1package config
2
3import (
4 "time"
5
6 "golang.org/x/crypto/ssh"
7)
8
9type rawFile struct {
10 Server rawServer `toml:"server"`
11 Portdistrict *rawPortdistrict `toml:"portdistrict"`
12 Config rawConfigSource `toml:"config"`
13 Userbase *rawUserbase `toml:"userbase"`
14 Invite rawInvite `toml:"invite"`
15 Session rawSession `toml:"session"`
16 Audit rawAudit `toml:"audit"`
17 Google *rawGoogle `toml:"google"`
18 LDAP *rawLDAP `toml:"ldap"`
19 Client []rawClient `toml:"client"`
20 App []rawApp `toml:"app"`
21}
22
23type rawServer struct {
24 Socket string `toml:"socket"`
25 Listen string `toml:"listen"`
26 MetricsListen string `toml:"metrics_listen"`
27 DomainIDP string `toml:"domain_idp"`
28 DomainAccount string `toml:"domain_account"`
29 DomainAdmin string `toml:"domain_admin"`
30 AdminGroup string `toml:"admin_group"`
31 SiteName string `toml:"site_name"`
32}
33
34type rawPortdistrict struct {
35 Listen string `toml:"listen"`
36 PeerTable string `toml:"peer_table"`
37 TableMaxAge string `toml:"table_max_age"`
38}
39
40type rawConfigSource struct {
41 Source string `toml:"source"`
42 Git *rawConfigGit `toml:"git"`
43}
44
45type rawConfigGit struct {
46 Remote string `toml:"remote"`
47 Branch string `toml:"branch"`
48 AllowedSigners string `toml:"allowed_signers"`
49 KnownHosts string `toml:"known_hosts"`
50}
51
52type rawUserbase struct {
53 Repo string `toml:"repo"`
54 Mirror string `toml:"mirror"`
55 KnownHosts string `toml:"known_hosts"`
56 BreakGlassRecipient string `toml:"break_glass_recipient"`
57 ExportSigningKeys bool `toml:"export_signing_keys"`
58 RestoreOnFirstBoot bool `toml:"restore_on_first_boot"`
59}
60
61type rawInvite struct {
62 TTL string `toml:"ttl"`
63 DefaultGroups []string `toml:"default_groups"`
64}
65
66type rawSession struct {
67 TTL string `toml:"ttl"`
68}
69
70type rawGoogle struct {
71 ClientID string `toml:"client_id"`
72 AllowedHD string `toml:"allowed_hd"`
73}
74
75type rawLDAP struct {
76 Listen string `toml:"listen"`
77 PrimaryGroup string `toml:"primary_group"`
78 BaseDN string `toml:"base_dn"`
79 TLSCert string `toml:"tls_cert"`
80 TLSKey string `toml:"tls_key"`
81}
82
83type rawClient struct {
84 ID string `toml:"id"`
85 RedirectURIs []string `toml:"redirect_uris"`
86 Public bool `toml:"public"`
87}
88
89type rawApp struct {
90 Domain string `toml:"domain"`
91 SessionTTL string `toml:"session_ttl"`
92 Groups []string `toml:"groups"`
93}
94
95const (
96 defaultMetricsListen = "127.0.0.1:9464"
97 defaultAdminGroup = "admins"
98 defaultPrimaryGroup = "members"
99 defaultInviteTTL = 168 * time.Hour
100 defaultSessionTTL = 12 * time.Hour
101 sourceFile = "file"
102 sourceGit = "git"
103)
104
105var defaultInviteGroups = []string{"members"}
106
107type Config struct {
108 Server Server
109 Portdistrict *Portdistrict
110 Source string
111 ConfigGit *ConfigGit
112 Userbase *Userbase
113 Invite Invite
114 Session Session
115 Audit Audit
116 Google *Google
117 LDAP *LDAP
118 PrimaryGroup string
119 Clients []Client
120 Apps []App
121 Secrets Secrets
122}
123
124type Server struct {
125 Socket string
126 Listen string
127 MetricsListen string
128 DomainIDP string
129 DomainAccount string
130 DomainAdmin string
131 AdminGroup string
132 SiteName string
133}
134
135type Portdistrict struct {
136 Listen string
137 PeerTable string
138 TableMaxAge time.Duration
139}
140
141type ConfigGit struct {
142 Remote string
143 Branch string
144 AllowedSigners string
145 KnownHosts string
146 Signers []ssh.PublicKey
147 KnownHostsData []byte
148}
149
150type Userbase struct {
151 Repo string
152 Mirror string
153 KnownHosts string
154 BreakGlassRecipient string
155 ExportSigningKeys bool
156 RestoreOnFirstBoot bool
157}
158
159type Invite struct {
160 TTL time.Duration
161 DefaultGroups []string
162}
163
164type Session struct {
165 TTL time.Duration
166}
167
168type Google struct {
169 ClientID string
170 AllowedHD string
171}
172
173type LDAP struct {
174 Listen string
175 BaseDN string
176 TLSCert string
177 TLSKey string
178}
179
180type Client struct {
181 ID string
182 RedirectURIs []string
183 Public bool
184}
185
186type App struct {
187 Domain string
188 SessionTTL time.Duration
189 Groups []string
190}
191
192func (c *Config) ReferencedGroups() []string {
193 seen := map[string]bool{}
194 var out []string
195 add := func(g string) {
196 if g != "" && !seen[g] {
197 seen[g] = true
198 out = append(out, g)
199 }
200 }
201 add(c.Server.AdminGroup)
202 add(c.PrimaryGroup)
203 for _, g := range c.Invite.DefaultGroups {
204 add(g)
205 }
206 for _, a := range c.Apps {
207 for _, g := range a.Groups {
208 add(g)
209 }
210 }
211 return out
212}
213
214type Secret struct {
215 p *string
216}
217
218type Secrets struct {
219 SessionMasterKey Secret
220 GoogleClientSecret Secret
221 ClientSecrets map[string]Secret
222 AgeIdentity Secret
223 UserbaseSigningKey Secret
224 UserbaseDeployKey Secret
225 ConfigDeployKey Secret
226}
227
228func (u *Userbase) SSH() bool {
229 return usesSSH(u.Repo, u.Mirror)
230}