|
| 1 | +// Package tunnel manages the optional public tunnel via cloudflared (spec 05). |
| 2 | +// The tunnel is DEFAULT-DOWN and account-gated; it reuses local routing by |
| 3 | +// pointing its ingress at the shared Caddy container, so the same proxy []Route |
| 4 | +// drives both local and public access (no drift). A tunnel must refuse to expose |
| 5 | +// a service whose env carries non-local secret:// values without an override. |
| 6 | +// |
| 7 | +// cloudflared runs through an injectable Runner so the package is fully |
| 8 | +// unit-testable without the binary or a Cloudflare account (locked decision #3: |
| 9 | +// build the logic, fake-runner test, flag the human/account step). |
| 10 | +package tunnel |
| 11 | + |
| 12 | +import ( |
| 13 | + "context" |
| 14 | + "fmt" |
| 15 | + "os" |
| 16 | + "os/exec" |
| 17 | + "sort" |
| 18 | + "strings" |
| 19 | + |
| 20 | + "github.com/open-source-cloud/devstack/internal/secrets" |
| 21 | +) |
| 22 | + |
| 23 | +// Runner runs the external cloudflared binary. Injectable for tests. |
| 24 | +type Runner interface { |
| 25 | + Run(ctx context.Context, name string, args ...string) error |
| 26 | + LookPath(file string) (string, error) |
| 27 | +} |
| 28 | + |
| 29 | +// Tunnel wraps cloudflared. The zero value uses the real OS exec runner. |
| 30 | +type Tunnel struct { |
| 31 | + Runner Runner |
| 32 | +} |
| 33 | + |
| 34 | +// New returns a Tunnel backed by the real exec runner. |
| 35 | +func New() *Tunnel { return &Tunnel{Runner: execRunner{}} } |
| 36 | + |
| 37 | +func (t *Tunnel) runner() Runner { |
| 38 | + if t.Runner != nil { |
| 39 | + return t.Runner |
| 40 | + } |
| 41 | + return execRunner{} |
| 42 | +} |
| 43 | + |
| 44 | +// Available reports whether the cloudflared binary is on PATH. |
| 45 | +func (t *Tunnel) Available() bool { |
| 46 | + _, err := t.runner().LookPath("cloudflared") |
| 47 | + return err == nil |
| 48 | +} |
| 49 | + |
| 50 | +// Login runs the interactive `cloudflared tunnel login` (account-gated). |
| 51 | +func (t *Tunnel) Login(ctx context.Context) error { |
| 52 | + return t.exec(ctx, "tunnel", "login") |
| 53 | +} |
| 54 | + |
| 55 | +// Create creates a named tunnel (writes <UUID>.json creds) via |
| 56 | +// `cloudflared tunnel create <name>` — avoids the login regression. |
| 57 | +func (t *Tunnel) Create(ctx context.Context, name string) error { |
| 58 | + if name == "" { |
| 59 | + return fmt.Errorf("tunnel name required") |
| 60 | + } |
| 61 | + return t.exec(ctx, "tunnel", "create", name) |
| 62 | +} |
| 63 | + |
| 64 | +// RouteDNS points a hostname at the tunnel. NOTE: cloudflared rejects a wildcard |
| 65 | +// (`*.project`) — that single wildcard CNAME must be created manually in DNS |
| 66 | +// (spec 05 gotcha); this routes concrete hostnames. |
| 67 | +func (t *Tunnel) RouteDNS(ctx context.Context, name, hostname string) error { |
| 68 | + if strings.HasPrefix(hostname, "*") { |
| 69 | + return fmt.Errorf("cloudflared cannot route a wildcard %q — create the *.<project> CNAME manually in the Cloudflare dashboard", hostname) |
| 70 | + } |
| 71 | + return t.exec(ctx, "tunnel", "route", "dns", name, hostname) |
| 72 | +} |
| 73 | + |
| 74 | +// Run starts the tunnel in the foreground with a config file |
| 75 | +// (`cloudflared tunnel --config <path> run`). |
| 76 | +func (t *Tunnel) Run(ctx context.Context, configPath string) error { |
| 77 | + return t.exec(ctx, "tunnel", "--config", configPath, "run") |
| 78 | +} |
| 79 | + |
| 80 | +func (t *Tunnel) exec(ctx context.Context, args ...string) error { |
| 81 | + if !t.Available() { |
| 82 | + return fmt.Errorf("cloudflared not found on PATH — install it (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) and run `devstack tunnel login`") |
| 83 | + } |
| 84 | + if err := t.runner().Run(ctx, "cloudflared", args...); err != nil { |
| 85 | + return fmt.Errorf("cloudflared %s: %w", strings.Join(args, " "), err) |
| 86 | + } |
| 87 | + return nil |
| 88 | +} |
| 89 | + |
| 90 | +// IngressConfig renders a cloudflared config.yml whose ingress maps every public |
| 91 | +// hostname to the shared Caddy upstream (so public reuses local routing), with |
| 92 | +// the required catch-all 404 last. Deterministic (hostnames sorted). |
| 93 | +func IngressConfig(name, credentialsFile, caddyUpstream string, hostnames []string) string { |
| 94 | + var b strings.Builder |
| 95 | + fmt.Fprintf(&b, "tunnel: %s\n", name) |
| 96 | + fmt.Fprintf(&b, "credentials-file: %s\n", credentialsFile) |
| 97 | + b.WriteString("ingress:\n") |
| 98 | + hosts := append([]string(nil), hostnames...) |
| 99 | + sort.Strings(hosts) |
| 100 | + for _, h := range hosts { |
| 101 | + fmt.Fprintf(&b, " - hostname: %s\n service: %s\n", h, caddyUpstream) |
| 102 | + } |
| 103 | + b.WriteString(" - service: http_status:404\n") |
| 104 | + return b.String() |
| 105 | +} |
| 106 | + |
| 107 | +// SecretBearing returns the non-local secret:// references found in envValues — a |
| 108 | +// tunnel must refuse to expose a service carrying these (unless overridden). |
| 109 | +// isLocalProvider classifies a provider name as local (offline, e.g. sops+age) |
| 110 | +// vs non-local (aws/infisical); an unknown/empty classifier treats all as |
| 111 | +// non-local (fail safe). |
| 112 | +func SecretBearing(envValues []string, isLocalProvider func(provider string) bool) []string { |
| 113 | + var out []string |
| 114 | + for _, v := range envValues { |
| 115 | + if !secrets.IsRef(v) { |
| 116 | + continue |
| 117 | + } |
| 118 | + ref, err := secrets.ParseRef(v) |
| 119 | + if err != nil { |
| 120 | + continue |
| 121 | + } |
| 122 | + if isLocalProvider != nil && isLocalProvider(ref.Provider) { |
| 123 | + continue |
| 124 | + } |
| 125 | + out = append(out, ref.Raw) |
| 126 | + } |
| 127 | + sort.Strings(out) |
| 128 | + return out |
| 129 | +} |
| 130 | + |
| 131 | +// execRunner is the production Runner. tunnel verbs are interactive/long-running, |
| 132 | +// so stdio is inherited. |
| 133 | +type execRunner struct{} |
| 134 | + |
| 135 | +func (execRunner) Run(ctx context.Context, name string, args ...string) error { |
| 136 | + cmd := exec.CommandContext(ctx, name, args...) |
| 137 | + cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr |
| 138 | + return cmd.Run() |
| 139 | +} |
| 140 | +func (execRunner) LookPath(file string) (string, error) { return exec.LookPath(file) } |
0 commit comments