mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00

Files

T

Joachim Wiberg 917eec3f25 webui: anonymous login, user menu, theme toggle, in-memory sessions

Anonymise the login page: generic "Login" title, lock icon instead
of product logo — makes the device harder to fingerprint.

Add a floating theme toggle button to the login page so users can
switch theme before logging in (cycles auto→light→dark).

Replace the four cluttered sidebar footer buttons (theme, download
config, reboot, logout) with an always-visible topbar user menu.
The dropdown shows the username, three theme options with a checkmark
on the active one, download config, reboot, and logout.

Refactor all handler page-data structs to embed PageData instead of
repeating the four base fields, and add Username (sourced from the
request context) so the topbar can display the logged-in user.

Polish pass on the login card: spacing, focus styles, button weights.

Replace the AES-encrypted-cookie session model with an opaque random
token backed by an in-memory map. The vendored design embedded the
user's username, password, CSRF, and feature flags into the cookie
and persisted the AES key under /var/lib/misc, making the keyfile a
passive credential-recovery oracle — anyone who could read it could
decrypt any captured cookie and recover the plaintext admin password.

Now: cookie is 32 bytes of crypto/rand, base64-url-encoded; sessions
live only in process memory; reboot/respawn/upgrade drops every
active session and the UI's 401 handler bounces the user to /login.
Sliding-window refresh on user activity, janitor goroutine sweeps
expired entries. --session-key flag and /var/lib/misc/webui-session.key
are gone.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

2026-06-14 22:07:24 +02:00

3.8 KiB

Raw Blame History

Infix WebUI

A lightweight web management interface for Infix network devices, built with Go and htmx.

The WebUI communicates with the device over RESTCONF (RFC 8040), presenting the same operational data available through the Infix CLI in a browser-friendly format.

Features

Dashboard -- system info, hardware, sensors, and interface summary with bridge member grouping
Interfaces -- list with status, addresses, and per-type detail; click through to a detail page with live-updating counters, WiFi station table, scan results, WireGuard peers, and ethernet frame statistics
Firewall -- zone-to-zone policy matrix
Keystore -- symmetric and asymmetric key display
Firmware -- slot overview, install from URL with live progress
Reboot -- two-phase status polling (wait down, wait up)
Config download -- startup datastore as JSON

Building

Requires Go 1.22 or later.

make build

Produces a statically linked webui binary with all templates, CSS, and JS embedded.

Cross-compile for the target:

GOOS=linux GOARCH=arm64 make build

Running

./webui --restconf https://192.168.0.1/restconf --listen :10000

Flag	Default	Description
`--listen`	`:10000`	Address to listen on
`--restconf`	`http://localhost:8080/restconf`	RESTCONF base URL of the device
`--insecure-tls`	`false`	Disable TLS certificate verification

The RESTCONF URL can also be set via the RESTCONF_URL environment variable.

Development

Point RESTCONF_URL at a running Infix device and start the dev server:

make dev ARGS="--restconf https://192.168.0.1/restconf"

This runs go run . on port 10000 with --insecure-tls already set.

Architecture

Browser ──htmx──▶ Go server ──RESTCONF──▶ Infix device (rousette/sysrepo)

Single binary -- templates, CSS, JS, and images are embedded via go:embed
Server-side rendering -- Go html/template with per-page parsing to avoid {{define "content"}} collisions
htmx SPA navigation -- sidebar links use hx-get / hx-target for partial page updates with hx-push-url for browser history
Stateless sessions -- AES-256-GCM encrypted cookies carry credentials (needed for every RESTCONF call); no server-side session store
Live polling -- counters update every 5s, firmware progress every 3s, all via htmx triggers

main.go                          Entry point, flags, embedded FS
internal/
  auth/                          Login, logout, session (AES-GCM cookies)
  restconf/                      HTTP client (Get, GetRaw, Post, PostJSON)
  handlers/                      Page handlers
    dashboard.go                   Dashboard, hardware, sensors
    interfaces.go                  Interface list, detail, counters
    firewall.go                    Zone matrix
    keystore.go                    Key display
    system.go                      Firmware, reboot, config download
  server/
    server.go                    Route registration, template wiring, middleware
templates/
  layouts/                       base.html (shell), sidebar.html
  pages/                         Per-page templates (one per route)
  fragments/                     htmx partial fragments
static/
  css/style.css                  All styles
  js/htmx.min.js                htmx library
  img/                           Logo, favicon

License

See LICENSE.

3.8 KiB Raw Blame History