609 lines
22 KiB
PHP
609 lines
22 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Servers;
|
|
|
|
use App\Models\AuditEvent;
|
|
use App\Models\Server;
|
|
use App\Services\Fail2banService;
|
|
use App\Services\FirewallService;
|
|
use App\Services\FleetService;
|
|
use App\Services\HardeningService;
|
|
use App\Support\Confirm\ConfirmToken;
|
|
use App\Support\Confirm\InvalidConfirmToken;
|
|
use App\Support\Os\OsDetector;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Str;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Attributes\On;
|
|
use Livewire\Attributes\Url;
|
|
use Livewire\Component;
|
|
use Throwable;
|
|
|
|
#[Layout('layouts.app')]
|
|
class Show extends Component
|
|
{
|
|
/** Route-model-bound by uuid (R11). */
|
|
public Server $server;
|
|
|
|
/** Active detail tab: 'overview' | 'docker' | 'terminal' (deep-linkable via ?tab=). */
|
|
#[Url]
|
|
public string $tab = 'overview';
|
|
|
|
/** Page <title>; localized at runtime (attributes can't call __()). */
|
|
public function title(): string
|
|
{
|
|
return __('servers.show_title');
|
|
}
|
|
|
|
public bool $connected = false;
|
|
|
|
public bool $ready = false;
|
|
|
|
public float $loadAvg = 0;
|
|
|
|
public array $volumes = [];
|
|
|
|
public array $interfaces = [];
|
|
|
|
public array $hardening = [];
|
|
|
|
/** Firewall state (installed/active/defaults/rules) for the Firewall-Regeln panel. */
|
|
public array $firewall = [];
|
|
|
|
/** fail2ban state (jails/banned IPs/whitelist) for the fail2ban-Status panel. */
|
|
public array $fail2ban = [];
|
|
|
|
/** Input for adding an IP/CIDR to the fail2ban whitelist. */
|
|
public string $newIgnoreIp = '';
|
|
|
|
/** Detected OS tooling (family/package manager/firewall) for the identity panel. */
|
|
public array $os = [];
|
|
|
|
public array $sshKeys = [];
|
|
|
|
/**
|
|
* Pull a live snapshot over SSH and persist identity/metrics onto the row.
|
|
* On any failure (no credential, unreachable) the page renders an offline
|
|
* state from the last persisted values instead of crashing.
|
|
*/
|
|
public function mount(): void
|
|
{
|
|
// Viewing a server's details makes it the ACTIVE server, so the sidebar switcher
|
|
// (and the scoped sections) reflect the server on screen. Set ONLY at mount — i.e.
|
|
// once per deliberate navigation — so a slow in-flight load() or a parallel tab
|
|
// can never write a stale value over a newer selection (the single-session active
|
|
// server is last-writer-wins; we keep writes to deliberate navigations only).
|
|
session(['active_server_id' => $this->server->id]);
|
|
|
|
// identity + gauges render from the persisted row immediately;
|
|
// the live snapshot loads lazily via wire:init -> load().
|
|
}
|
|
|
|
/** Lazy: pull the full SSH snapshot after the shell renders, behind skeletons. */
|
|
public function load(FleetService $fleet): void
|
|
{
|
|
try {
|
|
$snap = $fleet->snapshot($this->server);
|
|
$id = $snap['identity'];
|
|
$rootUsed = collect($snap['volumes'])->firstWhere('mount', '/')['used'] ?? $this->server->disk;
|
|
|
|
$this->server->forceFill([
|
|
'cpu' => $snap['metrics']['cpu'],
|
|
'mem' => $snap['metrics']['mem'],
|
|
'disk' => $rootUsed,
|
|
'os' => $id['os'],
|
|
'hostname' => $id['hostname'],
|
|
'uptime' => $id['uptime'],
|
|
'status' => 'online',
|
|
'last_seen_at' => now(),
|
|
'specs' => [
|
|
'cores' => $id['cores'],
|
|
'ram_gb' => $id['ram_gb'],
|
|
'disk_gb' => $id['disk_gb'],
|
|
'arch' => $id['arch'],
|
|
'kernel' => $id['kernel'],
|
|
'virt' => $id['virt'],
|
|
],
|
|
])->save();
|
|
|
|
$this->volumes = $snap['volumes'];
|
|
$this->interfaces = $snap['interfaces'];
|
|
$this->sshKeys = $snap['sshKeys'];
|
|
|
|
// Detected OS profile (cached) — surfaces the package manager + firewall
|
|
// tooling and drives which hardening features are offered.
|
|
try {
|
|
// fresh probe on each full load; primes the 1h cache the hardening,
|
|
// firewall and update reads reuse within this request cycle.
|
|
$profile = app(OsDetector::class)->detect($this->server, fresh: true);
|
|
$this->os = [
|
|
'familyLabel' => $profile->familyLabel(),
|
|
'packageManager' => $profile->packageManager,
|
|
'firewallTool' => $profile->firewallTool,
|
|
'serviceManager' => $profile->serviceManager,
|
|
];
|
|
} catch (Throwable) {
|
|
$this->os = [];
|
|
}
|
|
|
|
// Hardening state is a separate PRIVILEGED read (sshd -T + pkg checks).
|
|
try {
|
|
$this->hardening = app(HardeningService::class)->state($this->server);
|
|
} catch (Throwable) {
|
|
$this->hardening = [];
|
|
}
|
|
|
|
// Firewall rules/defaults (separate PRIVILEGED read; empty on failure).
|
|
try {
|
|
$this->firewall = app(FirewallService::class)->status($this->server);
|
|
} catch (Throwable) {
|
|
$this->firewall = [];
|
|
}
|
|
|
|
// fail2ban jails/banned IPs/whitelist (separate PRIVILEGED read).
|
|
try {
|
|
$this->fail2ban = app(Fail2banService::class)->status($this->server);
|
|
} catch (Throwable) {
|
|
$this->fail2ban = [];
|
|
}
|
|
$this->loadAvg = (float) ($snap['metrics']['load'] ?? 0);
|
|
$this->connected = true;
|
|
} catch (Throwable) {
|
|
$this->connected = false;
|
|
if ($this->server->status !== 'offline') {
|
|
$this->server->forceFill(['status' => 'offline'])->save();
|
|
}
|
|
}
|
|
|
|
$this->ready = true;
|
|
}
|
|
|
|
/** Refresh the live gauges from the poller-updated row (wire:poll). */
|
|
public function pollMetrics(): void
|
|
{
|
|
// Only the Übersicht tab shows live metrics; skip the refresh/re-render on Docker/Terminal.
|
|
if ($this->tab !== 'overview') {
|
|
return;
|
|
}
|
|
$this->server->refresh();
|
|
}
|
|
|
|
/**
|
|
* Revoke an SSH key (R5): opens the confirm modal, which writes the
|
|
* AuditEvent and re-dispatches `keyRemoved`. SSH layer removal lands later.
|
|
*/
|
|
public function confirmKeyRemoval(int $index): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-fleet'), 403);
|
|
|
|
$key = $this->sshKeys[$index] ?? null;
|
|
if ($key === null) {
|
|
return;
|
|
}
|
|
|
|
$fingerprint = $key['fingerprint'];
|
|
$comment = $key['comment'];
|
|
|
|
$this->dispatch('openModal',
|
|
component: 'modals.confirm-action',
|
|
arguments: [
|
|
'heading' => __('servers.confirm_remove_key_heading'),
|
|
'body' => __('servers.confirm_remove_key_body', ['name' => $comment, 'server' => $this->server->name]),
|
|
'confirmLabel' => __('common.remove'),
|
|
'danger' => true,
|
|
'icon' => 'trash',
|
|
'notify' => __('servers.notify_key_removed', ['name' => $comment]),
|
|
'token' => ConfirmToken::issue(
|
|
'keyRemoved',
|
|
['fingerprint' => $fingerprint],
|
|
'ssh_key.remove',
|
|
"{$comment} · {$this->server->name}",
|
|
$this->server->id,
|
|
),
|
|
],
|
|
);
|
|
}
|
|
|
|
/** Applies the confirmed key removal over SSH, then reloads the list. */
|
|
#[On('keyRemoved')]
|
|
public function removeKey(string $confirmToken, FleetService $fleet): void
|
|
{
|
|
// Re-gate on consume: ConfirmToken is uid-bound, not role-bound, so a token issued
|
|
// while the user could manage the fleet must still be refused after a demotion.
|
|
abort_unless(auth()->user()?->can('manage-fleet'), 403);
|
|
|
|
try {
|
|
$payload = ConfirmToken::consume($confirmToken, 'keyRemoved');
|
|
} catch (InvalidConfirmToken) {
|
|
return; // forged / replayed / direct-bypass attempt — no-op
|
|
}
|
|
if (($payload['serverId'] ?? null) !== $this->server->id) {
|
|
return; // token sealed for a different server — refuse to retarget
|
|
}
|
|
$fingerprint = $payload['params']['fingerprint'];
|
|
|
|
try {
|
|
$fleet->removeAuthorizedKey($this->server, $fingerprint);
|
|
} catch (Throwable $e) {
|
|
$this->dispatch('notify', message: __('servers.notify_remove_failed', ['error' => $e->getMessage()]));
|
|
|
|
return;
|
|
}
|
|
|
|
$this->reloadKeys($fleet);
|
|
}
|
|
|
|
/** Re-read the authorized keys after an add/remove. */
|
|
#[On('keyChanged')]
|
|
public function reloadKeys(FleetService $fleet): void
|
|
{
|
|
try {
|
|
$this->sshKeys = $fleet->sshKeys($this->server);
|
|
} catch (Throwable) {
|
|
// keep the current list on failure
|
|
}
|
|
}
|
|
|
|
/** Credential changed -> reconnect with the new login and re-pull the snapshot. */
|
|
#[On('credentialChanged')]
|
|
public function reloadAfterCredential(FleetService $fleet): void
|
|
{
|
|
$this->server->refresh();
|
|
$this->ready = false;
|
|
$this->load($fleet);
|
|
}
|
|
|
|
/** Open the file manager scoped to this server. */
|
|
public function openFiles()
|
|
{
|
|
session(['active_server_id' => $this->server->id]);
|
|
|
|
return $this->redirect(route('files.index'), navigate: true);
|
|
}
|
|
|
|
/**
|
|
* Toggle the credential between aktiv/gesperrt (sets/clears disabled_at).
|
|
* The CredentialVault already refuses a disabled credential, so this is the
|
|
* operator's kill-switch for a deposited login without deleting it.
|
|
*/
|
|
public function toggleCredential(): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-fleet'), 403);
|
|
|
|
$cred = $this->server->credential;
|
|
if (! $cred) {
|
|
return;
|
|
}
|
|
|
|
$disable = ! $cred->disabled;
|
|
$cred->forceFill(['disabled_at' => $disable ? now() : null])->save();
|
|
|
|
AuditEvent::create([
|
|
'user_id' => Auth::id(),
|
|
'server_id' => $this->server->id,
|
|
'actor' => Auth::user()?->name ?? 'system',
|
|
'action' => $disable ? 'credential.disable' : 'credential.enable',
|
|
'target' => $this->server->name.' · '.$cred->username,
|
|
'ip' => request()->ip(),
|
|
]);
|
|
|
|
$this->server->refresh();
|
|
$this->dispatch('notify', message: $disable ? __('servers.notify_access_locked') : __('servers.notify_access_unlocked'));
|
|
}
|
|
|
|
/**
|
|
* Delete the credential (R5): opens the confirm modal, which writes the
|
|
* AuditEvent and re-dispatches `credentialDeleted`.
|
|
*/
|
|
public function confirmDeleteCredential(): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-fleet'), 403);
|
|
|
|
$cred = $this->server->credential;
|
|
if (! $cred) {
|
|
return;
|
|
}
|
|
|
|
$this->dispatch('openModal',
|
|
component: 'modals.confirm-action',
|
|
arguments: [
|
|
'heading' => __('servers.confirm_delete_credential_heading'),
|
|
'body' => __('servers.confirm_delete_credential_body', ['server' => $this->server->name]),
|
|
'confirmLabel' => __('common.delete'),
|
|
'danger' => true,
|
|
'icon' => 'trash',
|
|
'notify' => __('servers.notify_access_deleted'),
|
|
'token' => ConfirmToken::issue(
|
|
'credentialDeleted',
|
|
[],
|
|
'credential.delete',
|
|
$this->server->name.' · '.$cred->username,
|
|
$this->server->id,
|
|
),
|
|
],
|
|
);
|
|
}
|
|
|
|
/** Applies the confirmed credential deletion, then refreshes the row. */
|
|
#[On('credentialDeleted')]
|
|
public function deleteCredential(string $confirmToken): void
|
|
{
|
|
// Re-gate on consume: ConfirmToken is uid-bound, not role-bound, so a token issued
|
|
// while the user could manage the fleet must still be refused after a demotion.
|
|
abort_unless(auth()->user()?->can('manage-fleet'), 403);
|
|
|
|
try {
|
|
$payload = ConfirmToken::consume($confirmToken, 'credentialDeleted');
|
|
} catch (InvalidConfirmToken) {
|
|
return; // forged / replayed / direct-bypass attempt — no-op
|
|
}
|
|
if (($payload['serverId'] ?? null) !== $this->server->id) {
|
|
return; // token sealed for a different server — refuse to retarget
|
|
}
|
|
|
|
$this->server->credential()->delete();
|
|
$this->server->refresh();
|
|
}
|
|
|
|
/**
|
|
* A hardening/firewall action was applied -> re-pull the snapshot so the
|
|
* checklist + firewall row reflect the new state.
|
|
*/
|
|
#[On('hardeningApplied')]
|
|
public function reloadSnapshot(): void
|
|
{
|
|
// A hardening/fail2ban toggle changes only the SECURITY reads. Re-probe the OS profile
|
|
// (a firewall "Aktivieren" may have just INSTALLED the tool the panels key off) and
|
|
// re-read the three security states — but keep the page rendered (no skeleton flip)
|
|
// and skip the full metrics/volumes/keys snapshot: that halves the SSH round-trips
|
|
// and the operator sees the page update in place instead of a long blank reload.
|
|
// The Sicherheit/Firewall panels show a wire:loading cue targeting this method.
|
|
$this->server->refresh();
|
|
|
|
try {
|
|
$profile = app(OsDetector::class)->detect($this->server, fresh: true);
|
|
$this->os = [
|
|
'familyLabel' => $profile->familyLabel(),
|
|
'packageManager' => $profile->packageManager,
|
|
'firewallTool' => $profile->firewallTool,
|
|
'serviceManager' => $profile->serviceManager,
|
|
];
|
|
} catch (Throwable) {
|
|
// keep the current profile on failure
|
|
}
|
|
|
|
try {
|
|
$this->hardening = app(HardeningService::class)->state($this->server);
|
|
} catch (Throwable) {
|
|
$this->hardening = [];
|
|
}
|
|
|
|
try {
|
|
$this->firewall = app(FirewallService::class)->status($this->server);
|
|
} catch (Throwable) {
|
|
$this->firewall = [];
|
|
}
|
|
|
|
try {
|
|
$this->fail2ban = app(Fail2banService::class)->status($this->server);
|
|
} catch (Throwable) {
|
|
$this->fail2ban = [];
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Delete a firewall rule (R5): opens the confirm modal, which writes the
|
|
* AuditEvent and re-dispatches `firewallRuleDelete` (handled below).
|
|
*/
|
|
public function confirmDeleteRule(int $index): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-network'), 403);
|
|
|
|
$rule = $this->firewall['rules'][$index] ?? null;
|
|
if ($rule === null) {
|
|
return;
|
|
}
|
|
$spec = $rule['spec'] ?? '';
|
|
$label = $rule['label'] ?? ($rule['raw'] ?? $spec);
|
|
|
|
$this->dispatch('openModal',
|
|
component: 'modals.confirm-action',
|
|
arguments: [
|
|
'heading' => __('servers.confirm_remove_rule_heading'),
|
|
'body' => __('servers.confirm_remove_rule_body', ['label' => $label, 'server' => $this->server->name]),
|
|
'confirmLabel' => __('common.remove'),
|
|
'danger' => true,
|
|
'icon' => 'trash',
|
|
// No premature audit/notify — the handler records the real outcome
|
|
// only after the remote command returns (audit reflects success).
|
|
'notify' => '',
|
|
'token' => ConfirmToken::issue(
|
|
'firewallRuleDelete',
|
|
['spec' => $spec, 'label' => $label],
|
|
serverId: $this->server->id,
|
|
),
|
|
],
|
|
);
|
|
}
|
|
|
|
/** Applies the confirmed rule deletion over SSH, then audits + reloads on success. */
|
|
#[On('firewallRuleDelete')]
|
|
public function deleteFirewallRule(string $confirmToken, FirewallService $firewall): void
|
|
{
|
|
// Re-gate on consume: ConfirmToken is uid-bound, not role-bound, so a token issued
|
|
// while the user could manage the network must still be refused after a demotion.
|
|
abort_unless(auth()->user()?->can('manage-network'), 403);
|
|
|
|
try {
|
|
$payload = ConfirmToken::consume($confirmToken, 'firewallRuleDelete');
|
|
} catch (InvalidConfirmToken) {
|
|
return; // forged / replayed / direct-bypass attempt — no-op
|
|
}
|
|
if (($payload['serverId'] ?? null) !== $this->server->id) {
|
|
return; // token sealed for a different server — refuse to retarget
|
|
}
|
|
$spec = $payload['params']['spec'];
|
|
$label = $payload['params']['label'];
|
|
|
|
try {
|
|
$res = $firewall->deleteRule($this->server, $spec);
|
|
} catch (Throwable $e) {
|
|
$this->dispatch('notify', message: __('servers.notify_remove_failed', ['error' => Str::limit($e->getMessage(), 90)]));
|
|
|
|
return;
|
|
}
|
|
|
|
// The rule was already gone — inform, refresh, but do NOT audit a non-event.
|
|
if (! empty($res['notFound'])) {
|
|
$this->dispatch('notify', message: __('servers.notify_rule_not_found'));
|
|
$this->reloadFirewall($firewall);
|
|
|
|
return;
|
|
}
|
|
|
|
if (! $res['ok']) {
|
|
$this->dispatch('notify', message: __('servers.notify_remove_failed', ['error' => Str::limit($res['output'] ?: __('servers.error_unknown'), 90)]));
|
|
|
|
return;
|
|
}
|
|
|
|
AuditEvent::create([
|
|
'user_id' => Auth::id(),
|
|
'server_id' => $this->server->id,
|
|
'actor' => Auth::user()?->name ?? 'system',
|
|
'action' => 'firewall.rule_delete',
|
|
'target' => $label.' · '.$this->server->name,
|
|
'ip' => request()->ip(),
|
|
]);
|
|
|
|
$this->dispatch('notify', message: __('servers.notify_firewall_rule_removed'));
|
|
$this->reloadFirewall($firewall);
|
|
}
|
|
|
|
/** Re-read the firewall state after an add/delete/default change. */
|
|
#[On('firewallChanged')]
|
|
public function reloadFirewall(FirewallService $firewall): void
|
|
{
|
|
try {
|
|
$this->firewall = $firewall->status($this->server);
|
|
} catch (Throwable) {
|
|
// keep the current state on failure
|
|
}
|
|
}
|
|
|
|
/** Unban a fail2ban IP — recovery action, so a direct (audited) click, no R5 modal. */
|
|
public function unbanIp(string $jail, string $ip, Fail2banService $fail2ban): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-network'), 403);
|
|
|
|
try {
|
|
$res = $fail2ban->unban($this->server, $jail, $ip);
|
|
} catch (Throwable $e) {
|
|
$this->dispatch('notify', message: __('servers.notify_unban_failed', ['error' => Str::limit($e->getMessage(), 90)]));
|
|
|
|
return;
|
|
}
|
|
if (! $res['ok']) {
|
|
$this->dispatch('notify', message: __('servers.notify_unban_failed', ['error' => Str::limit($res['output'] ?: __('servers.error_unknown'), 90)]));
|
|
|
|
return;
|
|
}
|
|
|
|
$this->audit('fail2ban.unban', $ip.' · '.$jail.' · '.$this->server->name);
|
|
$this->dispatch('notify', message: __('servers.notify_ip_unbanned', ['ip' => $ip]));
|
|
$this->reloadFail2ban($fail2ban);
|
|
}
|
|
|
|
/** Add an IP/CIDR to the fail2ban whitelist (ignoreip) — non-destructive, direct + audited. */
|
|
public function addIgnore(Fail2banService $fail2ban): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-network'), 403);
|
|
|
|
$ip = trim($this->newIgnoreIp);
|
|
if ($ip === '') {
|
|
return;
|
|
}
|
|
|
|
try {
|
|
$res = $fail2ban->addIgnoreIp($this->server, $ip);
|
|
} catch (Throwable $e) {
|
|
$this->dispatch('notify', message: __('servers.notify_whitelist_error', ['error' => Str::limit($e->getMessage(), 90)]));
|
|
|
|
return;
|
|
}
|
|
if (! $res['ok']) {
|
|
$this->dispatch('notify', message: __('servers.notify_whitelist_error', ['error' => Str::limit($res['output'] ?: __('servers.error_failed'), 90)]));
|
|
|
|
return;
|
|
}
|
|
if (! empty($res['noop'])) {
|
|
$this->newIgnoreIp = '';
|
|
$this->dispatch('notify', message: $res['output']);
|
|
|
|
return;
|
|
}
|
|
|
|
$this->audit('fail2ban.ignoreip_add', $ip.' · '.$this->server->name);
|
|
$this->newIgnoreIp = '';
|
|
$this->dispatch('notify', message: __('servers.notify_ip_whitelisted', ['ip' => $ip]));
|
|
$this->reloadFail2ban($fail2ban);
|
|
}
|
|
|
|
/** Remove an IP/CIDR from the fail2ban whitelist — direct + audited (loopback is refused by the service). */
|
|
public function removeIgnore(string $ip, Fail2banService $fail2ban): void
|
|
{
|
|
abort_unless(auth()->user()?->can('manage-network'), 403);
|
|
|
|
try {
|
|
$res = $fail2ban->removeIgnoreIp($this->server, $ip);
|
|
} catch (Throwable $e) {
|
|
$this->dispatch('notify', message: __('servers.notify_whitelist_error', ['error' => Str::limit($e->getMessage(), 90)]));
|
|
|
|
return;
|
|
}
|
|
if (! $res['ok']) {
|
|
$this->dispatch('notify', message: __('servers.notify_whitelist_error', ['error' => Str::limit($res['output'] ?: __('servers.error_failed'), 90)]));
|
|
|
|
return;
|
|
}
|
|
if (! empty($res['noop'])) {
|
|
$this->dispatch('notify', message: $res['output']);
|
|
|
|
return;
|
|
}
|
|
|
|
$this->audit('fail2ban.ignoreip_remove', $ip.' · '.$this->server->name);
|
|
$this->dispatch('notify', message: __('servers.notify_ip_unwhitelisted', ['ip' => $ip]));
|
|
$this->reloadFail2ban($fail2ban);
|
|
}
|
|
|
|
/** Re-read fail2ban state after an unban/ban/whitelist change. */
|
|
#[On('fail2banChanged')]
|
|
public function reloadFail2ban(Fail2banService $fail2ban): void
|
|
{
|
|
try {
|
|
$this->fail2ban = $fail2ban->status($this->server);
|
|
} catch (Throwable) {
|
|
// keep the current state on failure
|
|
}
|
|
}
|
|
|
|
/** Write one AuditEvent for a fail2ban action (success path only). */
|
|
private function audit(string $action, string $target): void
|
|
{
|
|
AuditEvent::create([
|
|
'user_id' => Auth::id(),
|
|
'server_id' => $this->server->id,
|
|
'actor' => Auth::user()?->name ?? 'system',
|
|
'action' => $action,
|
|
'target' => $target,
|
|
'ip' => request()->ip(),
|
|
]);
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
return view('livewire.servers.show')->title($this->title());
|
|
}
|
|
}
|