GitHub Actions
b761d7d4f7
On a fresh install the security_configs table is auto-migrated but contains no rows. Any code path reading SecurityConfig by name received an empty Go struct with zero values, producing an all-disabled UI state that offered no guidance to the user and made the security status endpoint appear broken. Adds a SeedDefaultSecurityConfig function that uses FirstOrCreate to guarantee a default row exists with safe, disabled-by-default values on every startup. The call is idempotent — existing rows are never modified, so upgrades are unaffected. If the seed fails the application logs a warning and continues rather than crashing. Zero-valued rate-limit fields are intentional and safe: the Cerberus rate-limit middleware applies hardcoded fallback thresholds when the stored values are zero, so enabling rate limiting without configuring thresholds results in sensible defaults rather than a divide-by-zero or traffic block. Adds three unit tests covering the empty-database, idempotent, and do-not-overwrite-existing paths.
42 lines
1.6 KiB
Go
42 lines
1.6 KiB
Go
package models
|
|
|
|
import (
|
|
"github.com/google/uuid"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// SeedDefaultSecurityConfig ensures a default SecurityConfig row exists in the database.
|
|
// It uses FirstOrCreate so it is safe to call on every startup — existing data is never
|
|
// overwritten. Returns the upserted record and any error encountered.
|
|
func SeedDefaultSecurityConfig(db *gorm.DB) (*SecurityConfig, error) {
|
|
record := SecurityConfig{
|
|
UUID: uuid.NewString(),
|
|
Name: "default",
|
|
Enabled: false,
|
|
CrowdSecMode: "disabled",
|
|
CrowdSecAPIURL: "http://127.0.0.1:8085",
|
|
WAFMode: "disabled",
|
|
WAFParanoiaLevel: 1,
|
|
RateLimitMode: "disabled",
|
|
RateLimitEnable: false,
|
|
// Zero values are intentional for the disabled default state.
|
|
// cerberus.RateLimitMiddleware guards against zero/negative values by falling
|
|
// back to safe operational defaults (requests=100, window=60s, burst=20) before
|
|
// computing the token-bucket rate. buildRateLimitHandler (caddy/config.go) also
|
|
// returns nil — skipping rate-limit injection — when either value is ≤ 0.
|
|
// A user enabling rate limiting via the UI without configuring thresholds will
|
|
// therefore receive the safe hardcoded defaults, not a zero-rate limit.
|
|
RateLimitBurst: 0,
|
|
RateLimitRequests: 0,
|
|
RateLimitWindowSec: 0,
|
|
}
|
|
|
|
// FirstOrCreate matches on Name only; if a row with name="default" already exists
|
|
// it is loaded into record without modifying any of its fields.
|
|
result := db.Where(SecurityConfig{Name: "default"}).FirstOrCreate(&record)
|
|
if result.Error != nil {
|
|
return nil, result.Error
|
|
}
|
|
return &record, nil
|
|
}
|