292 lines
17 KiB
PHP
292 lines
17 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\HoneypotController;
|
|
use App\Http\Middleware\BlockBannedIp;
|
|
use App\Http\Middleware\EnsureSecurityOnboarded;
|
|
use App\Http\Middleware\SetLocale;
|
|
use App\Http\Middleware\VerifyTerminalSidecarSecret;
|
|
use App\Livewire\Alerts;
|
|
use App\Livewire\Audit;
|
|
use App\Livewire\Auth;
|
|
use App\Livewire\Commands;
|
|
use App\Livewire\Dashboard;
|
|
use App\Livewire\Docker;
|
|
use App\Livewire\Files;
|
|
use App\Livewire\Help;
|
|
use App\Livewire\Patch;
|
|
use App\Livewire\Posture;
|
|
use App\Livewire\Release;
|
|
use App\Livewire\Servers;
|
|
use App\Livewire\Services;
|
|
use App\Livewire\Settings;
|
|
use App\Livewire\System;
|
|
use App\Livewire\Terminal;
|
|
use App\Livewire\Threats;
|
|
use App\Livewire\Versions;
|
|
use App\Livewire\Wireguard;
|
|
use App\Models\HostCredential;
|
|
use App\Models\Server;
|
|
use App\Models\TerminalSession;
|
|
use App\Services\DeploymentService;
|
|
use App\Services\MetricHistory;
|
|
use App\Services\WgStatus;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth as AuthFacade;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
// Language switch (public — also usable from the login page). Persists to the signed-in
|
|
// user and the session; only known locales (R16) are accepted, then we return back.
|
|
Route::get('/locale/{locale}', function (Request $request, string $locale) {
|
|
if (in_array($locale, SetLocale::SUPPORTED, true)) {
|
|
$request->session()->put('locale', $locale);
|
|
if ($user = $request->user()) {
|
|
$user->forceFill(['locale' => $locale])->save();
|
|
}
|
|
}
|
|
|
|
return redirect()->back();
|
|
})->name('locale.set');
|
|
|
|
// Caddy on-demand TLS gate: Caddy calls this before issuing a certificate for a host.
|
|
// Approve ONLY the configured panel domain, so Caddy can never be tricked into
|
|
// requesting certs for arbitrary domains pointed at this IP (rate-limit abuse).
|
|
Route::get('/_caddy/ask', function (Request $request, DeploymentService $deployment) {
|
|
$asked = strtolower(trim((string) $request->query('domain')));
|
|
$domain = $deployment->domain();
|
|
|
|
abort_unless($domain !== null && $asked !== '' && $asked === $domain && ! $deployment->externalTls(), 403);
|
|
|
|
return response('ok', 200);
|
|
})->name('caddy.ask');
|
|
|
|
// Lightweight PUBLIC version probe. The update-progress page polls this to detect when the
|
|
// rebuilt app is actually live (the running version moved past the pre-update one) — the OLD
|
|
// container keeps answering /up throughout the long build, so /up alone can't signal completion.
|
|
Route::get('/version.json', fn () => response()->json(['version' => (string) config('clusev.version')]))->name('version.json');
|
|
|
|
// Coarse update-progress feed. The host updater (update.sh / install.sh) writes a macro-stage to
|
|
// run/update-phase.json (bind-mounted to storage/app/restart-signal/); the update-progress page
|
|
// polls this to show REAL progress (fetch → build → restart → migrate → done) instead of a time
|
|
// guess. PUBLIC and only ever echoes a whitelisted stage token — never any sensitive data.
|
|
Route::get('/update-status.json', function (DeploymentService $deployment) {
|
|
$phase = $deployment->updatePhase();
|
|
|
|
return response()->json(['stage' => $phase['stage'] ?? null, 'at' => $phase['at'] ?? 0]);
|
|
})->name('update.status');
|
|
|
|
// INTERNAL: the terminal sidecar exchanges a single-use token for a connection spec. Authenticated by
|
|
// the shared secret (VerifyTerminalSidecarSecret) and only routed on the private Docker network — it
|
|
// returns DECRYPTED SSH credentials, so it must never be publicly reachable. Token is burned on use.
|
|
Route::post('/_internal/terminal/resolve', function (Request $request) {
|
|
$token = (string) $request->input('token');
|
|
|
|
// Burn the token ATOMICALLY: a single conditional UPDATE (used_at IS NULL AND not expired) — the
|
|
// DB row-locks it, so two racing resolves can never both succeed and open two PTYs from one token.
|
|
$burned = TerminalSession::where('token', $token)
|
|
->whereNull('used_at')
|
|
->where('expires_at', '>', now())
|
|
->update(['used_at' => now()]);
|
|
|
|
abort_if($burned !== 1, 404);
|
|
$session = TerminalSession::where('token', $token)->firstOrFail();
|
|
|
|
// The "Clusev host" terminal is a real SSH login into the host machine, configured by the operator
|
|
// (HostCredential). Hand the sidecar a server-shaped SSH spec — the decrypted login goes only over
|
|
// the internal network, never to the browser. No configured login → 404 (the UI gates this anyway).
|
|
if ($session->kind === 'host') {
|
|
$hc = HostCredential::current();
|
|
abort_if($hc === null, 404);
|
|
|
|
return response()->json([
|
|
'kind' => 'server',
|
|
'host' => $hc->host,
|
|
'port' => $hc->port ?: 22,
|
|
'username' => $hc->username,
|
|
'auth_type' => $hc->auth_type,
|
|
'secret' => $hc->secret, // decrypted by the model cast; internal net only
|
|
'passphrase' => $hc->passphrase,
|
|
'host_key' => null, // the host has no fleet TOFU pin (local machine)
|
|
]);
|
|
}
|
|
|
|
$server = $session->server()->with('credential')->first();
|
|
$cred = $server?->credential;
|
|
abort_if($server === null || $cred === null || $cred->disabled_at !== null, 404);
|
|
|
|
return response()->json([
|
|
'kind' => 'server',
|
|
'host' => $server->ip,
|
|
'port' => $server->ssh_port ?: 22,
|
|
'username' => $cred->username,
|
|
'auth_type' => $cred->auth_type,
|
|
'secret' => $cred->secret, // 'encrypted' cast → decrypted here; sent only over the internal net
|
|
'passphrase' => $cred->passphrase, // decrypted or null
|
|
// The TOFU-pinned host key (phpseclib getServerPublicHostKey, "<algo> <base64>"); the sidecar
|
|
// pins the SSH connection against it. Null when the server was never contacted → unpinned.
|
|
'host_key' => $server->ssh_host_key,
|
|
]);
|
|
})->middleware(VerifyTerminalSidecarSecret::class)->name('internal.terminal.resolve');
|
|
|
|
// ── Honeypot decoy paths ────────────────────────────────────────────────────────────────────
|
|
// Well-known scanner/exploit targets that NO legitimate client ever visits. Every hit is a hostile
|
|
// probe → HoneypotController::trap logs it, instant-bans the source IP, and serves a convincing fake
|
|
// body (BruteforceGuard::banNow no-ops for exempt/loopback IPs). Route::any so probes on any verb
|
|
// (GET/POST/HEAD) are caught. These paths were checked against the real top-level routes above
|
|
// (/locale, /_caddy/ask, /version.json, /update-status.json, /_internal/*) and the auth groups
|
|
// below (/login, /dashboard, …) — none collide. The two dotfile decoys (/.env, /.git/config) are
|
|
// additionally allowed through the nginx dotfile-deny guard (docker/nginx/nginx.conf).
|
|
// The decoys drop BlockBannedIp so an already-banned prober stays INSIDE the deception (always fed a
|
|
// fake, never a real 403 that reveals the panel) while the ban still keeps them off the REAL routes.
|
|
// CSRF is exempt for these paths in bootstrap/app.php (so a POSTed fake login is trapped, not 419'd).
|
|
// DetectHoneytoken stays on, so a canary submitted into the fake form is still caught.
|
|
Route::withoutMiddleware([BlockBannedIp::class])->group(function () {
|
|
Route::any('/.env', [HoneypotController::class, 'trap'])->name('honeypot.env');
|
|
Route::any('/.git/config', [HoneypotController::class, 'trap'])->name('honeypot.git');
|
|
Route::any('/wp-login.php', [HoneypotController::class, 'trap'])->name('honeypot.wp-login');
|
|
Route::any('/wp-admin', [HoneypotController::class, 'trap'])->name('honeypot.wp-admin');
|
|
Route::any('/wp-admin/{path?}', [HoneypotController::class, 'trap'])->where('path', '.*')->name('honeypot.wp-admin.path');
|
|
Route::any('/xmlrpc.php', [HoneypotController::class, 'trap'])->name('honeypot.xmlrpc');
|
|
Route::any('/phpmyadmin', [HoneypotController::class, 'trap'])->name('honeypot.phpmyadmin');
|
|
Route::any('/phpmyadmin/{path?}', [HoneypotController::class, 'trap'])->where('path', '.*')->name('honeypot.phpmyadmin.path');
|
|
Route::any('/administrator', [HoneypotController::class, 'trap'])->name('honeypot.administrator');
|
|
Route::any('/admin.php', [HoneypotController::class, 'trap'])->name('honeypot.admin-php');
|
|
Route::any('/adminer.php', [HoneypotController::class, 'trap'])->name('honeypot.adminer');
|
|
Route::any('/config.json', [HoneypotController::class, 'trap'])->name('honeypot.config-json');
|
|
Route::any('/vendor/{path?}', [HoneypotController::class, 'trap'])->where('path', '.*')->name('honeypot.vendor');
|
|
Route::any('/cgi-bin/{path?}', [HoneypotController::class, 'trap'])->where('path', '.*')->name('honeypot.cgi-bin');
|
|
Route::any('/solr/{path?}', [HoneypotController::class, 'trap'])->where('path', '.*')->name('honeypot.solr');
|
|
Route::any('/actuator/{path?}', [HoneypotController::class, 'trap'])->where('path', '.*')->name('honeypot.actuator');
|
|
});
|
|
|
|
Route::middleware('guest')->group(function () {
|
|
Route::get('/login', Auth\Login::class)->name('login');
|
|
Route::get('/forgot-password', Auth\ForgotPassword::class)->name('password.request');
|
|
Route::get('/reset-password/{token}', Auth\ResetPassword::class)->name('password.reset');
|
|
Route::get('/two-factor-challenge', Auth\TwoFactorChallenge::class)->name('two-factor.challenge');
|
|
Route::get('/two-factor-challenge/backup', Auth\TwoFactorBackup::class)->name('two-factor.challenge.backup');
|
|
});
|
|
|
|
Route::middleware('auth')->group(function () {
|
|
// Security onboarding — reachable before the panel is unlocked.
|
|
Route::get('/password', Auth\PasswordChange::class)->name('password.change');
|
|
Route::get('/two-factor-setup', Auth\TwoFactorSetup::class)->name('two-factor.setup');
|
|
|
|
// 2FA backup-codes download — the codes themselves are shown in a modal (Modals\RecoveryCodes).
|
|
// POST (not GET): consuming the one-time grant is a state change, so it must carry a CSRF
|
|
// token — a cross-site GET cannot burn the victim's grant.
|
|
Route::post('/two-factor/recovery-codes/download', function () {
|
|
// One download per fresh generation, and only briefly. The grant is a timestamp put
|
|
// alongside the codes when they are freshly generated/regenerated. pull() consumes it
|
|
// (single-use, so re-downloading stored codes by hitting this route directly 403s),
|
|
// and a grant older than 10 minutes — or any non-timestamp value — is rejected, so an
|
|
// unused grant cannot linger and be replayed later in the session. ->block() below
|
|
// serializes racing reads of the grant.
|
|
$grantedAt = session()->pull('2fa.download_grant');
|
|
$age = is_int($grantedAt) ? now()->timestamp - $grantedAt : null;
|
|
// Valid only within [now-600s, now]: rejects stale, non-timestamp, and future grants.
|
|
abort_unless($age !== null && $age >= 0 && $age <= 600, 403);
|
|
|
|
$codes = AuthFacade::user()->recoveryCodes();
|
|
|
|
return response()->streamDownload(
|
|
fn () => print (implode("\n", $codes)."\n"),
|
|
'clusev-recovery-codes.txt',
|
|
['Content-Type' => 'text/plain; charset=UTF-8'],
|
|
);
|
|
})->name('two-factor.recovery.download')
|
|
// Session blocking (Redis-backed atomic lock) serializes concurrent same-session
|
|
// requests so the one-time `2fa.download_grant` cannot be double-read by a racing
|
|
// request. True concurrency cannot be unit-tested; lock-capable stores (redis in
|
|
// prod, array/file in tests) keep the happy path green.
|
|
->block(5, 5);
|
|
|
|
Route::post('/logout', function () {
|
|
AuthFacade::logout();
|
|
session()->invalidate();
|
|
session()->regenerateToken();
|
|
|
|
return redirect()->route('login');
|
|
})->name('logout');
|
|
|
|
// The panel — requires completed onboarding (seeded password rotated).
|
|
Route::middleware(EnsureSecurityOnboarded::class)->group(function () {
|
|
Route::get('/', Dashboard::class)->name('dashboard');
|
|
|
|
Route::get('/servers', Servers\Index::class)->name('servers.index');
|
|
// MUST be registered before /servers/{server}, or "groups" is captured as a server uuid.
|
|
Route::get('/servers/groups', Servers\Groups::class)->middleware('can:manage-fleet')->name('servers.groups');
|
|
Route::get('/servers/{server}', Servers\Show::class)->name('servers.show');
|
|
|
|
// History-graph data for the Server-Details chart (the Alpine island fetches this per range).
|
|
Route::get('/servers/{server}/history.json', function (Server $server, Request $request, MetricHistory $history) {
|
|
$ranges = ['1h' => 3600, '24h' => 86400, '7d' => 604800, '30d' => 2592000];
|
|
$window = $ranges[$request->query('range', '24h')] ?? 86400;
|
|
|
|
return response()->json($history->series($server, $window));
|
|
})->name('servers.history');
|
|
|
|
Route::get('/services', Services\Index::class)->name('services.index');
|
|
Route::get('/docker', Docker\Index::class)->name('docker');
|
|
Route::get('/commands', Commands\Index::class)->middleware('can:operate')->name('commands');
|
|
Route::get('/files', Files\Index::class)->name('files.index');
|
|
Route::get('/audit', Audit\Index::class)->name('audit.index');
|
|
|
|
// Honeypot intelligence dashboard — admin-only (defense-in-depth: the route middleware here
|
|
// AND Threats\Index::mount() abort_unless both gate on manage-panel).
|
|
Route::get('/threats', Threats\Index::class)->name('threats')->middleware('can:manage-panel');
|
|
Route::get('/alerts', Alerts\Index::class)->middleware('can:manage-panel')->name('alerts');
|
|
|
|
Route::get('/settings', Settings\Index::class)->name('settings');
|
|
Route::get('/versions', Versions\Index::class)->name('versions');
|
|
Route::get('/system', System\Index::class)->name('system');
|
|
Route::get('/posture', Posture\Index::class)->middleware('can:operate')->name('posture');
|
|
Route::get('/patch', Patch\Index::class)->middleware('can:operate')->name('patch');
|
|
Route::get('/help', Help\Index::class)->name('help');
|
|
Route::get('/wireguard', Wireguard\Index::class)->middleware('can:manage-network')->name('wireguard');
|
|
Route::get('/terminal', Terminal\Index::class)->name('terminal');
|
|
|
|
// Dev-only Release page — first of the gating triple (spec): the route is registered ONLY when
|
|
// the flag is on, so with it off /release does not exist (uncached route file is re-included
|
|
// per request, so the flag is honoured). Release\Index::mount() abort_unless(...) is the second
|
|
// guard (covers a cached route file); the sidebar item is flag-gated too (third).
|
|
if (config('clusev.release_controls')) {
|
|
Route::get('/release', Release\Index::class)->name('release');
|
|
}
|
|
|
|
Route::get('/wg-status.json', fn (WgStatus $wg) => response()->json($wg->read()))->name('wg.status');
|
|
|
|
// Plain Blade view — deliberately NOT a Livewire component so it survives the
|
|
// container teardown that follows an update request (R1/R2 exception, by design).
|
|
Route::get('/update-progress', function (Request $request, DeploymentService $deployment) {
|
|
$parsed = parse_url((string) $request->query('return', ''), PHP_URL_PATH);
|
|
$return = (is_string($parsed) && str_starts_with($parsed, '/') && ! str_starts_with($parsed, '//')) ? $parsed : '/';
|
|
// Pre-update version (sanitised to the semver charset). The page finishes only once the
|
|
// running version has moved past this — see resources/views/update-progress.blade.php.
|
|
$from = preg_replace('/[^0-9A-Za-z.\-]/', '', (string) $request->query('from', ''));
|
|
|
|
// Server-side update start + current macro-stage so the page is REFRESH-PROOF: the
|
|
// elapsed timer counts from the real start, and the checklist resumes at the live phase
|
|
// (not back to phase one). A stage is only trusted when we know when THIS update began
|
|
// (startedAt, written by requestUpdate) AND the stage was written at/after it — so a
|
|
// leftover stage from a previous run can never drive the checklist or a premature finish.
|
|
$startedAt = $deployment->updateStartedAt();
|
|
$phase = $deployment->updatePhase();
|
|
$stageIndex = ['fetch' => 0, 'build' => 1, 'restart' => 2, 'migrate' => 3, 'done' => 4];
|
|
$initialPhase = 0;
|
|
$hasFeed = false; // a fresh real stage exists → drive the checklist from the feed, not the time guess
|
|
if ($phase !== null && $startedAt !== null && $phase['at'] >= $startedAt - 5) {
|
|
$initialPhase = $stageIndex[$phase['stage']] ?? 0;
|
|
$hasFeed = true;
|
|
}
|
|
|
|
return view('update-progress', [
|
|
'returnPath' => $return,
|
|
'fromVersion' => $from,
|
|
'startedAt' => $startedAt,
|
|
'initialPhase' => $initialPhase,
|
|
'hasFeed' => $hasFeed,
|
|
]);
|
|
})->name('update.progress');
|
|
});
|
|
});
|