mirror of
https://github.com/fosrl/pangolin.git
synced 2025-08-24 11:15:31 +02:00
664 lines
26 KiB
TypeScript
664 lines
26 KiB
TypeScript
import { Request, Response } from "express";
|
|
import { db, exitNodes } from "@server/db";
|
|
import { and, eq, inArray, or, isNull, ne } from "drizzle-orm";
|
|
import logger from "@server/logger";
|
|
import HttpCode from "@server/types/HttpCode";
|
|
import config from "@server/lib/config";
|
|
import { orgs, resources, sites, Target, targets } from "@server/db";
|
|
import { build } from "@server/build";
|
|
|
|
// Extended Target interface that includes site information
|
|
interface TargetWithSite extends Target {
|
|
site: {
|
|
siteId: number;
|
|
type: string;
|
|
subnet: string | null;
|
|
exitNodeId: number | null;
|
|
};
|
|
}
|
|
|
|
let currentExitNodeId: number;
|
|
const redirectHttpsMiddlewareName = "redirect-to-https";
|
|
const badgerMiddlewareName = "badger";
|
|
|
|
export async function traefikConfigProvider(
|
|
_: Request,
|
|
res: Response
|
|
): Promise<any> {
|
|
try {
|
|
// First query to get resources with site and org info
|
|
// Get the current exit node name from config
|
|
if (!currentExitNodeId) {
|
|
if (config.getRawConfig().gerbil.exit_node_name) {
|
|
const exitNodeName =
|
|
config.getRawConfig().gerbil.exit_node_name!;
|
|
const [exitNode] = await db
|
|
.select({
|
|
exitNodeId: exitNodes.exitNodeId
|
|
})
|
|
.from(exitNodes)
|
|
.where(eq(exitNodes.name, exitNodeName));
|
|
if (exitNode) {
|
|
currentExitNodeId = exitNode.exitNodeId;
|
|
}
|
|
} else {
|
|
const [exitNode] = await db
|
|
.select({
|
|
exitNodeId: exitNodes.exitNodeId
|
|
})
|
|
.from(exitNodes)
|
|
.limit(1);
|
|
|
|
if (exitNode) {
|
|
currentExitNodeId = exitNode.exitNodeId;
|
|
}
|
|
}
|
|
}
|
|
|
|
let traefikConfig = await getTraefikConfig(currentExitNodeId);
|
|
|
|
traefikConfig.http.middlewares[badgerMiddlewareName] = {
|
|
plugin: {
|
|
[badgerMiddlewareName]: {
|
|
apiBaseUrl: new URL(
|
|
"/api/v1",
|
|
`http://${
|
|
config.getRawConfig().server.internal_hostname
|
|
}:${config.getRawConfig().server.internal_port}`
|
|
).href,
|
|
userSessionCookieName:
|
|
config.getRawConfig().server.session_cookie_name,
|
|
|
|
// deprecated
|
|
accessTokenQueryParam:
|
|
config.getRawConfig().server
|
|
.resource_access_token_param,
|
|
|
|
resourceSessionRequestParam:
|
|
config.getRawConfig().server
|
|
.resource_session_request_param
|
|
}
|
|
}
|
|
};
|
|
|
|
return res.status(HttpCode.OK).json(traefikConfig);
|
|
} catch (e) {
|
|
logger.error(`Failed to build Traefik config: ${e}`);
|
|
return res.status(HttpCode.INTERNAL_SERVER_ERROR).json({
|
|
error: "Failed to build Traefik config"
|
|
});
|
|
}
|
|
}
|
|
|
|
export async function getTraefikConfig(exitNodeId: number): Promise<any> {
|
|
// Get all resources with related data
|
|
const allResources = await db.transaction(async (tx) => {
|
|
// Get resources with their targets and sites in a single optimized query
|
|
// Start from sites on this exit node, then join to targets and resources
|
|
const resourcesWithTargetsAndSites = await tx
|
|
.select({
|
|
// Resource fields
|
|
resourceId: resources.resourceId,
|
|
fullDomain: resources.fullDomain,
|
|
ssl: resources.ssl,
|
|
http: resources.http,
|
|
proxyPort: resources.proxyPort,
|
|
protocol: resources.protocol,
|
|
subdomain: resources.subdomain,
|
|
domainId: resources.domainId,
|
|
enabled: resources.enabled,
|
|
stickySession: resources.stickySession,
|
|
tlsServerName: resources.tlsServerName,
|
|
setHostHeader: resources.setHostHeader,
|
|
enableProxy: resources.enableProxy,
|
|
// Target fields
|
|
targetId: targets.targetId,
|
|
targetEnabled: targets.enabled,
|
|
ip: targets.ip,
|
|
method: targets.method,
|
|
port: targets.port,
|
|
internalPort: targets.internalPort,
|
|
// Site fields
|
|
siteId: sites.siteId,
|
|
siteType: sites.type,
|
|
subnet: sites.subnet,
|
|
exitNodeId: sites.exitNodeId
|
|
})
|
|
.from(sites)
|
|
.innerJoin(targets, eq(targets.siteId, sites.siteId))
|
|
.innerJoin(resources, eq(resources.resourceId, targets.resourceId))
|
|
.where(
|
|
and(
|
|
eq(targets.enabled, true),
|
|
eq(resources.enabled, true),
|
|
or(
|
|
eq(sites.exitNodeId, currentExitNodeId),
|
|
isNull(sites.exitNodeId)
|
|
)
|
|
)
|
|
);
|
|
|
|
// Group by resource and include targets with their unique site data
|
|
const resourcesMap = new Map();
|
|
|
|
resourcesWithTargetsAndSites.forEach((row) => {
|
|
const resourceId = row.resourceId;
|
|
|
|
if (!resourcesMap.has(resourceId)) {
|
|
resourcesMap.set(resourceId, {
|
|
resourceId: row.resourceId,
|
|
fullDomain: row.fullDomain,
|
|
ssl: row.ssl,
|
|
http: row.http,
|
|
proxyPort: row.proxyPort,
|
|
protocol: row.protocol,
|
|
subdomain: row.subdomain,
|
|
domainId: row.domainId,
|
|
enabled: row.enabled,
|
|
stickySession: row.stickySession,
|
|
tlsServerName: row.tlsServerName,
|
|
setHostHeader: row.setHostHeader,
|
|
enableProxy: row.enableProxy,
|
|
targets: []
|
|
});
|
|
}
|
|
|
|
// Add target with its associated site data
|
|
resourcesMap.get(resourceId).targets.push({
|
|
resourceId: row.resourceId,
|
|
targetId: row.targetId,
|
|
ip: row.ip,
|
|
method: row.method,
|
|
port: row.port,
|
|
internalPort: row.internalPort,
|
|
enabled: row.targetEnabled,
|
|
site: {
|
|
siteId: row.siteId,
|
|
type: row.siteType,
|
|
subnet: row.subnet,
|
|
exitNodeId: row.exitNodeId
|
|
}
|
|
});
|
|
});
|
|
|
|
return Array.from(resourcesMap.values());
|
|
});
|
|
|
|
if (!allResources.length) {
|
|
return {};
|
|
}
|
|
|
|
const config_output: any = {
|
|
http: {
|
|
middlewares: {
|
|
[redirectHttpsMiddlewareName]: {
|
|
redirectScheme: {
|
|
scheme: "https"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
};
|
|
|
|
for (const resource of allResources) {
|
|
const targets = resource.targets as Target[];
|
|
const site = resource.site;
|
|
|
|
const routerName = `${resource.resourceId}-router`;
|
|
const serviceName = `${resource.resourceId}-service`;
|
|
const fullDomain = `${resource.fullDomain}`;
|
|
const transportName = `${resource.resourceId}-transport`;
|
|
const hostHeaderMiddlewareName = `${resource.resourceId}-host-header-middleware`;
|
|
|
|
if (!resource.enabled) {
|
|
continue;
|
|
}
|
|
|
|
if (resource.http) {
|
|
if (!resource.domainId) {
|
|
continue;
|
|
}
|
|
|
|
if (!resource.fullDomain) {
|
|
logger.error(
|
|
`Resource ${resource.resourceId} has no fullDomain`
|
|
);
|
|
continue;
|
|
}
|
|
|
|
// add routers and services empty objects if they don't exist
|
|
if (!config_output.http.routers) {
|
|
config_output.http.routers = {};
|
|
}
|
|
|
|
if (!config_output.http.services) {
|
|
config_output.http.services = {};
|
|
}
|
|
|
|
const domainParts = fullDomain.split(".");
|
|
let wildCard;
|
|
if (domainParts.length <= 2) {
|
|
wildCard = `*.${domainParts.join(".")}`;
|
|
} else {
|
|
wildCard = `*.${domainParts.slice(1).join(".")}`;
|
|
}
|
|
|
|
if (!resource.subdomain) {
|
|
wildCard = resource.fullDomain;
|
|
}
|
|
|
|
const configDomain = config.getDomain(resource.domainId);
|
|
|
|
let certResolver: string, preferWildcardCert: boolean;
|
|
if (!configDomain) {
|
|
certResolver = config.getRawConfig().traefik.cert_resolver;
|
|
preferWildcardCert =
|
|
config.getRawConfig().traefik.prefer_wildcard_cert;
|
|
} else {
|
|
certResolver = configDomain.cert_resolver;
|
|
preferWildcardCert = configDomain.prefer_wildcard_cert;
|
|
}
|
|
|
|
let tls = {};
|
|
if (build == "oss") {
|
|
tls = {
|
|
certResolver: certResolver,
|
|
...(preferWildcardCert
|
|
? {
|
|
domains: [
|
|
{
|
|
main: wildCard
|
|
}
|
|
]
|
|
}
|
|
: {})
|
|
};
|
|
}
|
|
|
|
const additionalMiddlewares =
|
|
config.getRawConfig().traefik.additional_middlewares || [];
|
|
|
|
config_output.http.routers![routerName] = {
|
|
entryPoints: [
|
|
resource.ssl
|
|
? config.getRawConfig().traefik.https_entrypoint
|
|
: config.getRawConfig().traefik.http_entrypoint
|
|
],
|
|
middlewares: [badgerMiddlewareName, ...additionalMiddlewares],
|
|
service: serviceName,
|
|
rule: `Host(\`${fullDomain}\`)`,
|
|
priority: 100,
|
|
...(resource.ssl ? { tls } : {})
|
|
};
|
|
|
|
if (resource.ssl) {
|
|
config_output.http.routers![routerName + "-redirect"] = {
|
|
entryPoints: [
|
|
config.getRawConfig().traefik.http_entrypoint
|
|
],
|
|
middlewares: [redirectHttpsMiddlewareName],
|
|
service: serviceName,
|
|
rule: `Host(\`${fullDomain}\`)`,
|
|
<<<<<<< HEAD
|
|
priority: 100
|
|
=======
|
|
priority: 100,
|
|
...(resource.ssl ? { tls } : {})
|
|
};
|
|
|
|
if (resource.ssl) {
|
|
config_output.http.routers![routerName + "-redirect"] = {
|
|
entryPoints: [
|
|
config.getRawConfig().traefik.http_entrypoint
|
|
],
|
|
middlewares: [redirectHttpsMiddlewareName],
|
|
service: serviceName,
|
|
rule: `Host(\`${fullDomain}\`)`,
|
|
priority: 100
|
|
};
|
|
}
|
|
|
|
config_output.http.services![serviceName] = {
|
|
loadBalancer: {
|
|
servers: targets
|
|
.filter((target: TargetWithSite) => {
|
|
if (!target.enabled) {
|
|
return false;
|
|
}
|
|
if (
|
|
target.site.type === "local" ||
|
|
target.site.type === "wireguard"
|
|
) {
|
|
if (
|
|
!target.ip ||
|
|
!target.port ||
|
|
!target.method
|
|
) {
|
|
return false;
|
|
}
|
|
} else if (target.site.type === "newt") {
|
|
if (
|
|
!target.internalPort ||
|
|
!target.method ||
|
|
!target.site.subnet
|
|
) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
})
|
|
.map((target: TargetWithSite) => {
|
|
if (
|
|
target.site.type === "local" ||
|
|
target.site.type === "wireguard"
|
|
) {
|
|
return {
|
|
url: `${target.method}://${target.ip}:${target.port}`
|
|
};
|
|
} else if (target.site.type === "newt") {
|
|
const ip = target.site.subnet!.split("/")[0];
|
|
return {
|
|
url: `${target.method}://${ip}:${target.internalPort}`
|
|
};
|
|
}
|
|
}),
|
|
...(resource.stickySession
|
|
? {
|
|
sticky: {
|
|
cookie: {
|
|
name: "p_sticky", // TODO: make this configurable via config.yml like other cookies
|
|
secure: resource.ssl,
|
|
httpOnly: true
|
|
}
|
|
}
|
|
}
|
|
: {})
|
|
}
|
|
};
|
|
|
|
// Add the serversTransport if TLS server name is provided
|
|
if (resource.tlsServerName) {
|
|
if (!config_output.http.serversTransports) {
|
|
config_output.http.serversTransports = {};
|
|
}
|
|
config_output.http.serversTransports![transportName] = {
|
|
serverName: resource.tlsServerName,
|
|
//unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
|
|
// if defined in the static config and here. if not set, self-signed certs won't work
|
|
insecureSkipVerify: true
|
|
};
|
|
config_output.http.services![
|
|
serviceName
|
|
].loadBalancer.serversTransport = transportName;
|
|
}
|
|
|
|
// Add the host header middleware
|
|
if (resource.setHostHeader) {
|
|
if (!config_output.http.middlewares) {
|
|
config_output.http.middlewares = {};
|
|
}
|
|
config_output.http.middlewares[hostHeaderMiddlewareName] = {
|
|
headers: {
|
|
customRequestHeaders: {
|
|
Host: resource.setHostHeader
|
|
}
|
|
}
|
|
};
|
|
if (!config_output.http.routers![routerName].middlewares) {
|
|
config_output.http.routers![routerName].middlewares =
|
|
[];
|
|
}
|
|
config_output.http.routers![routerName].middlewares = [
|
|
...config_output.http.routers![routerName].middlewares,
|
|
hostHeaderMiddlewareName
|
|
];
|
|
}
|
|
} else {
|
|
// Non-HTTP (TCP/UDP) configuration
|
|
if (!resource.enableProxy) {
|
|
continue;
|
|
}
|
|
|
|
const protocol = resource.protocol.toLowerCase();
|
|
const port = resource.proxyPort;
|
|
|
|
if (!port) {
|
|
continue;
|
|
}
|
|
|
|
if (!config_output[protocol]) {
|
|
config_output[protocol] = {
|
|
routers: {},
|
|
services: {}
|
|
};
|
|
}
|
|
|
|
config_output[protocol].routers[routerName] = {
|
|
entryPoints: [`${protocol}-${port}`],
|
|
service: serviceName,
|
|
...(protocol === "tcp" ? { rule: "HostSNI(`*`)" } : {})
|
|
};
|
|
|
|
config_output[protocol].services[serviceName] = {
|
|
loadBalancer: {
|
|
servers: targets
|
|
.filter((target: TargetWithSite) => {
|
|
if (!target.enabled) {
|
|
return false;
|
|
}
|
|
if (
|
|
target.site.type === "local" ||
|
|
target.site.type === "wireguard"
|
|
) {
|
|
if (!target.ip || !target.port) {
|
|
return false;
|
|
}
|
|
} else if (target.site.type === "newt") {
|
|
if (!target.internalPort || !target.site.subnet) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
})
|
|
.map((target: TargetWithSite) => {
|
|
if (
|
|
target.site.type === "local" ||
|
|
target.site.type === "wireguard"
|
|
) {
|
|
return {
|
|
address: `${target.ip}:${target.port}`
|
|
};
|
|
} else if (target.site.type === "newt") {
|
|
const ip = target.site.subnet!.split("/")[0];
|
|
return {
|
|
address: `${ip}:${target.internalPort}`
|
|
};
|
|
}
|
|
}),
|
|
...(resource.stickySession
|
|
? {
|
|
sticky: {
|
|
ipStrategy: {
|
|
depth: 0,
|
|
sourcePort: true
|
|
}
|
|
}
|
|
}
|
|
: {})
|
|
}
|
|
>>>>>>> dev
|
|
};
|
|
}
|
|
|
|
config_output.http.services![serviceName] = {
|
|
loadBalancer: {
|
|
servers: targets
|
|
.filter((target: Target) => {
|
|
if (!target.enabled) {
|
|
return false;
|
|
}
|
|
if (
|
|
site.type === "local" ||
|
|
site.type === "wireguard"
|
|
) {
|
|
if (
|
|
!target.ip ||
|
|
!target.port ||
|
|
!target.method
|
|
) {
|
|
return false;
|
|
}
|
|
} else if (site.type === "newt") {
|
|
if (
|
|
!target.internalPort ||
|
|
!target.method ||
|
|
!site.subnet
|
|
) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
})
|
|
.map((target: Target) => {
|
|
if (
|
|
site.type === "local" ||
|
|
site.type === "wireguard"
|
|
) {
|
|
return {
|
|
url: `${target.method}://${target.ip}:${target.port}`
|
|
};
|
|
} else if (site.type === "newt") {
|
|
const ip = site.subnet!.split("/")[0];
|
|
return {
|
|
url: `${target.method}://${ip}:${target.internalPort}`
|
|
};
|
|
}
|
|
}),
|
|
...(resource.stickySession
|
|
? {
|
|
sticky: {
|
|
cookie: {
|
|
name: "p_sticky", // TODO: make this configurable via config.yml like other cookies
|
|
secure: resource.ssl,
|
|
httpOnly: true
|
|
}
|
|
}
|
|
}
|
|
: {})
|
|
}
|
|
};
|
|
|
|
// Add the serversTransport if TLS server name is provided
|
|
if (resource.tlsServerName) {
|
|
if (!config_output.http.serversTransports) {
|
|
config_output.http.serversTransports = {};
|
|
}
|
|
config_output.http.serversTransports![transportName] = {
|
|
serverName: resource.tlsServerName,
|
|
//unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
|
|
// if defined in the static config and here. if not set, self-signed certs won't work
|
|
insecureSkipVerify: true
|
|
};
|
|
config_output.http.services![
|
|
serviceName
|
|
].loadBalancer.serversTransport = transportName;
|
|
}
|
|
|
|
// Add the host header middleware
|
|
if (resource.setHostHeader) {
|
|
if (!config_output.http.middlewares) {
|
|
config_output.http.middlewares = {};
|
|
}
|
|
config_output.http.middlewares[hostHeaderMiddlewareName] = {
|
|
headers: {
|
|
customRequestHeaders: {
|
|
Host: resource.setHostHeader
|
|
}
|
|
}
|
|
};
|
|
if (!config_output.http.routers![routerName].middlewares) {
|
|
config_output.http.routers![routerName].middlewares = [];
|
|
}
|
|
config_output.http.routers![routerName].middlewares = [
|
|
...config_output.http.routers![routerName].middlewares,
|
|
hostHeaderMiddlewareName
|
|
];
|
|
}
|
|
} else {
|
|
// Non-HTTP (TCP/UDP) configuration
|
|
if (!resource.enableProxy) {
|
|
continue;
|
|
}
|
|
|
|
const protocol = resource.protocol.toLowerCase();
|
|
const port = resource.proxyPort;
|
|
|
|
if (!port) {
|
|
continue;
|
|
}
|
|
|
|
if (!config_output[protocol]) {
|
|
config_output[protocol] = {
|
|
routers: {},
|
|
services: {}
|
|
};
|
|
}
|
|
|
|
config_output[protocol].routers[routerName] = {
|
|
entryPoints: [`${protocol}-${port}`],
|
|
service: serviceName,
|
|
...(protocol === "tcp" ? { rule: "HostSNI(`*`)" } : {})
|
|
};
|
|
|
|
config_output[protocol].services[serviceName] = {
|
|
loadBalancer: {
|
|
servers: targets
|
|
.filter((target: Target) => {
|
|
if (!target.enabled) {
|
|
return false;
|
|
}
|
|
if (
|
|
site.type === "local" ||
|
|
site.type === "wireguard"
|
|
) {
|
|
if (!target.ip || !target.port) {
|
|
return false;
|
|
}
|
|
} else if (site.type === "newt") {
|
|
if (!target.internalPort || !site.subnet) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
})
|
|
.map((target: Target) => {
|
|
if (
|
|
site.type === "local" ||
|
|
site.type === "wireguard"
|
|
) {
|
|
return {
|
|
address: `${target.ip}:${target.port}`
|
|
};
|
|
} else if (site.type === "newt") {
|
|
const ip = site.subnet!.split("/")[0];
|
|
return {
|
|
address: `${ip}:${target.internalPort}`
|
|
};
|
|
}
|
|
}),
|
|
...(resource.stickySession
|
|
? {
|
|
sticky: {
|
|
ipStrategy: {
|
|
depth: 0,
|
|
sourcePort: true
|
|
}
|
|
}
|
|
}
|
|
: {})
|
|
}
|
|
};
|
|
}
|
|
}
|
|
return config_output;
|
|
}
|