294 lines
11 KiB
PHP
294 lines
11 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Admin;
|
|
|
|
use App\Models\Host;
|
|
use App\Models\VpnPeer;
|
|
use App\Provisioning\Jobs\ApplyVpnPeer;
|
|
use App\Provisioning\Jobs\SyncVpnPeers;
|
|
use App\Models\User;
|
|
use App\Services\Wireguard\ConfigHandoff;
|
|
use App\Services\Wireguard\ConfigVault;
|
|
use App\Services\Wireguard\Keypair;
|
|
use App\Services\Wireguard\QrCode;
|
|
use App\Services\Wireguard\WireguardHub;
|
|
use Illuminate\Database\QueryException;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\Rule;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Attributes\On;
|
|
use Livewire\Component;
|
|
|
|
/**
|
|
* VPN access management. The console container has no wg0, so live state is
|
|
* read from the database and refreshed by SyncVpnPeers on the provisioning
|
|
* queue — the poll below only nudges that job, it never talks to WireGuard.
|
|
*/
|
|
#[Layout('layouts.admin')]
|
|
class Vpn extends Component
|
|
{
|
|
public string $name = '';
|
|
|
|
/** Optional: a peer that generated its own key never hands us the private half. */
|
|
public string $publicKey = '';
|
|
|
|
/** Opaque handle for the freshly created config; see ConfigHandoff. */
|
|
public ?string $configToken = null;
|
|
|
|
public ?string $newConfigName = null;
|
|
|
|
/** Owner of the new access. Defaults to the operator creating it. */
|
|
public ?int $ownerId = null;
|
|
|
|
/** Keep the config so its owner can fetch it again behind their password. */
|
|
public bool $storeConfig = false;
|
|
|
|
public bool $showQr = false;
|
|
|
|
public function mount(): void
|
|
{
|
|
$this->authorize('viewAny', VpnPeer::class);
|
|
$this->ownerId = auth()->id();
|
|
}
|
|
|
|
/**
|
|
* mount() runs once; every later request — including the five-second poll —
|
|
* only hydrates. Without this, revoking vpn.manage would not take effect
|
|
* until the operator happened to reload the page, and the open tab would
|
|
* keep serving fresh peer state.
|
|
*/
|
|
public function hydrate(): void
|
|
{
|
|
$this->authorize('viewAny', VpnPeer::class);
|
|
}
|
|
|
|
public function create(): void
|
|
{
|
|
$this->authorize('create', VpnPeer::class);
|
|
|
|
$this->validate([
|
|
'name' => 'required|string|max:255',
|
|
'publicKey' => 'nullable|string|max:64',
|
|
// An access belongs to a person, and only to an operator: a customer
|
|
// account must never own a way into the management network.
|
|
'ownerId' => ['required', Rule::exists('users', 'id')],
|
|
]);
|
|
|
|
// Storing needs a key. Without one we would either write the credential
|
|
// in the clear or pretend we stored it — both worse than saying no.
|
|
if ($this->storeConfig && ! ConfigVault::available()) {
|
|
$this->addError('storeConfig', __('vpn.vault_unavailable'));
|
|
|
|
return;
|
|
}
|
|
|
|
$ownKey = trim($this->publicKey) !== '';
|
|
|
|
if ($this->storeConfig && $ownKey) {
|
|
$this->addError('storeConfig', __('vpn.cannot_store_foreign_key'));
|
|
|
|
return;
|
|
}
|
|
|
|
if ($ownKey && ! Keypair::isValidKey(trim($this->publicKey))) {
|
|
$this->addError('publicKey', __('vpn.invalid_key'));
|
|
|
|
return;
|
|
}
|
|
|
|
$keypair = $ownKey ? null : Keypair::generate();
|
|
$publicKey = $ownKey ? trim($this->publicKey) : $keypair->publicKey;
|
|
|
|
$hub = app(WireguardHub::class);
|
|
|
|
// Same lock the host pipeline holds while it reserves an address
|
|
// (ConfigureWireguard). Addresses come from one subnet but live in two
|
|
// tables, so neither unique index can catch the other's insert — the
|
|
// shared lock is what keeps a host and an access off the same tunnel IP.
|
|
try {
|
|
$peer = Cache::lock('wireguard:allocate', 30)->block(10, fn () => DB::transaction(function () use ($hub, $publicKey) {
|
|
// The owner row is locked for the whole insert, and revokeStaff()
|
|
// locks the same row: without that, a revocation could commit
|
|
// between the check and the insert, find no peer to remove, and
|
|
// leave the revoked colleague with a brand-new tunnel.
|
|
$owner = User::query()->whereKey($this->ownerId)->lockForUpdate()->first();
|
|
if ($owner === null || ! $owner->isOperator()) {
|
|
return 'owner_must_be_operator';
|
|
}
|
|
|
|
// Inside the lock: checking before it would let two concurrent
|
|
// requests both pass and the loser hit the unique index as a
|
|
// 500. withTrashed, because a revoked peer keeps its key until
|
|
// the hub confirms removal.
|
|
$existing = VpnPeer::withTrashed()->where('public_key', $publicKey)->first();
|
|
if ($existing !== null) {
|
|
return $existing->trashed() ? 'pending_removal' : 'duplicate_key';
|
|
}
|
|
|
|
// A host's key may not have been adopted into vpn_peers yet.
|
|
// Re-using it would make `wg set` rewrite that host's allowed-ip
|
|
// to the address allocated here — cutting the management tunnel
|
|
// to a live machine.
|
|
if (Host::query()->where('wg_pubkey', $publicKey)->exists()) {
|
|
return 'host_key';
|
|
}
|
|
|
|
return VpnPeer::create([
|
|
'name' => trim($this->name),
|
|
'kind' => VpnPeer::KIND_STAFF,
|
|
'user_id' => $this->ownerId,
|
|
'public_key' => $publicKey,
|
|
'allowed_ip' => $hub->allocateIp(),
|
|
'enabled' => true,
|
|
'present' => false,
|
|
'created_by' => auth()->id(),
|
|
]);
|
|
}));
|
|
} catch (QueryException) {
|
|
// Backstop: the unique index caught a writer that did not take this
|
|
// lock. Report it like any other duplicate instead of a 500.
|
|
$this->addError('publicKey', __('vpn.duplicate_key'));
|
|
|
|
return;
|
|
}
|
|
|
|
if (is_string($peer)) {
|
|
$field = $peer === 'owner_must_be_operator' ? 'ownerId' : 'publicKey';
|
|
$this->addError($field, __('vpn.'.$peer));
|
|
|
|
return;
|
|
}
|
|
|
|
ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, true);
|
|
|
|
// Whatever was on screen belongs to the previous access. Leaving it up
|
|
// after creating another one would present the wrong private config
|
|
// under the new name — and someone would hand it out.
|
|
$this->dismissConfig();
|
|
|
|
// Only a key we generated can be turned into a ready-to-use config.
|
|
if ($keypair !== null) {
|
|
$config = $this->clientConfig($keypair, $peer->allowed_ip);
|
|
$this->configToken = ConfigHandoff::put($config);
|
|
$this->newConfigName = $peer->name;
|
|
|
|
if ($this->storeConfig) {
|
|
$peer->forceFill(['config_secret' => ConfigVault::encrypt($config)])->saveQuietly();
|
|
}
|
|
}
|
|
|
|
$this->reset('name', 'publicKey', 'storeConfig');
|
|
$this->ownerId = auth()->id();
|
|
$this->dispatch('notify', message: __('vpn.created'));
|
|
}
|
|
|
|
public function toggle(string $uuid): void
|
|
{
|
|
// Looked up globally and then judged by the policy: filtering it out of
|
|
// the query here would turn "not allowed" into a button that silently
|
|
// does nothing, which is exactly how the portal used to lie to people.
|
|
$peer = VpnPeer::query()->where('uuid', $uuid)->first();
|
|
if ($peer === null) {
|
|
return;
|
|
}
|
|
$this->authorize('block', $peer);
|
|
|
|
$peer->update(['enabled' => ! $peer->enabled]);
|
|
ApplyVpnPeer::dispatch($peer->public_key, $peer->allowed_ip, $peer->enabled);
|
|
|
|
$this->dispatch('notify', message: $peer->enabled ? __('vpn.unblocked') : __('vpn.blocked'));
|
|
}
|
|
|
|
#[On('vpn-peer-deleted')]
|
|
public function peerDeleted(): void
|
|
{
|
|
$this->dispatch('notify', message: __('vpn.deleted'));
|
|
}
|
|
|
|
public function dismissConfig(): void
|
|
{
|
|
ConfigHandoff::forget($this->configToken);
|
|
$this->reset('configToken', 'newConfigName', 'showQr');
|
|
}
|
|
|
|
/**
|
|
* The list this operator is allowed to see: their own accesses, plus
|
|
* everything when they hold vpn.view.all. Filtering in the query as well as
|
|
* in the actions, so a forged uuid cannot reach a peer the page never showed.
|
|
*/
|
|
private function visiblePeers()
|
|
{
|
|
$query = VpnPeer::query();
|
|
|
|
if (! auth()->user()?->can('vpn.view.all')) {
|
|
$query->where('kind', VpnPeer::KIND_STAFF)->where('user_id', auth()->id());
|
|
}
|
|
|
|
return $query;
|
|
}
|
|
|
|
public function toggleQr(): void
|
|
{
|
|
$this->showQr = ! $this->showQr;
|
|
}
|
|
|
|
/**
|
|
* wg-quick takes the interface name from the filename, and Linux caps
|
|
* interface names at 15 characters — so the label is slugged and cut rather
|
|
* than handing the operator a file that fails to come up.
|
|
*/
|
|
public function configFilename(): string
|
|
{
|
|
$slug = Str::slug((string) $this->newConfigName) ?: 'clupilot';
|
|
|
|
return Str::limit($slug, 15, '').'.conf';
|
|
}
|
|
|
|
/** Polled by the view; throttled so a room full of open tabs cannot flood the queue. */
|
|
public function refreshPeers(): void
|
|
{
|
|
if (Cache::add('vpn:sync-dispatched', true, 8)) {
|
|
SyncVpnPeers::dispatch();
|
|
}
|
|
}
|
|
|
|
private function clientConfig(Keypair $keypair, string $ip): string
|
|
{
|
|
$hub = app(WireguardHub::class);
|
|
|
|
return implode("\n", [
|
|
'[Interface]',
|
|
'PrivateKey = '.$keypair->privateKey,
|
|
'Address = '.$ip.'/32',
|
|
'',
|
|
'[Peer]',
|
|
'PublicKey = '.$hub->publicKey(),
|
|
'Endpoint = '.$hub->endpoint(),
|
|
'AllowedIPs = '.config('provisioning.wireguard.subnet', '10.66.0.0/24'),
|
|
'PersistentKeepalive = 25',
|
|
'',
|
|
]);
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
$hub = app(WireguardHub::class);
|
|
|
|
return view('livewire.admin.vpn', [
|
|
'newConfig' => $config = ConfigHandoff::get($this->configToken),
|
|
'qrSvg' => $this->showQr && $config !== null ? QrCode::svg($config) : null,
|
|
'peers' => $this->visiblePeers()->with(['host', 'owner'])->orderByDesc('present')->orderBy('name')->get(),
|
|
'operators' => User::query()
|
|
->whereHas('roles', fn ($q) => $q->whereIn('name', User::OPERATOR_ROLES))
|
|
->orderBy('name')->get(['id', 'name', 'email']),
|
|
'canManage' => auth()->user()?->can('vpn.manage.all') ?? false,
|
|
'vaultAvailable' => ConfigVault::available(),
|
|
'hubEndpoint' => $hub->endpoint(),
|
|
'hubPublicKey' => $hub->publicKey(),
|
|
'lastSync' => VpnPeer::query()->max('observed_at'),
|
|
]);
|
|
}
|
|
}
|