
}
|
|
m.logger.Printf("[INFO] [infra] filebrowser: OnlyOffice joined %s — its FileBrowser link is on (R-1281)", infra.FilesNetwork)
|
|
case !linked && on:
|
|
if err := m.fbNetDisconnect(officeContainer, infra.FilesNetwork); err != nil {
|
|
m.logger.Printf("[WARN] [infra] filebrowser: OnlyOffice could not leave %s: %v", infra.FilesNetwork, err)
|
|
return
|
|
}
|
|
m.logger.Printf("[INFO] [infra] filebrowser: OnlyOffice left %s — its FileBrowser link is off (R-1281)", infra.FilesNetwork)
|
|
}
|
|
}
|
|
|
|
// fbNetDisconnect detaches container from network (test seam: fbNetDisconnectFn; a test FileBrowser and no seam → no-op).
|
|
func (m *Manager) fbNetDisconnect(container, network string) error {
|
|
if m.fbNetDisconnectFn != nil {
|
|
return m.fbNetDisconnectFn(container, network)
|
|
}
|
|
if m.fbHTTP != nil || m.fbBaseURL != "" {
|
|
return nil
|
|
}
|
|
out, err := dockerexec.Command("docker", "network", "disconnect", network, container).CombinedOutput()
|
|
if err != nil && !strings.Contains(string(out), "is not connected") {
|
|
return &netConnectError{out: strings.TrimSpace(string(out)), err: err}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// fbNetEnsure creates network when it does not exist (test seam: fbNetEnsureFn; a test FileBrowser and no seam → no-op).
|
|
func (m *Manager) fbNetEnsure(network string) error {
|
|
if m.fbNetEnsureFn != nil {
|
|
return m.fbNetEnsureFn(network)
|
|
}
|
|
if m.fbHTTP != nil || m.fbBaseURL != "" {
|
|
return nil
|
|
}
|
|
if err := dockerexec.Command("docker", "network", "inspect", network).Run(); err == nil {
|
|
return nil
|
|
}
|
|
out, err := dockerexec.Command("docker", "network", "create", network).CombinedOutput()
|
|
if err != nil && !strings.Contains(string(out), "already exists") {
|
|
return &netConnectError{out: strings.TrimSpace(string(out)), err: err}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// fbOfficeLinked reports whether FileBrowser's config holds the OnlyOffice block and whether OnlyOffice runs (test
|
|
// seam: fbOfficeLinkedFn; a test FileBrowser and no seam → neither).
|
|
func (m *Manager) fbOfficeLinked() (bool, bool) {
|
|
if m.fbOfficeLinkedFn != nil {
|
|
return m.fbOfficeLinkedFn()
|
|
}
|
|
if m.fbHTTP != nil || m.fbBaseURL != "" {
|
|
return false, false
|
|
}
|
|
b, err := os.ReadFile(filepath.Join(m.cfg.Paths.StacksDir, "filebrowser", "config.yaml"))
|
|
linked := err == nil && strings.Contains(string(b), "\nintegrations:\n office:")
|
|
return linked, containerRunning(officeContainer)
|
|
}
|
|
|
|
// EnsureFileBrowserGate is the whole check outside the base-stack round — called after web.SyncFileBrowserMounts
|
|
// re-creates FileBrowser, so a household's storage change does not leave the file browser offline until the next round.
|
|
func (m *Manager) EnsureFileBrowserGate() {
|
|
m.infraMu.Lock()
|
|
defer m.infraMu.Unlock()
|
|
m.fileBrowserGateLocked()
|
|
}
|
|
|
|
// fileBrowserGateLocked runs join → check → publish. The caller holds infraMu.
|
|
func (m *Manager) fileBrowserGateLocked() {
|
|
m.joinFileBrowserNetwork()
|
|
if err := m.EnsureFileBrowserAdminPassword(); err != nil {
|
|
// R-513: retried every round until decided. Logged, never fatal to the base stack.
|
|
m.logger.Printf("[WARN] [infra] %v", err)
|
|
}
|
|
m.ensureFileBrowserPublic()
|
|
}
|