Skip to content

Commit 5356400

Browse files
EmyrkEmyrk
committed
Pull app security key from primary
1 parent d237b19 commit 5356400

File tree

6 files changed

+37
-62
lines changed

6 files changed

+37
-62
lines changed

‎cli/server.go

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -621,17 +621,6 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
621621
}
622622
}
623623

624-
if cfg.Dangerous.DevAppSecurityKey.Value() != "" {
625-
_, err := workspaceapps.KeyFromString(cfg.Dangerous.DevAppSecurityKey.Value())
626-
if err != nil {
627-
return xerrors.Errorf("invalid dev app security key: %w", err)
628-
}
629-
err = tx.UpsertAppSecurityKey(ctx, cfg.Dangerous.DevAppSecurityKey.Value())
630-
if err != nil {
631-
return xerrors.Errorf("Insert dev app security key: %w", err)
632-
}
633-
}
634-
635624
// Read the app signing key from the DB. We store it hex encoded
636625
// since the config table uses strings for the value and we
637626
// don't want to deal with automatic encoding issues.

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ var (
181181
rbac.ResourceUserData.Type: {rbac.ActionCreate, rbac.ActionUpdate},
182182
rbac.ResourceWorkspace.Type: {rbac.ActionUpdate},
183183
rbac.ResourceWorkspaceExecution.Type: {rbac.ActionCreate},
184+
rbac.ResourceWorkspaceProxy.Type: {rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
184185
}),
185186
Org: map[string][]rbac.Permission{},
186187
User: []rbac.Permission{},

‎codersdk/deployment.go

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -328,9 +328,8 @@ type LoggingConfig struct {
328328
}
329329

330330
type DangerousConfig struct {
331-
AllowPathAppSharing clibase.Bool `json:"allow_path_app_sharing" typescript:",notnull"`
332-
AllowPathAppSiteOwnerAccess clibase.Bool `json:"allow_path_app_site_owner_access" typescript:",notnull"`
333-
DevAppSecurityKey clibase.String `json:"dev_app_security_key" typescript:",notnull"`
331+
AllowPathAppSharing clibase.Bool `json:"allow_path_app_sharing" typescript:",notnull"`
332+
AllowPathAppSiteOwnerAccess clibase.Bool `json:"allow_path_app_site_owner_access" typescript:",notnull"`
334333
}
335334

336335
const (
@@ -1186,15 +1185,6 @@ when required by your organization's security policy.`,
11861185
Value: &c.Dangerous.AllowPathAppSiteOwnerAccess,
11871186
Group: &deploymentGroupDangerous,
11881187
},
1189-
{
1190-
Name: "App Security Key (Development Only)",
1191-
Description: "Used to override the app security key stored in the database. This should never be used in production.",
1192-
Flag: "dangerous-dev-app-security-key",
1193-
Default: "",
1194-
Value: &c.Dangerous.DevAppSecurityKey,
1195-
Annotations: clibase.Annotations{}.Mark("secret", "true"),
1196-
Hidden: true,
1197-
},
11981188
// Misc. settings
11991189
{
12001190
Name: "Experiments",

‎enterprise/cli/proxyserver.go

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ import (
2626
"github.com/coder/coder/cli/cliui"
2727
"github.com/coder/coder/coderd/httpapi"
2828
"github.com/coder/coder/coderd/httpmw"
29-
"github.com/coder/coder/coderd/workspaceapps"
3029
"github.com/coder/coder/codersdk"
3130
"github.com/coder/coder/enterprise/wsproxy"
3231
)
@@ -55,7 +54,6 @@ func (r *RootCmd) proxyServer() *clibase.Cmd {
5554
}
5655
proxySessionToken clibase.String
5756
primaryAccessURL clibase.URL
58-
appSecuritYKey clibase.String
5957
)
6058
opts.Add(
6159
// Options only for external workspace proxies
@@ -83,20 +81,6 @@ func (r *RootCmd) proxyServer() *clibase.Cmd {
8381
Group: &externalProxyOptionGroup,
8482
Hidden: false,
8583
},
86-
87-
// TODO: This will eventually be pulled over an authenticated api endpoint.
88-
clibase.Option{
89-
Name: "App Security Key",
90-
Description: "App security key used for decrypting/verifying app tokens sent from coderd.",
91-
Flag: "app-security-key",
92-
Env: "CODER_APP_SECURITY_KEY",
93-
YAML: "appSecurityKey",
94-
Default: "",
95-
Value: &appSecuritYKey,
96-
Group: &externalProxyOptionGroup,
97-
Hidden: false,
98-
Annotations: clibase.Annotations{}.Mark("secret", "true"),
99-
},
10084
)
10185

10286
cmd := &clibase.Cmd{
@@ -113,11 +97,6 @@ func (r *RootCmd) proxyServer() *clibase.Cmd {
11397
return xerrors.Errorf("primary access URL must be http or https: url=%s", primaryAccessURL.String())
11498
}
11599

116-
secKey, err := workspaceapps.KeyFromString(appSecuritYKey.Value())
117-
if err != nil {
118-
return xerrors.Errorf("app security key: %w", err)
119-
}
120-
121100
var closers closers
122101
// Main command context for managing cancellation of running
123102
// services.
@@ -236,14 +215,13 @@ func (r *RootCmd) proxyServer() *clibase.Cmd {
236215
closers.Add(closeFunc)
237216
}
238217

239-
proxy, err := wsproxy.New(&wsproxy.Options{
218+
proxy, err := wsproxy.New(ctx, &wsproxy.Options{
240219
Logger: logger,
241220
DashboardURL: primaryAccessURL.Value(),
242221
AccessURL: cfg.AccessURL.Value(),
243222
AppHostname: appHostname,
244223
AppHostnameRegex: appHostnameRegex,
245224
RealIPConfig: realIPConfig,
246-
AppSecurityKey: secKey,
247225
Tracing: tracer,
248226
PrometheusRegistry: prometheusRegistry,
249227
APIRateLimit: int(cfg.RateLimit.API.Value()),

‎enterprise/coderd/coderdenttest/proxytest.go

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -115,14 +115,14 @@ func NewWorkspaceProxy(t *testing.T, coderdAPI *coderd.API, owner *codersdk.Clie
115115
})
116116
require.NoError(t, err, "failed to create workspace proxy")
117117

118-
wssrv, err := wsproxy.New(&wsproxy.Options{
119-
Logger: slogtest.Make(t, nil).Leveled(slog.LevelDebug),
120-
DashboardURL: coderdAPI.AccessURL,
121-
AccessURL: accessURL,
122-
AppHostname: options.AppHostname,
123-
AppHostnameRegex: appHostnameRegex,
124-
RealIPConfig: coderdAPI.RealIPConfig,
125-
AppSecurityKey: coderdAPI.AppSecurityKey,
118+
wssrv, err := wsproxy.New(ctx, &wsproxy.Options{
119+
Logger: slogtest.Make(t, nil).Leveled(slog.LevelDebug),
120+
DashboardURL: coderdAPI.AccessURL,
121+
AccessURL: accessURL,
122+
AppHostname: options.AppHostname,
123+
AppHostnameRegex: appHostnameRegex,
124+
RealIPConfig: coderdAPI.RealIPConfig,
125+
//AppSecurityKey: coderdAPI.AppSecurityKey,
126126
Tracing: coderdAPI.TracerProvider,
127127
APIRateLimit: coderdAPI.APIRateLimit,
128128
SecureAuthCookie: coderdAPI.SecureAuthCookie,

‎enterprise/wsproxy/wsproxy.go

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,6 @@ type Options struct {
4949
AppHostnameRegex *regexp.Regexp
5050

5151
RealIPConfig *httpmw.RealIPConfig
52-
// TODO: @emyrk this key needs to be provided via a file or something?
53-
// Maybe we should curl it from the primary over some secure connection?
54-
AppSecurityKey workspaceapps.SecurityKey
5552

5653
Tracing trace.TracerProvider
5754
PrometheusRegistry *prometheus.Registry
@@ -72,7 +69,6 @@ func (o *Options) Validate() error {
7269
errs.Required("RealIPConfig", o.RealIPConfig)
7370
errs.Required("PrometheusRegistry", o.PrometheusRegistry)
7471
errs.NotEmpty("ProxySessionToken", o.ProxySessionToken)
75-
errs.NotEmpty("AppSecurityKey", o.AppSecurityKey)
7672

7773
if len(errs) > 0 {
7874
return errs
@@ -107,7 +103,7 @@ type Server struct {
107103
cancel context.CancelFunc
108104
}
109105

110-
func New(opts *Options) (*Server, error) {
106+
func New(ctx context.Context, opts *Options) (*Server, error) {
111107
if opts.PrometheusRegistry == nil {
112108
opts.PrometheusRegistry = prometheus.NewRegistry()
113109
}
@@ -116,13 +112,34 @@ func New(opts *Options) (*Server, error) {
116112
return nil, err
117113
}
118114

119-
// TODO: implement some ping and registration logic
120115
client := wsproxysdk.New(opts.DashboardURL)
121116
err := client.SetSessionToken(opts.ProxySessionToken)
122117
if err != nil {
123118
return nil, xerrors.Errorf("set client token: %w", err)
124119
}
125120

121+
// TODO: Probably do some version checking here
122+
info, err := client.SDKClient.BuildInfo(ctx)
123+
if err != nil {
124+
return nil, xerrors.Errorf("failed to fetch build info from %q: %w", opts.DashboardURL, err)
125+
}
126+
if info.WorkspaceProxy {
127+
return nil, xerrors.Errorf("%q is a workspace proxy, not a primary coderd instance", opts.DashboardURL)
128+
}
129+
130+
regResp, err := client.RegisterWorkspaceProxy(ctx, wsproxysdk.RegisterWorkspaceProxyRequest{
131+
AccessURL: opts.AccessURL.String(),
132+
WildcardHostname: opts.AppHostname,
133+
})
134+
if err != nil {
135+
return nil, xerrors.Errorf("register proxy: %w", err)
136+
}
137+
138+
secKey, err := workspaceapps.KeyFromString(regResp.AppSecurityKey)
139+
if err != nil {
140+
return nil, xerrors.Errorf("parse app security key: %w", err)
141+
}
142+
126143
r := chi.NewRouter()
127144
ctx, cancel := context.WithCancel(context.Background())
128145
s := &Server{
@@ -149,11 +166,11 @@ func New(opts *Options) (*Server, error) {
149166
AccessURL: opts.AccessURL,
150167
AppHostname: opts.AppHostname,
151168
Client: client,
152-
SecurityKey: s.Options.AppSecurityKey,
169+
SecurityKey: secKey,
153170
Logger: s.Logger.Named("proxy_token_provider"),
154171
},
155172
WorkspaceConnCache: wsconncache.New(s.DialWorkspaceAgent, 0),
156-
AppSecurityKey: opts.AppSecurityKey,
173+
AppSecurityKey: secKey,
157174

158175
DisablePathApps: opts.DisablePathApps,
159176
SecureAuthCookie: opts.SecureAuthCookie,

0 commit comments

Comments
 (0)