mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-02 05:43:02 +02:00
confd: make web server and web console interface configurable
This commit adds an initial YANG model for Infix web services under the infix-services.yang umbrella. For now the nginx server statements in /etc/nginx/nginx.conf are always on, but the backend ttyd, and the entire nginx server can be disabled. The default in the YANG model for both is disabled, the factory-config has been updated to enable these services by default. The Web Console Interface mDNS service has been updated to advertise on port 7681, which nginx is set to forward to ttyd. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
+26
-12
@@ -25,8 +25,10 @@ http {
|
||||
}
|
||||
|
||||
server {
|
||||
include ssl.conf;
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name _;
|
||||
include ssl.conf;
|
||||
|
||||
#error_page 404 /404.html;
|
||||
|
||||
@@ -41,25 +43,37 @@ http {
|
||||
root html;
|
||||
index index.html index.htm;
|
||||
}
|
||||
|
||||
location ~ ^/console(.*)$ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_pass http://127.0.0.1:7681/$1;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 7681 ssl;
|
||||
listen [::]:7681 ssl;
|
||||
server_name _;
|
||||
|
||||
include ssl.conf;
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_pass http://127.0.0.1:7681;
|
||||
proxy_redirect off;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
server_name network.local;
|
||||
include ssl.conf;
|
||||
|
||||
location / {
|
||||
include netbrowse.conf;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
|
||||
|
||||
@@ -90,5 +90,4 @@ if [ -n "$BR2_PACKAGE_NGINX" ]; then
|
||||
cp "$common/netbrowse.conf" "$TARGET_DIR/etc/nginx/"
|
||||
cp "$common/nginx.conf" "$TARGET_DIR/etc/nginx/"
|
||||
cp "$common/ssl.conf" "$TARGET_DIR/etc/nginx/"
|
||||
ln -sf ../available/nginx.conf "$TARGET_DIR/etc/finit.d/enabled/nginx.conf"
|
||||
fi
|
||||
|
||||
@@ -1 +1 @@
|
||||
service [2345] <!> ttyd login -- Web terminal daemon (ttyd)
|
||||
service [2345] <!> ttyd -i lo -p 7681 login -- Web terminal daemon (ttyd)
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
../available/ttyd.conf
|
||||
@@ -1,6 +1,3 @@
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
|
||||
ssl_certificate /etc/ssl/certs/self-signed.crt;
|
||||
ssl_certificate_key /etc/ssl/private/self-signed.key;
|
||||
|
||||
|
||||
@@ -15,7 +15,6 @@ NETBROWSE_REDISTRIBUTE = NO
|
||||
define NETBROWSE_INSTALL_EXTRA
|
||||
$(INSTALL) -D -m 0644 $(NETBROWSE_PKGDIR)/netbrowse.svc \
|
||||
$(FINIT_D)/available/netbrowse.conf
|
||||
ln -sf ../available/netbrowse.conf $(FINIT_D)/enabled/netbrowse.conf
|
||||
$(INSTALL) -d -m 755 $(TARGET_DIR)/etc/default
|
||||
echo "NETBROWSE_ARGS=\"network.local $(BR2_TARGET_GENERIC_HOSTNAME).local\"" \
|
||||
> $(TARGET_DIR)/etc/default/netbrowse
|
||||
|
||||
@@ -226,7 +226,7 @@ sysrepoctl -s $SEARCH \
|
||||
-i infix-dhcp-client@2024-01-30.yang -g wheel -p 0660 \
|
||||
-i infix-shell-type@2023-08-21.yang -g wheel -p 0660 \
|
||||
-i infix-system@2024-02-29.yang -g wheel -p 0660 \
|
||||
-i infix-services@2023-10-16.yang -g wheel -p 0660 \
|
||||
-i infix-services@2024-04-08.yang -g wheel -p 0660 \
|
||||
-i ieee802-ethernet-interface@2019-06-21.yang -g wheel -p 0660 \
|
||||
-i infix-ethernet-interface@2024-02-27.yang -g wheel -p 0660 \
|
||||
-I "${INIT_DATA}"
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"ieee802-dot1ab-lldp:lldp": {
|
||||
"infix-lldp:enabled": true
|
||||
},
|
||||
"infix-services:mdns": {
|
||||
"enabled": true
|
||||
},
|
||||
"infix-services:web": {
|
||||
"enabled": true,
|
||||
"console": {
|
||||
"enabled": true
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,11 +1,5 @@
|
||||
{
|
||||
"ietf-system:system": {
|
||||
"hostname": "infix"
|
||||
},
|
||||
"ieee802-dot1ab-lldp:lldp": {
|
||||
"infix-lldp:enabled": true
|
||||
},
|
||||
"infix-services:mdns": {
|
||||
"enabled": true
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
factorydir = $(pkgdatadir)/factory.d
|
||||
dist_factory_DATA = 10-nacm.json \
|
||||
10-netconf-server.json 10-system.json
|
||||
dist_factory_DATA = 10-nacm.json 10-netconf-server.json \
|
||||
10-infix-system.json 10-system.json
|
||||
|
||||
@@ -1158,7 +1158,7 @@ static void mdns_records(const char *hostname)
|
||||
{
|
||||
struct mdns_svc svc[] = {
|
||||
{ "https", "_https._tcp", 443, "Web Management Interface", "adminurl=https://%s.local" },
|
||||
{ "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local/console" },
|
||||
{ "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local:7681" },
|
||||
{ "http", "_http._tcp", 80, "Web Management Interface", "adminurl=http://%s.local" },
|
||||
{ "netconf", "_netconf-ssh._tcp", 830, "NETCONF (XML/SSH)", NULL },
|
||||
{ "sftp-ssh","_sftp-ssh._tcp", 22, "Secure file transfer (FTP/SSH)", NULL },
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
#include <assert.h>
|
||||
#include <ctype.h>
|
||||
#include <pwd.h>
|
||||
#include <stdarg.h>
|
||||
#include <sys/utsname.h>
|
||||
#include <sys/sysinfo.h>
|
||||
#include <sys/types.h>
|
||||
@@ -16,19 +17,21 @@
|
||||
|
||||
|
||||
static const struct srx_module_requirement reqs[] = {
|
||||
{ .dir = YANG_PATH_, .name = "infix-services", .rev = "2023-10-16" },
|
||||
{ .dir = YANG_PATH_, .name = "infix-services", .rev = "2024-04-08" },
|
||||
{ .dir = YANG_PATH_, .name = "ieee802-dot1ab-lldp", .rev = "2022-03-15" },
|
||||
{ .dir = YANG_PATH_, .name = "infix-lldp", .rev = "2023-08-23" },
|
||||
{ NULL }
|
||||
};
|
||||
|
||||
static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *xpath,
|
||||
const char *name, const char *svc)
|
||||
const char *name, const char *sub, ...)
|
||||
{
|
||||
char path[strlen(xpath) + 10];
|
||||
struct lyd_node *diff, *srv;
|
||||
sr_error_t err = 0;
|
||||
const char *svc;
|
||||
sr_data_t *cfg;
|
||||
va_list ap;
|
||||
int ena;
|
||||
|
||||
switch (event) {
|
||||
@@ -51,15 +54,19 @@ static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *x
|
||||
if (err)
|
||||
goto err_release_data;
|
||||
|
||||
srv = lydx_get_descendant(cfg->tree, name, NULL);
|
||||
srv = lydx_get_descendant(cfg->tree, name, sub, NULL);
|
||||
if (!srv) {
|
||||
ERROR("Cannot find %s subtree", name);
|
||||
return -1;
|
||||
}
|
||||
|
||||
ena = lydx_is_enabled(srv, "enabled");
|
||||
if (systemf("initctl -nbq %s %s", ena ? "enable" : "disable", svc))
|
||||
ERROR("Failed %s %s", ena ? "enabling" : "disabling", name);
|
||||
va_start(ap, sub);
|
||||
while ((svc = va_arg(ap, const char *))) {
|
||||
if (systemf("initctl -nbq %s %s", ena ? "enable" : "disable", svc))
|
||||
ERROR("Failed %s %s", ena ? "enabling" : "disabling", name);
|
||||
}
|
||||
va_end(ap);
|
||||
|
||||
lyd_free_tree(diff);
|
||||
err_release_data:
|
||||
@@ -72,13 +79,25 @@ err_abandon:
|
||||
static int mdns_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
|
||||
const char *xpath, sr_event_t event, unsigned request_id, void *_confd)
|
||||
{
|
||||
return svc_change(session, event, xpath, "mdns", "avahi");
|
||||
return svc_change(session, event, xpath, "mdns", NULL, "avahi", NULL);
|
||||
}
|
||||
|
||||
static int ttyd_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
|
||||
const char *xpath, sr_event_t event, unsigned request_id, void *_confd)
|
||||
{
|
||||
return svc_change(session, event, xpath, "web", "console", "ttyd", NULL);
|
||||
}
|
||||
|
||||
static int lldp_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
|
||||
const char *xpath, sr_event_t event, unsigned request_id, void *_confd)
|
||||
{
|
||||
return svc_change(session, event, xpath, "lldp", "lldpd");
|
||||
return svc_change(session, event, xpath, "lldp", NULL, "lldpd", NULL);
|
||||
}
|
||||
|
||||
static int web_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module,
|
||||
const char *xpath, sr_event_t event, unsigned request_id, void *_confd)
|
||||
{
|
||||
return svc_change(session, event, xpath, "web", NULL, "nginx", "ttyd", "netbrowse", NULL);
|
||||
}
|
||||
|
||||
int infix_services_init(struct confd *confd)
|
||||
@@ -91,6 +110,10 @@ int infix_services_init(struct confd *confd)
|
||||
|
||||
REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:mdns",
|
||||
0, mdns_change, confd, &confd->sub);
|
||||
REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web",
|
||||
0, web_change, confd, &confd->sub);
|
||||
REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web/infix-services:console",
|
||||
0, ttyd_change, confd, &confd->sub);
|
||||
REGISTER_CHANGE(confd->session, "ieee802-dot1ab-lldp", "/ieee802-dot1ab-lldp:lldp",
|
||||
0, lldp_change, confd, &confd->sub);
|
||||
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
module infix-services {
|
||||
yang-version 1.1;
|
||||
namespace "urn:ietf:params:xml:ns:yang:infix-services";
|
||||
prefix infix-svc;
|
||||
|
||||
organization "KernelKit";
|
||||
contact "kernelkit@googlegroups.com";
|
||||
description "Infix services, generic.";
|
||||
|
||||
revision 2023-10-16 {
|
||||
description "Drop SSDP support, mDNS-SD is now available in Windows 10.";
|
||||
reference "internal";
|
||||
}
|
||||
|
||||
revision 2023-08-22 {
|
||||
description "Initial revision, add SSDP and mDNS-SD enable/disable only.";
|
||||
reference "internal";
|
||||
}
|
||||
|
||||
/*
|
||||
* Data nodes
|
||||
*/
|
||||
|
||||
container mdns {
|
||||
description "Advertise system and services over mDNS-SD, IPv4 and IPv6.";
|
||||
|
||||
leaf enabled {
|
||||
type boolean;
|
||||
description "Globally enable or disable mDNS/SD on all interfaces.";
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
module infix-services {
|
||||
yang-version 1.1;
|
||||
namespace "urn:ietf:params:xml:ns:yang:infix-services";
|
||||
prefix infix-svc;
|
||||
|
||||
organization "KernelKit";
|
||||
contact "kernelkit@googlegroups.com";
|
||||
description "Infix services, generic.";
|
||||
|
||||
revision 2024-04-08 {
|
||||
description "Initial support for web services.";
|
||||
reference "internal";
|
||||
}
|
||||
revision 2023-10-16 {
|
||||
description "Drop SSDP support, mDNS-SD is now available in Windows 10.";
|
||||
reference "internal";
|
||||
}
|
||||
revision 2023-08-22 {
|
||||
description "Initial revision, add SSDP and mDNS-SD enable/disable only.";
|
||||
reference "internal";
|
||||
}
|
||||
|
||||
/*
|
||||
* Data nodes
|
||||
*/
|
||||
|
||||
container mdns {
|
||||
description "Advertise system and services over mDNS-SD, IPv4 and IPv6.";
|
||||
|
||||
leaf enabled {
|
||||
description "Globally enable or disable mDNS/SD on all interfaces.";
|
||||
type boolean;
|
||||
}
|
||||
}
|
||||
|
||||
container web {
|
||||
description "Web services";
|
||||
|
||||
leaf enabled {
|
||||
description "Enable or disable on all web services.
|
||||
|
||||
Enabling this setting activates a web proxy server reponsible
|
||||
for routing requests to other web applications, as well as it
|
||||
redirecting all insecure HTTP requests to HTTPS.
|
||||
|
||||
Disabling this setting disables the web proxy server and all
|
||||
other services/applications that run behind it.";
|
||||
type boolean;
|
||||
}
|
||||
|
||||
container console {
|
||||
description "Web console interface.";
|
||||
|
||||
leaf enabled {
|
||||
description "Enable or disable web console interface on port 7681.";
|
||||
type boolean;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user