headscale/app.go

193 lines
5.3 KiB
Go
Raw Normal View History

2020-06-21 04:32:08 -06:00
package headscale
import (
"errors"
2020-06-21 04:32:08 -06:00
"fmt"
"log"
"net/http"
2021-02-21 15:54:15 -07:00
"os"
"strings"
"sync"
"time"
2020-06-21 04:32:08 -06:00
"github.com/gin-gonic/gin"
"golang.org/x/crypto/acme/autocert"
2021-07-04 13:40:46 -06:00
"gorm.io/gorm"
2021-02-20 15:57:06 -07:00
"tailscale.com/tailcfg"
2021-06-25 10:57:08 -06:00
"tailscale.com/types/wgkey"
2020-06-21 04:32:08 -06:00
)
2021-02-21 14:14:38 -07:00
// Config contains the initial Headscale configuration
2020-06-21 04:32:08 -06:00
type Config struct {
ServerURL string
Addr string
PrivateKeyPath string
DerpMap *tailcfg.DERPMap
EphemeralNodeInactivityTimeout time.Duration
2020-06-21 04:32:08 -06:00
DBtype string
DBpath string
2020-06-21 04:32:08 -06:00
DBhost string
DBport int
DBname string
DBuser string
DBpass string
TLSLetsEncryptHostname string
TLSLetsEncryptCacheDir string
TLSLetsEncryptChallengeType string
TLSCertPath string
TLSKeyPath string
2020-06-21 04:32:08 -06:00
}
2021-02-21 14:14:38 -07:00
// Headscale represents the base app of the service
2020-06-21 04:32:08 -06:00
type Headscale struct {
cfg Config
2021-07-04 13:40:46 -06:00
db *gorm.DB
2020-06-21 04:32:08 -06:00
dbString string
dbType string
dbDebug bool
2021-06-25 10:57:08 -06:00
publicKey *wgkey.Key
privateKey *wgkey.Private
2021-07-03 09:31:32 -06:00
aclPolicy *ACLPolicy
2021-07-04 05:24:05 -06:00
aclRules *[]tailcfg.FilterRule
2021-07-03 09:31:32 -06:00
pollMu sync.Mutex
clientsPolling map[uint64]chan []byte // this is by all means a hackity hack
2020-06-21 04:32:08 -06:00
}
2021-02-21 14:14:38 -07:00
// NewHeadscale returns the Headscale app
2020-06-21 04:32:08 -06:00
func NewHeadscale(cfg Config) (*Headscale, error) {
2021-02-21 15:54:15 -07:00
content, err := os.ReadFile(cfg.PrivateKeyPath)
2020-06-21 04:32:08 -06:00
if err != nil {
return nil, err
}
2021-06-25 10:57:08 -06:00
privKey, err := wgkey.ParsePrivate(string(content))
2020-06-21 04:32:08 -06:00
if err != nil {
return nil, err
}
pubKey := privKey.Public()
var dbString string
switch cfg.DBtype {
case "postgres":
dbString = fmt.Sprintf("host=%s port=%d dbname=%s user=%s password=%s sslmode=disable", cfg.DBhost,
cfg.DBport, cfg.DBname, cfg.DBuser, cfg.DBpass)
case "sqlite3":
dbString = cfg.DBpath
default:
2021-07-11 07:10:37 -06:00
return nil, errors.New("unsupported DB")
}
2020-06-21 04:32:08 -06:00
h := Headscale{
cfg: cfg,
dbType: cfg.DBtype,
dbString: dbString,
2020-06-21 04:32:08 -06:00
privateKey: privKey,
publicKey: &pubKey,
2021-07-04 05:24:05 -06:00
aclRules: &tailcfg.FilterAllowAll, // default allowall
2020-06-21 04:32:08 -06:00
}
2021-07-04 05:24:05 -06:00
2020-06-21 04:32:08 -06:00
err = h.initDB()
if err != nil {
return nil, err
}
2021-07-04 13:40:46 -06:00
h.clientsPolling = make(map[uint64]chan []byte)
2020-06-21 04:32:08 -06:00
return &h, nil
}
// Redirect to our TLS url
func (h *Headscale) redirect(w http.ResponseWriter, req *http.Request) {
target := h.cfg.ServerURL + req.URL.RequestURI()
http.Redirect(w, req, target, http.StatusFound)
}
// ExpireEphemeralNodes deletes ephemeral machine records that have not been
// seen for longer than h.cfg.EphemeralNodeInactivityTimeout
func (h *Headscale) ExpireEphemeralNodes(milliSeconds int64) {
ticker := time.NewTicker(time.Duration(milliSeconds) * time.Millisecond)
for range ticker.C {
h.expireEphemeralNodesWorker()
}
}
func (h *Headscale) expireEphemeralNodesWorker() {
namespaces, err := h.ListNamespaces()
if err != nil {
log.Printf("Error listing namespaces: %s", err)
return
}
for _, ns := range *namespaces {
machines, err := h.ListMachinesInNamespace(ns.Name)
if err != nil {
log.Printf("Error listing machines in namespace %s: %s", ns.Name, err)
return
}
for _, m := range *machines {
if m.AuthKey != nil && m.LastSeen != nil && m.AuthKey.Ephemeral && time.Now().After(m.LastSeen.Add(h.cfg.EphemeralNodeInactivityTimeout)) {
log.Printf("[%s] Ephemeral client removed from database\n", m.Name)
2021-07-04 13:40:46 -06:00
err = h.db.Unscoped().Delete(m).Error
if err != nil {
log.Printf("[%s] 🤮 Cannot delete ephemeral machine from the database: %s", m.Name, err)
}
}
}
}
}
2021-02-21 14:14:38 -07:00
// Serve launches a GIN server with the Headscale API
2020-06-21 04:32:08 -06:00
func (h *Headscale) Serve() error {
r := gin.Default()
r.GET("/key", h.KeyHandler)
r.GET("/register", h.RegisterWebAPI)
r.POST("/machine/:id/map", h.PollNetMapHandler)
r.POST("/machine/:id", h.RegistrationHandler)
var err error
if h.cfg.TLSLetsEncryptHostname != "" {
if !strings.HasPrefix(h.cfg.ServerURL, "https://") {
log.Println("WARNING: listening with TLS but ServerURL does not start with https://")
}
m := autocert.Manager{
Prompt: autocert.AcceptTOS,
HostPolicy: autocert.HostWhitelist(h.cfg.TLSLetsEncryptHostname),
Cache: autocert.DirCache(h.cfg.TLSLetsEncryptCacheDir),
}
s := &http.Server{
Addr: h.cfg.Addr,
TLSConfig: m.TLSConfig(),
Handler: r,
}
if h.cfg.TLSLetsEncryptChallengeType == "TLS-ALPN-01" {
// Configuration via autocert with TLS-ALPN-01 (https://tools.ietf.org/html/rfc8737)
// The RFC requires that the validation is done on port 443; in other words, headscale
// must be configured to run on port 443.
err = s.ListenAndServeTLS("", "")
} else if h.cfg.TLSLetsEncryptChallengeType == "HTTP-01" {
// Configuration via autocert with HTTP-01. This requires listening on
// port 80 for the certificate validation in addition to the headscale
// service, which can be configured to run on any other port.
go func() {
log.Fatal(http.ListenAndServe(":http", m.HTTPHandler(http.HandlerFunc(h.redirect))))
}()
2021-04-24 09:26:50 -06:00
err = s.ListenAndServeTLS("", "")
} else {
return errors.New("Unknown value for TLSLetsEncryptChallengeType")
}
} else if h.cfg.TLSCertPath == "" {
if !strings.HasPrefix(h.cfg.ServerURL, "http://") {
log.Println("WARNING: listening without TLS but ServerURL does not start with http://")
}
err = r.Run(h.cfg.Addr)
} else {
if !strings.HasPrefix(h.cfg.ServerURL, "https://") {
log.Println("WARNING: listening with TLS but ServerURL does not start with https://")
}
err = r.RunTLS(h.cfg.Addr, h.cfg.TLSCertPath, h.cfg.TLSKeyPath)
}
2020-06-21 04:32:08 -06:00
return err
}