Merge pull request #37 from sjtug/wip-refactor-json-api

Refactor JSON API
sjtug · Mar 3, 2018 · 1179a6b · 1179a6b
2 parents c1e9564 + 94bc2ac
commit 1179a6b
Show file tree

Hide file tree

Showing 5 changed files with 37 additions and 55 deletions.
diff --git a/Caddyfile.template b/Caddyfile.template
@@ -5,6 +5,23 @@
 {{/* input data source should be named as "cfg": -d cfg=config.yaml */}}
 {{ $cfg := (ds "cfg") }}
 
+{{/* address of lug backend */}}
+{{ $lug_addr := "127.0.0.1:7001" }}
+
+{{/* configure methods to protect your admin API */}}
+{{ define "login_config" }}
+    {{/* by default this uses Github OAuth, change it to your needs! */}}
+    {{/* the sample OAuth application only allows redirection to 127.0.0.1:2015, so register your own OAuth App! */}}
+    github client_id=d8d4b5b349b0172af159,client_secret=aa4a70fe46d309220fefce5a567a0a884dea715b
+    jwt_expiry 24h
+    cookie_expiry 2400h
+{{ end }}
+
+{{ define "jwt_config" }}
+    {{/* only allow username=htfy96 */}}
+    allow sub htfy96
+{{ end }}
+
 {{define "serve_local_common_config"}}
     log stdout
     ratelimit / 32 32 second
@@ -27,6 +44,22 @@
 # Exposed at :9180
 / {
     prometheus
+
+    # API
+    proxy /lug/ {{$lug_addr}} {
+        {{ template "reverse_proxy_common_proxy_config" }}
+    }
+
+    jwt {
+        path /lug/v1/admin
+        {{ template "jwt_config" }}
+    }
+
+    login {
+        {{ template "login_config" }}
+    }
+    ratelimit / 4 8 second
+    gzip
 }
 
 {{ range $name, $worker := $cfg.repos }}
@@ -49,11 +82,3 @@
 {{ end }} {{/* if $worker */}}
 {{ end }} {{/* range */}}
 
-# API
-/lug {
-    proxy / lug:7001 {
-        {{ template "reverse_proxy_common_proxy_config" }}
-    }
-    ratelimit / 4 8 second
-    gzip
-}
diff --git a/config.example.yaml b/config.example.yaml
@@ -11,10 +11,6 @@ exporter_address: :8081
 # Address where JSON API will be served
 json_api:
     address: :7001
-    # certfile: "/foobar/tls.cer"
-    # keyfile: "/foobar/foobar.com.key"
-    # username: "example"
-    # password: "example"
 
 repos:
     - type: rsync

diff --git a/config/config.go b/config/config.go
@@ -15,14 +15,6 @@ type RepoConfig map[string]string
 type JsonAPIConfig struct {
 	// The address that lug listens for JSON API
 	Address string
-	// HTTP basic auth username
-	Username string
-	// HTTP basic auth password
-	Password string
-	// Https certfile
-	CertFile string
-	// Https keyfile
-	KeyFile string
 }
 
 type LogStashConfig struct {

diff --git a/main.go b/main.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/cheshir/logrustash"
 	"github.com/davecgh/go-spew/spew"
-	"github.com/goji/httpauth"
 	log "github.com/sirupsen/logrus"
 	"github.com/sjtug/lug/config"
 	"github.com/sjtug/lug/exporter"
@@ -31,10 +30,6 @@ type CommandFlags struct {
 	license      bool
 	jsonAPIAddr  string
 	exporterAddr string
-	certFile     string
-	keyFile      string
-	apiUser      string
-	apiPassword  string
 }
 
 // parse command line options and return CommandFlags
@@ -45,10 +40,6 @@ func getFlags() (flags CommandFlags) {
 	flag.BoolVarP(&flags.version, "version", "v", false, "Prints version of lug")
 	flag.StringVarP(&flags.jsonAPIAddr, "jsonapi", "j", "", "JSON API Address")
 	flag.StringVarP(&flags.exporterAddr, "exporter", "e", "", "Exporter Address")
-	flag.StringVar(&flags.certFile, "cert", "", "HTTPS Cert file of JSON API")
-	flag.StringVar(&flags.keyFile, "key", "", "HTTPS Key file of JSON API")
-	flag.StringVarP(&flags.apiUser, "api-user", "u", "", "User for authentication of JSON API")
-	flag.StringVarP(&flags.apiPassword, "api-password", "p", "", "Password for authentication of JSON API")
 	flag.Parse()
 	return
 }
@@ -76,10 +67,6 @@ func init() {
 
 	cfgViper := config.CfgViper
 	cfgViper.BindPFlag("json_api.address", flag.Lookup("jsonapi"))
-	cfgViper.BindPFlag("json_api.certfile", flag.Lookup("cert"))
-	cfgViper.BindPFlag("json_api.keyfile", flag.Lookup("key"))
-	cfgViper.BindPFlag("json_api.username", flag.Lookup("api-user"))
-	cfgViper.BindPFlag("json_api.password", flag.Lookup("api-password"))
 	cfgViper.BindPFlag("exporter_address", flag.Lookup("exporter"))
 
 	if flags.version {
@@ -117,25 +104,7 @@ func main() {
 	}
 	jsonapi := manager.NewRestfulAPI(m)
 	handler := jsonapi.GetAPIHandler()
-	if cfg.JsonAPIConfig.Username != "" && cfg.JsonAPIConfig.Password != "" {
-		auth := httpauth.BasicAuth(httpauth.AuthOptions{
-			Realm:    "Require authentication",
-			User:     cfg.JsonAPIConfig.Username,
-			Password: cfg.JsonAPIConfig.Password,
-		})
-		handler = auth(handler)
-	}
-	if cfg.JsonAPIConfig.KeyFile == "" || cfg.JsonAPIConfig.CertFile == "" {
-		if cfg.JsonAPIConfig.Username != "" && cfg.JsonAPIConfig.Password != "" {
-			log.Warn("JSON API with HTTP auth without TLS/SSL is vulnerable")
-		}
-		log.Infof("Http JSON API listening on %s", cfg.JsonAPIConfig.Address)
-		go http.ListenAndServe(cfg.JsonAPIConfig.Address, handler)
-	} else {
-		log.Infof("Https JSON API listening on %s with certfile %s and keyfile %s", cfg.JsonAPIConfig.Address,
-			cfg.JsonAPIConfig.CertFile, cfg.JsonAPIConfig.KeyFile)
-		go http.ListenAndServeTLS(cfg.JsonAPIConfig.Address, cfg.JsonAPIConfig.CertFile, cfg.JsonAPIConfig.KeyFile, handler)
-	}
+	go http.ListenAndServe(cfg.JsonAPIConfig.Address, handler)
 
 	go exporter.Expose(cfg.ExporterAddr)
 	m.Run()

diff --git a/manager/json_rest.go b/manager/json_rest.go
@@ -26,9 +26,9 @@ func (r *RestfulAPI) GetAPIHandler() http.Handler {
 	router, err := rest.MakeRouter(
 		rest.Get("/lug/v1/manager", r.getManagerStatusDetail),
 		rest.Get("/lug/v1/manager/summary", r.getManagerStatusSummary),
-		rest.Post("/lug/v1/manager/start", r.startManager),
-		rest.Post("/lug/v1/manager/stop", r.stopManager),
-		rest.Delete("/lug/v1/manager", r.exitManager),
+		rest.Post("/lug/v1/admin/manager/start", r.startManager),
+		rest.Post("/lug/v1/admin/manager/stop", r.stopManager),
+		rest.Delete("/lug/v1/admin/manager", r.exitManager),
 	)
 	if err != nil {
 		log.Fatal(err)