273 lines
9.6 KiB
Go
273 lines
9.6 KiB
Go
package httpapi
|
||
|
||
import (
|
||
"context"
|
||
"errors"
|
||
"fmt"
|
||
"net"
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/dnsprovider"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/firewall"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/setup"
|
||
)
|
||
|
||
const setupRequestLimit = 64 * 1024
|
||
|
||
type setupDNSVerifier interface {
|
||
Verify(ctx context.Context, input setup.DNSVerificationInput) (setup.DNSVerificationResult, error)
|
||
Check(token, providerID, credentialRef, testDomain string) error
|
||
Consume(token, providerID, credentialRef, testDomain string) error
|
||
}
|
||
|
||
type setupRequest struct {
|
||
AdminUsername string `json:"admin_username"`
|
||
AdminEmail string `json:"admin_email"`
|
||
AdminPassword string `json:"admin_password"`
|
||
ServerPort int `json:"server_port"`
|
||
EmailProvider string `json:"email_provider"`
|
||
EmailEndpoint string `json:"email_endpoint"`
|
||
Recipients []string `json:"recipients"`
|
||
DNSProvider string `json:"dns_provider"`
|
||
DNSCredentialRef string `json:"dns_credential_ref"`
|
||
DNSVerificationToken string `json:"dns_verification_token"`
|
||
DNSTestDomain string `json:"dns_test_domain"`
|
||
CertificateRoot string `json:"certificate_root"`
|
||
WebHostname string `json:"web_hostname"`
|
||
WebPublicIP string `json:"web_public_ip"`
|
||
WebEnabled *bool `json:"web_enabled"`
|
||
HTTPSMode string `json:"https_mode"`
|
||
}
|
||
|
||
type dnsTestRequest struct {
|
||
ProviderID string `json:"provider"`
|
||
TestDomain string `json:"test_domain"`
|
||
Credentials map[string]string `json:"credentials"`
|
||
}
|
||
|
||
func (s *Server) registerSetupRoutes() {
|
||
s.router.GET("/api/v1/setup/status", s.setupStatus)
|
||
s.router.GET("/api/v1/setup/dns/providers", s.setupDNSProviders)
|
||
s.router.POST("/api/v1/setup/dns/test", s.testSetupDNS)
|
||
s.router.POST("/api/v1/setup", s.applySetup)
|
||
}
|
||
|
||
func (s *Server) setupStatus(c *gin.Context) {
|
||
s.configMu.RLock()
|
||
cfg := s.config
|
||
s.configMu.RUnlock()
|
||
if !cfg.SetupReady && !isLoopbackRequest(c.Request) {
|
||
s.writeError(c, http.StatusForbidden, "首次初始化接口仅允许从本机访问", nil)
|
||
return
|
||
}
|
||
phase := "ready"
|
||
blockers := []string{}
|
||
if !cfg.SetupReady {
|
||
phase = "configuration_required"
|
||
blockers = append(blockers, "需要完成首次初始化")
|
||
if cfg.DNS.VerificationState != "verified" {
|
||
blockers = append(blockers, "DNS API 尚未验证")
|
||
}
|
||
}
|
||
c.JSON(http.StatusOK, gin.H{
|
||
"initialized": cfg.SetupReady,
|
||
"phase": phase,
|
||
"blockers": blockers,
|
||
"server_port": cfg.Server.Port,
|
||
"reset_url": cfg.ResetURL(),
|
||
"https_mode": cfg.Server.HTTPSMode,
|
||
"web_enabled": cfg.Web.Enabled,
|
||
"web_hostname": cfg.Web.Hostname,
|
||
"web_public_ip": cfg.Web.PublicIP,
|
||
"certificate_root": cfg.Paths.Certificate,
|
||
"dns_provider": cfg.DNS.Provider,
|
||
"dns_verification_state": cfg.DNS.VerificationState,
|
||
"dns_test_available": s.setupDNS != nil,
|
||
})
|
||
}
|
||
|
||
func (s *Server) setupDNSProviders(c *gin.Context) {
|
||
if !s.allowSetupRequest(c) {
|
||
return
|
||
}
|
||
c.JSON(http.StatusOK, gin.H{"items": dnsprovider.Descriptors()})
|
||
}
|
||
|
||
func (s *Server) testSetupDNS(c *gin.Context) {
|
||
if !s.allowSetupRequest(c) {
|
||
return
|
||
}
|
||
if s.setupDNS == nil {
|
||
s.writeError(c, http.StatusServiceUnavailable, "DNS 在线验证服务尚未初始化", nil)
|
||
return
|
||
}
|
||
c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, setupRequestLimit)
|
||
var request dnsTestRequest
|
||
if err := c.ShouldBindJSON(&request); err != nil {
|
||
s.writeError(c, http.StatusBadRequest, "DNS 测试请求参数无效", err)
|
||
return
|
||
}
|
||
ctx, cancel := context.WithTimeout(c.Request.Context(), 45*time.Second)
|
||
defer cancel()
|
||
result, err := s.setupDNS.Verify(ctx, setup.DNSVerificationInput{
|
||
ProviderID: request.ProviderID, TestDomain: request.TestDomain, Credentials: request.Credentials,
|
||
})
|
||
if err != nil {
|
||
if errors.Is(err, dnsprovider.ErrProviderUnavailable) {
|
||
s.writeError(c, http.StatusNotImplemented, "该 DNS 服务商在线验证适配器尚未开放", nil)
|
||
return
|
||
}
|
||
if s.logger != nil {
|
||
s.logger.Error("DNS API 在线验证失败", "provider", request.ProviderID, "test_domain", request.TestDomain)
|
||
}
|
||
c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "DNS API 在线验证失败，请检查凭据、测试域名和 DNS 权限"})
|
||
return
|
||
}
|
||
c.JSON(http.StatusOK, gin.H{
|
||
"verified": true,
|
||
"credential_ref": result.CredentialRef,
|
||
"verification_token": result.VerificationToken,
|
||
"expires_at": result.ExpiresAt,
|
||
"message": "DNS API 在线验证通过，凭据已加密保存。",
|
||
})
|
||
}
|
||
|
||
func (s *Server) applySetup(c *gin.Context) {
|
||
s.configMu.Lock()
|
||
defer s.configMu.Unlock()
|
||
if !isLoopbackRequest(c.Request) {
|
||
s.writeError(c, http.StatusForbidden, "首次初始化接口仅允许从本机访问", nil)
|
||
return
|
||
}
|
||
if s.config.SetupReady {
|
||
s.writeError(c, http.StatusConflict, "初始化已经完成，不能重复提交", nil)
|
||
return
|
||
}
|
||
c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, setupRequestLimit)
|
||
var request setupRequest
|
||
if err := c.ShouldBindJSON(&request); err != nil {
|
||
s.writeError(c, http.StatusBadRequest, "初始化请求参数无效", err)
|
||
return
|
||
}
|
||
if s.setupDNS == nil {
|
||
s.writeError(c, http.StatusServiceUnavailable, "DNS 在线验证服务尚未初始化", nil)
|
||
return
|
||
}
|
||
testDomain := strings.TrimSpace(request.DNSTestDomain)
|
||
if testDomain == "" {
|
||
testDomain = strings.TrimSpace(request.WebHostname)
|
||
}
|
||
if err := s.setupDNS.Check(request.DNSVerificationToken, request.DNSProvider, request.DNSCredentialRef, testDomain); err != nil {
|
||
s.writeError(c, http.StatusBadRequest, err.Error(), nil)
|
||
return
|
||
}
|
||
webEnabled := true
|
||
if request.WebEnabled != nil {
|
||
webEnabled = *request.WebEnabled
|
||
}
|
||
updated := s.config
|
||
err := setup.Apply(&updated, setup.Input{
|
||
AdminUsername: request.AdminUsername,
|
||
AdminEmail: request.AdminEmail,
|
||
AdminPassword: request.AdminPassword,
|
||
ServerPort: request.ServerPort,
|
||
EmailProvider: request.EmailProvider,
|
||
EmailEndpoint: request.EmailEndpoint,
|
||
EmailRecipients: request.Recipients,
|
||
DNSProvider: request.DNSProvider,
|
||
DNSCredentialRef: request.DNSCredentialRef,
|
||
DNSVerified: true,
|
||
CertificateRoot: request.CertificateRoot,
|
||
WebHostname: request.WebHostname,
|
||
WebPublicIP: request.WebPublicIP,
|
||
WebEnabled: webEnabled,
|
||
HTTPSMode: request.HTTPSMode,
|
||
})
|
||
if err != nil {
|
||
s.writeError(c, http.StatusBadRequest, err.Error(), err)
|
||
return
|
||
}
|
||
if strings.TrimSpace(s.configPath) == "" {
|
||
s.writeError(c, http.StatusInternalServerError, "服务未配置配置文件路径，无法保存初始化结果", nil)
|
||
return
|
||
}
|
||
firewallResult := firewall.Result{
|
||
Backend: firewall.BackendNone, Port: updated.Server.Port,
|
||
Message: "未配置防火墙管理器，已跳过本机规则创建",
|
||
}
|
||
if s.firewall != nil {
|
||
firewallContext, cancel := context.WithTimeout(c.Request.Context(), 30*time.Second)
|
||
firewallResult, err = s.firewall.OpenTCP(firewallContext, updated.Server.Port)
|
||
cancel()
|
||
if err != nil {
|
||
s.writeError(c, http.StatusInternalServerError, "自动配置本机防火墙失败，请使用管理员权限重新运行初始化程序", err)
|
||
return
|
||
}
|
||
}
|
||
if err := updated.Save(s.configPath); err != nil {
|
||
if firewallResult.Created && s.firewall != nil {
|
||
rollbackContext, cancel := context.WithTimeout(context.Background(), 30*time.Second)
|
||
rollbackErr := s.firewall.Rollback(rollbackContext, firewallResult)
|
||
cancel()
|
||
if rollbackErr != nil {
|
||
if s.logger != nil {
|
||
s.logger.Error("保存初始化配置失败，且回滚本机防火墙规则失败", "error", rollbackErr, "rule", firewallResult.RuleName)
|
||
}
|
||
s.writeError(c, http.StatusInternalServerError, "保存初始化配置失败，且自动创建的防火墙规则回滚失败，请手动检查本机防火墙", err)
|
||
return
|
||
}
|
||
}
|
||
s.writeError(c, http.StatusInternalServerError, "保存初始化配置失败", err)
|
||
return
|
||
}
|
||
if err := s.setupDNS.Consume(request.DNSVerificationToken, request.DNSProvider, request.DNSCredentialRef, testDomain); err != nil && s.logger != nil {
|
||
s.logger.Warn("初始化配置已保存，但清理 DNS 验证令牌失败", "error", err)
|
||
}
|
||
s.config = updated
|
||
c.JSON(http.StatusOK, gin.H{
|
||
"initialized": true,
|
||
"message": fmt.Sprintf(
|
||
"初始化配置已保存，DNS API 已完成在线验证且凭据已加密保存。%s。请确认云安全组已放行主服务端口 %d；Scert-admin 默认关闭，启动后通过 %s 使用临时重置入口。证书申请和 HTTPS 切换将在后续任务中完成。",
|
||
firewallResult.Message, updated.Server.Port, updated.ResetURL(),
|
||
),
|
||
"status": gin.H{
|
||
"server_port": updated.Server.Port,
|
||
"reset_url": updated.ResetURL(),
|
||
"web_enabled": updated.Web.Enabled,
|
||
"https_mode": updated.Server.HTTPSMode,
|
||
"firewall": firewallResult,
|
||
},
|
||
})
|
||
}
|
||
|
||
func (s *Server) allowSetupRequest(c *gin.Context) bool {
|
||
s.configMu.RLock()
|
||
initialized := s.config.SetupReady
|
||
s.configMu.RUnlock()
|
||
if initialized {
|
||
s.writeError(c, http.StatusConflict, "初始化已经完成，不能重复执行初始化 DNS 测试", nil)
|
||
return false
|
||
}
|
||
if !isLoopbackRequest(c.Request) {
|
||
s.writeError(c, http.StatusForbidden, "首次初始化接口仅允许从本机访问", nil)
|
||
return false
|
||
}
|
||
return true
|
||
}
|
||
|
||
func isLoopbackRequest(request *http.Request) bool {
|
||
if request == nil {
|
||
return false
|
||
}
|
||
host, _, err := net.SplitHostPort(request.RemoteAddr)
|
||
if err != nil {
|
||
host = request.RemoteAddr
|
||
}
|
||
ip := net.ParseIP(strings.TrimSpace(host))
|
||
return ip != nil && ip.IsLoopback()
|
||
}
|