admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hub v0.26.0: pull-based config delivery + retire inbound GUI controls

Browse Source 
config_version counter (bumped on every config save) advertised in the report
ACK; controller re-pulls + self-restarts on a change. Retire Trigger Update /
Push Config / Pull Config / Show Diff handlers+routes+buttons and the inbound
geo-notify (keep hub->Cloudflare geo removal). Setup command -> host-install;
delete dead customer.html + config_detail.html. Closes AUDIT-hub-gui F-S1/F-S4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs
This commit is contained in:
authentik Default Admin
2026-06-30 21:49:33 +02:00
parent e51e03bd7b
commit a3ac6c9488
10 changed files with 226 additions and 1247 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hub/internal/web/configs.go
+7 -476
View File
@@ -4,7 +4,6 @@ import (
"encoding/json"
"fmt"
"html/template"
"io"
"net/http"
"regexp"
"sort"
@@ -14,7 +13,6 @@ import (
cfClient "gitea.dooplex.hu/admin/felhom-hub/internal/cloudflare"
"gitea.dooplex.hu/admin/felhom-hub/internal/configgen"
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
"gopkg.in/yaml.v3"
)
var validCustomerID = regexp.MustCompile(`^[a-zA-Z0-9.\-]+$`)
@@ -229,14 +227,6 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
}
}
// Config drift badge: the at-rest comparison source (infra-backup) was retired
// 2026-06-16. With no stored controller.yaml to diff against, the passive badge is
// left empty (the template hides it when ConfigSyncStatus == ""). The live "Show
// Diff" path (handleCompareConfig, which fetches the controller's config over HTTP)
// is unaffected and remains the way to check drift on demand.
var configSyncStatus string // "" hides the badge; "in_sync"/"mismatch" reserved for a future live source
var configDiffCount int
// Version check
var latestVersion string
var updateAvailable bool
@@ -304,9 +294,6 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
EffectiveFloor string // override else global ("" = no floor)
BelowFloor bool // current < effective floor (would auto-update)
ConfigSyncStatus string // "in_sync", "mismatch", "unknown"
ConfigDiffCount int
NotifPrefs *store.NotificationPrefs
RecentNotifications []store.NotificationLogEntry
History []store.CustomerSummary
@@ -364,9 +351,6 @@ func (s *Server) handleCustomerUnified(w http.ResponseWriter, r *http.Request, c
EffectiveFloor: effectiveFloor,
BelowFloor: belowFloor,
ConfigSyncStatus: configSyncStatus,
ConfigDiffCount: configDiffCount,
NotifPrefs: notifPrefs,
RecentNotifications: recentNotifs,
History: history,
@@ -718,81 +702,6 @@ func (s *Server) handleSetCustomerFloor(w http.ResponseWriter, r *http.Request,
http.Redirect(w, r, "/customers/"+customerID+"?flash=floor_set", http.StatusSeeOther)
}
// handlePushConfig sends the generated YAML config to the controller.
func (s *Server) handlePushConfig(w http.ResponseWriter, r *http.Request, customerID string) {
cfg, err := s.store.GetCustomerConfig(customerID)
if err != nil || cfg == nil {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusNotFound)
w.Write([]byte(`{"ok":false,"error":"No config found for this customer"}`))
return
}
// Get controller URL from latest report
customer, _ := s.store.GetCustomer(customerID)
controllerURL := ""
if customer != nil {
controllerURL = customer.ControllerURL
if controllerURL == "" {
var rpt struct {
ControllerURL string `json:"controller_url"`
}
json.Unmarshal([]byte(customer.ReportJSON), &rpt)
controllerURL = rpt.ControllerURL
}
}
if controllerURL == "" {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusBadRequest)
w.Write([]byte(`{"ok":false,"error":"Controller URL not available — waiting for first report"}`))
return
}
// Generate YAML
templateYAML := defaultControllerTemplate
if s.templateFetcher != nil {
templateYAML = s.templateFetcher.Template()
}
yamlOutput, err := configgen.Generate(templateYAML, cfg)
if err != nil {
s.logger.Printf("[ERROR] Failed to generate config for push to %s: %v", customerID, err)
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusInternalServerError)
w.Write([]byte(`{"ok":false,"error":"Failed to generate config"}`))
return
}
// POST to controller
pushURL := controllerURL + "/api/config/apply"
req, err := http.NewRequest("POST", pushURL, strings.NewReader(yamlOutput))
if err != nil {
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusInternalServerError)
w.Write([]byte(`{"ok":false,"error":"Failed to create request"}`))
return
}
req.Header.Set("Authorization", "Bearer "+s.apiKey)
req.Header.Set("Content-Type", "text/yaml")
client := &http.Client{Timeout: 30 * time.Second}
resp, err := client.Do(req)
if err != nil {
s.logger.Printf("[ERROR] Push config to %s failed: %v", pushURL, err)
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusBadGateway)
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": fmt.Sprintf("Controller unreachable: %v", err)})
return
}
defer resp.Body.Close()
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
s.logger.Printf("[INFO] Push config to %s — controller responded %d: %s", customerID, resp.StatusCode, string(body))
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(resp.StatusCode)
w.Write(body)
}
// handleCreateConfigFromReport auto-creates a config entry from report data.
func (s *Server) handleCreateConfigFromReport(w http.ResponseWriter, r *http.Request, customerID string) {
// Check if config already exists
@@ -886,334 +795,12 @@ func buildConfigJSON(r *http.Request) string {
return string(data)
}
// --- Config comparison helpers (used by the live "Show Diff" handler) ---
// volatileKeys are YAML keys ignored during config comparison (always differ or deprecated).
var volatileKeys = map[string]bool{
"web.session_secret": true,
}
// sensitiveKeyParts are substrings that indicate a value should be masked in diff output.
var sensitiveKeyParts = []string{"token", "password", "secret", "api_key"}
// flattenYAML recursively flattens a nested map into dot-separated key-value pairs.
func flattenYAML(m map[string]interface{}, prefix string) map[string]string {
result := make(map[string]string)
for k, v := range m {
key := k
if prefix != "" {
key = prefix + "." + k
}
switch val := v.(type) {
case map[string]interface{}:
for fk, fv := range flattenYAML(val, key) {
result[fk] = fv
}
case []interface{}:
for i, item := range val {
itemKey := fmt.Sprintf("%s.%d", key, i)
if sub, ok := item.(map[string]interface{}); ok {
for fk, fv := range flattenYAML(sub, itemKey) {
result[fk] = fv
}
} else {
result[itemKey] = fmt.Sprintf("%v", item)
}
}
default:
result[key] = fmt.Sprintf("%v", v)
}
}
return result
}
// configDiff represents a single key-value difference between two configs.
type configDiff struct {
Key string `json:"key"`
HubValue string `json:"hub"`
CtrlValue string `json:"controller"`
Status string `json:"status"` // "changed", "hub_only", "controller_only"
}
// compareYAMLValues parses two YAML strings and returns their value differences.
// Volatile keys (e.g., web.session_secret) are excluded.
func compareYAMLValues(hubYAML, controllerYAML string) []configDiff {
var hubMap, ctrlMap map[string]interface{}
yaml.Unmarshal([]byte(hubYAML), &hubMap)
yaml.Unmarshal([]byte(controllerYAML), &ctrlMap)
hubFlat := flattenYAML(hubMap, "")
ctrlFlat := flattenYAML(ctrlMap, "")
var diffs []configDiff
// Keys in hub but different/missing in controller
for k, hv := range hubFlat {
if volatileKeys[k] {
continue
}
cv, exists := ctrlFlat[k]
if !exists {
if hv != "" && hv != "<nil>" {
diffs = append(diffs, configDiff{Key: k, HubValue: hv, CtrlValue: "(not set)", Status: "hub_only"})
}
} else if hv != cv {
diffs = append(diffs, configDiff{Key: k, HubValue: hv, CtrlValue: cv, Status: "changed"})
}
}
// Keys in controller but missing in hub
for k, cv := range ctrlFlat {
if volatileKeys[k] {
continue
}
if _, exists := hubFlat[k]; !exists {
if cv != "" && cv != "<nil>" {
diffs = append(diffs, configDiff{Key: k, HubValue: "(not set)", CtrlValue: cv, Status: "controller_only"})
}
}
}
sort.Slice(diffs, func(i, j int) bool { return diffs[i].Key < diffs[j].Key })
return diffs
}
// maskSensitive masks a value if the key contains sensitive substrings.
func maskSensitive(key, value string) string {
if value == "" || value == "(not set)" {
return value
}
keyLower := strings.ToLower(key)
for _, part := range sensitiveKeyParts {
if strings.Contains(keyLower, part) {
if len(value) > 8 {
return "***" + value[len(value)-4:]
}
return "***"
}
}
return value
}
// handleConfigDiff returns a JSON diff between Hub-generated and controller's live config.
func (s *Server) handleConfigDiff(w http.ResponseWriter, r *http.Request, customerID string) {
cfg, err := s.store.GetCustomerConfig(customerID)
if err != nil || cfg == nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "No config found"})
return
}
// Get controller URL
customer, _ := s.store.GetCustomer(customerID)
controllerURL := ""
if customer != nil {
controllerURL = customer.ControllerURL
if controllerURL == "" {
var rpt struct {
ControllerURL string `json:"controller_url"`
}
json.Unmarshal([]byte(customer.ReportJSON), &rpt)
controllerURL = rpt.ControllerURL
}
}
if controllerURL == "" {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Controller URL not available"})
return
}
// Fetch live config from controller
fetchURL := controllerURL + "/api/config"
req, err := http.NewRequest("GET", fetchURL, nil)
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to create request"})
return
}
req.Header.Set("Authorization", "Bearer "+s.apiKey)
client := &http.Client{Timeout: 15 * time.Second}
resp, err := client.Do(req)
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": fmt.Sprintf("Controller unreachable: %v", err)})
return
}
defer resp.Body.Close()
if resp.StatusCode != 200 {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": fmt.Sprintf("Controller returned HTTP %d", resp.StatusCode)})
return
}
controllerYAML, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to read controller response"})
return
}
// Generate Hub YAML
templateYAML := defaultControllerTemplate
if s.templateFetcher != nil {
templateYAML = s.templateFetcher.Template()
}
hubYAML, err := configgen.Generate(templateYAML, cfg)
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to generate Hub config"})
return
}
// Compare
diffs := compareYAMLValues(hubYAML, string(controllerYAML))
// Mask sensitive values
for i := range diffs {
diffs[i].HubValue = maskSensitive(diffs[i].Key, diffs[i].HubValue)
diffs[i].CtrlValue = maskSensitive(diffs[i].Key, diffs[i].CtrlValue)
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{
"ok": true,
"in_sync": len(diffs) == 0,
"diff_count": len(diffs),
"diffs": diffs,
})
}
// handlePullConfig fetches the controller's live config and imports it into the Hub.
func (s *Server) handlePullConfig(w http.ResponseWriter, r *http.Request, customerID string) {
cfg, err := s.store.GetCustomerConfig(customerID)
if err != nil || cfg == nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "No config found"})
return
}
// Get controller URL
customer, _ := s.store.GetCustomer(customerID)
controllerURL := ""
if customer != nil {
controllerURL = customer.ControllerURL
if controllerURL == "" {
var rpt struct {
ControllerURL string `json:"controller_url"`
}
json.Unmarshal([]byte(customer.ReportJSON), &rpt)
controllerURL = rpt.ControllerURL
}
}
if controllerURL == "" {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Controller URL not available"})
return
}
// Fetch live config from controller
fetchURL := controllerURL + "/api/config"
req, err := http.NewRequest("GET", fetchURL, nil)
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to create request"})
return
}
req.Header.Set("Authorization", "Bearer "+s.apiKey)
client := &http.Client{Timeout: 15 * time.Second}
resp, err := client.Do(req)
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": fmt.Sprintf("Controller unreachable: %v", err)})
return
}
defer resp.Body.Close()
if resp.StatusCode != 200 {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": fmt.Sprintf("Controller returned HTTP %d", resp.StatusCode)})
return
}
body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
if err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to read controller response"})
return
}
// Parse controller's YAML
var parsed map[string]interface{}
if err := yaml.Unmarshal(body, &parsed); err != nil {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to parse controller YAML"})
return
}
// Extract identity fields
if customer, ok := parsed["customer"].(map[string]interface{}); ok {
if v, ok := customer["name"].(string); ok && v != "" {
cfg.CustomerName = v
}
if v, ok := customer["domain"].(string); ok && v != "" {
cfg.Domain = v
}
if v, ok := customer["email"].(string); ok && v != "" {
cfg.Email = v
}
}
// Build config_json from override fields
overrides := make(map[string]interface{})
// Infrastructure tokens
if infra, ok := parsed["infrastructure"].(map[string]interface{}); ok {
infraOverrides := make(map[string]interface{})
if v, ok := infra["cf_tunnel_token"].(string); ok && v != "" {
infraOverrides["cf_tunnel_token"] = v
}
if v, ok := infra["cf_api_token"].(string); ok && v != "" {
infraOverrides["cf_api_token"] = v
}
if len(infraOverrides) > 0 {
overrides["infrastructure"] = infraOverrides
}
}
// Git credentials
if git, ok := parsed["git"].(map[string]interface{}); ok {
gitOverrides := make(map[string]interface{})
if v, ok := git["username"].(string); ok && v != "" {
gitOverrides["username"] = v
}
if v, ok := git["token"].(string); ok && v != "" {
gitOverrides["token"] = v
}
if len(gitOverrides) > 0 {
overrides["git"] = gitOverrides
}
}
configJSON, _ := json.Marshal(overrides)
cfg.ConfigJSON = string(configJSON)
if err := s.store.SaveCustomerConfig(cfg); err != nil {
s.logger.Printf("[ERROR] Pull config: failed to update config for %s: %v", customerID, err)
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": false, "error": "Failed to save config"})
return
}
s.logger.Printf("[INFO] Config pulled from controller for %s", customerID)
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Config imported from controller"})
}
// handleGeoDisable removes all [felhom-geo] WAF rules from Cloudflare for a customer,
// and notifies the controller to disable geo-restriction in its settings.
// handleGeoDisable removes all [felhom-geo] WAF rules from Cloudflare for a customer. The Cloudflare
// WAF rules ARE the geo enforcement, so removing them disables geo-restriction. This is a hub→Cloudflare
// call (NOT into the box) and stays. The old secondary inbound notify to the controller
// (notifyControllerGeoDisable) was retired in v0.26.0 to honour the never-inbound posture — the
// controller-side geo intent is left as a noted follow-up (there is no periodic re-apply, so the CF
// removal sticks).
func (s *Server) handleGeoDisable(w http.ResponseWriter, r *http.Request, customerID string) {
cfg, err := s.store.GetCustomerConfig(customerID)
if err != nil || cfg == nil {
@@ -1256,62 +843,6 @@ func (s *Server) handleGeoDisable(w http.ResponseWriter, r *http.Request, custom
s.logger.Printf("[INFO] Geo disable for %s: Cloudflare WAF rules removed", customerID)
// 2. Background: notify controller to disable geo in settings (retry for up to 10 min)
customer, _ := s.store.GetCustomer(customerID)
controllerURL := ""
if customer != nil {
controllerURL = customer.ControllerURL
}
if controllerURL == "" {
var rpt struct {
ControllerURL string `json:"controller_url"`
}
if customer != nil {
json.Unmarshal([]byte(customer.ReportJSON), &rpt)
controllerURL = rpt.ControllerURL
}
}
if controllerURL != "" && s.apiKey != "" {
go s.notifyControllerGeoDisable(customerID, controllerURL)
} else {
s.logger.Printf("[WARN] Geo disable for %s: cannot notify controller (no URL or API key)", customerID)
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Geo-restriction removed from Cloudflare. Controller will be notified."})
}
// notifyControllerGeoDisable retries sending geo-disable to the controller every 30s for up to 10 min.
func (s *Server) notifyControllerGeoDisable(customerID, controllerURL string) {
geoURL := controllerURL + "/api/geo/settings"
for attempt := 1; attempt <= 20; attempt++ {
req, err := http.NewRequest("POST", geoURL, strings.NewReader(`{"enabled":false,"allowed_countries":["HU"]}`))
if err != nil {
s.logger.Printf("[ERROR] Geo disable notify %s attempt %d: create request: %v", customerID, attempt, err)
return
}
req.Header.Set("Authorization", "Bearer "+s.apiKey)
req.Header.Set("Content-Type", "application/json")
client := &http.Client{Timeout: 15 * time.Second}
resp, err := client.Do(req)
if err != nil {
s.logger.Printf("[WARN] Geo disable notify %s attempt %d: %v", customerID, attempt, err)
time.Sleep(30 * time.Second)
continue
}
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
resp.Body.Close()
if resp.StatusCode >= 200 && resp.StatusCode < 300 {
s.logger.Printf("[INFO] Geo disable notify %s: controller confirmed (attempt %d): %s", customerID, attempt, string(body))
return
}
s.logger.Printf("[WARN] Geo disable notify %s attempt %d: status %d: %s", customerID, attempt, resp.StatusCode, string(body))
time.Sleep(30 * time.Second)
}
s.logger.Printf("[ERROR] Geo disable notify %s: gave up after 20 attempts", customerID)
json.NewEncoder(w).Encode(map[string]interface{}{"ok": true, "message": "Geo-restriction removed from Cloudflare."})
}