-
-
package handlers
-
-import (
- "net/http"
- "strconv"
-
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
- "gorm.io/gorm"
-)
-
-type AccessListHandler struct {
- service *services.AccessListService
-}
-
-func NewAccessListHandler(db *gorm.DB) *AccessListHandler {
- return &AccessListHandler{
- service: services.NewAccessListService(db),
- }
-}
-
-// Create handles POST /api/v1/access-lists
-func (h *AccessListHandler) Create(c *gin.Context) {
- var acl models.AccessList
- if err := c.ShouldBindJSON(&acl); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if err := h.service.Create(&acl); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusCreated, acl)
-}
-
-// List handles GET /api/v1/access-lists
-func (h *AccessListHandler) List(c *gin.Context) {
- acls, err := h.service.List()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, acls)
-}
-
-// Get handles GET /api/v1/access-lists/:id
-func (h *AccessListHandler) Get(c *gin.Context) {
- id, err := strconv.ParseUint(c.Param("id"), 10, 32)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
- return
- }
-
- acl, err := h.service.GetByID(uint(id))
- if err != nil {
- if err == services.ErrAccessListNotFound {
- c.JSON(http.StatusNotFound, gin.H{"error": "access list not found"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, acl)
-}
-
-// Update handles PUT /api/v1/access-lists/:id
-func (h *AccessListHandler) Update(c *gin.Context) {
- id, err := strconv.ParseUint(c.Param("id"), 10, 32)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
- return
- }
-
- var updates models.AccessList
- if err := c.ShouldBindJSON(&updates); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if err := h.service.Update(uint(id), &updates); err != nil {
- if err == services.ErrAccessListNotFound {
- c.JSON(http.StatusNotFound, gin.H{"error": "access list not found"})
- return
- }
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Fetch updated record
- acl, _ := h.service.GetByID(uint(id))
- c.JSON(http.StatusOK, acl)
-}
-
-// Delete handles DELETE /api/v1/access-lists/:id
-func (h *AccessListHandler) Delete(c *gin.Context) {
- id, err := strconv.ParseUint(c.Param("id"), 10, 32)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
- return
- }
-
- if err := h.service.Delete(uint(id)); err != nil {
- if err == services.ErrAccessListNotFound {
- c.JSON(http.StatusNotFound, gin.H{"error": "access list not found"})
- return
- }
- if err == services.ErrAccessListInUse {
- c.JSON(http.StatusConflict, gin.H{"error": "access list is in use by proxy hosts"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{"message": "access list deleted"})
-}
-
-// TestIP handles POST /api/v1/access-lists/:id/test
-func (h *AccessListHandler) TestIP(c *gin.Context) {
- id, err := strconv.ParseUint(c.Param("id"), 10, 32)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
- return
- }
-
- var req struct {
- IPAddress string `json:"ip_address" binding:"required"`
- }
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- allowed, reason, err := h.service.TestIP(uint(id), req.IPAddress)
- if err != nil {
- if err == services.ErrAccessListNotFound {
- c.JSON(http.StatusNotFound, gin.H{"error": "access list not found"})
- return
- }
- if err == services.ErrInvalidIPAddress {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid IP address"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{
- "allowed": allowed,
- "reason": reason,
- })
-}
-
-// GetTemplates handles GET /api/v1/access-lists/templates
-func (h *AccessListHandler) GetTemplates(c *gin.Context) {
- templates := h.service.GetTemplates()
- c.JSON(http.StatusOK, templates)
-}
-
-
-
package handlers
-
-import (
- "net/http"
-
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type AuthHandler struct {
- authService *services.AuthService
-}
-
-func NewAuthHandler(authService *services.AuthService) *AuthHandler {
- return &AuthHandler{authService: authService}
-}
-
-type LoginRequest struct {
- Email string `json:"email" binding:"required,email"`
- Password string `json:"password" binding:"required"`
-}
-
-func (h *AuthHandler) Login(c *gin.Context) {
- var req LoginRequest
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- token, err := h.authService.Login(req.Email, req.Password)
- if err != nil {
- c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
- return
- }
-
- // Set cookie
- c.SetCookie("auth_token", token, 3600*24, "/", "", false, true) // Secure should be true in prod
-
- c.JSON(http.StatusOK, gin.H{"token": token})
-}
-
-type RegisterRequest struct {
- Email string `json:"email" binding:"required,email"`
- Password string `json:"password" binding:"required,min=8"`
- Name string `json:"name" binding:"required"`
-}
-
-func (h *AuthHandler) Register(c *gin.Context) {
- var req RegisterRequest
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- user, err := h.authService.Register(req.Email, req.Password, req.Name)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusCreated, user)
-}
-
-func (h *AuthHandler) Logout(c *gin.Context) {
- c.SetCookie("auth_token", "", -1, "/", "", false, true)
- c.JSON(http.StatusOK, gin.H{"message": "Logged out"})
-}
-
-func (h *AuthHandler) Me(c *gin.Context) {
- userID, _ := c.Get("userID")
- role, _ := c.Get("role")
-
- u, err := h.authService.GetUserByID(userID.(uint))
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{
- "user_id": userID,
- "role": role,
- "name": u.Name,
- "email": u.Email,
- })
-}
-
-type ChangePasswordRequest struct {
- OldPassword string `json:"old_password" binding:"required"`
- NewPassword string `json:"new_password" binding:"required,min=8"`
-}
-
-func (h *AuthHandler) ChangePassword(c *gin.Context) {
- var req ChangePasswordRequest
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- userID, exists := c.Get("userID")
- if !exists {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
- return
- }
-
- if err := h.authService.ChangePassword(userID.(uint), req.OldPassword, req.NewPassword); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{"message": "Password updated successfully"})
-}
-
-
-
package handlers
-
-import (
- "net/http"
- "os"
- "path/filepath"
-
- "github.com/Wikid82/charon/backend/internal/api/middleware"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/Wikid82/charon/backend/internal/util"
- "github.com/gin-gonic/gin"
-)
-
-type BackupHandler struct {
- service *services.BackupService
-}
-
-func NewBackupHandler(service *services.BackupService) *BackupHandler {
- return &BackupHandler{service: service}
-}
-
-func (h *BackupHandler) List(c *gin.Context) {
- backups, err := h.service.ListBackups()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list backups"})
- return
- }
- c.JSON(http.StatusOK, backups)
-}
-
-func (h *BackupHandler) Create(c *gin.Context) {
- filename, err := h.service.CreateBackup()
- if err != nil {
- middleware.GetRequestLogger(c).WithField("action", "create_backup").WithError(err).Error("Failed to create backup")
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create backup: " + err.Error()})
- return
- }
- middleware.GetRequestLogger(c).WithField("action", "create_backup").WithField("filename", util.SanitizeForLog(filepath.Base(filename))).Info("Backup created successfully")
- c.JSON(http.StatusCreated, gin.H{"filename": filename, "message": "Backup created successfully"})
-}
-
-func (h *BackupHandler) Delete(c *gin.Context) {
- filename := c.Param("filename")
- if err := h.service.DeleteBackup(filename); err != nil {
- if os.IsNotExist(err) {
- c.JSON(http.StatusNotFound, gin.H{"error": "Backup not found"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete backup"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Backup deleted"})
-}
-
-func (h *BackupHandler) Download(c *gin.Context) {
- filename := c.Param("filename")
- path, err := h.service.GetBackupPath(filename)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if _, err := os.Stat(path); os.IsNotExist(err) {
- c.JSON(http.StatusNotFound, gin.H{"error": "Backup not found"})
- return
- }
-
- c.Header("Content-Disposition", "attachment; filename="+filename)
- c.File(path)
-}
-
-func (h *BackupHandler) Restore(c *gin.Context) {
- filename := c.Param("filename")
- if err := h.service.RestoreBackup(filename); err != nil {
- middleware.GetRequestLogger(c).WithField("action", "restore_backup").WithField("filename", util.SanitizeForLog(filepath.Base(filename))).WithError(err).Error("Failed to restore backup")
- if os.IsNotExist(err) {
- c.JSON(http.StatusNotFound, gin.H{"error": "Backup not found"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to restore backup: " + err.Error()})
- return
- }
- middleware.GetRequestLogger(c).WithField("action", "restore_backup").WithField("filename", util.SanitizeForLog(filepath.Base(filename))).Info("Backup restored successfully")
- // In a real scenario, we might want to trigger a restart here
- c.JSON(http.StatusOK, gin.H{"message": "Backup restored successfully. Please restart the container."})
-}
-
-
-
package handlers
-
-import (
- "fmt"
- "net/http"
- "strconv"
-
- "github.com/gin-gonic/gin"
-
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/Wikid82/charon/backend/internal/util"
-)
-
-// BackupServiceInterface defines the contract for backup service operations
-type BackupServiceInterface interface {
- CreateBackup() (string, error)
- ListBackups() ([]services.BackupFile, error)
- DeleteBackup(filename string) error
- GetBackupPath(filename string) (string, error)
- RestoreBackup(filename string) error
-}
-
-type CertificateHandler struct {
- service *services.CertificateService
- backupService BackupServiceInterface
- notificationService *services.NotificationService
-}
-
-func NewCertificateHandler(service *services.CertificateService, backupService BackupServiceInterface, ns *services.NotificationService) *CertificateHandler {
- return &CertificateHandler{
- service: service,
- backupService: backupService,
- notificationService: ns,
- }
-}
-
-func (h *CertificateHandler) List(c *gin.Context) {
- certs, err := h.service.ListCertificates()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, certs)
-}
-
-type UploadCertificateRequest struct {
- Name string `form:"name" binding:"required"`
- Certificate string `form:"certificate"` // PEM content
- PrivateKey string `form:"private_key"` // PEM content
-}
-
-func (h *CertificateHandler) Upload(c *gin.Context) {
- // Handle multipart form
- name := c.PostForm("name")
- if name == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "name is required"})
- return
- }
-
- // Read files
- certFile, err := c.FormFile("certificate_file")
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "certificate_file is required"})
- return
- }
-
- keyFile, err := c.FormFile("key_file")
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "key_file is required"})
- return
- }
-
- // Open and read content
- certSrc, err := certFile.Open()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to open cert file"})
- return
- }
- defer func() { _ = certSrc.Close() }()
-
- keySrc, err := keyFile.Open()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to open key file"})
- return
- }
- defer func() { _ = keySrc.Close() }()
-
- // Read to string
- // Limit size to avoid DoS (e.g. 1MB)
- certBytes := make([]byte, 1024*1024)
- n, _ := certSrc.Read(certBytes)
- certPEM := string(certBytes[:n])
-
- keyBytes := make([]byte, 1024*1024)
- n, _ = keySrc.Read(keyBytes)
- keyPEM := string(keyBytes[:n])
-
- cert, err := h.service.UploadCertificate(name, certPEM, keyPEM)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "cert",
- "Certificate Uploaded",
- fmt.Sprintf("Certificate %s uploaded", util.SanitizeForLog(cert.Name)),
- map[string]interface{}{
- "Name": util.SanitizeForLog(cert.Name),
- "Domains": util.SanitizeForLog(cert.Domains),
- "Action": "uploaded",
- },
- )
- }
-
- c.JSON(http.StatusCreated, cert)
-}
-
-func (h *CertificateHandler) Delete(c *gin.Context) {
- idStr := c.Param("id")
- id, err := strconv.ParseUint(idStr, 10, 32)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
- return
- }
-
- // Check if certificate is in use before proceeding
- inUse, err := h.service.IsCertificateInUse(uint(id))
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to check certificate usage"})
- return
- }
- if inUse {
- c.JSON(http.StatusConflict, gin.H{"error": "certificate is in use by one or more proxy hosts"})
- return
- }
-
- // Create backup before deletion
- if h.backupService != nil {
- if _, err := h.backupService.CreateBackup(); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create backup before deletion"})
- return
- }
- }
-
- // Proceed with deletion
- if err := h.service.DeleteCertificate(uint(id)); err != nil {
- if err == services.ErrCertInUse {
- c.JSON(http.StatusConflict, gin.H{"error": "certificate is in use by one or more proxy hosts"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "cert",
- "Certificate Deleted",
- fmt.Sprintf("Certificate ID %d deleted", id),
- map[string]interface{}{
- "ID": id,
- "Action": "deleted",
- },
- )
- }
-
- c.JSON(http.StatusOK, gin.H{"message": "certificate deleted"})
-}
-
-
-
package handlers
-
-import (
- "context"
- "fmt"
- "os"
- "os/exec"
- "path/filepath"
- "strconv"
- "syscall"
-)
-
-// DefaultCrowdsecExecutor implements CrowdsecExecutor using OS processes.
-type DefaultCrowdsecExecutor struct {
-}
-
-func NewDefaultCrowdsecExecutor() *DefaultCrowdsecExecutor { return &DefaultCrowdsecExecutor{} }
-
-func (e *DefaultCrowdsecExecutor) pidFile(configDir string) string {
- return filepath.Join(configDir, "crowdsec.pid")
-}
-
-func (e *DefaultCrowdsecExecutor) Start(ctx context.Context, binPath, configDir string) (int, error) {
- cmd := exec.CommandContext(ctx, binPath, "--config-dir", configDir)
- cmd.Stdout = os.Stdout
- cmd.Stderr = os.Stderr
- if err := cmd.Start(); err != nil {
- return 0, err
- }
- pid := cmd.Process.Pid
- // write pid file
- if err := os.WriteFile(e.pidFile(configDir), []byte(strconv.Itoa(pid)), 0o644); err != nil {
- return pid, fmt.Errorf("failed to write pid file: %w", err)
- }
- // wait in background
- go func() {
- _ = cmd.Wait()
- _ = os.Remove(e.pidFile(configDir))
- }()
- return pid, nil
-}
-
-func (e *DefaultCrowdsecExecutor) Stop(ctx context.Context, configDir string) error {
- b, err := os.ReadFile(e.pidFile(configDir))
- if err != nil {
- return fmt.Errorf("pid file read: %w", err)
- }
- pid, err := strconv.Atoi(string(b))
- if err != nil {
- return fmt.Errorf("invalid pid: %w", err)
- }
- proc, err := os.FindProcess(pid)
- if err != nil {
- return err
- }
- if err := proc.Signal(syscall.SIGTERM); err != nil {
- return err
- }
- // best-effort remove pid file
- _ = os.Remove(e.pidFile(configDir))
- return nil
-}
-
-func (e *DefaultCrowdsecExecutor) Status(ctx context.Context, configDir string) (bool, int, error) {
- b, err := os.ReadFile(e.pidFile(configDir))
- if err != nil {
- return false, 0, nil
- }
- pid, err := strconv.Atoi(string(b))
- if err != nil {
- return false, 0, nil
- }
- // Check process exists
- proc, err := os.FindProcess(pid)
- if err != nil {
- return false, pid, nil
- }
- // Sending signal 0 is not portable on Windows, but OK for Linux containers
- if err := proc.Signal(syscall.Signal(0)); err != nil {
- return false, pid, nil
- }
- return true, pid, nil
-}
-
-
-
package handlers
-
-import (
- "archive/tar"
- "compress/gzip"
- "context"
- "fmt"
- "github.com/Wikid82/charon/backend/internal/logger"
- "io"
- "net/http"
- "os"
- "path/filepath"
- "strings"
- "time"
-
- "github.com/gin-gonic/gin"
- "gorm.io/gorm"
-)
-
-// Executor abstracts starting/stopping CrowdSec so tests can mock it.
-type CrowdsecExecutor interface {
- Start(ctx context.Context, binPath, configDir string) (int, error)
- Stop(ctx context.Context, configDir string) error
- Status(ctx context.Context, configDir string) (running bool, pid int, err error)
-}
-
-// CrowdsecHandler manages CrowdSec process and config imports.
-type CrowdsecHandler struct {
- DB *gorm.DB
- Executor CrowdsecExecutor
- BinPath string
- DataDir string
-}
-
-func NewCrowdsecHandler(db *gorm.DB, exec CrowdsecExecutor, binPath, dataDir string) *CrowdsecHandler {
- return &CrowdsecHandler{DB: db, Executor: exec, BinPath: binPath, DataDir: dataDir}
-}
-
-// Start starts the CrowdSec process.
-func (h *CrowdsecHandler) Start(c *gin.Context) {
- ctx := c.Request.Context()
- pid, err := h.Executor.Start(ctx, h.BinPath, h.DataDir)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, gin.H{"status": "started", "pid": pid})
-}
-
-// Stop stops the CrowdSec process.
-func (h *CrowdsecHandler) Stop(c *gin.Context) {
- ctx := c.Request.Context()
- if err := h.Executor.Stop(ctx, h.DataDir); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, gin.H{"status": "stopped"})
-}
-
-// Status returns simple running state.
-func (h *CrowdsecHandler) Status(c *gin.Context) {
- ctx := c.Request.Context()
- running, pid, err := h.Executor.Status(ctx, h.DataDir)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, gin.H{"running": running, "pid": pid})
-}
-
-// ImportConfig accepts a tar.gz or zip upload and extracts into DataDir (backing up existing config).
-func (h *CrowdsecHandler) ImportConfig(c *gin.Context) {
- file, err := c.FormFile("file")
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "file required"})
- return
- }
-
- // Save to temp file
- tmpDir := os.TempDir()
- tmpPath := filepath.Join(tmpDir, fmt.Sprintf("crowdsec-import-%d", time.Now().UnixNano()))
- if err := os.MkdirAll(tmpPath, 0o755); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create temp dir"})
- return
- }
-
- dst := filepath.Join(tmpPath, file.Filename)
- if err := c.SaveUploadedFile(file, dst); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save upload"})
- return
- }
-
- // For safety, do minimal validation: ensure file non-empty
- fi, err := os.Stat(dst)
- if err != nil || fi.Size() == 0 {
- c.JSON(http.StatusBadRequest, gin.H{"error": "empty upload"})
- return
- }
-
- // Backup current config
- backupDir := h.DataDir + ".backup." + time.Now().Format("20060102-150405")
- if _, err := os.Stat(h.DataDir); err == nil {
- _ = os.Rename(h.DataDir, backupDir)
- }
- // Create target dir
- if err := os.MkdirAll(h.DataDir, 0o755); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create config dir"})
- return
- }
-
- // For now, simply copy uploaded file into data dir for operator to handle extraction
- target := filepath.Join(h.DataDir, file.Filename)
- in, err := os.Open(dst)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to open temp file"})
- return
- }
- defer in.Close()
- out, err := os.Create(target)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create target file"})
- return
- }
- defer out.Close()
- if _, err := io.Copy(out, in); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to write config"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{"status": "imported", "backup": backupDir})
-}
-
-// ExportConfig creates a tar.gz archive of the CrowdSec data directory and streams it
-// back to the client as a downloadable file.
-func (h *CrowdsecHandler) ExportConfig(c *gin.Context) {
- // Ensure DataDir exists
- if _, err := os.Stat(h.DataDir); os.IsNotExist(err) {
- c.JSON(http.StatusNotFound, gin.H{"error": "crowdsec config not found"})
- return
- }
-
- // Create a gzip writer and tar writer that stream directly to the response
- c.Header("Content-Type", "application/gzip")
- filename := fmt.Sprintf("crowdsec-config-%s.tar.gz", time.Now().Format("20060102-150405"))
- c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%s", filename))
- gw := gzip.NewWriter(c.Writer)
- defer func() {
- if err := gw.Close(); err != nil {
- logger.Log().WithError(err).Warn("Failed to close gzip writer")
- }
- }()
- tw := tar.NewWriter(gw)
- defer func() {
- if err := tw.Close(); err != nil {
- logger.Log().WithError(err).Warn("Failed to close tar writer")
- }
- }()
-
- // Walk the DataDir and add files to the archive
- err := filepath.Walk(h.DataDir, func(path string, info os.FileInfo, err error) error {
- if err != nil {
- return err
- }
- if info.IsDir() {
- return nil
- }
- rel, err := filepath.Rel(h.DataDir, path)
- if err != nil {
- return err
- }
- // Open file
- f, err := os.Open(path)
- if err != nil {
- return err
- }
- defer f.Close()
-
- hdr := &tar.Header{
- Name: rel,
- Size: info.Size(),
- Mode: int64(info.Mode()),
- ModTime: info.ModTime(),
- }
- if err := tw.WriteHeader(hdr); err != nil {
- return err
- }
- if _, err := io.Copy(tw, f); err != nil {
- return err
- }
- return nil
- })
- if err != nil {
- // If any error occurred while creating the archive, return 500
- c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-}
-
-// ListFiles returns a flat list of files under the CrowdSec DataDir.
-func (h *CrowdsecHandler) ListFiles(c *gin.Context) {
- var files []string
- if _, err := os.Stat(h.DataDir); os.IsNotExist(err) {
- c.JSON(http.StatusOK, gin.H{"files": files})
- return
- }
- err := filepath.Walk(h.DataDir, func(path string, info os.FileInfo, err error) error {
- if err != nil {
- return err
- }
- if !info.IsDir() {
- rel, err := filepath.Rel(h.DataDir, path)
- if err != nil {
- return err
- }
- files = append(files, rel)
- }
- return nil
- })
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, gin.H{"files": files})
-}
-
-// ReadFile returns the contents of a specific file under DataDir. Query param 'path' required.
-func (h *CrowdsecHandler) ReadFile(c *gin.Context) {
- rel := c.Query("path")
- if rel == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "path required"})
- return
- }
- clean := filepath.Clean(rel)
- // prevent directory traversal
- p := filepath.Join(h.DataDir, clean)
- if !strings.HasPrefix(p, filepath.Clean(h.DataDir)) {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
- return
- }
- data, err := os.ReadFile(p)
- if err != nil {
- if os.IsNotExist(err) {
- c.JSON(http.StatusNotFound, gin.H{"error": "file not found"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, gin.H{"content": string(data)})
-}
-
-// WriteFile writes content to a file under the CrowdSec DataDir, creating a backup before doing so.
-// JSON body: { "path": "relative/path.conf", "content": "..." }
-func (h *CrowdsecHandler) WriteFile(c *gin.Context) {
- var payload struct {
- Path string `json:"path"`
- Content string `json:"content"`
- }
- if err := c.ShouldBindJSON(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload"})
- return
- }
- if payload.Path == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "path required"})
- return
- }
- clean := filepath.Clean(payload.Path)
- p := filepath.Join(h.DataDir, clean)
- if !strings.HasPrefix(p, filepath.Clean(h.DataDir)) {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
- return
- }
- // Backup existing DataDir
- backupDir := h.DataDir + ".backup." + time.Now().Format("20060102-150405")
- if _, err := os.Stat(h.DataDir); err == nil {
- if err := os.Rename(h.DataDir, backupDir); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create backup"})
- return
- }
- }
- // Recreate DataDir and write file
- if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to prepare dir"})
- return
- }
- if err := os.WriteFile(p, []byte(payload.Content), 0o644); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to write file"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"status": "written", "backup": backupDir})
-}
-
-// RegisterRoutes registers crowdsec admin routes under protected group
-func (h *CrowdsecHandler) RegisterRoutes(rg *gin.RouterGroup) {
- rg.POST("/admin/crowdsec/start", h.Start)
- rg.POST("/admin/crowdsec/stop", h.Stop)
- rg.GET("/admin/crowdsec/status", h.Status)
- rg.POST("/admin/crowdsec/import", h.ImportConfig)
- rg.GET("/admin/crowdsec/export", h.ExportConfig)
- rg.GET("/admin/crowdsec/files", h.ListFiles)
- rg.GET("/admin/crowdsec/file", h.ReadFile)
- rg.POST("/admin/crowdsec/file", h.WriteFile)
-}
-
-
-
package handlers
-
-import (
- "fmt"
- "net/http"
-
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type DockerHandler struct {
- dockerService *services.DockerService
- remoteServerService *services.RemoteServerService
-}
-
-func NewDockerHandler(dockerService *services.DockerService, remoteServerService *services.RemoteServerService) *DockerHandler {
- return &DockerHandler{
- dockerService: dockerService,
- remoteServerService: remoteServerService,
- }
-}
-
-func (h *DockerHandler) RegisterRoutes(r *gin.RouterGroup) {
- r.GET("/docker/containers", h.ListContainers)
-}
-
-func (h *DockerHandler) ListContainers(c *gin.Context) {
- host := c.Query("host")
- serverID := c.Query("server_id")
-
- // If server_id is provided, look up the remote server
- if serverID != "" {
- server, err := h.remoteServerService.GetByUUID(serverID)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "Remote server not found"})
- return
- }
-
- // Construct Docker host string
- // Assuming TCP for now as that's what RemoteServer supports (Host/Port)
- // TODO: Support SSH if/when RemoteServer supports it
- host = fmt.Sprintf("tcp://%s:%d", server.Host, server.Port)
- }
-
- containers, err := h.dockerService.ListContainers(c.Request.Context(), host)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list containers: " + err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, containers)
-}
-
-
-
package handlers
-
-import (
- "fmt"
- "net/http"
-
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/Wikid82/charon/backend/internal/util"
- "github.com/gin-gonic/gin"
- "gorm.io/gorm"
-)
-
-type DomainHandler struct {
- DB *gorm.DB
- notificationService *services.NotificationService
-}
-
-func NewDomainHandler(db *gorm.DB, ns *services.NotificationService) *DomainHandler {
- return &DomainHandler{
- DB: db,
- notificationService: ns,
- }
-}
-
-func (h *DomainHandler) List(c *gin.Context) {
- var domains []models.Domain
- if err := h.DB.Order("name asc").Find(&domains).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch domains"})
- return
- }
- c.JSON(http.StatusOK, domains)
-}
-
-func (h *DomainHandler) Create(c *gin.Context) {
- var input struct {
- Name string `json:"name" binding:"required"`
- }
-
- if err := c.ShouldBindJSON(&input); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- domain := models.Domain{
- Name: input.Name,
- }
-
- if err := h.DB.Create(&domain).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create domain"})
- return
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "domain",
- "Domain Added",
- fmt.Sprintf("Domain %s added", util.SanitizeForLog(domain.Name)),
- map[string]interface{}{
- "Name": util.SanitizeForLog(domain.Name),
- "Action": "created",
- },
- )
- }
-
- c.JSON(http.StatusCreated, domain)
-}
-
-func (h *DomainHandler) Delete(c *gin.Context) {
- id := c.Param("id")
- var domain models.Domain
- if err := h.DB.Where("uuid = ?", id).First(&domain).Error; err == nil {
- // Send Notification before delete (or after if we keep the name)
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "domain",
- "Domain Deleted",
- fmt.Sprintf("Domain %s deleted", util.SanitizeForLog(domain.Name)),
- map[string]interface{}{
- "Name": util.SanitizeForLog(domain.Name),
- "Action": "deleted",
- },
- )
- }
- }
-
- if err := h.DB.Where("uuid = ?", id).Delete(&models.Domain{}).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete domain"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Domain deleted"})
-}
-
-
-
package handlers
-
-import (
- "net/http"
- "os"
- "strconv"
- "strings"
-
- "github.com/gin-gonic/gin"
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/models"
-)
-
-// FeatureFlagsHandler exposes simple DB-backed feature flags with env fallback.
-type FeatureFlagsHandler struct {
- DB *gorm.DB
-}
-
-func NewFeatureFlagsHandler(db *gorm.DB) *FeatureFlagsHandler {
- return &FeatureFlagsHandler{DB: db}
-}
-
-// defaultFlags lists the canonical feature flags we expose.
-var defaultFlags = []string{
- "feature.global.enabled",
- "feature.cerberus.enabled",
- "feature.uptime.enabled",
- "feature.notifications.enabled",
- "feature.docker.enabled",
-}
-
-// GetFlags returns a map of feature flag -> bool. DB setting takes precedence
-// and falls back to environment variables if present.
-func (h *FeatureFlagsHandler) GetFlags(c *gin.Context) {
- result := make(map[string]bool)
-
- for _, key := range defaultFlags {
- // Try DB
- var s models.Setting
- if err := h.DB.Where("key = ?", key).First(&s).Error; err == nil {
- v := strings.ToLower(strings.TrimSpace(s.Value))
- b := v == "1" || v == "true" || v == "yes"
- result[key] = b
- continue
- }
-
- // Fallback to env vars. Try FEATURE_... and also stripped service name e.g. CERBERUS_ENABLED
- envKey := strings.ToUpper(strings.ReplaceAll(key, ".", "_"))
- if ev, ok := os.LookupEnv(envKey); ok {
- if bv, err := strconv.ParseBool(ev); err == nil {
- result[key] = bv
- continue
- }
- // accept 1/0
- result[key] = ev == "1"
- continue
- }
-
- // Try shorter variant after removing leading "feature."
- if strings.HasPrefix(key, "feature.") {
- short := strings.ToUpper(strings.ReplaceAll(strings.TrimPrefix(key, "feature."), ".", "_"))
- if ev, ok := os.LookupEnv(short); ok {
- if bv, err := strconv.ParseBool(ev); err == nil {
- result[key] = bv
- continue
- }
- result[key] = ev == "1"
- continue
- }
- }
-
- // Default false
- result[key] = false
- }
-
- c.JSON(http.StatusOK, result)
-}
-
-// UpdateFlags accepts a JSON object map[string]bool and upserts settings.
-func (h *FeatureFlagsHandler) UpdateFlags(c *gin.Context) {
- var payload map[string]bool
- if err := c.ShouldBindJSON(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- for k, v := range payload {
- // Only allow keys in the default list to avoid arbitrary settings
- allowed := false
- for _, ak := range defaultFlags {
- if ak == k {
- allowed = true
- break
- }
- }
- if !allowed {
- continue
- }
-
- s := models.Setting{Key: k, Value: strconv.FormatBool(v), Type: "bool", Category: "feature"}
- if err := h.DB.Where(models.Setting{Key: k}).Assign(s).FirstOrCreate(&s).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save setting"})
- return
- }
- }
-
- c.JSON(http.StatusOK, gin.H{"status": "ok"})
-}
-
-
-
package handlers
-
-import (
- "net"
- "net/http"
-
- "github.com/Wikid82/charon/backend/internal/version"
- "github.com/gin-gonic/gin"
-)
-
-// getLocalIP returns the non-loopback local IP of the host
-func getLocalIP() string {
- addrs, err := net.InterfaceAddrs()
- if err != nil {
- return ""
- }
- for _, address := range addrs {
- // check the address type and if it is not a loopback then return it
- if ipnet, ok := address.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
- if ipnet.IP.To4() != nil {
- return ipnet.IP.String()
- }
- }
- }
- return ""
-}
-
-// HealthHandler responds with basic service metadata for uptime checks.
-func HealthHandler(c *gin.Context) {
- c.JSON(http.StatusOK, gin.H{
- "status": "ok",
- "service": version.Name,
- "version": version.Version,
- "git_commit": version.GitCommit,
- "build_time": version.BuildTime,
- "internal_ip": getLocalIP(),
- })
-}
-
-
-
package handlers
-
-import (
- "encoding/json"
- "fmt"
- "net/http"
- "os"
- "path"
- "path/filepath"
- "strings"
- "time"
-
- "github.com/gin-gonic/gin"
- "github.com/google/uuid"
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/api/middleware"
- "github.com/Wikid82/charon/backend/internal/caddy"
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/Wikid82/charon/backend/internal/util"
-)
-
-// ImportHandler handles Caddyfile import operations.
-type ImportHandler struct {
- db *gorm.DB
- proxyHostSvc *services.ProxyHostService
- importerservice *caddy.Importer
- importDir string
- mountPath string
-}
-
-// NewImportHandler creates a new import handler.
-func NewImportHandler(db *gorm.DB, caddyBinary, importDir, mountPath string) *ImportHandler {
- return &ImportHandler{
- db: db,
- proxyHostSvc: services.NewProxyHostService(db),
- importerservice: caddy.NewImporter(caddyBinary),
- importDir: importDir,
- mountPath: mountPath,
- }
-}
-
-// RegisterRoutes registers import-related routes.
-func (h *ImportHandler) RegisterRoutes(router *gin.RouterGroup) {
- router.GET("/import/status", h.GetStatus)
- router.GET("/import/preview", h.GetPreview)
- router.POST("/import/upload", h.Upload)
- router.POST("/import/upload-multi", h.UploadMulti)
- router.POST("/import/detect-imports", h.DetectImports)
- router.POST("/import/commit", h.Commit)
- router.DELETE("/import/cancel", h.Cancel)
-}
-
-// GetStatus returns current import session status.
-func (h *ImportHandler) GetStatus(c *gin.Context) {
- var session models.ImportSession
- err := h.db.Where("status IN ?", []string{"pending", "reviewing"}).
- Order("created_at DESC").
- First(&session).Error
-
- if err == gorm.ErrRecordNotFound {
- // No pending/reviewing session, check if there's a mounted Caddyfile available for transient preview
- if h.mountPath != "" {
- if fileInfo, err := os.Stat(h.mountPath); err == nil {
- // Check if this mount has already been committed recently
- var committedSession models.ImportSession
- err := h.db.Where("source_file = ? AND status = ?", h.mountPath, "committed").
- Order("committed_at DESC").
- First(&committedSession).Error
-
- // Allow re-import if:
- // 1. Never committed before (err == gorm.ErrRecordNotFound), OR
- // 2. File was modified after last commit
- allowImport := err == gorm.ErrRecordNotFound
- if !allowImport && committedSession.CommittedAt != nil {
- fileMod := fileInfo.ModTime()
- commitTime := *committedSession.CommittedAt
- allowImport = fileMod.After(commitTime)
- }
-
- if allowImport {
- // Mount file is available for import
- c.JSON(http.StatusOK, gin.H{
- "has_pending": true,
- "session": gin.H{
- "id": "transient",
- "state": "transient",
- "source_file": h.mountPath,
- },
- })
- return
- }
- // Mount file was already committed and hasn't been modified, don't offer it again
- }
- }
- c.JSON(http.StatusOK, gin.H{"has_pending": false})
- return
- }
-
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{
- "has_pending": true,
- "session": gin.H{
- "id": session.UUID,
- "state": session.Status,
- "created_at": session.CreatedAt,
- "updated_at": session.UpdatedAt,
- },
- })
-}
-
-// GetPreview returns parsed hosts and conflicts for review.
-func (h *ImportHandler) GetPreview(c *gin.Context) {
- var session models.ImportSession
- err := h.db.Where("status IN ?", []string{"pending", "reviewing"}).
- Order("created_at DESC").
- First(&session).Error
-
- if err == nil {
- // DB session found
- var result caddy.ImportResult
- if err := json.Unmarshal([]byte(session.ParsedData), &result); err == nil {
- // Update status to reviewing
- session.Status = "reviewing"
- h.db.Save(&session)
-
- // Read original Caddyfile content if available
- var caddyfileContent string
- if session.SourceFile != "" {
- if content, err := os.ReadFile(session.SourceFile); err == nil {
- caddyfileContent = string(content)
- } else {
- backupPath := filepath.Join(h.importDir, "backups", filepath.Base(session.SourceFile))
- if content, err := os.ReadFile(backupPath); err == nil {
- caddyfileContent = string(content)
- }
- }
- }
-
- c.JSON(http.StatusOK, gin.H{
- "session": gin.H{
- "id": session.UUID,
- "state": session.Status,
- "created_at": session.CreatedAt,
- "updated_at": session.UpdatedAt,
- "source_file": session.SourceFile,
- },
- "preview": result,
- "caddyfile_content": caddyfileContent,
- })
- return
- }
- }
-
- // No DB session found or failed to parse session. Try transient preview from mountPath.
- if h.mountPath != "" {
- if fileInfo, err := os.Stat(h.mountPath); err == nil {
- // Check if this mount has already been committed recently
- var committedSession models.ImportSession
- err := h.db.Where("source_file = ? AND status = ?", h.mountPath, "committed").
- Order("committed_at DESC").
- First(&committedSession).Error
-
- // Allow preview if:
- // 1. Never committed before (err == gorm.ErrRecordNotFound), OR
- // 2. File was modified after last commit
- allowPreview := err == gorm.ErrRecordNotFound
- if !allowPreview && committedSession.CommittedAt != nil {
- allowPreview = fileInfo.ModTime().After(*committedSession.CommittedAt)
- }
-
- if !allowPreview {
- // Mount file was already committed and hasn't been modified, don't offer preview again
- c.JSON(http.StatusNotFound, gin.H{"error": "no pending import"})
- return
- }
-
- // Parse mounted Caddyfile transiently
- transient, err := h.importerservice.ImportFile(h.mountPath)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to parse mounted Caddyfile"})
- return
- }
-
- // Build a transient session id (not persisted)
- sid := uuid.NewString()
- var caddyfileContent string
- if content, err := os.ReadFile(h.mountPath); err == nil {
- caddyfileContent = string(content)
- }
-
- // Check for conflicts with existing hosts and build conflict details
- existingHosts, _ := h.proxyHostSvc.List()
- existingDomainsMap := make(map[string]models.ProxyHost)
- for _, eh := range existingHosts {
- existingDomainsMap[eh.DomainNames] = eh
- }
-
- conflictDetails := make(map[string]gin.H)
- for _, ph := range transient.Hosts {
- if existing, found := existingDomainsMap[ph.DomainNames]; found {
- transient.Conflicts = append(transient.Conflicts, ph.DomainNames)
- conflictDetails[ph.DomainNames] = gin.H{
- "existing": gin.H{
- "forward_scheme": existing.ForwardScheme,
- "forward_host": existing.ForwardHost,
- "forward_port": existing.ForwardPort,
- "ssl_forced": existing.SSLForced,
- "websocket": existing.WebsocketSupport,
- "enabled": existing.Enabled,
- },
- "imported": gin.H{
- "forward_scheme": ph.ForwardScheme,
- "forward_host": ph.ForwardHost,
- "forward_port": ph.ForwardPort,
- "ssl_forced": ph.SSLForced,
- "websocket": ph.WebsocketSupport,
- },
- }
- }
- }
-
- c.JSON(http.StatusOK, gin.H{
- "session": gin.H{"id": sid, "state": "transient", "source_file": h.mountPath},
- "preview": transient,
- "caddyfile_content": caddyfileContent,
- "conflict_details": conflictDetails,
- })
- return
- }
- }
-
- c.JSON(http.StatusNotFound, gin.H{"error": "no pending import"})
-}
-
-// Upload handles manual Caddyfile upload or paste.
-func (h *ImportHandler) Upload(c *gin.Context) {
- var req struct {
- Content string `json:"content" binding:"required"`
- Filename string `json:"filename"`
- }
-
- // Capture raw request for better diagnostics in tests
- if err := c.ShouldBindJSON(&req); err != nil {
- // Try to include raw body preview when binding fails
- entry := middleware.GetRequestLogger(c)
- if raw, _ := c.GetRawData(); len(raw) > 0 {
- entry.WithError(err).WithField("raw_body_preview", util.SanitizeForLog(string(raw))).Error("Import Upload: failed to bind JSON")
- } else {
- entry.WithError(err).Error("Import Upload: failed to bind JSON")
- }
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- middleware.GetRequestLogger(c).WithField("filename", util.SanitizeForLog(filepath.Base(req.Filename))).WithField("content_len", len(req.Content)).Info("Import Upload: received upload")
-
- // Save upload to import/uploads/<uuid>.caddyfile and return transient preview (do not persist yet)
- sid := uuid.NewString()
- uploadsDir, err := safeJoin(h.importDir, "uploads")
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "invalid import directory"})
- return
- }
- if err := os.MkdirAll(uploadsDir, 0755); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create uploads directory"})
- return
- }
- tempPath, err := safeJoin(uploadsDir, fmt.Sprintf("%s.caddyfile", sid))
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "invalid temp path"})
- return
- }
- if err := os.WriteFile(tempPath, []byte(req.Content), 0644); err != nil {
- middleware.GetRequestLogger(c).WithField("tempPath", util.SanitizeForLog(filepath.Base(tempPath))).WithError(err).Error("Import Upload: failed to write temp file")
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to write upload"})
- return
- }
-
- // Parse uploaded file transiently
- result, err := h.importerservice.ImportFile(tempPath)
- if err != nil {
- // Read a small preview of the uploaded file for diagnostics
- preview := ""
- if b, rerr := os.ReadFile(tempPath); rerr == nil {
- if len(b) > 200 {
- preview = string(b[:200])
- } else {
- preview = string(b)
- }
- }
- middleware.GetRequestLogger(c).WithError(err).WithField("tempPath", util.SanitizeForLog(filepath.Base(tempPath))).WithField("content_preview", util.SanitizeForLog(preview)).Error("Import Upload: import failed")
- c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("import failed: %v", err)})
- return
- }
-
- // If no hosts were parsed, provide a clearer error when import directives exist
- if len(result.Hosts) == 0 {
- imports := detectImportDirectives(req.Content)
- if len(imports) > 0 {
- sanitizedImports := make([]string, 0, len(imports))
- for _, imp := range imports {
- sanitizedImports = append(sanitizedImports, util.SanitizeForLog(filepath.Base(imp)))
- }
- middleware.GetRequestLogger(c).WithField("imports", sanitizedImports).Warn("Import Upload: no hosts parsed but imports detected")
- } else {
- middleware.GetRequestLogger(c).WithField("content_len", len(req.Content)).Warn("Import Upload: no hosts parsed and no imports detected")
- }
- if len(imports) > 0 {
- c.JSON(http.StatusBadRequest, gin.H{"error": "no sites found in uploaded Caddyfile; imports detected; please upload the referenced site files using the multi-file import flow", "imports": imports})
- return
- }
- c.JSON(http.StatusBadRequest, gin.H{"error": "no sites found in uploaded Caddyfile"})
- return
- }
-
- // Check for conflicts with existing hosts and build conflict details
- existingHosts, _ := h.proxyHostSvc.List()
- existingDomainsMap := make(map[string]models.ProxyHost)
- for _, eh := range existingHosts {
- existingDomainsMap[eh.DomainNames] = eh
- }
-
- conflictDetails := make(map[string]gin.H)
- for _, ph := range result.Hosts {
- if existing, found := existingDomainsMap[ph.DomainNames]; found {
- result.Conflicts = append(result.Conflicts, ph.DomainNames)
- conflictDetails[ph.DomainNames] = gin.H{
- "existing": gin.H{
- "forward_scheme": existing.ForwardScheme,
- "forward_host": existing.ForwardHost,
- "forward_port": existing.ForwardPort,
- "ssl_forced": existing.SSLForced,
- "websocket": existing.WebsocketSupport,
- "enabled": existing.Enabled,
- },
- "imported": gin.H{
- "forward_scheme": ph.ForwardScheme,
- "forward_host": ph.ForwardHost,
- "forward_port": ph.ForwardPort,
- "ssl_forced": ph.SSLForced,
- "websocket": ph.WebsocketSupport,
- },
- }
- }
- }
-
- c.JSON(http.StatusOK, gin.H{
- "session": gin.H{"id": sid, "state": "transient", "source_file": tempPath},
- "conflict_details": conflictDetails,
- "preview": result,
- })
-}
-
-// DetectImports analyzes Caddyfile content and returns detected import directives.
-func (h *ImportHandler) DetectImports(c *gin.Context) {
- var req struct {
- Content string `json:"content" binding:"required"`
- }
-
- if err := c.ShouldBindJSON(&req); err != nil {
- entry := middleware.GetRequestLogger(c)
- if raw, _ := c.GetRawData(); len(raw) > 0 {
- entry.WithError(err).WithField("raw_body_preview", util.SanitizeForLog(string(raw))).Error("Import UploadMulti: failed to bind JSON")
- } else {
- entry.WithError(err).Error("Import UploadMulti: failed to bind JSON")
- }
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- imports := detectImportDirectives(req.Content)
- c.JSON(http.StatusOK, gin.H{
- "has_imports": len(imports) > 0,
- "imports": imports,
- })
-}
-
-// UploadMulti handles upload of main Caddyfile + multiple site files.
-func (h *ImportHandler) UploadMulti(c *gin.Context) {
- var req struct {
- Files []struct {
- Filename string `json:"filename" binding:"required"`
- Content string `json:"content" binding:"required"`
- } `json:"files" binding:"required,min=1"`
- }
-
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Validate: at least one file must be named "Caddyfile" or have no path separator
- hasCaddyfile := false
- for _, f := range req.Files {
- if f.Filename == "Caddyfile" || !strings.Contains(f.Filename, "/") {
- hasCaddyfile = true
- break
- }
- }
- if !hasCaddyfile {
- c.JSON(http.StatusBadRequest, gin.H{"error": "must include a main Caddyfile"})
- return
- }
-
- // Create session directory
- sid := uuid.NewString()
- sessionDir, err := safeJoin(h.importDir, filepath.Join("uploads", sid))
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "invalid session directory"})
- return
- }
- if err := os.MkdirAll(sessionDir, 0755); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create session directory"})
- return
- }
-
- // Write all files
- mainCaddyfile := ""
- for _, f := range req.Files {
- if strings.TrimSpace(f.Content) == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("file '%s' is empty", f.Filename)})
- return
- }
-
- // Clean filename and create subdirectories if needed
- cleanName := filepath.Clean(f.Filename)
- targetPath, err := safeJoin(sessionDir, cleanName)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid filename: %s", f.Filename)})
- return
- }
-
- // Create parent directory if file is in a subdirectory
- if dir := filepath.Dir(targetPath); dir != sessionDir {
- if err := os.MkdirAll(dir, 0755); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("failed to create directory for %s", f.Filename)})
- return
- }
- }
-
- if err := os.WriteFile(targetPath, []byte(f.Content), 0644); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("failed to write file %s", f.Filename)})
- return
- }
-
- // Track main Caddyfile
- if cleanName == "Caddyfile" || !strings.Contains(cleanName, "/") {
- mainCaddyfile = targetPath
- }
- }
-
- // Parse the main Caddyfile (which will automatically resolve imports)
- result, err := h.importerservice.ImportFile(mainCaddyfile)
- if err != nil {
- // Provide diagnostics
- preview := ""
- if b, rerr := os.ReadFile(mainCaddyfile); rerr == nil {
- if len(b) > 200 {
- preview = string(b[:200])
- } else {
- preview = string(b)
- }
- }
- middleware.GetRequestLogger(c).WithError(err).WithField("mainCaddyfile", util.SanitizeForLog(filepath.Base(mainCaddyfile))).WithField("preview", util.SanitizeForLog(preview)).Error("Import UploadMulti: import failed")
- c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("import failed: %v", err)})
- return
- }
-
- // If parsing succeeded but no hosts were found, and imports were present in the main file,
- // inform the caller to upload the site files.
- if len(result.Hosts) == 0 {
- mainContentBytes, _ := os.ReadFile(mainCaddyfile)
- imports := detectImportDirectives(string(mainContentBytes))
- if len(imports) > 0 {
- c.JSON(http.StatusBadRequest, gin.H{"error": "no sites parsed from main Caddyfile; import directives detected; please include site files in upload", "imports": imports})
- return
- }
- c.JSON(http.StatusBadRequest, gin.H{"error": "no sites parsed from main Caddyfile"})
- return
- }
-
- // Check for conflicts
- existingHosts, _ := h.proxyHostSvc.List()
- existingDomains := make(map[string]bool)
- for _, eh := range existingHosts {
- existingDomains[eh.DomainNames] = true
- }
- for _, ph := range result.Hosts {
- if existingDomains[ph.DomainNames] {
- result.Conflicts = append(result.Conflicts, ph.DomainNames)
- }
- }
-
- c.JSON(http.StatusOK, gin.H{
- "session": gin.H{"id": sid, "state": "transient", "source_file": mainCaddyfile},
- "preview": result,
- })
-}
-
-// detectImportDirectives scans Caddyfile content for import directives.
-func detectImportDirectives(content string) []string {
- imports := []string{}
- lines := strings.Split(content, "\n")
- for _, line := range lines {
- trimmed := strings.TrimSpace(line)
- if strings.HasPrefix(trimmed, "import ") {
- path := strings.TrimSpace(strings.TrimPrefix(trimmed, "import"))
- // Remove any trailing comments
- if idx := strings.Index(path, "#"); idx != -1 {
- path = strings.TrimSpace(path[:idx])
- }
- imports = append(imports, path)
- }
- }
- return imports
-}
-
-// safeJoin joins a user-supplied path to a base directory and ensures
-// the resulting path is contained within the base directory.
-func safeJoin(baseDir, userPath string) (string, error) {
- clean := filepath.Clean(userPath)
- if clean == "" || clean == "." {
- return "", fmt.Errorf("empty path not allowed")
- }
- if filepath.IsAbs(clean) {
- return "", fmt.Errorf("absolute paths not allowed")
- }
-
- // Prevent attempts like ".." at start
- if strings.HasPrefix(clean, ".."+string(os.PathSeparator)) || clean == ".." {
- return "", fmt.Errorf("path traversal detected")
- }
-
- target := filepath.Join(baseDir, clean)
- rel, err := filepath.Rel(baseDir, target)
- if err != nil {
- return "", fmt.Errorf("invalid path")
- }
- if strings.HasPrefix(rel, "..") {
- return "", fmt.Errorf("path traversal detected")
- }
-
- // Normalize to use base's separators
- target = path.Clean(target)
- return target, nil
-}
-
-// isSafePathUnderBase reports whether userPath, when cleaned and joined
-// to baseDir, stays within baseDir. Used by tests.
-func isSafePathUnderBase(baseDir, userPath string) bool {
- _, err := safeJoin(baseDir, userPath)
- return err == nil
-}
-
-// Commit finalizes the import with user's conflict resolutions.
-func (h *ImportHandler) Commit(c *gin.Context) {
- var req struct {
- SessionUUID string `json:"session_uuid" binding:"required"`
- Resolutions map[string]string `json:"resolutions"` // domain -> action (keep/skip, overwrite, rename)
- Names map[string]string `json:"names"` // domain -> custom name
- }
-
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Try to find a DB-backed session first
- var session models.ImportSession
- // Basic sanitize of session id to prevent path separators
- sid := filepath.Base(req.SessionUUID)
- if sid == "" || sid == "." || strings.Contains(sid, string(os.PathSeparator)) {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid session_uuid"})
- return
- }
- var result *caddy.ImportResult
- if err := h.db.Where("uuid = ? AND status = ?", sid, "reviewing").First(&session).Error; err == nil {
- // DB session found
- if err := json.Unmarshal([]byte(session.ParsedData), &result); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to parse import data"})
- return
- }
- } else {
- // No DB session: check for uploaded temp file
- var parseErr error
- uploadsPath, err := safeJoin(h.importDir, filepath.Join("uploads", fmt.Sprintf("%s.caddyfile", sid)))
- if err == nil {
- if _, err := os.Stat(uploadsPath); err == nil {
- r, err := h.importerservice.ImportFile(uploadsPath)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to parse uploaded file"})
- return
- }
- result = r
- // We'll create a committed DB session after applying
- session = models.ImportSession{UUID: sid, SourceFile: uploadsPath}
- }
- }
- // If not found yet, check mounted Caddyfile
- if result == nil && h.mountPath != "" {
- if _, err := os.Stat(h.mountPath); err == nil {
- r, err := h.importerservice.ImportFile(h.mountPath)
- if err != nil {
- parseErr = err
- } else {
- result = r
- session = models.ImportSession{UUID: sid, SourceFile: h.mountPath}
- }
- }
- }
- // If still not parsed, return not found or error
- if result == nil {
- if parseErr != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to parse mounted Caddyfile"})
- return
- }
- c.JSON(http.StatusNotFound, gin.H{"error": "session not found or file missing"})
- return
- }
- }
-
- // Convert parsed hosts to ProxyHost models
- proxyHosts := caddy.ConvertToProxyHosts(result.Hosts)
- middleware.GetRequestLogger(c).WithField("parsed_hosts", len(result.Hosts)).WithField("proxy_hosts", len(proxyHosts)).Info("Import Commit: Parsed and converted hosts")
-
- created := 0
- updated := 0
- skipped := 0
- errors := []string{}
-
- // Get existing hosts to check for overwrites
- existingHosts, _ := h.proxyHostSvc.List()
- existingMap := make(map[string]*models.ProxyHost)
- for i := range existingHosts {
- existingMap[existingHosts[i].DomainNames] = &existingHosts[i]
- }
-
- for _, host := range proxyHosts {
- action := req.Resolutions[host.DomainNames]
-
- // Apply custom name from user input
- if customName, ok := req.Names[host.DomainNames]; ok && customName != "" {
- host.Name = customName
- }
-
- // "keep" means keep existing (don't import), same as "skip"
- if action == "skip" || action == "keep" {
- skipped++
- continue
- }
-
- if action == "rename" {
- host.DomainNames += "-imported"
- }
-
- // Handle overwrite: preserve existing ID, UUID, and certificate
- if action == "overwrite" {
- if existing, found := existingMap[host.DomainNames]; found {
- host.ID = existing.ID
- host.UUID = existing.UUID
- host.CertificateID = existing.CertificateID // Preserve certificate association
- host.CreatedAt = existing.CreatedAt
-
- if err := h.proxyHostSvc.Update(&host); err != nil {
- errMsg := fmt.Sprintf("%s: %s", host.DomainNames, err.Error())
- errors = append(errors, errMsg)
- middleware.GetRequestLogger(c).WithField("host", util.SanitizeForLog(host.DomainNames)).WithField("error", sanitizeForLog(errMsg)).Error("Import Commit Error (update)")
- } else {
- updated++
- middleware.GetRequestLogger(c).WithField("host", util.SanitizeForLog(host.DomainNames)).Info("Import Commit Success: Updated host")
- }
- continue
- }
- // If "overwrite" but doesn't exist, fall through to create
- }
-
- // Create new host
- host.UUID = uuid.NewString()
- if err := h.proxyHostSvc.Create(&host); err != nil {
- errMsg := fmt.Sprintf("%s: %s", host.DomainNames, err.Error())
- errors = append(errors, errMsg)
- middleware.GetRequestLogger(c).WithField("host", util.SanitizeForLog(host.DomainNames)).WithField("error", util.SanitizeForLog(errMsg)).Error("Import Commit Error")
- } else {
- created++
- middleware.GetRequestLogger(c).WithField("host", util.SanitizeForLog(host.DomainNames)).Info("Import Commit Success: Created host")
- }
- }
-
- // Persist an import session record now that user confirmed
- now := time.Now()
- session.Status = "committed"
- session.CommittedAt = &now
- session.UserResolutions = string(mustMarshal(req.Resolutions))
- // If ParsedData/ConflictReport not set, fill from result
- if session.ParsedData == "" {
- session.ParsedData = string(mustMarshal(result))
- }
- if session.ConflictReport == "" {
- session.ConflictReport = string(mustMarshal(result.Conflicts))
- }
- if err := h.db.Save(&session).Error; err != nil {
- middleware.GetRequestLogger(c).WithError(err).Warn("Warning: failed to save import session")
- }
-
- c.JSON(http.StatusOK, gin.H{
- "created": created,
- "updated": updated,
- "skipped": skipped,
- "errors": errors,
- })
-}
-
-// Cancel discards a pending import session.
-func (h *ImportHandler) Cancel(c *gin.Context) {
- sessionUUID := c.Query("session_uuid")
- if sessionUUID == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "session_uuid required"})
- return
- }
-
- sid := filepath.Base(sessionUUID)
- if sid == "" || sid == "." || strings.Contains(sid, string(os.PathSeparator)) {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid session_uuid"})
- return
- }
-
- var session models.ImportSession
- if err := h.db.Where("uuid = ?", sid).First(&session).Error; err == nil {
- session.Status = "rejected"
- h.db.Save(&session)
- c.JSON(http.StatusOK, gin.H{"message": "import cancelled"})
- return
- }
-
- // If no DB session, check for uploaded temp file and delete it
- uploadsPath, err := safeJoin(h.importDir, filepath.Join("uploads", fmt.Sprintf("%s.caddyfile", sid)))
- if err == nil {
- if _, err := os.Stat(uploadsPath); err == nil {
- os.Remove(uploadsPath)
- c.JSON(http.StatusOK, gin.H{"message": "transient upload cancelled"})
- return
- }
- }
-
- // If neither exists, return not found
- c.JSON(http.StatusNotFound, gin.H{"error": "session not found"})
-}
-
-// CheckMountedImport checks for mounted Caddyfile on startup.
-func CheckMountedImport(db *gorm.DB, mountPath, caddyBinary, importDir string) error {
- if _, err := os.Stat(mountPath); os.IsNotExist(err) {
- // If mount is gone, remove any pending/reviewing sessions created previously for this mount
- db.Where("source_file = ? AND status IN ?", mountPath, []string{"pending", "reviewing"}).Delete(&models.ImportSession{})
- return nil // No mounted file, nothing to import
- }
-
- // Check if already processed (includes committed to avoid re-imports)
- var count int64
- db.Model(&models.ImportSession{}).Where("source_file = ? AND status IN ?",
- mountPath, []string{"pending", "reviewing", "committed"}).Count(&count)
-
- if count > 0 {
- return nil // Already processed
- }
-
- // Do not create a DB session automatically for mounted imports; preview will be transient.
- return nil
-}
-
-func mustMarshal(v interface{}) []byte {
- b, _ := json.Marshal(v)
- return b
-}
-
-
-
package handlers
-
-import (
- "io"
- "net/http"
- "os"
- "strconv"
- "strings"
-
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type LogsHandler struct {
- service *services.LogService
-}
-
-func NewLogsHandler(service *services.LogService) *LogsHandler {
- return &LogsHandler{service: service}
-}
-
-func (h *LogsHandler) List(c *gin.Context) {
- logs, err := h.service.ListLogs()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list logs"})
- return
- }
- c.JSON(http.StatusOK, logs)
-}
-
-func (h *LogsHandler) Read(c *gin.Context) {
- filename := c.Param("filename")
-
- // Parse query parameters
- limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
- offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
-
- filter := models.LogFilter{
- Search: c.Query("search"),
- Host: c.Query("host"),
- Status: c.Query("status"),
- Level: c.Query("level"),
- Limit: limit,
- Offset: offset,
- Sort: c.DefaultQuery("sort", "desc"),
- }
-
- logs, total, err := h.service.QueryLogs(filename, filter)
- if err != nil {
- if os.IsNotExist(err) {
- c.JSON(http.StatusNotFound, gin.H{"error": "Log file not found"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to read log"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{
- "filename": filename,
- "logs": logs,
- "total": total,
- "limit": limit,
- "offset": offset,
- })
-}
-
-func (h *LogsHandler) Download(c *gin.Context) {
- filename := c.Param("filename")
- path, err := h.service.GetLogPath(filename)
- if err != nil {
- if strings.Contains(err.Error(), "invalid filename") {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusNotFound, gin.H{"error": "Log file not found"})
- return
- }
-
- // Create a temporary file to serve a consistent snapshot
- // This prevents Content-Length mismatches if the live log file grows during download
- tmpFile, err := os.CreateTemp("", "charon-log-*.log")
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create temp file"})
- return
- }
- defer os.Remove(tmpFile.Name())
-
- srcFile, err := os.Open(path)
- if err != nil {
- _ = tmpFile.Close()
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to open log file"})
- return
- }
- defer func() { _ = srcFile.Close() }()
-
- if _, err := io.Copy(tmpFile, srcFile); err != nil {
- _ = tmpFile.Close()
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to copy log file"})
- return
- }
- _ = tmpFile.Close()
-
- c.Header("Content-Disposition", "attachment; filename="+filename)
- c.File(tmpFile.Name())
-}
-
-
-
package handlers
-
-import (
- "net/http"
-
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type NotificationHandler struct {
- service *services.NotificationService
-}
-
-func NewNotificationHandler(service *services.NotificationService) *NotificationHandler {
- return &NotificationHandler{service: service}
-}
-
-func (h *NotificationHandler) List(c *gin.Context) {
- unreadOnly := c.Query("unread") == "true"
- notifications, err := h.service.List(unreadOnly)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list notifications"})
- return
- }
- c.JSON(http.StatusOK, notifications)
-}
-
-func (h *NotificationHandler) MarkAsRead(c *gin.Context) {
- id := c.Param("id")
- if err := h.service.MarkAsRead(id); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to mark notification as read"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Notification marked as read"})
-}
-
-func (h *NotificationHandler) MarkAllAsRead(c *gin.Context) {
- if err := h.service.MarkAllAsRead(); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to mark all notifications as read"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "All notifications marked as read"})
-}
-
-
-
package handlers
-
-import (
- "encoding/json"
- "fmt"
- "net/http"
- "strings"
- "time"
-
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type NotificationProviderHandler struct {
- service *services.NotificationService
-}
-
-func NewNotificationProviderHandler(service *services.NotificationService) *NotificationProviderHandler {
- return &NotificationProviderHandler{service: service}
-}
-
-func (h *NotificationProviderHandler) List(c *gin.Context) {
- providers, err := h.service.ListProviders()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list providers"})
- return
- }
- c.JSON(http.StatusOK, providers)
-}
-
-func (h *NotificationProviderHandler) Create(c *gin.Context) {
- var provider models.NotificationProvider
- if err := c.ShouldBindJSON(&provider); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if err := h.service.CreateProvider(&provider); err != nil {
- // If it's a validation error from template parsing, return 400
- if strings.Contains(err.Error(), "invalid custom template") || strings.Contains(err.Error(), "rendered template") || strings.Contains(err.Error(), "failed to parse template") || strings.Contains(err.Error(), "failed to render template") {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create provider"})
- return
- }
- c.JSON(http.StatusCreated, provider)
-}
-
-func (h *NotificationProviderHandler) Update(c *gin.Context) {
- id := c.Param("id")
- var provider models.NotificationProvider
- if err := c.ShouldBindJSON(&provider); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- provider.ID = id
-
- if err := h.service.UpdateProvider(&provider); err != nil {
- if strings.Contains(err.Error(), "invalid custom template") || strings.Contains(err.Error(), "rendered template") || strings.Contains(err.Error(), "failed to parse template") || strings.Contains(err.Error(), "failed to render template") {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update provider"})
- return
- }
- c.JSON(http.StatusOK, provider)
-}
-
-func (h *NotificationProviderHandler) Delete(c *gin.Context) {
- id := c.Param("id")
- if err := h.service.DeleteProvider(id); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete provider"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Provider deleted"})
-}
-
-func (h *NotificationProviderHandler) Test(c *gin.Context) {
- var provider models.NotificationProvider
- if err := c.ShouldBindJSON(&provider); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if err := h.service.TestProvider(provider); err != nil {
- // Create internal notification for the failure
- _, _ = h.service.Create(models.NotificationTypeError, "Test Failed", fmt.Sprintf("Provider %s test failed: %v", provider.Name, err))
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Test notification sent"})
-}
-
-// Templates returns a list of built-in templates a provider can use.
-func (h *NotificationProviderHandler) Templates(c *gin.Context) {
- c.JSON(http.StatusOK, []gin.H{
- {"id": "minimal", "name": "Minimal", "description": "Small JSON payload with title, message and time."},
- {"id": "detailed", "name": "Detailed", "description": "Full JSON payload with host, services and all data."},
- {"id": "custom", "name": "Custom", "description": "Use your own JSON template in the Config field."},
- })
-}
-
-// Preview renders the template for a provider and returns the resulting JSON object or an error.
-func (h *NotificationProviderHandler) Preview(c *gin.Context) {
- var raw map[string]interface{}
- if err := c.ShouldBindJSON(&raw); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- var provider models.NotificationProvider
- // Marshal raw into provider to get proper types
- if b, err := json.Marshal(raw); err == nil {
- _ = json.Unmarshal(b, &provider)
- }
- var payload map[string]interface{}
- if d, ok := raw["data"].(map[string]interface{}); ok {
- payload = d
- }
-
- if payload == nil {
- payload = map[string]interface{}{}
- }
-
- // Add some defaults for preview
- if _, ok := payload["Title"]; !ok {
- payload["Title"] = "Preview Title"
- }
- if _, ok := payload["Message"]; !ok {
- payload["Message"] = "Preview Message"
- }
- payload["Time"] = time.Now().Format(time.RFC3339)
- payload["EventType"] = "preview"
-
- rendered, parsed, err := h.service.RenderTemplate(provider, payload)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "rendered": rendered})
- return
- }
- c.JSON(http.StatusOK, gin.H{"rendered": rendered, "parsed": parsed})
-}
-
-
-
package handlers
-
-import (
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
- "net/http"
-)
-
-type NotificationTemplateHandler struct {
- service *services.NotificationService
-}
-
-func NewNotificationTemplateHandler(s *services.NotificationService) *NotificationTemplateHandler {
- return &NotificationTemplateHandler{service: s}
-}
-
-func (h *NotificationTemplateHandler) List(c *gin.Context) {
- list, err := h.service.ListTemplates()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list templates"})
- return
- }
- c.JSON(http.StatusOK, list)
-}
-
-func (h *NotificationTemplateHandler) Create(c *gin.Context) {
- var t models.NotificationTemplate
- if err := c.ShouldBindJSON(&t); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- if err := h.service.CreateTemplate(&t); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create template"})
- return
- }
- c.JSON(http.StatusCreated, t)
-}
-
-func (h *NotificationTemplateHandler) Update(c *gin.Context) {
- id := c.Param("id")
- var t models.NotificationTemplate
- if err := c.ShouldBindJSON(&t); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- t.ID = id
- if err := h.service.UpdateTemplate(&t); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to update template"})
- return
- }
- c.JSON(http.StatusOK, t)
-}
-
-func (h *NotificationTemplateHandler) Delete(c *gin.Context) {
- id := c.Param("id")
- if err := h.service.DeleteTemplate(id); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to delete template"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "deleted"})
-}
-
-// Preview allows rendering an arbitrary template (provided in request) or a stored template by id.
-func (h *NotificationTemplateHandler) Preview(c *gin.Context) {
- var raw map[string]interface{}
- if err := c.ShouldBindJSON(&raw); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- var tmplStr string
- if id, ok := raw["template_id"].(string); ok && id != "" {
- t, err := h.service.GetTemplate(id)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "template not found"})
- return
- }
- tmplStr = t.Config
- } else if s, ok := raw["template"].(string); ok {
- tmplStr = s
- }
-
- data := map[string]interface{}{}
- if d, ok := raw["data"].(map[string]interface{}); ok {
- data = d
- }
-
- // Build a fake provider to leverage existing RenderTemplate logic
- provider := models.NotificationProvider{Template: "custom", Config: tmplStr}
- rendered, parsed, err := h.service.RenderTemplate(provider, data)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "rendered": rendered})
- return
- }
- c.JSON(http.StatusOK, gin.H{"rendered": rendered, "parsed": parsed})
-}
-
-
-
package handlers
-
-import (
- "encoding/json"
- "fmt"
- "net/http"
- "strconv"
-
- "github.com/gin-gonic/gin"
- "github.com/google/uuid"
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/api/middleware"
- "github.com/Wikid82/charon/backend/internal/caddy"
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/Wikid82/charon/backend/internal/util"
-)
-
-// ProxyHostHandler handles CRUD operations for proxy hosts.
-type ProxyHostHandler struct {
- service *services.ProxyHostService
- caddyManager *caddy.Manager
- notificationService *services.NotificationService
- uptimeService *services.UptimeService
-}
-
-// NewProxyHostHandler creates a new proxy host handler.
-func NewProxyHostHandler(db *gorm.DB, caddyManager *caddy.Manager, ns *services.NotificationService, uptimeService *services.UptimeService) *ProxyHostHandler {
- return &ProxyHostHandler{
- service: services.NewProxyHostService(db),
- caddyManager: caddyManager,
- notificationService: ns,
- uptimeService: uptimeService,
- }
-}
-
-// RegisterRoutes registers proxy host routes.
-func (h *ProxyHostHandler) RegisterRoutes(router *gin.RouterGroup) {
- router.GET("/proxy-hosts", h.List)
- router.POST("/proxy-hosts", h.Create)
- router.GET("/proxy-hosts/:uuid", h.Get)
- router.PUT("/proxy-hosts/:uuid", h.Update)
- router.DELETE("/proxy-hosts/:uuid", h.Delete)
- router.POST("/proxy-hosts/test", h.TestConnection)
- router.PUT("/proxy-hosts/bulk-update-acl", h.BulkUpdateACL)
-}
-
-// List retrieves all proxy hosts.
-func (h *ProxyHostHandler) List(c *gin.Context) {
- hosts, err := h.service.List()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, hosts)
-}
-
-// Create creates a new proxy host.
-func (h *ProxyHostHandler) Create(c *gin.Context) {
- var host models.ProxyHost
- if err := c.ShouldBindJSON(&host); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Validate and normalize advanced config if present
- if host.AdvancedConfig != "" {
- var parsed interface{}
- if err := json.Unmarshal([]byte(host.AdvancedConfig), &parsed); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid advanced_config JSON: " + err.Error()})
- return
- }
- parsed = caddy.NormalizeAdvancedConfig(parsed)
- if norm, err := json.Marshal(parsed); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid advanced_config after normalization: " + err.Error()})
- return
- } else {
- host.AdvancedConfig = string(norm)
- }
- }
-
- host.UUID = uuid.NewString()
-
- // Assign UUIDs to locations
- for i := range host.Locations {
- host.Locations[i].UUID = uuid.NewString()
- }
-
- if err := h.service.Create(&host); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- // Rollback: delete the created host if config application fails
- middleware.GetRequestLogger(c).WithError(err).Error("Error applying config")
- if deleteErr := h.service.Delete(host.ID); deleteErr != nil {
- idStr := strconv.FormatUint(uint64(host.ID), 10)
- middleware.GetRequestLogger(c).WithField("host_id", idStr).WithError(deleteErr).Error("Critical: Failed to rollback host")
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to apply configuration: " + err.Error()})
- return
- }
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "proxy_host",
- "Proxy Host Created",
- fmt.Sprintf("Proxy Host %s (%s) created", util.SanitizeForLog(host.Name), util.SanitizeForLog(host.DomainNames)),
- map[string]interface{}{
- "Name": util.SanitizeForLog(host.Name),
- "Domains": util.SanitizeForLog(host.DomainNames),
- "Action": "created",
- },
- )
- }
-
- c.JSON(http.StatusCreated, host)
-}
-
-// Get retrieves a proxy host by UUID.
-func (h *ProxyHostHandler) Get(c *gin.Context) {
- uuid := c.Param("uuid")
-
- host, err := h.service.GetByUUID(uuid)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "proxy host not found"})
- return
- }
-
- c.JSON(http.StatusOK, host)
-}
-
-// Update updates an existing proxy host.
-func (h *ProxyHostHandler) Update(c *gin.Context) {
- uuidStr := c.Param("uuid")
-
- host, err := h.service.GetByUUID(uuidStr)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "proxy host not found"})
- return
- }
-
- // Perform a partial update: only mutate fields present in payload
- var payload map[string]interface{}
- if err := c.ShouldBindJSON(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Handle simple scalar fields by json tag names (snake_case)
- if v, ok := payload["name"].(string); ok {
- host.Name = v
- }
- if v, ok := payload["domain_names"].(string); ok {
- host.DomainNames = v
- }
- if v, ok := payload["forward_scheme"].(string); ok {
- host.ForwardScheme = v
- }
- if v, ok := payload["forward_host"].(string); ok {
- host.ForwardHost = v
- }
- if v, ok := payload["forward_port"]; ok {
- switch t := v.(type) {
- case float64:
- host.ForwardPort = int(t)
- case int:
- host.ForwardPort = t
- case string:
- if p, err := strconv.Atoi(t); err == nil {
- host.ForwardPort = p
- }
- }
- }
- if v, ok := payload["ssl_forced"].(bool); ok {
- host.SSLForced = v
- }
- if v, ok := payload["http2_support"].(bool); ok {
- host.HTTP2Support = v
- }
- if v, ok := payload["hsts_enabled"].(bool); ok {
- host.HSTSEnabled = v
- }
- if v, ok := payload["hsts_subdomains"].(bool); ok {
- host.HSTSSubdomains = v
- }
- if v, ok := payload["block_exploits"].(bool); ok {
- host.BlockExploits = v
- }
- if v, ok := payload["websocket_support"].(bool); ok {
- host.WebsocketSupport = v
- }
- if v, ok := payload["application"].(string); ok {
- host.Application = v
- }
- if v, ok := payload["enabled"].(bool); ok {
- host.Enabled = v
- }
-
- // Nullable foreign keys
- if v, ok := payload["certificate_id"]; ok {
- if v == nil {
- host.CertificateID = nil
- } else {
- switch t := v.(type) {
- case float64:
- id := uint(t)
- host.CertificateID = &id
- case int:
- id := uint(t)
- host.CertificateID = &id
- case string:
- if n, err := strconv.ParseUint(t, 10, 32); err == nil {
- id := uint(n)
- host.CertificateID = &id
- }
- }
- }
- }
- if v, ok := payload["access_list_id"]; ok {
- if v == nil {
- host.AccessListID = nil
- } else {
- switch t := v.(type) {
- case float64:
- id := uint(t)
- host.AccessListID = &id
- case int:
- id := uint(t)
- host.AccessListID = &id
- case string:
- if n, err := strconv.ParseUint(t, 10, 32); err == nil {
- id := uint(n)
- host.AccessListID = &id
- }
- }
- }
- }
-
- // Locations: replace only if provided
- if v, ok := payload["locations"].([]interface{}); ok {
- // Rebind to []models.Location
- b, _ := json.Marshal(v)
- var locs []models.Location
- if err := json.Unmarshal(b, &locs); err == nil {
- // Ensure UUIDs exist for any new location entries
- for i := range locs {
- if locs[i].UUID == "" {
- locs[i].UUID = uuid.New().String()
- }
- }
- host.Locations = locs
- } else {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid locations payload"})
- return
- }
- }
-
- // Advanced config: normalize if provided and changed
- if v, ok := payload["advanced_config"].(string); ok {
- if v != "" && v != host.AdvancedConfig {
- var parsed interface{}
- if err := json.Unmarshal([]byte(v), &parsed); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid advanced_config JSON: " + err.Error()})
- return
- }
- parsed = caddy.NormalizeAdvancedConfig(parsed)
- if norm, err := json.Marshal(parsed); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid advanced_config after normalization: " + err.Error()})
- return
- } else {
- // Backup previous
- host.AdvancedConfigBackup = host.AdvancedConfig
- host.AdvancedConfig = string(norm)
- }
- } else if v == "" { // allow clearing advanced config
- host.AdvancedConfigBackup = host.AdvancedConfig
- host.AdvancedConfig = ""
- }
- }
-
- if err := h.service.Update(host); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to apply configuration: " + err.Error()})
- return
- }
- }
-
- c.JSON(http.StatusOK, host)
-}
-
-// Delete removes a proxy host.
-func (h *ProxyHostHandler) Delete(c *gin.Context) {
- uuid := c.Param("uuid")
-
- host, err := h.service.GetByUUID(uuid)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "proxy host not found"})
- return
- }
-
- // check if we should also delete associated uptime monitors (query param: delete_uptime=true)
- deleteUptime := c.DefaultQuery("delete_uptime", "false") == "true"
-
- if deleteUptime && h.uptimeService != nil {
- // Find all monitors referencing this proxy host and delete each
- var monitors []models.UptimeMonitor
- if err := h.uptimeService.DB.Where("proxy_host_id = ?", host.ID).Find(&monitors).Error; err == nil {
- for _, m := range monitors {
- _ = h.uptimeService.DeleteMonitor(m.ID)
- }
- }
- }
-
- if err := h.service.Delete(host.ID); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to apply configuration: " + err.Error()})
- return
- }
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "proxy_host",
- "Proxy Host Deleted",
- fmt.Sprintf("Proxy Host %s deleted", host.Name),
- map[string]interface{}{
- "Name": host.Name,
- "Action": "deleted",
- },
- )
- }
-
- c.JSON(http.StatusOK, gin.H{"message": "proxy host deleted"})
-}
-
-// TestConnection checks if the proxy host is reachable.
-func (h *ProxyHostHandler) TestConnection(c *gin.Context) {
- var req struct {
- ForwardHost string `json:"forward_host" binding:"required"`
- ForwardPort int `json:"forward_port" binding:"required"`
- }
-
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if err := h.service.TestConnection(req.ForwardHost, req.ForwardPort); err != nil {
- c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{"message": "Connection successful"})
-}
-
-// BulkUpdateACL applies or removes an access list to multiple proxy hosts.
-func (h *ProxyHostHandler) BulkUpdateACL(c *gin.Context) {
- var req struct {
- HostUUIDs []string `json:"host_uuids" binding:"required"`
- AccessListID *uint `json:"access_list_id"` // nil means remove ACL
- }
-
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if len(req.HostUUIDs) == 0 {
- c.JSON(http.StatusBadRequest, gin.H{"error": "host_uuids cannot be empty"})
- return
- }
-
- updated := 0
- errors := []map[string]string{}
-
- for _, uuid := range req.HostUUIDs {
- host, err := h.service.GetByUUID(uuid)
- if err != nil {
- errors = append(errors, map[string]string{
- "uuid": uuid,
- "error": "proxy host not found",
- })
- continue
- }
-
- host.AccessListID = req.AccessListID
- if err := h.service.Update(host); err != nil {
- errors = append(errors, map[string]string{
- "uuid": uuid,
- "error": err.Error(),
- })
- continue
- }
-
- updated++
- }
-
- // Apply Caddy config once for all updates
- if updated > 0 && h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{
- "error": "Failed to apply configuration: " + err.Error(),
- "updated": updated,
- "errors": errors,
- })
- return
- }
- }
-
- c.JSON(http.StatusOK, gin.H{
- "updated": updated,
- "errors": errors,
- })
-}
-
-
-
package handlers
-
-import (
- "fmt"
- "net"
- "net/http"
- "time"
-
- "github.com/gin-gonic/gin"
- "github.com/google/uuid"
-
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/Wikid82/charon/backend/internal/util"
-)
-
-// RemoteServerHandler handles HTTP requests for remote server management.
-type RemoteServerHandler struct {
- service *services.RemoteServerService
- notificationService *services.NotificationService
-}
-
-// NewRemoteServerHandler creates a new remote server handler.
-func NewRemoteServerHandler(service *services.RemoteServerService, ns *services.NotificationService) *RemoteServerHandler {
- return &RemoteServerHandler{
- service: service,
- notificationService: ns,
- }
-}
-
-// RegisterRoutes registers remote server routes.
-func (h *RemoteServerHandler) RegisterRoutes(router *gin.RouterGroup) {
- router.GET("/remote-servers", h.List)
- router.POST("/remote-servers", h.Create)
- router.GET("/remote-servers/:uuid", h.Get)
- router.PUT("/remote-servers/:uuid", h.Update)
- router.DELETE("/remote-servers/:uuid", h.Delete)
- router.POST("/remote-servers/test", h.TestConnectionCustom)
- router.POST("/remote-servers/:uuid/test", h.TestConnection)
-}
-
-// List retrieves all remote servers.
-func (h *RemoteServerHandler) List(c *gin.Context) {
- enabledOnly := c.Query("enabled") == "true"
-
- servers, err := h.service.List(enabledOnly)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, servers)
-}
-
-// Create creates a new remote server.
-func (h *RemoteServerHandler) Create(c *gin.Context) {
- var server models.RemoteServer
- if err := c.ShouldBindJSON(&server); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- server.UUID = uuid.NewString()
-
- if err := h.service.Create(&server); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "remote_server",
- "Remote Server Added",
- fmt.Sprintf("Remote Server %s (%s:%d) added", util.SanitizeForLog(server.Name), util.SanitizeForLog(server.Host), server.Port),
- map[string]interface{}{
- "Name": util.SanitizeForLog(server.Name),
- "Host": util.SanitizeForLog(server.Host),
- "Port": server.Port,
- "Action": "created",
- },
- )
- }
-
- c.JSON(http.StatusCreated, server)
-}
-
-// Get retrieves a remote server by UUID.
-func (h *RemoteServerHandler) Get(c *gin.Context) {
- uuid := c.Param("uuid")
-
- server, err := h.service.GetByUUID(uuid)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
- return
- }
-
- c.JSON(http.StatusOK, server)
-}
-
-// Update updates an existing remote server.
-func (h *RemoteServerHandler) Update(c *gin.Context) {
- uuid := c.Param("uuid")
-
- server, err := h.service.GetByUUID(uuid)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
- return
- }
-
- if err := c.ShouldBindJSON(server); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- if err := h.service.Update(server); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, server)
-}
-
-// Delete removes a remote server.
-func (h *RemoteServerHandler) Delete(c *gin.Context) {
- uuid := c.Param("uuid")
-
- server, err := h.service.GetByUUID(uuid)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
- return
- }
-
- if err := h.service.Delete(server.ID); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- // Send Notification
- if h.notificationService != nil {
- h.notificationService.SendExternal(c.Request.Context(),
- "remote_server",
- "Remote Server Deleted",
- fmt.Sprintf("Remote Server %s deleted", util.SanitizeForLog(server.Name)),
- map[string]interface{}{
- "Name": util.SanitizeForLog(server.Name),
- "Action": "deleted",
- },
- )
- }
-
- c.JSON(http.StatusNoContent, nil)
-}
-
-// TestConnection tests the TCP connection to a remote server.
-func (h *RemoteServerHandler) TestConnection(c *gin.Context) {
- uuid := c.Param("uuid")
-
- server, err := h.service.GetByUUID(uuid)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "server not found"})
- return
- }
-
- // Test TCP connection with 5 second timeout
- address := net.JoinHostPort(server.Host, fmt.Sprintf("%d", server.Port))
- conn, err := net.DialTimeout("tcp", address, 5*time.Second)
-
- result := gin.H{
- "server_uuid": server.UUID,
- "address": address,
- "timestamp": time.Now().UTC(),
- }
-
- if err != nil {
- result["reachable"] = false
- result["error"] = err.Error()
-
- // Update server reachability status
- server.Reachable = false
- now := time.Now().UTC()
- server.LastChecked = &now
- _ = h.service.Update(server)
-
- c.JSON(http.StatusOK, result)
- return
- }
- defer func() { _ = conn.Close() }()
-
- // Connection successful
- result["reachable"] = true
- result["latency_ms"] = time.Since(time.Now()).Milliseconds()
-
- // Update server reachability status
- server.Reachable = true
- now := time.Now().UTC()
- server.LastChecked = &now
- _ = h.service.Update(server)
-
- c.JSON(http.StatusOK, result)
-}
-
-// TestConnectionCustom tests connectivity to a host/port provided in the body
-func (h *RemoteServerHandler) TestConnectionCustom(c *gin.Context) {
- var req struct {
- Host string `json:"host" binding:"required"`
- Port int `json:"port" binding:"required"`
- }
-
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Test TCP connection with 5 second timeout
- address := net.JoinHostPort(req.Host, fmt.Sprintf("%d", req.Port))
- start := time.Now()
- conn, err := net.DialTimeout("tcp", address, 5*time.Second)
-
- result := gin.H{
- "address": address,
- "timestamp": time.Now().UTC(),
- }
-
- if err != nil {
- result["reachable"] = false
- result["error"] = err.Error()
- c.JSON(http.StatusOK, result)
- return
- }
- defer func() { _ = conn.Close() }()
-
- // Connection successful
- result["reachable"] = true
- result["latency_ms"] = time.Since(start).Milliseconds()
-
- c.JSON(http.StatusOK, result)
-}
-
-
-
package handlers
-
-import (
- "regexp"
- "strings"
-)
-
-// sanitizeForLog removes control characters and newlines from user content before logging.
-func sanitizeForLog(s string) string {
- if s == "" {
- return s
- }
- // Replace CRLF and LF with spaces and remove other control chars
- s = strings.ReplaceAll(s, "\r\n", " ")
- s = strings.ReplaceAll(s, "\n", " ")
- // remove any other non-printable control characters
- re := regexp.MustCompile(`[\x00-\x1F\x7F]+`)
- s = re.ReplaceAllString(s, " ")
- return s
-}
-
-
-
package handlers
-
-import (
- "errors"
- "net"
- "net/http"
- "strconv"
- "strings"
-
- "github.com/gin-gonic/gin"
- log "github.com/sirupsen/logrus"
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/caddy"
- "github.com/Wikid82/charon/backend/internal/config"
- "github.com/Wikid82/charon/backend/internal/models"
- "github.com/Wikid82/charon/backend/internal/services"
-)
-
-// SecurityHandler handles security-related API requests.
-type SecurityHandler struct {
- cfg config.SecurityConfig
- db *gorm.DB
- svc *services.SecurityService
- caddyManager *caddy.Manager
-}
-
-// NewSecurityHandler creates a new SecurityHandler.
-func NewSecurityHandler(cfg config.SecurityConfig, db *gorm.DB, caddyManager *caddy.Manager) *SecurityHandler {
- svc := services.NewSecurityService(db)
- return &SecurityHandler{cfg: cfg, db: db, svc: svc, caddyManager: caddyManager}
-}
-
-// GetStatus returns the current status of all security services.
-func (h *SecurityHandler) GetStatus(c *gin.Context) {
- enabled := h.cfg.CerberusEnabled
- // Check runtime setting override
- var settingKey = "security.cerberus.enabled"
- if h.db != nil {
- var setting struct{ Value string }
- if err := h.db.Raw("SELECT value FROM settings WHERE key = ? LIMIT 1", settingKey).Scan(&setting).Error; err == nil && setting.Value != "" {
- if strings.EqualFold(setting.Value, "true") {
- enabled = true
- } else {
- enabled = false
- }
- }
- }
-
- // Allow runtime overrides for CrowdSec mode + API URL via settings table
- mode := h.cfg.CrowdSecMode
- apiURL := h.cfg.CrowdSecAPIURL
- if h.db != nil {
- var m struct{ Value string }
- if err := h.db.Raw("SELECT value FROM settings WHERE key = ? LIMIT 1", "security.crowdsec.mode").Scan(&m).Error; err == nil && m.Value != "" {
- mode = m.Value
- }
- var a struct{ Value string }
- if err := h.db.Raw("SELECT value FROM settings WHERE key = ? LIMIT 1", "security.crowdsec.api_url").Scan(&a).Error; err == nil && a.Value != "" {
- apiURL = a.Value
- }
- }
-
- // Only allow 'local' as an enabled mode. Any other value should be treated as disabled.
- if mode != "local" {
- mode = "disabled"
- apiURL = ""
- }
-
- // Allow runtime override for ACL enabled flag via settings table
- aclEnabled := h.cfg.ACLMode == "enabled"
- aclEffective := aclEnabled && enabled
- if h.db != nil {
- var a struct{ Value string }
- if err := h.db.Raw("SELECT value FROM settings WHERE key = ? LIMIT 1", "security.acl.enabled").Scan(&a).Error; err == nil && a.Value != "" {
- if strings.EqualFold(a.Value, "true") {
- aclEnabled = true
- } else if strings.EqualFold(a.Value, "false") {
- aclEnabled = false
- }
-
- // If Cerberus is disabled, ACL should not be considered enabled even
- // if the ACL setting is true. This keeps ACL tied to the Cerberus
- // suite state in the UI and APIs.
- aclEffective = aclEnabled && enabled
- }
- }
-
- c.JSON(http.StatusOK, gin.H{
- "cerberus": gin.H{"enabled": enabled},
- "crowdsec": gin.H{
- "mode": mode,
- "api_url": apiURL,
- "enabled": mode == "local",
- },
- "waf": gin.H{
- "mode": h.cfg.WAFMode,
- "enabled": h.cfg.WAFMode != "" && h.cfg.WAFMode != "disabled",
- },
- "rate_limit": gin.H{
- "mode": h.cfg.RateLimitMode,
- "enabled": h.cfg.RateLimitMode == "enabled",
- },
- "acl": gin.H{
- "mode": h.cfg.ACLMode,
- "enabled": aclEffective,
- },
- })
-}
-
-// GetConfig returns the site security configuration from DB or default
-func (h *SecurityHandler) GetConfig(c *gin.Context) {
- cfg, err := h.svc.Get()
- if err != nil {
- if err == services.ErrSecurityConfigNotFound {
- c.JSON(http.StatusOK, gin.H{"config": nil})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read security config"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"config": cfg})
-}
-
-// UpdateConfig creates or updates the SecurityConfig in DB
-func (h *SecurityHandler) UpdateConfig(c *gin.Context) {
- var payload models.SecurityConfig
- if err := c.ShouldBindJSON(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload"})
- return
- }
- if payload.Name == "" {
- payload.Name = "default"
- }
- if err := h.svc.Upsert(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
- // Apply updated config to Caddy so WAF mode changes take effect
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- log.WithError(err).Warn("failed to apply security config changes to Caddy")
- }
- }
- c.JSON(http.StatusOK, gin.H{"config": payload})
-}
-
-// GenerateBreakGlass generates a break-glass token and returns the plaintext token once
-func (h *SecurityHandler) GenerateBreakGlass(c *gin.Context) {
- token, err := h.svc.GenerateBreakGlassToken("default")
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate break-glass token"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"token": token})
-}
-
-// ListDecisions returns recent security decisions
-func (h *SecurityHandler) ListDecisions(c *gin.Context) {
- limit := 50
- if q := c.Query("limit"); q != "" {
- if v, err := strconv.Atoi(q); err == nil {
- limit = v
- }
- }
- list, err := h.svc.ListDecisions(limit)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list decisions"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"decisions": list})
-}
-
-// CreateDecision creates a manual decision (override) - for now no checks besides payload
-func (h *SecurityHandler) CreateDecision(c *gin.Context) {
- var payload models.SecurityDecision
- if err := c.ShouldBindJSON(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload"})
- return
- }
- if payload.IP == "" || payload.Action == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "ip and action are required"})
- return
- }
- // Populate source
- payload.Source = "manual"
- if err := h.svc.LogDecision(&payload); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to log decision"})
- return
- }
- // Record an audit entry
- actor := c.GetString("user_id")
- if actor == "" {
- actor = c.ClientIP()
- }
- _ = h.svc.LogAudit(&models.SecurityAudit{Actor: actor, Action: "create_decision", Details: payload.Details})
- c.JSON(http.StatusOK, gin.H{"decision": payload})
-}
-
-// ListRuleSets returns the list of known rulesets
-func (h *SecurityHandler) ListRuleSets(c *gin.Context) {
- list, err := h.svc.ListRuleSets()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to list rule sets"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"rulesets": list})
-}
-
-// UpsertRuleSet uploads or updates a ruleset
-func (h *SecurityHandler) UpsertRuleSet(c *gin.Context) {
- var payload models.SecurityRuleSet
- if err := c.ShouldBindJSON(&payload); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid payload"})
- return
- }
- if payload.Name == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "name required"})
- return
- }
- if err := h.svc.UpsertRuleSet(&payload); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to upsert ruleset"})
- return
- }
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to apply configuration: " + err.Error()})
- return
- }
- }
- // Create an audit event
- actor := c.GetString("user_id")
- if actor == "" {
- actor = c.ClientIP()
- }
- _ = h.svc.LogAudit(&models.SecurityAudit{Actor: actor, Action: "upsert_ruleset", Details: payload.Name})
- c.JSON(http.StatusOK, gin.H{"ruleset": payload})
-}
-
-// DeleteRuleSet removes a ruleset by id
-func (h *SecurityHandler) DeleteRuleSet(c *gin.Context) {
- idParam := c.Param("id")
- if idParam == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "id is required"})
- return
- }
- id, err := strconv.ParseUint(idParam, 10, 32)
- if err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
- return
- }
- if err := h.svc.DeleteRuleSet(uint(id)); err != nil {
- if errors.Is(err, gorm.ErrRecordNotFound) {
- c.JSON(http.StatusNotFound, gin.H{"error": "ruleset not found"})
- return
- }
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to delete ruleset"})
- return
- }
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to apply configuration: " + err.Error()})
- return
- }
- }
- actor := c.GetString("user_id")
- if actor == "" {
- actor = c.ClientIP()
- }
- _ = h.svc.LogAudit(&models.SecurityAudit{Actor: actor, Action: "delete_ruleset", Details: idParam})
- c.JSON(http.StatusOK, gin.H{"deleted": true})
-}
-
-// Enable toggles Cerberus on, validating admin whitelist or break-glass token
-func (h *SecurityHandler) Enable(c *gin.Context) {
- // Look for requester's IP and optional breakglass token
- adminIP := c.ClientIP()
- var body struct {
- Token string `json:"break_glass_token"`
- }
- _ = c.ShouldBindJSON(&body)
-
- // If config exists, require that adminIP is in whitelist or token matches
- cfg, err := h.svc.Get()
- if err != nil && err != services.ErrSecurityConfigNotFound {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to retrieve security config"})
- return
- }
- if cfg != nil {
- // Check admin whitelist
- if cfg.AdminWhitelist == "" && body.Token == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "admin whitelist missing; provide break_glass_token or add admin_whitelist CIDR before enabling"})
- return
- }
- if body.Token != "" {
- ok, err := h.svc.VerifyBreakGlassToken(cfg.Name, body.Token)
- if err == nil && ok {
- // proceed
- } else {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "break glass token invalid"})
- return
- }
- } else {
- // verify client IP in admin whitelist
- found := false
- for _, entry := range strings.Split(cfg.AdminWhitelist, ",") {
- entry = strings.TrimSpace(entry)
- if entry == "" {
- continue
- }
- if entry == adminIP {
- found = true
- break
- }
- // If CIDR, check contains
- if _, cidr, err := net.ParseCIDR(entry); err == nil {
- if cidr.Contains(net.ParseIP(adminIP)) {
- found = true
- break
- }
- }
- }
- if !found {
- c.JSON(http.StatusForbidden, gin.H{"error": "admin IP not present in admin_whitelist"})
- return
- }
- }
- }
- // Set enabled true
- newCfg := &models.SecurityConfig{Name: "default", Enabled: true}
- if cfg != nil {
- newCfg = cfg
- newCfg.Enabled = true
- }
- if err := h.svc.Upsert(newCfg); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to enable Cerberus"})
- return
- }
- if h.caddyManager != nil {
- if err := h.caddyManager.ApplyConfig(c.Request.Context()); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to apply configuration: " + err.Error()})
- return
- }
- }
- c.JSON(http.StatusOK, gin.H{"enabled": true})
-}
-
-// Disable toggles Cerberus off; requires break-glass token or localhost request
-func (h *SecurityHandler) Disable(c *gin.Context) {
- var body struct {
- Token string `json:"break_glass_token"`
- }
- _ = c.ShouldBindJSON(&body)
- // Allow requests from localhost to disable without token
- clientIP := c.ClientIP()
- if clientIP == "127.0.0.1" || clientIP == "::1" {
- cfg, _ := h.svc.Get()
- if cfg == nil {
- cfg = &models.SecurityConfig{Name: "default", Enabled: false}
- } else {
- cfg.Enabled = false
- }
- _ = h.svc.Upsert(cfg)
- if h.caddyManager != nil {
- _ = h.caddyManager.ApplyConfig(c.Request.Context())
- }
- c.JSON(http.StatusOK, gin.H{"enabled": false})
- return
- }
- cfg, err := h.svc.Get()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read config"})
- return
- }
- if body.Token == "" {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "break glass token required to disable Cerberus from non-localhost"})
- return
- }
- ok, err := h.svc.VerifyBreakGlassToken(cfg.Name, body.Token)
- if err != nil || !ok {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "break glass token invalid"})
- return
- }
- cfg.Enabled = false
- _ = h.svc.Upsert(cfg)
- if h.caddyManager != nil {
- _ = h.caddyManager.ApplyConfig(c.Request.Context())
- }
- c.JSON(http.StatusOK, gin.H{"enabled": false})
-}
-
-
-
package handlers
-
-import (
- "encoding/json"
- "net/http"
- "net/http/httptest"
- "testing"
-
- "github.com/gin-gonic/gin"
- "github.com/stretchr/testify/assert"
-
- "github.com/Wikid82/charon/backend/internal/config"
-)
-
-func TestSecurityHandler_GetStatus_Fixed(t *testing.T) {
- gin.SetMode(gin.TestMode)
-
- tests := []struct {
- name string
- cfg config.SecurityConfig
- expectedStatus int
- expectedBody map[string]interface{}
- }{
- {
- name: "All Disabled",
- cfg: config.SecurityConfig{
- CrowdSecMode: "disabled",
- WAFMode: "disabled",
- RateLimitMode: "disabled",
- ACLMode: "disabled",
- },
- expectedStatus: http.StatusOK,
- expectedBody: map[string]interface{}{
- "cerberus": map[string]interface{}{"enabled": false},
- "crowdsec": map[string]interface{}{
- "mode": "disabled",
- "api_url": "",
- "enabled": false,
- },
- "waf": map[string]interface{}{
- "mode": "disabled",
- "enabled": false,
- },
- "rate_limit": map[string]interface{}{
- "mode": "disabled",
- "enabled": false,
- },
- "acl": map[string]interface{}{
- "mode": "disabled",
- "enabled": false,
- },
- },
- },
- {
- name: "All Enabled",
- cfg: config.SecurityConfig{
- CrowdSecMode: "local",
- WAFMode: "enabled",
- RateLimitMode: "enabled",
- ACLMode: "enabled",
- },
- expectedStatus: http.StatusOK,
- expectedBody: map[string]interface{}{
- "cerberus": map[string]interface{}{"enabled": true},
- "crowdsec": map[string]interface{}{
- "mode": "local",
- "api_url": "",
- "enabled": true,
- },
- "waf": map[string]interface{}{
- "mode": "enabled",
- "enabled": true,
- },
- "rate_limit": map[string]interface{}{
- "mode": "enabled",
- "enabled": true,
- },
- "acl": map[string]interface{}{
- "mode": "enabled",
- "enabled": true,
- },
- },
- },
- }
-
- for _, tt := range tests {
- t.Run(tt.name, func(t *testing.T) {
- handler := NewSecurityHandler(tt.cfg, nil, nil)
- router := gin.New()
- router.GET("/security/status", handler.GetStatus)
-
- w := httptest.NewRecorder()
- req, _ := http.NewRequest("GET", "/security/status", nil)
- router.ServeHTTP(w, req)
-
- assert.Equal(t, tt.expectedStatus, w.Code)
-
- var response map[string]interface{}
- err := json.Unmarshal(w.Body.Bytes(), &response)
- assert.NoError(t, err)
-
- expectedJSON, _ := json.Marshal(tt.expectedBody)
- var expectedNormalized map[string]interface{}
- if err := json.Unmarshal(expectedJSON, &expectedNormalized); err != nil {
- t.Fatalf("failed to unmarshal expected JSON: %v", err)
- }
-
- assert.Equal(t, expectedNormalized, response)
- })
- }
-}
-
-
-
package handlers
-
-import (
- "net/http"
-
- "github.com/gin-gonic/gin"
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/models"
-)
-
-type SettingsHandler struct {
- DB *gorm.DB
-}
-
-func NewSettingsHandler(db *gorm.DB) *SettingsHandler {
- return &SettingsHandler{DB: db}
-}
-
-// GetSettings returns all settings.
-func (h *SettingsHandler) GetSettings(c *gin.Context) {
- var settings []models.Setting
- if err := h.DB.Find(&settings).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch settings"})
- return
- }
-
- // Convert to map for easier frontend consumption
- settingsMap := make(map[string]string)
- for _, s := range settings {
- settingsMap[s.Key] = s.Value
- }
-
- c.JSON(http.StatusOK, settingsMap)
-}
-
-type UpdateSettingRequest struct {
- Key string `json:"key" binding:"required"`
- Value string `json:"value" binding:"required"`
- Category string `json:"category"`
- Type string `json:"type"`
-}
-
-// UpdateSetting updates or creates a setting.
-func (h *SettingsHandler) UpdateSetting(c *gin.Context) {
- var req UpdateSettingRequest
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- setting := models.Setting{
- Key: req.Key,
- Value: req.Value,
- }
-
- if req.Category != "" {
- setting.Category = req.Category
- }
- if req.Type != "" {
- setting.Type = req.Type
- }
-
- // Upsert
- if err := h.DB.Where(models.Setting{Key: req.Key}).Assign(setting).FirstOrCreate(&setting).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save setting"})
- return
- }
-
- c.JSON(http.StatusOK, setting)
-}
-
-
-
package handlers
-
-import (
- "net/http"
- "strings"
-
- "github.com/gin-gonic/gin"
-)
-
-type SystemHandler struct{}
-
-func NewSystemHandler() *SystemHandler {
- return &SystemHandler{}
-}
-
-type MyIPResponse struct {
- IP string `json:"ip"`
- Source string `json:"source"`
-}
-
-// GetMyIP returns the client's public IP address
-func (h *SystemHandler) GetMyIP(c *gin.Context) {
- // Try to get the real IP from various headers (in order of preference)
- // This handles proxies, load balancers, and CDNs
- ip := getClientIP(c.Request)
-
- source := "direct"
- if c.GetHeader("X-Forwarded-For") != "" {
- source = "X-Forwarded-For"
- } else if c.GetHeader("X-Real-IP") != "" {
- source = "X-Real-IP"
- } else if c.GetHeader("CF-Connecting-IP") != "" {
- source = "Cloudflare"
- }
-
- c.JSON(http.StatusOK, MyIPResponse{
- IP: ip,
- Source: source,
- })
-}
-
-// getClientIP extracts the real client IP from the request
-// Checks headers in order of trust/reliability
-func getClientIP(r *http.Request) string {
- // Cloudflare
- if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
- return ip
- }
-
- // Other CDNs/proxies
- if ip := r.Header.Get("X-Real-IP"); ip != "" {
- return ip
- }
-
- // Standard proxy header (can be a comma-separated list)
- if forwarded := r.Header.Get("X-Forwarded-For"); forwarded != "" {
- // Take the first IP in the list (client IP)
- ips := strings.Split(forwarded, ",")
- if len(ips) > 0 {
- return strings.TrimSpace(ips[0])
- }
- }
-
- // Fallback to RemoteAddr (format: "IP:port")
- if ip := r.RemoteAddr; ip != "" {
- // Remove port if present
- if idx := strings.LastIndex(ip, ":"); idx != -1 {
- return ip[:idx]
- }
- return ip
- }
-
- return "unknown"
-}
-
-
-
package handlers
-
-import (
- "fmt"
- "math/rand"
- "strings"
- "testing"
- "time"
-
- "gorm.io/driver/sqlite"
- "gorm.io/gorm"
-)
-
-// openTestDB creates a SQLite in-memory DB unique per test and applies
-// a busy timeout and WAL journal mode to reduce SQLITE locking during parallel tests.
-func OpenTestDB(t *testing.T) *gorm.DB {
- t.Helper()
- // Append a timestamp/random suffix to ensure uniqueness even across parallel runs
- dsnName := strings.ReplaceAll(t.Name(), "/", "_")
- rand.Seed(time.Now().UnixNano())
- uniqueSuffix := fmt.Sprintf("%d%d", time.Now().UnixNano(), rand.Intn(10000))
- dsn := fmt.Sprintf("file:%s_%s?mode=memory&cache=shared&_journal_mode=WAL&_busy_timeout=5000", dsnName, uniqueSuffix)
- db, err := gorm.Open(sqlite.Open(dsn), &gorm.Config{})
- if err != nil {
- t.Fatalf("failed to open test db: %v", err)
- }
- return db
-}
-
-
-
package handlers
-
-import (
- "net/http"
-
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type UpdateHandler struct {
- service *services.UpdateService
-}
-
-func NewUpdateHandler(service *services.UpdateService) *UpdateHandler {
- return &UpdateHandler{service: service}
-}
-
-func (h *UpdateHandler) Check(c *gin.Context) {
- info, err := h.service.CheckForUpdates()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check for updates"})
- return
- }
- c.JSON(http.StatusOK, info)
-}
-
-
-
package handlers
-
-import (
- "net/http"
- "strconv"
-
- "github.com/Wikid82/charon/backend/internal/services"
- "github.com/gin-gonic/gin"
-)
-
-type UptimeHandler struct {
- service *services.UptimeService
-}
-
-func NewUptimeHandler(service *services.UptimeService) *UptimeHandler {
- return &UptimeHandler{service: service}
-}
-
-func (h *UptimeHandler) List(c *gin.Context) {
- monitors, err := h.service.ListMonitors()
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list monitors"})
- return
- }
- c.JSON(http.StatusOK, monitors)
-}
-
-func (h *UptimeHandler) GetHistory(c *gin.Context) {
- id := c.Param("id")
- limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
-
- history, err := h.service.GetMonitorHistory(id, limit)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get history"})
- return
- }
- c.JSON(http.StatusOK, history)
-}
-
-func (h *UptimeHandler) Update(c *gin.Context) {
- id := c.Param("id")
- var updates map[string]interface{}
- if err := c.ShouldBindJSON(&updates); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- monitor, err := h.service.UpdateMonitor(id, updates)
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
- return
- }
-
- c.JSON(http.StatusOK, monitor)
-}
-
-func (h *UptimeHandler) Sync(c *gin.Context) {
- if err := h.service.SyncMonitors(); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to sync monitors"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Sync started"})
-}
-
-// Delete removes a monitor and its associated data
-func (h *UptimeHandler) Delete(c *gin.Context) {
- id := c.Param("id")
- if err := h.service.DeleteMonitor(id); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete monitor"})
- return
- }
- c.JSON(http.StatusOK, gin.H{"message": "Monitor deleted"})
-}
-
-// CheckMonitor triggers an immediate check for a specific monitor
-func (h *UptimeHandler) CheckMonitor(c *gin.Context) {
- id := c.Param("id")
- monitor, err := h.service.GetMonitorByID(id)
- if err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "Monitor not found"})
- return
- }
-
- // Trigger immediate check in background
- go h.service.CheckMonitor(*monitor)
-
- c.JSON(http.StatusOK, gin.H{"message": "Check triggered"})
-}
-
-
-
package handlers
-
-import (
- "net/http"
- "strings"
-
- "github.com/gin-gonic/gin"
- "github.com/google/uuid"
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/models"
-)
-
-type UserHandler struct {
- DB *gorm.DB
-}
-
-func NewUserHandler(db *gorm.DB) *UserHandler {
- return &UserHandler{DB: db}
-}
-
-func (h *UserHandler) RegisterRoutes(r *gin.RouterGroup) {
- r.GET("/setup", h.GetSetupStatus)
- r.POST("/setup", h.Setup)
- r.GET("/profile", h.GetProfile)
- r.POST("/regenerate-api-key", h.RegenerateAPIKey)
- r.PUT("/profile", h.UpdateProfile)
-}
-
-// GetSetupStatus checks if the application needs initial setup (i.e., no users exist).
-func (h *UserHandler) GetSetupStatus(c *gin.Context) {
- var count int64
- if err := h.DB.Model(&models.User{}).Count(&count).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check setup status"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{
- "setupRequired": count == 0,
- })
-}
-
-type SetupRequest struct {
- Name string `json:"name" binding:"required"`
- Email string `json:"email" binding:"required,email"`
- Password string `json:"password" binding:"required,min=8"`
-}
-
-// Setup creates the initial admin user and configures the ACME email.
-func (h *UserHandler) Setup(c *gin.Context) {
- // 1. Check if setup is allowed
- var count int64
- if err := h.DB.Model(&models.User{}).Count(&count).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check setup status"})
- return
- }
-
- if count > 0 {
- c.JSON(http.StatusForbidden, gin.H{"error": "Setup already completed"})
- return
- }
-
- // 2. Parse request
- var req SetupRequest
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // 3. Create User
- user := models.User{
- UUID: uuid.New().String(),
- Name: req.Name,
- Email: strings.ToLower(req.Email),
- Role: "admin",
- Enabled: true,
- APIKey: uuid.New().String(),
- }
-
- if err := user.SetPassword(req.Password); err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to hash password"})
- return
- }
-
- // 4. Create Setting for ACME Email
- acmeEmailSetting := models.Setting{
- Key: "caddy.acme_email",
- Value: req.Email,
- Type: "string",
- Category: "caddy",
- }
-
- // Transaction to ensure both succeed
- err := h.DB.Transaction(func(tx *gorm.DB) error {
- if err := tx.Create(&user).Error; err != nil {
- return err
- }
- // Use Save to update if exists (though it shouldn't in fresh setup) or create
- if err := tx.Where(models.Setting{Key: "caddy.acme_email"}).Assign(models.Setting{Value: req.Email}).FirstOrCreate(&acmeEmailSetting).Error; err != nil {
- return err
- }
- return nil
- })
-
- if err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to complete setup: " + err.Error()})
- return
- }
-
- c.JSON(http.StatusCreated, gin.H{
- "message": "Setup completed successfully",
- "user": gin.H{
- "id": user.ID,
- "email": user.Email,
- "name": user.Name,
- },
- })
-}
-
-// RegenerateAPIKey generates a new API key for the authenticated user.
-func (h *UserHandler) RegenerateAPIKey(c *gin.Context) {
- userID, exists := c.Get("userID")
- if !exists {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
- return
- }
-
- apiKey := uuid.New().String()
-
- if err := h.DB.Model(&models.User{}).Where("id = ?", userID).Update("api_key", apiKey).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update API key"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{"api_key": apiKey})
-}
-
-// GetProfile returns the current user's profile including API key.
-func (h *UserHandler) GetProfile(c *gin.Context) {
- userID, exists := c.Get("userID")
- if !exists {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
- return
- }
-
- var user models.User
- if err := h.DB.First(&user, userID).Error; err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{
- "id": user.ID,
- "email": user.Email,
- "name": user.Name,
- "role": user.Role,
- "api_key": user.APIKey,
- })
-}
-
-type UpdateProfileRequest struct {
- Name string `json:"name" binding:"required"`
- Email string `json:"email" binding:"required,email"`
- CurrentPassword string `json:"current_password"`
-}
-
-// UpdateProfile updates the authenticated user's profile.
-func (h *UserHandler) UpdateProfile(c *gin.Context) {
- userID, exists := c.Get("userID")
- if !exists {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
- return
- }
-
- var req UpdateProfileRequest
- if err := c.ShouldBindJSON(&req); err != nil {
- c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
- return
- }
-
- // Get current user
- var user models.User
- if err := h.DB.First(&user, userID).Error; err != nil {
- c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
- return
- }
-
- // Check if email is already taken by another user
- req.Email = strings.ToLower(req.Email)
- var count int64
- if err := h.DB.Model(&models.User{}).Where("email = ? AND id != ?", req.Email, userID).Count(&count).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check email availability"})
- return
- }
-
- if count > 0 {
- c.JSON(http.StatusConflict, gin.H{"error": "Email already in use"})
- return
- }
-
- // If email is changing, verify password
- if req.Email != user.Email {
- if req.CurrentPassword == "" {
- c.JSON(http.StatusBadRequest, gin.H{"error": "Current password is required to change email"})
- return
- }
- if !user.CheckPassword(req.CurrentPassword) {
- c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid password"})
- return
- }
- }
-
- if err := h.DB.Model(&models.User{}).Where("id = ?", userID).Updates(map[string]interface{}{
- "name": req.Name,
- "email": req.Email,
- }).Error; err != nil {
- c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update profile"})
- return
- }
-
- c.JSON(http.StatusOK, gin.H{"message": "Profile updated successfully"})
-}
-
-
-
-
-
package caddy
-
-import (
- "bytes"
- "context"
- "encoding/json"
- "fmt"
- "io"
- "net/http"
- "time"
-)
-
-// Client wraps the Caddy admin API.
-type Client struct {
- baseURL string
- httpClient *http.Client
-}
-
-// NewClient creates a Caddy API client.
-func NewClient(adminAPIURL string) *Client {
- return &Client{
- baseURL: adminAPIURL,
- httpClient: &http.Client{
- Timeout: 30 * time.Second,
- },
- }
-}
-
-// Load atomically replaces Caddy's entire configuration.
-// This is the primary method for applying configuration changes.
-func (c *Client) Load(ctx context.Context, config *Config) error {
- body, err := json.Marshal(config)
- if err != nil {
- return fmt.Errorf("marshal config: %w", err)
- }
-
- req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/load", bytes.NewReader(body))
- if err != nil {
- return fmt.Errorf("create request: %w", err)
- }
- req.Header.Set("Content-Type", "application/json")
-
- resp, err := c.httpClient.Do(req)
- if err != nil {
- return fmt.Errorf("execute request: %w", err)
- }
- defer resp.Body.Close()
-
- if resp.StatusCode != http.StatusOK {
- bodyBytes, _ := io.ReadAll(resp.Body)
- return fmt.Errorf("caddy returned status %d: %s", resp.StatusCode, string(bodyBytes))
- }
-
- return nil
-}
-
-// GetConfig retrieves the current running configuration from Caddy.
-func (c *Client) GetConfig(ctx context.Context) (*Config, error) {
- req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/config/", nil)
- if err != nil {
- return nil, fmt.Errorf("create request: %w", err)
- }
-
- resp, err := c.httpClient.Do(req)
- if err != nil {
- return nil, fmt.Errorf("execute request: %w", err)
- }
- defer resp.Body.Close()
-
- if resp.StatusCode != http.StatusOK {
- bodyBytes, _ := io.ReadAll(resp.Body)
- return nil, fmt.Errorf("caddy returned status %d: %s", resp.StatusCode, string(bodyBytes))
- }
-
- var config Config
- if err := json.NewDecoder(resp.Body).Decode(&config); err != nil {
- return nil, fmt.Errorf("decode response: %w", err)
- }
-
- return &config, nil
-}
-
-// Ping checks if Caddy admin API is reachable.
-func (c *Client) Ping(ctx context.Context) error {
- req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/config/", nil)
- if err != nil {
- return fmt.Errorf("create request: %w", err)
- }
-
- resp, err := c.httpClient.Do(req)
- if err != nil {
- return fmt.Errorf("caddy unreachable: %w", err)
- }
- defer resp.Body.Close()
-
- if resp.StatusCode != http.StatusOK {
- return fmt.Errorf("caddy returned status %d", resp.StatusCode)
- }
-
- return nil
-}
-
-
-
package caddy
-
-import (
- "encoding/json"
- "fmt"
- "path/filepath"
- "strings"
-
- "github.com/Wikid82/charon/backend/internal/models"
-)
-
-// GenerateConfig creates a Caddy JSON configuration from proxy hosts.
-// This is the core transformation layer from our database model to Caddy config.
-func GenerateConfig(hosts []models.ProxyHost, storageDir string, acmeEmail string, frontendDir string, sslProvider string, acmeStaging bool) (*Config, error) {
- // Define log file paths
- // We assume storageDir is like ".../data/caddy/data", so we go up to ".../data/logs"
- // storageDir is .../data/caddy/data
- // Dir -> .../data/caddy
- // Dir -> .../data
- logDir := filepath.Join(filepath.Dir(filepath.Dir(storageDir)), "logs")
- logFile := filepath.Join(logDir, "access.log")
-
- config := &Config{
- Logging: &LoggingConfig{
- Logs: map[string]*LogConfig{
- "access": {
- Level: "INFO",
- Writer: &WriterConfig{
- Output: "file",
- Filename: logFile,
- Roll: true,
- RollSize: 10, // 10 MB
- RollKeep: 5, // Keep 5 files
- RollKeepDays: 7, // Keep for 7 days
- },
- Encoder: &EncoderConfig{
- Format: "json",
- },
- Include: []string{"http.log.access.access_log"},
- },
- },
- },
- Apps: Apps{
- HTTP: &HTTPApp{
- Servers: map[string]*Server{},
- },
- },
- Storage: Storage{
- System: "file_system",
- Root: storageDir,
- },
- }
-
- if acmeEmail != "" {
- var issuers []interface{}
-
- // Configure issuers based on provider preference
- switch sslProvider {
- case "letsencrypt":
- acmeIssuer := map[string]interface{}{
- "module": "acme",
- "email": acmeEmail,
- }
- if acmeStaging {
- acmeIssuer["ca"] = "https://acme-staging-v02.api.letsencrypt.org/directory"
- }
- issuers = append(issuers, acmeIssuer)
- case "zerossl":
- issuers = append(issuers, map[string]interface{}{
- "module": "zerossl",
- })
- default: // "both" or empty
- acmeIssuer := map[string]interface{}{
- "module": "acme",
- "email": acmeEmail,
- }
- if acmeStaging {
- acmeIssuer["ca"] = "https://acme-staging-v02.api.letsencrypt.org/directory"
- }
- issuers = append(issuers, acmeIssuer)
- issuers = append(issuers, map[string]interface{}{
- "module": "zerossl",
- })
- }
-
- config.Apps.TLS = &TLSApp{
- Automation: &AutomationConfig{
- Policies: []*AutomationPolicy{
- {
- IssuersRaw: issuers,
- },
- },
- },
- }
- }
-
- // Collect CUSTOM certificates only (not Let's Encrypt - those are managed by ACME)
- // Only custom/uploaded certificates should be loaded via LoadPEM
- customCerts := make(map[uint]models.SSLCertificate)
- for _, host := range hosts {
- if host.CertificateID != nil && host.Certificate != nil {
- // Only include custom certificates, not ACME-managed ones
- if host.Certificate.Provider == "custom" {
- customCerts[*host.CertificateID] = *host.Certificate
- }
- }
- }
-
- if len(customCerts) > 0 {
- var loadPEM []LoadPEMConfig
- for _, cert := range customCerts {
- // Validate that custom cert has both certificate and key
- if cert.Certificate == "" || cert.PrivateKey == "" {
- fmt.Printf("Warning: Custom certificate %s missing certificate or key, skipping\n", cert.Name)
- continue
- }
- loadPEM = append(loadPEM, LoadPEMConfig{
- Certificate: cert.Certificate,
- Key: cert.PrivateKey,
- Tags: []string{cert.UUID},
- })
- }
-
- if len(loadPEM) > 0 {
- if config.Apps.TLS == nil {
- config.Apps.TLS = &TLSApp{}
- }
- config.Apps.TLS.Certificates = &CertificatesConfig{
- LoadPEM: loadPEM,
- }
- }
- }
-
- if len(hosts) == 0 && frontendDir == "" {
- return config, nil
- }
-
- // Initialize routes slice
- routes := make([]*Route, 0)
-
- // Track processed domains to prevent duplicates (Ghost Host fix)
- processedDomains := make(map[string]bool)
-
- // Sort hosts by UpdatedAt desc to prefer newer configs in case of duplicates
- // Note: This assumes the input slice is already sorted or we don't care about order beyond duplicates
- // The caller (ApplyConfig) fetches all hosts. We should probably sort them here or there.
- // For now, we'll just process them. If we encounter a duplicate domain, we skip it.
- // To ensure we keep the *latest* one, we should iterate in reverse or sort.
- // But ApplyConfig uses db.Find(&hosts), which usually returns by ID asc.
- // So later IDs (newer) come last.
- // We want to keep the NEWER one.
- // So we should iterate backwards? Or just overwrite?
- // Caddy config structure is a list of servers/routes.
- // If we have multiple routes matching the same host, Caddy uses the first one?
- // Actually, Caddy matches routes in order.
- // If we emit two routes for "example.com", the first one will catch it.
- // So we want the NEWEST one to be FIRST in the list?
- // Or we want to only emit ONE route for "example.com".
- // If we emit only one, it should be the newest one.
- // So we should process hosts from newest to oldest, and skip duplicates.
-
- // Let's iterate in reverse order (assuming input is ID ASC)
- for i := len(hosts) - 1; i >= 0; i-- {
- host := hosts[i]
-
- if !host.Enabled {
- continue
- }
-
- if host.DomainNames == "" {
- // Log warning?
- continue
- }
-
- // Parse comma-separated domains
- rawDomains := strings.Split(host.DomainNames, ",")
- var uniqueDomains []string
-
- for _, d := range rawDomains {
- d = strings.TrimSpace(d)
- d = strings.ToLower(d) // Normalize to lowercase
- if d == "" {
- continue
- }
- if processedDomains[d] {
- fmt.Printf("Warning: Skipping duplicate domain %s for host %s (Ghost Host detection)\n", d, host.UUID)
- continue
- }
- processedDomains[d] = true
- uniqueDomains = append(uniqueDomains, d)
- }
-
- if len(uniqueDomains) == 0 {
- continue
- }
-
- // Build handlers for this host
- handlers := make([]Handler, 0)
-
- // Add Access Control List (ACL) handler if configured
- if host.AccessListID != nil && host.AccessList != nil && host.AccessList.Enabled {
- aclHandler, err := buildACLHandler(host.AccessList)
- if err != nil {
- fmt.Printf("Warning: Failed to build ACL handler for host %s: %v\n", host.UUID, err)
- } else if aclHandler != nil {
- handlers = append(handlers, aclHandler)
- }
- }
-
- // Add HSTS header if enabled
- if host.HSTSEnabled {
- hstsValue := "max-age=31536000"
- if host.HSTSSubdomains {
- hstsValue += "; includeSubDomains"
- }
- handlers = append(handlers, HeaderHandler(map[string][]string{
- "Strict-Transport-Security": {hstsValue},
- }))
- }
-
- // Add exploit blocking if enabled
- if host.BlockExploits {
- handlers = append(handlers, BlockExploitsHandler())
- }
-
- // Handle custom locations first (more specific routes)
- for _, loc := range host.Locations {
- dial := fmt.Sprintf("%s:%d", loc.ForwardHost, loc.ForwardPort)
- locRoute := &Route{
- Match: []Match{
- {
- Host: uniqueDomains,
- Path: []string{loc.Path, loc.Path + "/*"},
- },
- },
- Handle: []Handler{
- ReverseProxyHandler(dial, host.WebsocketSupport, host.Application),
- },
- Terminal: true,
- }
- routes = append(routes, locRoute)
- }
-
- // Main proxy handler
- dial := fmt.Sprintf("%s:%d", host.ForwardHost, host.ForwardPort)
- // Insert user advanced config (if present) as headers or handlers before the reverse proxy
- // so user-specified headers/handlers are applied prior to proxying.
- if host.AdvancedConfig != "" {
- var parsed interface{}
- if err := json.Unmarshal([]byte(host.AdvancedConfig), &parsed); err != nil {
- fmt.Printf("Warning: Failed to parse advanced_config for host %s: %v\n", host.UUID, err)
- } else {
- switch v := parsed.(type) {
- case map[string]interface{}:
- // Append as a handler
- // Ensure it has a "handler" key
- if _, ok := v["handler"]; ok {
- handlers = append(handlers, Handler(v))
- } else {
- fmt.Printf("Warning: advanced_config for host %s is not a handler object\n", host.UUID)
- }
- case []interface{}:
- for _, it := range v {
- if m, ok := it.(map[string]interface{}); ok {
- if _, ok2 := m["handler"]; ok2 {
- handlers = append(handlers, Handler(m))
- }
- }
- }
- default:
- fmt.Printf("Warning: advanced_config for host %s has unexpected JSON structure\n", host.UUID)
- }
- }
- }
- mainHandlers := append(handlers, ReverseProxyHandler(dial, host.WebsocketSupport, host.Application))
-
- route := &Route{
- Match: []Match{
- {Host: uniqueDomains},
- },
- Handle: mainHandlers,
- Terminal: true,
- }
-
- routes = append(routes, route)
- }
-
- // Add catch-all 404 handler
- // This matches any request that wasn't handled by previous routes
- if frontendDir != "" {
- catchAllRoute := &Route{
- Handle: []Handler{
- RewriteHandler("/unknown.html"),
- FileServerHandler(frontendDir),
- },
- Terminal: true,
- }
- routes = append(routes, catchAllRoute)
- }
-
- config.Apps.HTTP.Servers["charon_server"] = &Server{
- Listen: []string{":80", ":443"},
- Routes: routes,
- AutoHTTPS: &AutoHTTPSConfig{
- Disable: false,
- DisableRedir: false,
- },
- Logs: &ServerLogs{
- DefaultLoggerName: "access_log",
- },
- }
-
- return config, nil
-}
-
-// buildACLHandler creates access control handlers based on the AccessList configuration
-func buildACLHandler(acl *models.AccessList) (Handler, error) {
- // For geo-blocking, we use CEL (Common Expression Language) matcher with caddy-geoip2 placeholders
- // For IP-based ACLs, we use Caddy's native remote_ip matcher
-
- if strings.HasPrefix(acl.Type, "geo_") {
- // Geo-blocking using caddy-geoip2
- countryCodes := strings.Split(acl.CountryCodes, ",")
- var trimmedCodes []string
- for _, code := range countryCodes {
- trimmedCodes = append(trimmedCodes, `"`+strings.TrimSpace(code)+`"`)
- }
-
- var expression string
- if acl.Type == "geo_whitelist" {
- // Allow only these countries
- expression = fmt.Sprintf("{geoip2.country_code} in [%s]", strings.Join(trimmedCodes, ", "))
- } else {
- // geo_blacklist: Block these countries
- expression = fmt.Sprintf("{geoip2.country_code} not_in [%s]", strings.Join(trimmedCodes, ", "))
- }
-
- return Handler{
- "handler": "subroute",
- "routes": []map[string]interface{}{
- {
- "match": []map[string]interface{}{
- {
- "not": []map[string]interface{}{
- {
- "expression": expression,
- },
- },
- },
- },
- "handle": []map[string]interface{}{
- {
- "handler": "static_response",
- "status_code": 403,
- "body": "Access denied: Geographic restriction",
- },
- },
- "terminal": true,
- },
- },
- }, nil
- }
-
- // IP/CIDR-based ACLs using Caddy's native remote_ip matcher
- if acl.LocalNetworkOnly {
- // Allow only RFC1918 private networks
- return Handler{
- "handler": "subroute",
- "routes": []map[string]interface{}{
- {
- "match": []map[string]interface{}{
- {
- "not": []map[string]interface{}{
- {
- "remote_ip": map[string]interface{}{
- "ranges": []string{
- "10.0.0.0/8",
- "172.16.0.0/12",
- "192.168.0.0/16",
- "127.0.0.0/8",
- "169.254.0.0/16",
- "fc00::/7",
- "fe80::/10",
- "::1/128",
- },
- },
- },
- },
- },
- },
- "handle": []map[string]interface{}{
- {
- "handler": "static_response",
- "status_code": 403,
- "body": "Access denied: Not a local network IP",
- },
- },
- "terminal": true,
- },
- },
- }, nil
- }
-
- // Parse IP rules
- if acl.IPRules == "" {
- return nil, nil
- }
-
- var rules []models.AccessListRule
- if err := json.Unmarshal([]byte(acl.IPRules), &rules); err != nil {
- return nil, fmt.Errorf("invalid IP rules JSON: %w", err)
- }
-
- if len(rules) == 0 {
- return nil, nil
- }
-
- // Extract CIDR ranges
- var cidrs []string
- for _, rule := range rules {
- cidrs = append(cidrs, rule.CIDR)
- }
-
- if acl.Type == "whitelist" {
- // Allow only these IPs (block everything else)
- return Handler{
- "handler": "subroute",
- "routes": []map[string]interface{}{
- {
- "match": []map[string]interface{}{
- {
- "not": []map[string]interface{}{
- {
- "remote_ip": map[string]interface{}{
- "ranges": cidrs,
- },
- },
- },
- },
- },
- "handle": []map[string]interface{}{
- {
- "handler": "static_response",
- "status_code": 403,
- "body": "Access denied: IP not in whitelist",
- },
- },
- "terminal": true,
- },
- },
- }, nil
- }
-
- if acl.Type == "blacklist" {
- // Block these IPs (allow everything else)
- return Handler{
- "handler": "subroute",
- "routes": []map[string]interface{}{
- {
- "match": []map[string]interface{}{
- {
- "remote_ip": map[string]interface{}{
- "ranges": cidrs,
- },
- },
- },
- "handle": []map[string]interface{}{
- {
- "handler": "static_response",
- "status_code": 403,
- "body": "Access denied: IP blacklisted",
- },
- },
- "terminal": true,
- },
- },
- }, nil
- }
-
- return nil, nil
-}
-
-
-
package caddy
-
-import (
- "encoding/json"
- "errors"
- "fmt"
- "net"
- "os"
- "os/exec"
- "path/filepath"
- "strings"
-
- "github.com/Wikid82/charon/backend/internal/models"
-)
-
-// Executor defines an interface for executing shell commands.
-type Executor interface {
- Execute(name string, args ...string) ([]byte, error)
-}
-
-// DefaultExecutor implements Executor using os/exec.
-type DefaultExecutor struct{}
-
-func (e *DefaultExecutor) Execute(name string, args ...string) ([]byte, error) {
- return exec.Command(name, args...).Output()
-}
-
-// CaddyConfig represents the root structure of Caddy's JSON config.
-type CaddyConfig struct {
- Apps *CaddyApps `json:"apps,omitempty"`
-}
-
-// CaddyApps contains application-specific configurations.
-type CaddyApps struct {
- HTTP *CaddyHTTP `json:"http,omitempty"`
-}
-
-// CaddyHTTP represents the HTTP app configuration.
-type CaddyHTTP struct {
- Servers map[string]*CaddyServer `json:"servers,omitempty"`
-}
-
-// CaddyServer represents a single server configuration.
-type CaddyServer struct {
- Listen []string `json:"listen,omitempty"`
- Routes []*CaddyRoute `json:"routes,omitempty"`
- TLSConnectionPolicies interface{} `json:"tls_connection_policies,omitempty"`
-}
-
-// CaddyRoute represents a single route with matchers and handlers.
-type CaddyRoute struct {
- Match []*CaddyMatcher `json:"match,omitempty"`
- Handle []*CaddyHandler `json:"handle,omitempty"`
-}
-
-// CaddyMatcher represents route matching criteria.
-type CaddyMatcher struct {
- Host []string `json:"host,omitempty"`
-}
-
-// CaddyHandler represents a handler in the route.
-type CaddyHandler struct {
- Handler string `json:"handler"`
- Upstreams interface{} `json:"upstreams,omitempty"`
- Headers interface{} `json:"headers,omitempty"`
- Routes interface{} `json:"routes,omitempty"` // For subroute handlers
-}
-
-// ParsedHost represents a single host detected during Caddyfile import.
-type ParsedHost struct {
- DomainNames string `json:"domain_names"`
- ForwardScheme string `json:"forward_scheme"`
- ForwardHost string `json:"forward_host"`
- ForwardPort int `json:"forward_port"`
- SSLForced bool `json:"ssl_forced"`
- WebsocketSupport bool `json:"websocket_support"`
- RawJSON string `json:"raw_json"` // Original Caddy JSON for this route
- Warnings []string `json:"warnings"` // Unsupported features
-}
-
-// ImportResult contains parsed hosts and detected conflicts.
-type ImportResult struct {
- Hosts []ParsedHost `json:"hosts"`
- Conflicts []string `json:"conflicts"`
- Errors []string `json:"errors"`
-}
-
-// Importer handles Caddyfile parsing and conversion to CPM+ models.
-type Importer struct {
- caddyBinaryPath string
- executor Executor
-}
-
-// NewImporter creates a new Caddyfile importer.
-func NewImporter(binaryPath string) *Importer {
- if binaryPath == "" {
- binaryPath = "caddy" // Default to PATH
- }
- return &Importer{
- caddyBinaryPath: binaryPath,
- executor: &DefaultExecutor{},
- }
-}
-
-// ParseCaddyfile reads a Caddyfile and converts it to Caddy JSON.
-func (i *Importer) ParseCaddyfile(caddyfilePath string) ([]byte, error) {
- if _, err := os.Stat(caddyfilePath); os.IsNotExist(err) {
- return nil, fmt.Errorf("caddyfile not found: %s", caddyfilePath)
- }
-
- output, err := i.executor.Execute(i.caddyBinaryPath, "adapt", "--config", caddyfilePath, "--adapter", "caddyfile")
- if err != nil {
- return nil, fmt.Errorf("caddy adapt failed: %w (output: %s)", err, string(output))
- }
-
- return output, nil
-}
-
-// extractHandlers recursively extracts handlers from a list, flattening subroutes.
-func (i *Importer) extractHandlers(handles []*CaddyHandler) []*CaddyHandler {
- var result []*CaddyHandler
-
- for _, handler := range handles {
- // If this is a subroute, extract handlers from its first route
- if handler.Handler == "subroute" {
- if routes, ok := handler.Routes.([]interface{}); ok && len(routes) > 0 {
- if subroute, ok := routes[0].(map[string]interface{}); ok {
- if subhandles, ok := subroute["handle"].([]interface{}); ok {
- // Convert the subhandles to CaddyHandler objects
- for _, sh := range subhandles {
- if shMap, ok := sh.(map[string]interface{}); ok {
- subHandler := &CaddyHandler{}
- if handlerType, ok := shMap["handler"].(string); ok {
- subHandler.Handler = handlerType
- }
- if upstreams, ok := shMap["upstreams"]; ok {
- subHandler.Upstreams = upstreams
- }
- if headers, ok := shMap["headers"]; ok {
- subHandler.Headers = headers
- }
- result = append(result, subHandler)
- }
- }
- }
- }
- }
- } else {
- // Regular handler, add it directly
- result = append(result, handler)
- }
- }
-
- return result
-}
-
-// ExtractHosts parses Caddy JSON and extracts proxy host information.
-func (i *Importer) ExtractHosts(caddyJSON []byte) (*ImportResult, error) {
- var config CaddyConfig
- if err := json.Unmarshal(caddyJSON, &config); err != nil {
- return nil, fmt.Errorf("parsing caddy json: %w", err)
- }
-
- result := &ImportResult{
- Hosts: []ParsedHost{},
- Conflicts: []string{},
- Errors: []string{},
- }
-
- if config.Apps == nil || config.Apps.HTTP == nil || config.Apps.HTTP.Servers == nil {
- return result, nil // Empty config
- }
-
- seenDomains := make(map[string]bool)
-
- for serverName, server := range config.Apps.HTTP.Servers {
- // Detect if this server uses SSL based on listen address or TLS policies
- serverUsesSSL := server.TLSConnectionPolicies != nil
- for _, listenAddr := range server.Listen {
- // Check if listening on :443 or any HTTPS port indicator
- if strings.Contains(listenAddr, ":443") || strings.HasSuffix(listenAddr, "443") {
- serverUsesSSL = true
- break
- }
- }
-
- for routeIdx, route := range server.Routes {
- for _, match := range route.Match {
- for _, hostMatcher := range match.Host {
- domain := hostMatcher
-
- // Check for duplicate domains (report domain names only)
- if seenDomains[domain] {
- result.Conflicts = append(result.Conflicts, domain)
- continue
- }
- seenDomains[domain] = true
-
- // Extract reverse proxy handler
- host := ParsedHost{
- DomainNames: domain,
- SSLForced: strings.HasPrefix(domain, "https") || serverUsesSSL,
- }
-
- // Find reverse_proxy handler (may be nested in subroute)
- handlers := i.extractHandlers(route.Handle)
-
- for _, handler := range handlers {
- if handler.Handler == "reverse_proxy" {
- upstreams, _ := handler.Upstreams.([]interface{})
- if len(upstreams) > 0 {
- if upstream, ok := upstreams[0].(map[string]interface{}); ok {
- dial, _ := upstream["dial"].(string)
- if dial != "" {
- hostStr, portStr, err := net.SplitHostPort(dial)
- if err == nil {
- host.ForwardHost = hostStr
- if _, err := fmt.Sscanf(portStr, "%d", &host.ForwardPort); err != nil {
- host.ForwardPort = 80
- }
- } else {
- // Fallback: assume dial is just the host or has some other format
- // Try to handle simple "host:port" manually if net.SplitHostPort failed for some reason
- // or assume it's just a host
- parts := strings.Split(dial, ":")
- if len(parts) == 2 {
- host.ForwardHost = parts[0]
- if _, err := fmt.Sscanf(parts[1], "%d", &host.ForwardPort); err != nil {
- host.ForwardPort = 80
- }
- } else {
- host.ForwardHost = dial
- host.ForwardPort = 80
- }
- }
- }
- }
- }
-
- // Check for websocket support
- if headers, ok := handler.Headers.(map[string]interface{}); ok {
- if upgrade, ok := headers["Upgrade"].([]interface{}); ok {
- for _, v := range upgrade {
- if v == "websocket" {
- host.WebsocketSupport = true
- break
- }
- }
- }
- }
-
- // Default scheme
- host.ForwardScheme = "http"
- if host.SSLForced {
- host.ForwardScheme = "https"
- }
- }
-
- // Detect unsupported features
- if handler.Handler == "rewrite" {
- host.Warnings = append(host.Warnings, "Rewrite rules not supported - manual configuration required")
- }
- if handler.Handler == "file_server" {
- host.Warnings = append(host.Warnings, "File server directives not supported")
- }
- }
-
- // Store raw JSON for this route
- routeJSON, _ := json.Marshal(map[string]interface{}{
- "server": serverName,
- "route": routeIdx,
- "data": route,
- })
- host.RawJSON = string(routeJSON)
-
- result.Hosts = append(result.Hosts, host)
- }
- }
- }
- }
-
- return result, nil
-}
-
-// ImportFile performs complete import: parse Caddyfile and extract hosts.
-func (i *Importer) ImportFile(caddyfilePath string) (*ImportResult, error) {
- caddyJSON, err := i.ParseCaddyfile(caddyfilePath)
- if err != nil {
- return nil, err
- }
-
- return i.ExtractHosts(caddyJSON)
-}
-
-// ConvertToProxyHosts converts parsed hosts to ProxyHost models.
-func ConvertToProxyHosts(parsedHosts []ParsedHost) []models.ProxyHost {
- hosts := make([]models.ProxyHost, 0, len(parsedHosts))
-
- for _, parsed := range parsedHosts {
- if parsed.ForwardHost == "" || parsed.ForwardPort == 0 {
- continue // Skip invalid entries
- }
-
- hosts = append(hosts, models.ProxyHost{
- Name: parsed.DomainNames, // Can be customized by user during review
- DomainNames: parsed.DomainNames,
- ForwardScheme: parsed.ForwardScheme,
- ForwardHost: parsed.ForwardHost,
- ForwardPort: parsed.ForwardPort,
- SSLForced: parsed.SSLForced,
- WebsocketSupport: parsed.WebsocketSupport,
- })
- }
-
- return hosts
-}
-
-// ValidateCaddyBinary checks if the Caddy binary is available.
-func (i *Importer) ValidateCaddyBinary() error {
- _, err := i.executor.Execute(i.caddyBinaryPath, "version")
- if err != nil {
- return errors.New("caddy binary not found or not executable")
- }
- return nil
-}
-
-// BackupCaddyfile creates a timestamped backup of the original Caddyfile.
-func BackupCaddyfile(originalPath, backupDir string) (string, error) {
- if err := os.MkdirAll(backupDir, 0755); err != nil {
- return "", fmt.Errorf("creating backup directory: %w", err)
- }
-
- timestamp := fmt.Sprintf("%d", os.Getpid()) // Simple timestamp placeholder
- backupPath := filepath.Join(backupDir, fmt.Sprintf("Caddyfile.%s.backup", timestamp))
-
- input, err := os.ReadFile(originalPath)
- if err != nil {
- return "", fmt.Errorf("reading original file: %w", err)
- }
-
- if err := os.WriteFile(backupPath, input, 0644); err != nil {
- return "", fmt.Errorf("writing backup: %w", err)
- }
-
- return backupPath, nil
-}
-
-
-
package caddy
-
-import (
- "context"
- "crypto/sha256"
- "encoding/json"
- "fmt"
- "os"
- "path/filepath"
- "sort"
- "time"
-
- "gorm.io/gorm"
-
- "github.com/Wikid82/charon/backend/internal/models"
-)
-
-// Manager orchestrates Caddy configuration lifecycle: generate, validate, apply, rollback.
-type Manager struct {
- client *Client
- db *gorm.DB
- configDir string
- frontendDir string
- acmeStaging bool
-}
-
-// NewManager creates a configuration manager.
-func NewManager(client *Client, db *gorm.DB, configDir string, frontendDir string, acmeStaging bool) *Manager {
- return &Manager{
- client: client,
- db: db,
- configDir: configDir,
- frontendDir: frontendDir,
- acmeStaging: acmeStaging,
- }
-}
-
-// ApplyConfig generates configuration from database, validates it, applies to Caddy with rollback on failure.
-func (m *Manager) ApplyConfig(ctx context.Context) error {
- // Fetch all proxy hosts from database
- var hosts []models.ProxyHost
- if err := m.db.Preload("Locations").Preload("Certificate").Preload("AccessList").Find(&hosts).Error; err != nil {
- return fmt.Errorf("fetch proxy hosts: %w", err)
- }
-
- // Fetch ACME email setting
- var acmeEmailSetting models.Setting
- var acmeEmail string
- if err := m.db.Where("key = ?", "caddy.acme_email").First(&acmeEmailSetting).Error; err == nil {
- acmeEmail = acmeEmailSetting.Value
- }
-
- // Fetch SSL Provider setting
- var sslProviderSetting models.Setting
- var sslProvider string
- if err := m.db.Where("key = ?", "caddy.ssl_provider").First(&sslProviderSetting).Error; err == nil {
- sslProvider = sslProviderSetting.Value
- }
-
- // Generate Caddy config
- config, err := GenerateConfig(hosts, filepath.Join(m.configDir, "data"), acmeEmail, m.frontendDir, sslProvider, m.acmeStaging)
- if err != nil {
- return fmt.Errorf("generate config: %w", err)
- }
-
- // Validate before applying
- if err := Validate(config); err != nil {
- return fmt.Errorf("validation failed: %w", err)
- }
-
- // Save snapshot for rollback
- snapshotPath, err := m.saveSnapshot(config)
- if err != nil {
- return fmt.Errorf("save snapshot: %w", err)
- }
-
- // Calculate config hash for audit trail
- configJSON, _ := json.Marshal(config)
- configHash := fmt.Sprintf("%x", sha256.Sum256(configJSON))
-
- // Apply to Caddy
- if err := m.client.Load(ctx, config); err != nil {
- // Remove the failed snapshot so rollback uses the previous one
- _ = os.Remove(snapshotPath)
-
- // Rollback on failure
- if rollbackErr := m.rollback(ctx); rollbackErr != nil {
- // If rollback fails, we still want to record the failure
- m.recordConfigChange(configHash, false, err.Error())
- return fmt.Errorf("apply failed: %w, rollback also failed: %v", err, rollbackErr)
- }
-
- // Record failed attempt
- m.recordConfigChange(configHash, false, err.Error())
- return fmt.Errorf("apply failed (rolled back): %w", err)
- }
-
- // Record successful application
- m.recordConfigChange(configHash, true, "")
-
- // Cleanup old snapshots (keep last 10)
- if err := m.rotateSnapshots(10); err != nil {
- // Non-fatal - log but don't fail
- fmt.Printf("warning: snapshot rotation failed: %v\n", err)
- }
-
- return nil
-}
-
-// saveSnapshot stores the config to disk with timestamp.
-func (m *Manager) saveSnapshot(config *Config) (string, error) {
- timestamp := time.Now().Unix()
- filename := fmt.Sprintf("config-%d.json", timestamp)
- path := filepath.Join(m.configDir, filename)
-
- configJSON, err := json.MarshalIndent(config, "", " ")
- if err != nil {
- return "", fmt.Errorf("marshal config: %w", err)
- }
-
- if err := os.WriteFile(path, configJSON, 0644); err != nil {
- return "", fmt.Errorf("write snapshot: %w", err)
- }
-
- return path, nil
-}
-
-// rollback loads the most recent snapshot from disk.
-func (m *Manager) rollback(ctx context.Context) error {
- snapshots, err := m.listSnapshots()
- if err != nil || len(snapshots) == 0 {
- return fmt.Errorf("no snapshots available for rollback")
- }
-
- // Load most recent snapshot
- latestSnapshot := snapshots[len(snapshots)-1]
- configJSON, err := os.ReadFile(latestSnapshot)
- if err != nil {
- return fmt.Errorf("read snapshot: %w", err)
- }
-
- var config Config
- if err := json.Unmarshal(configJSON, &config); err != nil {
- return fmt.Errorf("unmarshal snapshot: %w", err)
- }
-
- // Apply the snapshot
- if err := m.client.Load(ctx, &config); err != nil {
- return fmt.Errorf("load snapshot: %w", err)
- }
-
- return nil
-}
-
-// listSnapshots returns all snapshot file paths sorted by modification time.
-func (m *Manager) listSnapshots() ([]string, error) {
- entries, err := os.ReadDir(m.configDir)
- if err != nil {
- return nil, fmt.Errorf("read config dir: %w", err)
- }
-
- var snapshots []string
- for _, entry := range entries {
- if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" {
- continue
- }
- snapshots = append(snapshots, filepath.Join(m.configDir, entry.Name()))
- }
-
- // Sort by modification time
- sort.Slice(snapshots, func(i, j int) bool {
- infoI, _ := os.Stat(snapshots[i])
- infoJ, _ := os.Stat(snapshots[j])
- return infoI.ModTime().Before(infoJ.ModTime())
- })
-
- return snapshots, nil
-}
-
-// rotateSnapshots keeps only the N most recent snapshots.
-func (m *Manager) rotateSnapshots(keep int) error {
- snapshots, err := m.listSnapshots()
- if err != nil {
- return err
- }
-
- if len(snapshots) <= keep {
- return nil
- }
-
- // Delete oldest snapshots
- toDelete := snapshots[:len(snapshots)-keep]
- for _, path := range toDelete {
- if err := os.Remove(path); err != nil {
- return fmt.Errorf("delete snapshot %s: %w", path, err)
- }
- }
-
- return nil
-}
-
-// recordConfigChange stores an audit record in the database.
-func (m *Manager) recordConfigChange(configHash string, success bool, errorMsg string) {
- record := models.CaddyConfig{
- ConfigHash: configHash,
- AppliedAt: time.Now(),
- Success: success,
- ErrorMsg: errorMsg,
- }
-
- // Best effort - don't fail if audit logging fails
- m.db.Create(&record)
-}
-
-// Ping checks if Caddy is reachable.
-func (m *Manager) Ping(ctx context.Context) error {
- return m.client.Ping(ctx)
-}
-
-// GetCurrentConfig retrieves the running config from Caddy.
-func (m *Manager) GetCurrentConfig(ctx context.Context) (*Config, error) {
- return m.client.GetConfig(ctx)
-}
-
-
-
package caddy
-
-// Config represents Caddy's top-level JSON configuration structure.
-// Reference: https://caddyserver.com/docs/json/
-type Config struct {
- Apps Apps `json:"apps"`
- Logging *LoggingConfig `json:"logging,omitempty"`
- Storage Storage `json:"storage,omitempty"`
-}
-
-// LoggingConfig configures Caddy's logging facility.
-type LoggingConfig struct {
- Logs map[string]*LogConfig `json:"logs,omitempty"`
- Sinks *SinkConfig `json:"sinks,omitempty"`
-}
-
-// LogConfig configures a specific logger.
-type LogConfig struct {
- Writer *WriterConfig `json:"writer,omitempty"`
- Encoder *EncoderConfig `json:"encoder,omitempty"`
- Level string `json:"level,omitempty"`
- Include []string `json:"include,omitempty"`
- Exclude []string `json:"exclude,omitempty"`
-}
-
-// WriterConfig configures the log writer (output).
-type WriterConfig struct {
- Output string `json:"output"`
- Filename string `json:"filename,omitempty"`
- Roll bool `json:"roll,omitempty"`
- RollSize int `json:"roll_size_mb,omitempty"`
- RollKeep int `json:"roll_keep,omitempty"`
- RollKeepDays int `json:"roll_keep_days,omitempty"`
-}
-
-// EncoderConfig configures the log format.
-type EncoderConfig struct {
- Format string `json:"format"` // "json", "console", etc.
-}
-
-// SinkConfig configures log sinks (e.g. stderr).
-type SinkConfig struct {
- Writer *WriterConfig `json:"writer,omitempty"`
-}
-
-// Storage configures the storage module.
-type Storage struct {
- System string `json:"module"`
- Root string `json:"root,omitempty"`
-}
-
-// Apps contains all Caddy app modules.
-type Apps struct {
- HTTP *HTTPApp `json:"http,omitempty"`
- TLS *TLSApp `json:"tls,omitempty"`
-}
-
-// HTTPApp configures the HTTP app.
-type HTTPApp struct {
- Servers map[string]*Server `json:"servers"`
-}
-
-// Server represents an HTTP server instance.
-type Server struct {
- Listen []string `json:"listen"`
- Routes []*Route `json:"routes"`
- AutoHTTPS *AutoHTTPSConfig `json:"automatic_https,omitempty"`
- Logs *ServerLogs `json:"logs,omitempty"`
-}
-
-// AutoHTTPSConfig controls automatic HTTPS behavior.
-type AutoHTTPSConfig struct {
- Disable bool `json:"disable,omitempty"`
- DisableRedir bool `json:"disable_redirects,omitempty"`
- Skip []string `json:"skip,omitempty"`
-}
-
-// ServerLogs configures access logging.
-type ServerLogs struct {
- DefaultLoggerName string `json:"default_logger_name,omitempty"`
-}
-
-// Route represents an HTTP route (matcher + handlers).
-type Route struct {
- Match []Match `json:"match,omitempty"`
- Handle []Handler `json:"handle"`
- Terminal bool `json:"terminal,omitempty"`
-}
-
-// Match represents a request matcher.
-type Match struct {
- Host []string `json:"host,omitempty"`
- Path []string `json:"path,omitempty"`
-}
-
-// Handler is the interface for all handler types.
-// Actual types will implement handler-specific fields.
-type Handler map[string]interface{}
-
-// ReverseProxyHandler creates a reverse_proxy handler.
-// application: "none", "plex", "jellyfin", "emby", "homeassistant", "nextcloud", "vaultwarden"
-func ReverseProxyHandler(dial string, enableWS bool, application string) Handler {
- h := Handler{
- "handler": "reverse_proxy",
- "flush_interval": -1, // Disable buffering for better streaming performance (Plex, etc.)
- "upstreams": []map[string]interface{}{
- {"dial": dial},
- },
- }
-
- // Build headers configuration
- headers := make(map[string]interface{})
- requestHeaders := make(map[string]interface{})
- setHeaders := make(map[string][]string)
-
- // WebSocket support
- if enableWS {
- setHeaders["Upgrade"] = []string{"{http.request.header.Upgrade}"}
- setHeaders["Connection"] = []string{"{http.request.header.Connection}"}
- }
-
- // Application-specific headers for proper client IP forwarding
- // These are critical for media servers behind tunnels/CGNAT
- switch application {
- case "plex":
- // Pass-through common Plex headers for improved compatibility when proxying
- setHeaders["X-Plex-Client-Identifier"] = []string{"{http.request.header.X-Plex-Client-Identifier}"}
- setHeaders["X-Plex-Device"] = []string{"{http.request.header.X-Plex-Device}"}
- setHeaders["X-Plex-Device-Name"] = []string{"{http.request.header.X-Plex-Device-Name}"}
- setHeaders["X-Plex-Platform"] = []string{"{http.request.header.X-Plex-Platform}"}
- setHeaders["X-Plex-Platform-Version"] = []string{"{http.request.header.X-Plex-Platform-Version}"}
- setHeaders["X-Plex-Product"] = []string{"{http.request.header.X-Plex-Product}"}
- setHeaders["X-Plex-Token"] = []string{"{http.request.header.X-Plex-Token}"}
- setHeaders["X-Plex-Version"] = []string{"{http.request.header.X-Plex-Version}"}
- // Also set X-Real-IP for accurate client IP reporting
- setHeaders["X-Real-IP"] = []string{"{http.request.remote.host}"}
- setHeaders["X-Forwarded-Host"] = []string{"{http.request.host}"}
- case "jellyfin", "emby", "homeassistant", "nextcloud", "vaultwarden":
- // X-Real-IP is required by most apps to identify the real client
- // Caddy already sets X-Forwarded-For and X-Forwarded-Proto by default
- setHeaders["X-Real-IP"] = []string{"{http.request.remote.host}"}
- // Some apps also check these headers
- setHeaders["X-Forwarded-Host"] = []string{"{http.request.host}"}
- }
-
- // Only add headers config if we have headers to set
- if len(setHeaders) > 0 {
- requestHeaders["set"] = setHeaders
- headers["request"] = requestHeaders
- h["headers"] = headers
- }
-
- return h
-}
-
-// HeaderHandler creates a handler that sets HTTP response headers.
-func HeaderHandler(headers map[string][]string) Handler {
- return Handler{
- "handler": "headers",
- "response": map[string]interface{}{
- "set": headers,
- },
- }
-}
-
-// BlockExploitsHandler creates a handler that blocks common exploits.
-// This uses Caddy's request matchers to block malicious patterns.
-func BlockExploitsHandler() Handler {
- return Handler{
- "handler": "vars",
- // Placeholder for future exploit blocking logic
- // Can be extended with specific matchers for SQL injection, XSS, etc.
- }
-}
-
-// RewriteHandler creates a rewrite handler.
-func RewriteHandler(uri string) Handler {
- return Handler{
- "handler": "rewrite",
- "uri": uri,
- }
-}
-
-// FileServerHandler creates a file_server handler.
-func FileServerHandler(root string) Handler {
- return Handler{
- "handler": "file_server",
- "root": root,
- }
-}
-
-// TLSApp configures the TLS app for certificate management.
-type TLSApp struct {
- Automation *AutomationConfig `json:"automation,omitempty"`
- Certificates *CertificatesConfig `json:"certificates,omitempty"`
-}
-
-// CertificatesConfig configures manual certificate loading.
-type CertificatesConfig struct {
- LoadPEM []LoadPEMConfig `json:"load_pem,omitempty"`
-}
-
-// LoadPEMConfig defines a PEM-loaded certificate.
-type LoadPEMConfig struct {
- Certificate string `json:"certificate"`
- Key string `json:"key"`
- Tags []string `json:"tags,omitempty"`
-}
-
-// AutomationConfig controls certificate automation.
-type AutomationConfig struct {
- Policies []*AutomationPolicy `json:"policies,omitempty"`
-}
-
-// AutomationPolicy defines certificate management for specific domains.
-type AutomationPolicy struct {
- Subjects []string `json:"subjects,omitempty"`
- IssuersRaw []interface{} `json:"issuers,omitempty"`
-}
-
-
-
package caddy
-
-import (
- "encoding/json"
- "fmt"
- "net"
- "strconv"
- "strings"
-)
-
-// Validate performs pre-flight validation on a Caddy config before applying it.
-func Validate(cfg *Config) error {
- if cfg == nil {
- return fmt.Errorf("config cannot be nil")
- }
-
- if cfg.Apps.HTTP == nil {
- return nil // Empty config is valid
- }
-
- // Track seen hosts to detect duplicates
- seenHosts := make(map[string]bool)
-
- for serverName, server := range cfg.Apps.HTTP.Servers {
- if len(server.Listen) == 0 {
- return fmt.Errorf("server %s has no listen addresses", serverName)
- }
-
- // Validate listen addresses
- for _, addr := range server.Listen {
- if err := validateListenAddr(addr); err != nil {
- return fmt.Errorf("invalid listen address %s in server %s: %w", addr, serverName, err)
- }
- }
-
- // Validate routes
- for i, route := range server.Routes {
- if err := validateRoute(route, seenHosts); err != nil {
- return fmt.Errorf("invalid route %d in server %s: %w", i, serverName, err)
- }
- }
- }
-
- // Validate JSON marshalling works
- if _, err := json.Marshal(cfg); err != nil {
- return fmt.Errorf("config cannot be marshalled to JSON: %w", err)
- }
-
- return nil
-}
-
-func validateListenAddr(addr string) error {
- // Strip network type prefix if present (tcp/, udp/)
- if idx := strings.Index(addr, "/"); idx != -1 {
- addr = addr[idx+1:]
- }
-
- // Parse host:port
- host, portStr, err := net.SplitHostPort(addr)
- if err != nil {
- return fmt.Errorf("invalid address format: %w", err)
- }
-
- // Validate port
- port, err := strconv.Atoi(portStr)
- if err != nil {
- return fmt.Errorf("invalid port: %w", err)
- }
- if port < 1 || port > 65535 {
- return fmt.Errorf("port %d out of range (1-65535)", port)
- }
-
- // Validate host (allow empty for wildcard binding)
- if host != "" && net.ParseIP(host) == nil {
- return fmt.Errorf("invalid IP address: %s", host)
- }
-
- return nil
-}
-
-func validateRoute(route *Route, seenHosts map[string]bool) error {
- if len(route.Handle) == 0 {
- return fmt.Errorf("route has no handlers")
- }
-
- // Check for duplicate host matchers
- for _, match := range route.Match {
- for _, host := range match.Host {
- if seenHosts[host] {
- return fmt.Errorf("duplicate host matcher: %s", host)
- }
- seenHosts[host] = true
- }
- }
-
- // Validate handlers
- for i, handler := range route.Handle {
- if err := validateHandler(handler); err != nil {
- return fmt.Errorf("invalid handler %d: %w", i, err)
- }
- }
-
- return nil
-}
-
-func validateHandler(handler Handler) error {
- handlerType, ok := handler["handler"].(string)
- if !ok {
- return fmt.Errorf("handler missing 'handler' field")
- }
-
- switch handlerType {
- case "reverse_proxy":
- return validateReverseProxy(handler)
- case "file_server", "static_response":
- return nil // Accept other common handlers
- default:
- // Unknown handlers are allowed (Caddy is extensible)
- return nil
- }
-}
-
-func validateReverseProxy(handler Handler) error {
- upstreams, ok := handler["upstreams"].([]map[string]interface{})
- if !ok {
- return fmt.Errorf("reverse_proxy missing upstreams")
- }
-
- if len(upstreams) == 0 {
- return fmt.Errorf("reverse_proxy has no upstreams")
- }
-
- for i, upstream := range upstreams {
- dial, ok := upstream["dial"].(string)
- if !ok || dial == "" {
- return fmt.Errorf("upstream %d missing dial address", i)
- }
-
- // Validate dial address format (host:port)
- if _, _, err := net.SplitHostPort(dial); err != nil {
- return fmt.Errorf("upstream %d has invalid dial address %s: %w", i, dial, err)
- }
- }
-
- return nil
-}
-
-
-