diff --git a/board/common/nginx.conf b/board/common/nginx.conf index c2759be5..5227e600 100644 --- a/board/common/nginx.conf +++ b/board/common/nginx.conf @@ -25,8 +25,10 @@ http { } server { - include ssl.conf; + listen 443 ssl; + listen [::]:443 ssl; server_name _; + include ssl.conf; #error_page 404 /404.html; @@ -41,25 +43,37 @@ http { root html; index index.html index.htm; } - - location ~ ^/console(.*)$ { - proxy_http_version 1.1; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_pass http://127.0.0.1:7681/$1; - } } server { + listen 7681 ssl; + listen [::]:7681 ssl; + server_name _; + include ssl.conf; + + location / { + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_pass http://127.0.0.1:7681; + proxy_redirect off; + } + } + + server { + listen 443 ssl; + listen [::]:443 ssl; server_name network.local; + include ssl.conf; location / { include netbrowse.conf; - } + } } access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info; diff --git a/board/common/post-build.sh b/board/common/post-build.sh index b28c377a..70941714 100755 --- a/board/common/post-build.sh +++ b/board/common/post-build.sh @@ -90,5 +90,4 @@ if [ -n "$BR2_PACKAGE_NGINX" ]; then cp "$common/netbrowse.conf" "$TARGET_DIR/etc/nginx/" cp "$common/nginx.conf" "$TARGET_DIR/etc/nginx/" cp "$common/ssl.conf" "$TARGET_DIR/etc/nginx/" - ln -sf ../available/nginx.conf "$TARGET_DIR/etc/finit.d/enabled/nginx.conf" fi diff --git a/board/common/rootfs/etc/finit.d/available/ttyd.conf b/board/common/rootfs/etc/finit.d/available/ttyd.conf index da12f0ed..72d7fffe 100644 --- a/board/common/rootfs/etc/finit.d/available/ttyd.conf +++ b/board/common/rootfs/etc/finit.d/available/ttyd.conf @@ -1 +1 @@ -service [2345] ttyd login -- Web terminal daemon (ttyd) +service [2345] ttyd -i lo -p 7681 login -- Web terminal daemon (ttyd) diff --git a/board/common/rootfs/etc/finit.d/enabled/ttyd.conf b/board/common/rootfs/etc/finit.d/enabled/ttyd.conf deleted file mode 120000 index 9d29291b..00000000 --- a/board/common/rootfs/etc/finit.d/enabled/ttyd.conf +++ /dev/null @@ -1 +0,0 @@ -../available/ttyd.conf \ No newline at end of file diff --git a/board/common/ssl.conf b/board/common/ssl.conf index b518e087..a9b06df9 100644 --- a/board/common/ssl.conf +++ b/board/common/ssl.conf @@ -1,6 +1,3 @@ -listen 443 ssl; -listen [::]:443 ssl; - ssl_certificate /etc/ssl/certs/self-signed.crt; ssl_certificate_key /etc/ssl/private/self-signed.key; diff --git a/package/netbrowse/netbrowse.mk b/package/netbrowse/netbrowse.mk index c2900c27..a5dd30db 100644 --- a/package/netbrowse/netbrowse.mk +++ b/package/netbrowse/netbrowse.mk @@ -15,7 +15,6 @@ NETBROWSE_REDISTRIBUTE = NO define NETBROWSE_INSTALL_EXTRA $(INSTALL) -D -m 0644 $(NETBROWSE_PKGDIR)/netbrowse.svc \ $(FINIT_D)/available/netbrowse.conf - ln -sf ../available/netbrowse.conf $(FINIT_D)/enabled/netbrowse.conf $(INSTALL) -d -m 755 $(TARGET_DIR)/etc/default echo "NETBROWSE_ARGS=\"network.local $(BR2_TARGET_GENERIC_HOSTNAME).local\"" \ > $(TARGET_DIR)/etc/default/netbrowse diff --git a/src/confd/bin/bootstrap b/src/confd/bin/bootstrap index ef51c056..d96dd2a9 100755 --- a/src/confd/bin/bootstrap +++ b/src/confd/bin/bootstrap @@ -226,7 +226,7 @@ sysrepoctl -s $SEARCH \ -i infix-dhcp-client@2024-01-30.yang -g wheel -p 0660 \ -i infix-shell-type@2023-08-21.yang -g wheel -p 0660 \ -i infix-system@2024-02-29.yang -g wheel -p 0660 \ - -i infix-services@2023-10-16.yang -g wheel -p 0660 \ + -i infix-services@2024-04-08.yang -g wheel -p 0660 \ -i ieee802-ethernet-interface@2019-06-21.yang -g wheel -p 0660 \ -i infix-ethernet-interface@2024-02-27.yang -g wheel -p 0660 \ -I "${INIT_DATA}" diff --git a/src/confd/share/factory.d/10-infix-system.json b/src/confd/share/factory.d/10-infix-system.json new file mode 100644 index 00000000..96fc917f --- /dev/null +++ b/src/confd/share/factory.d/10-infix-system.json @@ -0,0 +1,14 @@ +{ + "ieee802-dot1ab-lldp:lldp": { + "infix-lldp:enabled": true + }, + "infix-services:mdns": { + "enabled": true + }, + "infix-services:web": { + "enabled": true, + "console": { + "enabled": true + } + } +} diff --git a/src/confd/share/factory.d/10-system.json b/src/confd/share/factory.d/10-system.json index 0291145c..71796301 100644 --- a/src/confd/share/factory.d/10-system.json +++ b/src/confd/share/factory.d/10-system.json @@ -1,11 +1,5 @@ { "ietf-system:system": { "hostname": "infix" - }, - "ieee802-dot1ab-lldp:lldp": { - "infix-lldp:enabled": true - }, - "infix-services:mdns": { - "enabled": true } } diff --git a/src/confd/share/factory.d/Makefile.am b/src/confd/share/factory.d/Makefile.am index 84bcf82c..8c42d8f1 100644 --- a/src/confd/share/factory.d/Makefile.am +++ b/src/confd/share/factory.d/Makefile.am @@ -1,3 +1,3 @@ factorydir = $(pkgdatadir)/factory.d -dist_factory_DATA = 10-nacm.json \ - 10-netconf-server.json 10-system.json +dist_factory_DATA = 10-nacm.json 10-netconf-server.json \ + 10-infix-system.json 10-system.json diff --git a/src/confd/src/ietf-system.c b/src/confd/src/ietf-system.c index 5dea1a35..f99f81c3 100644 --- a/src/confd/src/ietf-system.c +++ b/src/confd/src/ietf-system.c @@ -1158,7 +1158,7 @@ static void mdns_records(const char *hostname) { struct mdns_svc svc[] = { { "https", "_https._tcp", 443, "Web Management Interface", "adminurl=https://%s.local" }, - { "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local/console" }, + { "ttyd", "_https._tcp", 443, "Web Console Interface", "adminurl=https://%s.local:7681" }, { "http", "_http._tcp", 80, "Web Management Interface", "adminurl=http://%s.local" }, { "netconf", "_netconf-ssh._tcp", 830, "NETCONF (XML/SSH)", NULL }, { "sftp-ssh","_sftp-ssh._tcp", 22, "Secure file transfer (FTP/SSH)", NULL }, diff --git a/src/confd/src/infix-services.c b/src/confd/src/infix-services.c index ea2cc8d4..189193fa 100644 --- a/src/confd/src/infix-services.c +++ b/src/confd/src/infix-services.c @@ -3,6 +3,7 @@ #include #include #include +#include #include #include #include @@ -16,19 +17,21 @@ static const struct srx_module_requirement reqs[] = { - { .dir = YANG_PATH_, .name = "infix-services", .rev = "2023-10-16" }, + { .dir = YANG_PATH_, .name = "infix-services", .rev = "2024-04-08" }, { .dir = YANG_PATH_, .name = "ieee802-dot1ab-lldp", .rev = "2022-03-15" }, { .dir = YANG_PATH_, .name = "infix-lldp", .rev = "2023-08-23" }, { NULL } }; static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *xpath, - const char *name, const char *svc) + const char *name, const char *sub, ...) { char path[strlen(xpath) + 10]; struct lyd_node *diff, *srv; sr_error_t err = 0; + const char *svc; sr_data_t *cfg; + va_list ap; int ena; switch (event) { @@ -51,15 +54,19 @@ static int svc_change(sr_session_ctx_t *session, sr_event_t event, const char *x if (err) goto err_release_data; - srv = lydx_get_descendant(cfg->tree, name, NULL); + srv = lydx_get_descendant(cfg->tree, name, sub, NULL); if (!srv) { ERROR("Cannot find %s subtree", name); return -1; } ena = lydx_is_enabled(srv, "enabled"); - if (systemf("initctl -nbq %s %s", ena ? "enable" : "disable", svc)) - ERROR("Failed %s %s", ena ? "enabling" : "disabling", name); + va_start(ap, sub); + while ((svc = va_arg(ap, const char *))) { + if (systemf("initctl -nbq %s %s", ena ? "enable" : "disable", svc)) + ERROR("Failed %s %s", ena ? "enabling" : "disabling", name); + } + va_end(ap); lyd_free_tree(diff); err_release_data: @@ -72,13 +79,25 @@ err_abandon: static int mdns_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, const char *xpath, sr_event_t event, unsigned request_id, void *_confd) { - return svc_change(session, event, xpath, "mdns", "avahi"); + return svc_change(session, event, xpath, "mdns", NULL, "avahi", NULL); +} + +static int ttyd_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, + const char *xpath, sr_event_t event, unsigned request_id, void *_confd) +{ + return svc_change(session, event, xpath, "web", "console", "ttyd", NULL); } static int lldp_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, const char *xpath, sr_event_t event, unsigned request_id, void *_confd) { - return svc_change(session, event, xpath, "lldp", "lldpd"); + return svc_change(session, event, xpath, "lldp", NULL, "lldpd", NULL); +} + +static int web_change(sr_session_ctx_t *session, uint32_t sub_id, const char *module, + const char *xpath, sr_event_t event, unsigned request_id, void *_confd) +{ + return svc_change(session, event, xpath, "web", NULL, "nginx", "ttyd", "netbrowse", NULL); } int infix_services_init(struct confd *confd) @@ -91,6 +110,10 @@ int infix_services_init(struct confd *confd) REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:mdns", 0, mdns_change, confd, &confd->sub); + REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web", + 0, web_change, confd, &confd->sub); + REGISTER_CHANGE(confd->session, "infix-services", "/infix-services:web/infix-services:console", + 0, ttyd_change, confd, &confd->sub); REGISTER_CHANGE(confd->session, "ieee802-dot1ab-lldp", "/ieee802-dot1ab-lldp:lldp", 0, lldp_change, confd, &confd->sub); diff --git a/src/confd/yang/infix-services@2023-10-16.yang b/src/confd/yang/infix-services@2023-10-16.yang deleted file mode 100644 index 7f681f38..00000000 --- a/src/confd/yang/infix-services@2023-10-16.yang +++ /dev/null @@ -1,32 +0,0 @@ -module infix-services { - yang-version 1.1; - namespace "urn:ietf:params:xml:ns:yang:infix-services"; - prefix infix-svc; - - organization "KernelKit"; - contact "kernelkit@googlegroups.com"; - description "Infix services, generic."; - - revision 2023-10-16 { - description "Drop SSDP support, mDNS-SD is now available in Windows 10."; - reference "internal"; - } - - revision 2023-08-22 { - description "Initial revision, add SSDP and mDNS-SD enable/disable only."; - reference "internal"; - } - - /* - * Data nodes - */ - - container mdns { - description "Advertise system and services over mDNS-SD, IPv4 and IPv6."; - - leaf enabled { - type boolean; - description "Globally enable or disable mDNS/SD on all interfaces."; - } - } -} diff --git a/src/confd/yang/infix-services@2024-04-08.yang b/src/confd/yang/infix-services@2024-04-08.yang new file mode 100644 index 00000000..c8640a02 --- /dev/null +++ b/src/confd/yang/infix-services@2024-04-08.yang @@ -0,0 +1,60 @@ +module infix-services { + yang-version 1.1; + namespace "urn:ietf:params:xml:ns:yang:infix-services"; + prefix infix-svc; + + organization "KernelKit"; + contact "kernelkit@googlegroups.com"; + description "Infix services, generic."; + + revision 2024-04-08 { + description "Initial support for web services."; + reference "internal"; + } + revision 2023-10-16 { + description "Drop SSDP support, mDNS-SD is now available in Windows 10."; + reference "internal"; + } + revision 2023-08-22 { + description "Initial revision, add SSDP and mDNS-SD enable/disable only."; + reference "internal"; + } + + /* + * Data nodes + */ + + container mdns { + description "Advertise system and services over mDNS-SD, IPv4 and IPv6."; + + leaf enabled { + description "Globally enable or disable mDNS/SD on all interfaces."; + type boolean; + } + } + + container web { + description "Web services"; + + leaf enabled { + description "Enable or disable on all web services. + + Enabling this setting activates a web proxy server reponsible + for routing requests to other web applications, as well as it + redirecting all insecure HTTP requests to HTTPS. + + Disabling this setting disables the web proxy server and all + other services/applications that run behind it."; + type boolean; + } + + container console { + description "Web console interface."; + + leaf enabled { + description "Enable or disable web console interface on port 7681."; + type boolean; + } + } + } +}