admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub: S2 /offsite registry page (read-only) + nav + WGPeer.CreatedAt

Browse Source 
Endpoint card + peers table (truncated pubkeys with full-value title attr,
bound peers link to /hosts/<id>); Offsite nav link in all 9 page templates;
render tests for endpoint/peers, empty, and not-configured states.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-04 00:48:03 +02:00
parent ba52005e61
commit 13203c2452
16 changed files with 253 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/api/handler.go
+3 -3
View File
@@ -1130,9 +1130,9 @@ var allowedEventTypes = map[string]bool{
"node_down": true,
"node_recovered": true,
// Hub-generated host-domain events (v0.7.0, slice 3)
"host_stale": true,
"host_down": true,
"host_recovered": true,
"host_stale": true,
"host_down": true,
"host_recovered": true,
// Hub-generated host root-fs disk-pressure (v0.23.0) — distinct from the controller's GUEST disk_*
"host_disk_warning": true,
"host_disk_critical": true,
hub/internal/api/wg_test.go
+3 -3
View File
@@ -142,9 +142,9 @@ func TestWGPeers_BadPubkeyRejected(t *testing.T) {
putTestEndpoint(t, h)
bad := []string{
"not-base64",
base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 16)), // 24 chars
"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!", // 44 chars, not base64
base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 33)), // 44 chars but 33 bytes
base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 16)), // 24 chars
"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!", // 44 chars, not base64
base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 33)), // 44 chars but 33 bytes
}
for _, pk := range bad {
rr := do(h, http.MethodPost, "/admin/wg/peers", globalKey, `{"pubkey":"`+pk+`"}`)
hub/internal/store/wg.go
+3 -2
View File
@@ -42,6 +42,7 @@ type WGPeer struct {
AssignedIP string // bare IP — the /32 suffix is presentation, not storage
HostID string
Note string
CreatedAt string // as stored (SQLite datetime text); display-only
}
// SetWGEndpoint upserts the (single expected) endpoint record.
@@ -318,7 +319,7 @@ func (s *Store) RemoveWGPeer(pubkey string) error {
// ListWGPeers returns all registered peers ordered by assigned_ip — a deterministic order so
// the sync payload bytes are stable for identical registries.
func (s *Store) ListWGPeers() ([]WGPeer, error) {
rows, err := s.db.Query(`SELECT pubkey, assigned_ip, host_id, note FROM wg_peers ORDER BY assigned_ip`)
rows, err := s.db.Query(`SELECT pubkey, assigned_ip, host_id, note, created_at FROM wg_peers ORDER BY assigned_ip`)
if err != nil {
return nil, err
}
@@ -326,7 +327,7 @@ func (s *Store) ListWGPeers() ([]WGPeer, error) {
var peers []WGPeer
for rows.Next() {
var p WGPeer
if err := rows.Scan(&p.Pubkey, &p.AssignedIP, &p.HostID, &p.Note); err != nil {
if err := rows.Scan(&p.Pubkey, &p.AssignedIP, &p.HostID, &p.Note, &p.CreatedAt); err != nil {
return nil, err
}
peers = append(peers, p)
hub/internal/web/offsite.go
+78
View File
@@ -0,0 +1,78 @@
package web
// S2 offsite connectivity: the read-only /offsite registry page (doc 06 §8 S2 "hub UI shows the
// peer registry"). Read-only by design — add/remove stay on the admin API; UI mutations arrive
// with tunnel health (S3/S6). Peers render neutral (no health state exists yet — nothing to
// except on, so no status colors).
import (
"database/sql"
"net/http"
)
// truncateMiddle shortens a long opaque value (pubkeys) for table display, keeping both ends —
// the full value always rides the title attribute.
func truncateMiddle(s string, keep int) string {
if len(s) <= 2*keep+1 {
return s
}
return s[:keep] + "…" + s[len(s)-keep:]
}
// offsitePeerRow is the per-peer view model.
type offsitePeerRow struct {
Pubkey string
PubkeyShort string
AssignedIP string // with /32
HostID string // "" = unbound
Note string
CreatedAt string
}
// handleOffsite renders the offsite registry: the endpoint card + the peer table.
func (s *Server) handleOffsite(w http.ResponseWriter, r *http.Request) {
data := map[string]interface{}{
"HasEndpoint": false,
}
ep, err := s.store.GetWGEndpoint()
if err != nil && err != sql.ErrNoRows {
s.logger.Printf("[ERROR] offsite: endpoint read: %v", err)
http.Error(w, "Internal error", http.StatusInternalServerError)
return
}
if ep != nil {
data["HasEndpoint"] = true
data["Endpoint"] = map[string]interface{}{
"DNSName": ep.DNSName,
"WGPort": ep.WGPort,
"ServerPubkey": ep.ServerPubkey,
"ServerPubkeyShort": truncateMiddle(ep.ServerPubkey, 10),
"TunnelSubnet": ep.TunnelSubnet,
"PBSTunnelIP": ep.PBSTunnelIP,
}
}
peers, err := s.store.ListWGPeers()
if err != nil {
s.logger.Printf("[ERROR] offsite: peer list: %v", err)
http.Error(w, "Internal error", http.StatusInternalServerError)
return
}
rows := make([]offsitePeerRow, 0, len(peers))
for _, p := range peers {
rows = append(rows, offsitePeerRow{
Pubkey: p.Pubkey,
PubkeyShort: truncateMiddle(p.Pubkey, 10),
AssignedIP: p.AssignedIP + "/32",
HostID: p.HostID,
Note: p.Note,
CreatedAt: p.CreatedAt,
})
}
data["Peers"] = rows
if err := s.templates.ExecuteTemplate(w, "offsite.html", data); err != nil {
s.logger.Printf("[ERROR] offsite.html template: %v", err)
}
}
hub/internal/web/offsite_test.go
+74
View File
@@ -0,0 +1,74 @@
package web
// Group C — the /offsite registry page renders in all three states (S2 Part 3).
import (
"net/http"
"net/http/httptest"
"strings"
"testing"
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
)
func renderOffsite(t *testing.T, s *Server) string {
t.Helper()
rr := httptest.NewRecorder()
s.handleOffsite(rr, httptest.NewRequest(http.MethodGet, "/offsite", nil))
if rr.Code != http.StatusOK {
t.Fatalf("offsite render = %d", rr.Code)
}
return rr.Body.String()
}
func TestOffsite_NoEndpoint(t *testing.T) {
s, _ := newTestServer(t)
html := renderOffsite(t, s)
if !strings.Contains(html, "Not configured") {
t.Errorf("no-endpoint state missing: %s", html[:200])
}
if !strings.Contains(html, "No WireGuard peers registered") {
t.Errorf("empty-peers state missing")
}
}
func TestOffsite_EndpointAndPeers(t *testing.T) {
s, st := newTestServer(t)
if err := st.SetWGEndpoint(&store.WGEndpoint{
DNSName: "ep0.felhom.eu", WGPort: 443,
ServerPubkey: "CQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQk=",
TunnelSubnet: "10.77.0.0/24", PBSTunnelIP: "10.77.0.1",
}); err != nil {
t.Fatal(err)
}
st.UpsertHost(&store.Host{HostID: "hv1", CustomerID: "c1", APIKey: "k"})
if _, _, err := st.RegisterWGPeerForHost("hv1", "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE="); err != nil {
t.Fatal(err)
}
if _, _, err := st.AddWGPeer("AgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgI=", "", "unbound-test"); err != nil {
t.Fatal(err)
}
html := renderOffsite(t, s)
for _, want := range []string{
"ep0.felhom.eu:443", // endpoint card
"10.77.0.0/24", // subnet
"10.77.0.1:8007", // PBS tunnel addr
"10.77.0.2/32", // bound peer ip
"10.77.0.3/32", // unbound peer ip
`href="/hosts/hv1"`, // bound peer links to its host
"unbound-test", // note column
} {
if !strings.Contains(html, want) {
t.Errorf("offsite page missing %q", want)
}
}
// Unbound peer renders an em-dash host cell, not a broken link.
if strings.Contains(html, `href="/hosts/"`) {
t.Error("unbound peer rendered an empty host link")
}
// Full pubkey rides the title attribute (truncated display).
if !strings.Contains(html, `title="AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE="`) {
t.Error("full pubkey missing from title attr")
}
}
hub/internal/web/server.go
+3
View File
@@ -241,6 +241,9 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
case strings.HasPrefix(path, "/apps/"):
appName := strings.TrimPrefix(path, "/apps/")
s.handleAppDetail(w, r, appName)
// Offsite — read-only WG endpoint + peer registry (S2). Mutations stay on the admin API.
case path == "/offsite":
s.handleOffsite(w, r)
// Hosts — read-only fleet view (audit F-M1). GET only; no host actions.
case path == "/hosts" || path == "/hosts/":
s.handleHostsList(w, r)
hub/internal/web/templates/app_detail.html
+1
View File
@@ -17,6 +17,7 @@
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link active">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/apps.html
+1
View File
@@ -16,6 +16,7 @@
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link active">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/config_form.html
+1
View File
@@ -16,6 +16,7 @@
<a href="/configs" class="nav-link active">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/configs.html
+1
View File
@@ -16,6 +16,7 @@
<a href="/configs" class="nav-link active">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/configuration.html
+1
View File
@@ -16,6 +16,7 @@
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link active">Configuration</a>
</nav>
</header>
hub/internal/web/templates/customer_unified.html
+1
View File
@@ -17,6 +17,7 @@
<a href="/configs" class="nav-link active">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
<a href="/configs" class="back-link">&larr; All Customers</a>
hub/internal/web/templates/dashboard.html
+1
View File
@@ -17,6 +17,7 @@
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/host_detail.html
+1
View File
@@ -16,6 +16,7 @@
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link active">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/hosts.html
+1
View File
@@ -16,6 +16,7 @@
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link active">Hosts</a>
<a href="/offsite" class="nav-link">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
hub/internal/web/templates/offsite.html
+80
View File
@@ -0,0 +1,80 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Offsite — Felhom Hub</title>
<link rel="stylesheet" href="/style.css">
</head>
<body>
{{template "icon_sprite"}}
<div class="container">
<header>
<h1>Felhom <span>Hub</span></h1>
<nav class="nav-links">
<a href="/" class="nav-link">Dashboard</a>
<a href="/configs" class="nav-link">Customers</a>
<a href="/apps" class="nav-link">Apps</a>
<a href="/hosts" class="nav-link">Hosts</a>
<a href="/offsite" class="nav-link active">Offsite</a>
<a href="/configuration" class="nav-link">Configuration</a>
</nav>
</header>
<h2 style="margin-bottom: 1rem;">Offsite connectivity</h2>
{{if .HasEndpoint}}
<section class="card" style="margin-bottom: 1.5rem;">
<h3>Endpoint</h3>
<table class="detail-table">
<tr><th>Address</th><td><code>{{.Endpoint.DNSName}}:{{.Endpoint.WGPort}}</code> (WireGuard, UDP)</td></tr>
<tr><th>Server public key</th><td><code title="{{.Endpoint.ServerPubkey}}">{{.Endpoint.ServerPubkeyShort}}</code></td></tr>
<tr><th>Tunnel subnet</th><td><code>{{.Endpoint.TunnelSubnet}}</code></td></tr>
<tr><th>PBS tunnel address</th><td><code>{{.Endpoint.PBSTunnelIP}}:8007</code></td></tr>
</table>
</section>
{{else}}
<section class="card" style="margin-bottom: 1.5rem;">
<h3>Endpoint</h3>
<p class="text-muted">Not configured. Register one via <code>PUT /api/v1/admin/wg/endpoint</code> (runbook: offsite-endpoint.md).</p>
</section>
{{end}}
{{if .Peers}}
<section class="card" style="padding: 0; overflow: hidden;">
<table class="data-table">
<thead>
<tr>
<th>Public key</th>
<th>Assigned IP</th>
<th>Host</th>
<th>Note</th>
<th>Created</th>
</tr>
</thead>
<tbody>
{{range .Peers}}
<tr>
<td><code title="{{.Pubkey}}">{{.PubkeyShort}}</code></td>
<td><code>{{.AssignedIP}}</code></td>
<td>{{if .HostID}}<a href="/hosts/{{.HostID}}">{{.HostID}}</a>{{else}}—{{end}}</td>
<td>{{if .Note}}{{.Note}}{{else}}—{{end}}</td>
<td>{{.CreatedAt}}</td>
</tr>
{{end}}
</tbody>
</table>
</section>
{{else}}
<div class="empty-state">
<p>No WireGuard peers registered.</p>
<p class="hint">A peer appears here when a box registers via <code>POST /hosts/&lt;id&gt;/wg</code> or the operator adds one via the admin API.</p>
</div>
{{end}}
<footer style="margin-top: 2rem; color: var(--text-muted); font-size: 0.8rem; text-align: center;">
Felhom Hub <span style="font-family: var(--font-mono)">{{hubVersion}}</span>
</footer>
</div>
</body>
</html>