Audiobuzz
c40dd5ac93
The human->UI hop now authenticates with a hardware passkey (YubiKey), not an mTLS client cert: phishing-resistant, origin-bound, better UX. (manager->broker stays mTLS — service-to-service.) - webauthn.go: credential store (registered admins + passkeys + a one-time-token jti replay ledger; JSON file, atomic writes) + the webauthn.User impl + RP setup. - cli.go: 'fleet-manager register-admin <name>' mints a short-lived HMAC-signed enrolment link over a shared enrol key; the browser completes the WebAuthn create ceremony. No anyone-can-register endpoint; single-use via the ledger. - authapi.go: register/login ceremonies (usernameless discoverable login, userVerification required) + logout + whoami; short-lived in-memory ceremony store between begin/finish. - session.go: opaque server-side sessions (Secure/HttpOnly/SameSite=Strict cookie) + requireSession middleware gating /api/*, with a CSRF header check on mutations. adminName now comes from the session (audit attribution). - main.go: register-admin subcommand dispatch; admin TLS switched to SERVER-AUTH (no client cert) with a HOT-RELOADING cert (certReloader) so a Let's Encrypt DNS-01 renewal is picked up without a restart. RP = diskless-server.bitasylum.org. /api/* mounted behind requireSession; /auth/* + /healthz public. Cert strategy (per design decision): the UI HTTPS cert is a publicly-trusted LE cert via DNS-01 (mgmt-network UI isn't internet-reachable, so HTTP-01/TLS-ALPN-01 can't validate; DNS-01 proves control of bitasylum.org via TXT + supports wildcards). External ACME client issues+renews to the cert path; manager reloads. Deps: github.com/go-webauthn/webauthn (server-side). Tests: enrol-token mint/verify/tamper/expiry, session middleware (401/403/CSRF/expiry), cred-store persistence + jti ledger. build/test/vet/gofmt clean. Live passkey ceremony (virtual authenticator / real YubiKey) is a bench item.
42 lines
1.8 KiB
AMPL
42 lines
1.8 KiB
AMPL
// fleet-manager — server-side fleet control plane for the diskless kiosk fleet:
|
|
// inventory, enrolment authorisation, lifecycle (desired-state) control, and the
|
|
// metrics gateway that fronts InfluxDB. Backend for the admin SPA. See
|
|
// docs/fleet-management-design.md and docs/tpm-enrolment-design.md §5.
|
|
//
|
|
// Unlike fleet-hostapi / fleet-enrol (baked into the reproducible verity image,
|
|
// so stdlib-only), this is a SERVER-SIDE service that ships as its own container
|
|
// on the mgmt network — external deps are acceptable here. They are added at the
|
|
// build checkpoint that needs them:
|
|
// - google.golang.org/grpc + protobuf : the agent bidi stream (added ckpt 2)
|
|
// - github.com/influxdata/influxdb-client-go/v2 : metrics read/write (ckpt 4)
|
|
module fleet-manager
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/go-webauthn/webauthn v0.17.4
|
|
github.com/influxdata/influxdb-client-go/v2 v2.14.0
|
|
google.golang.org/grpc v1.82.0
|
|
google.golang.org/protobuf v1.36.11
|
|
)
|
|
|
|
require (
|
|
github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.2 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
|
github.com/go-webauthn/x v0.2.6 // indirect
|
|
github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
|
|
github.com/google/go-tpm v0.9.8 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/influxdata/line-protocol v0.0.0-20200327222509-2487e7298839 // indirect
|
|
github.com/oapi-codegen/runtime v1.0.0 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
golang.org/x/crypto v0.52.0 // indirect
|
|
golang.org/x/net v0.54.0 // indirect
|
|
golang.org/x/sys v0.45.0 // indirect
|
|
golang.org/x/text v0.37.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
|
|
)
|