wild-cloud/wild-central
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Support custom domains. Fix host-record/address resolution.

Browse Source
This commit is contained in:
Paul Payne
2026-07-13 00:26:13 +00:00
parent 65c7e56b0a
commit 1e7d93256e
12 changed files with 336 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
TODO.md
View File

@@ -16,3 +16,7 @@ Affects: keila (CORS headers), plausible (Private-Network-Access header).
## Input validation for header values
Header values with special characters (newlines, NULs) should be rejected at registration time. Currently values are Go-`%q`-quoted in the HAProxy output which handles spaces/commas but may produce backslash escapes that HAProxy doesn't understand for edge cases.
## APT package: Authelia bare-metal installation
When building the wild-central apt package in `dist/`, include Authelia as a dependency or document its installation. Bare-metal installation instructions: https://www.authelia.com/integration/deployment/bare-metal/

6
docs/registrations.md
View File

@@ -113,8 +113,8 @@ When a service is registered, Central automatically:
| Effect | Passthrough | Terminate |
|--------|-------------|-----------|
| **LAN DNS** | `address=/<domain>/<backend-IP>` — direct to backend | `address=/<domain>/<central-IP>` — through Central |
| **LAN DNS (private)** | Also `local=/<domain>/` — prevents upstream forwarding | Same |
| **LAN DNS** | `host-record=<domain>,<backend-IP>` (exact) or `address=/<domain>/<backend-IP>` (wildcard if subdomains:true) | `host-record=<domain>,<central-IP>` (exact) or `address=/<domain>/<central-IP>` (wildcard if subdomains:true) |
| **AAAA filtering** | `filter-AAAA` globally strips IPv6 from upstream responses (prevents Happy Eyeballs on IPv4-only LAN) | Same |
| **Public DNS** | DDNS A record if public | Same |
| **Proxy** | L4 SNI passthrough. Subdomains adds `*.domain` matching. | L7 HTTP reverse proxy by Host header. Routes add path-based ACLs. |
| **TLS** | Backend handles — Central passes through | Central provisions cert via Let's Encrypt |
@@ -147,7 +147,7 @@ Central creates: LAN DNS → Central IP, public DNS A record, HAProxy L7 TLS ter
}
```
Central creates: LAN DNS → Central IP (with `local=/`), HAProxy L7 reverse proxy, TLS cert via certbot. No public DNS.
Central creates: LAN DNS → Central IP (host-record=, exact match), HAProxy L7 reverse proxy, TLS cert via certbot. No public DNS.
### Service with custom response headers

77
internal/api/v1/handlers_reconciliation_test.go
View File

@@ -168,17 +168,18 @@ func TestReconciliation_HAProxyConfigFromDomains(t *testing.T) {
}
// TestReconciliation_DnsmasqConfigFromDomains verifies that reconciliation
// correctly generates dnsmasq config from registered domains, including
// the critical reach-based local=/ directives.
// correctly generates dnsmasq config from registered domains. Wildcard
// domains (subdomains:true) get address=/, exact-match domains get
// host-record=. No local=/ directives — AAAA is handled by filter-AAAA.
func TestReconciliation_DnsmasqConfigFromDomains(t *testing.T) {
api, _ := setupTestAPI(t)
centralIP := "192.168.8.151"
// Register domains with different reach and backend types
// Register domains with different backend types and subdomain settings
testDomains := []domains.Domain{
{
// tcp-passthrough, public → DNS points to k8s LB IP, no local=/
// tcp-passthrough, wildcard → address=/ with backend IP
DomainName: "cloud.payne.io",
Source: "wild-cloud",
Backend: domains.Backend{Address: "192.168.8.240:443", Type: domains.BackendTCPPassthrough},
@@ -186,13 +187,13 @@ func TestReconciliation_DnsmasqConfigFromDomains(t *testing.T) {
Public: true,
},
{
// http, internal → DNS points to Central IP, has local=/
// http, exact → host-record= with Central IP
DomainName: "my-api.payne.io",
Source: "wild-works",
Backend: domains.Backend{Address: "192.168.8.60:9001", Type: domains.BackendHTTP},
},
{
// http, public → DNS points to Central IP, NO local=/
// http, exact → host-record= with Central IP
DomainName: "public-app.payne.io",
Source: "wild-works",
Backend: domains.Backend{Address: "192.168.8.60:8080", Type: domains.BackendHTTP},
@@ -226,35 +227,35 @@ func TestReconciliation_DnsmasqConfigFromDomains(t *testing.T) {
}
dnsEntries = append(dnsEntries, dnsmasq.DNSEntry{
Domain: dom.DomainName,
IP: dnsIP,
Domain: dom.DomainName,
IP: dnsIP,
Wildcard: dom.Subdomains,
})
}
dnsmasqCfg := api.dnsmasq.Generate(globalCfg, dnsEntries)
// --- TCP passthrough (public) → backend IP ---
// --- Wildcard (subdomains:true) → address=/ with backend IP ---
if !strings.Contains(dnsmasqCfg, "address=/cloud.payne.io/192.168.8.240") {
t.Errorf("tcp-passthrough domain must point DNS to backend IP (192.168.8.240):\n%s", dnsmasqCfg)
t.Errorf("wildcard domain must use address=/ with backend IP:\n%s", dnsmasqCfg)
}
// --- HTTP domains → Central IP ---
if !strings.Contains(dnsmasqCfg, "address=/my-api.payne.io/192.168.8.151") {
t.Errorf("http/internal domain must point DNS to Central IP (192.168.8.151):\n%s", dnsmasqCfg)
// --- Exact-match HTTP domains → host-record= with Central IP ---
if !strings.Contains(dnsmasqCfg, "host-record=my-api.payne.io,192.168.8.151") {
t.Errorf("exact-match http domain must use host-record= with Central IP:\n%s", dnsmasqCfg)
}
if !strings.Contains(dnsmasqCfg, "address=/public-app.payne.io/192.168.8.151") {
t.Errorf("http/public domain must point DNS to Central IP (192.168.8.151):\n%s", dnsmasqCfg)
if !strings.Contains(dnsmasqCfg, "host-record=public-app.payne.io,192.168.8.151") {
t.Errorf("exact-match http domain must use host-record= with Central IP:\n%s", dnsmasqCfg)
}
// --- All domains get local=/ to prevent AAAA leaking upstream (Happy Eyeballs) ---
if !strings.Contains(dnsmasqCfg, "local=/my-api.payne.io/") {
t.Errorf("domain must have local=/ entry:\n%s", dnsmasqCfg)
// --- No local=/ directives (AAAA handled by filter-AAAA) ---
if strings.Contains(dnsmasqCfg, "local=/") {
t.Errorf("must not produce local=/ directives:\n%s", dnsmasqCfg)
}
if !strings.Contains(dnsmasqCfg, "local=/cloud.payne.io/") {
t.Errorf("domain must have local=/ entry (prevents AAAA leaking):\n%s", dnsmasqCfg)
}
if !strings.Contains(dnsmasqCfg, "local=/public-app.payne.io/") {
t.Errorf("domain must have local=/ entry (prevents AAAA leaking):\n%s", dnsmasqCfg)
// --- filter-AAAA present ---
if !strings.Contains(dnsmasqCfg, "filter-AAAA") {
t.Errorf("must include filter-AAAA directive:\n%s", dnsmasqCfg)
}
}
@@ -345,19 +346,20 @@ func TestReconciliation_TCPPassthroughDNSTarget(t *testing.T) {
dnsIP = extractHost(dom.Backend.Address)
}
dnsEntries = append(dnsEntries, dnsmasq.DNSEntry{
Domain: dom.DomainName,
IP: dnsIP,
Domain: dom.DomainName,
IP: dnsIP,
Wildcard: dom.Subdomains,
})
}
dnsmasqCfg := api.dnsmasq.Generate(globalCfg, dnsEntries)
// TCP passthrough → DNS points to backend (k8s LB), NOT central
// TCP passthrough with subdomains → address=/ to backend (k8s LB), NOT central
if !strings.Contains(dnsmasqCfg, "address=/cloud.payne.io/192.168.8.240") {
t.Errorf("tcp-passthrough DNS must point to backend IP 192.168.8.240:\n%s", dnsmasqCfg)
t.Errorf("wildcard tcp-passthrough DNS must use address=/ to backend IP 192.168.8.240:\n%s", dnsmasqCfg)
}
if strings.Contains(dnsmasqCfg, "address=/cloud.payne.io/192.168.8.151") {
t.Errorf("tcp-passthrough DNS must NOT point to Central IP:\n%s", dnsmasqCfg)
if strings.Contains(dnsmasqCfg, "host-record=cloud.payne.io,192.168.8.151") {
t.Errorf("wildcard tcp-passthrough DNS must NOT use host-record= to Central IP:\n%s", dnsmasqCfg)
}
}
@@ -437,20 +439,21 @@ func TestReconciliation_DNSOnlyNoGateway(t *testing.T) {
dnsIP = extractHost(dom.Backend.Address)
}
dnsEntries = append(dnsEntries, dnsmasq.DNSEntry{
Domain: dom.DomainName,
IP: dnsIP,
Domain: dom.DomainName,
IP: dnsIP,
Wildcard: dom.Subdomains,
})
}
dnsmasqCfg := api.dnsmasq.Generate(globalCfg, dnsEntries)
// dns-only domain should resolve to its backend IP (192.168.8.222)
if !strings.Contains(dnsmasqCfg, "address=/dev.payne.io/192.168.8.222") {
t.Errorf("dns-only domain must point DNS to backend IP:\n%s", dnsmasqCfg)
// dns-only domain (public, no subdomains) → host-record= with backend IP
if !strings.Contains(dnsmasqCfg, "host-record=dev.payne.io,192.168.8.222") {
t.Errorf("dns-only domain must use host-record= with backend IP:\n%s", dnsmasqCfg)
}
// HTTP domain should resolve to Central IP
if !strings.Contains(dnsmasqCfg, "address=/app.payne.io/192.168.8.151") {
t.Errorf("http domain must point DNS to Central IP:\n%s", dnsmasqCfg)
// HTTP domain (no subdomains) → host-record= with Central IP
if !strings.Contains(dnsmasqCfg, "host-record=app.payne.io,192.168.8.151") {
t.Errorf("http domain must use host-record= with Central IP:\n%s", dnsmasqCfg)
}
}

5
internal/api/v1/helpers.go
View File

@@ -242,8 +242,9 @@ func (api *API) reconcileNetworking() {
}
dnsEntries = append(dnsEntries, dnsmasq.DNSEntry{
Domain: dom.DomainName,
IP: dnsIP,
Domain: dom.DomainName,
IP: dnsIP,
Wildcard: dom.Subdomains,
})
}

60
internal/dnsmasq/config.go
View File

@@ -14,14 +14,14 @@ import (
)
// DNSEntry represents a single domain-to-IP DNS mapping for dnsmasq.
// Each entry produces both local=/ and address=/ directives.
// local=/ makes dnsmasq authoritative for the domain, which prevents
// AAAA queries from leaking to upstream DNS. Without it, upstream could
// return public IPv6 records and browsers using Happy Eyeballs (RFC 8305)
// would try the unreachable IPv6 path first, adding latency on LAN.
// Exact-match domains use host-record= (SOA/NS queries forwarded upstream,
// enabling ACME DNS-01 validation). Wildcard domains use address=/ to resolve
// all subdomains. Happy Eyeballs (AAAA leaking) is handled globally by
// filter-AAAA in the config template.
type DNSEntry struct {
Domain string // FQDN to resolve (e.g. "cloud.payne.io")
IP string // target IPv4 address
Domain string // FQDN to resolve (e.g. "cloud.payne.io")
IP string // target IPv4 address
Wildcard bool // true: address=/ (all subdomains); false: host-record= (exact match)
}
// ConfigGenerator handles dnsmasq configuration generation
@@ -75,12 +75,17 @@ func (g *ConfigGenerator) Generate(cfg *config.State, entries []DNSEntry) string
if entry.Domain == "" || entry.IP == "" {
continue
}
// local=/ makes dnsmasq authoritative for the domain so AAAA queries
// return empty instead of leaking to upstream DNS. Without this,
// upstream could return public IPv6 records and browsers using Happy
// Eyeballs (RFC 8305) would try the unreachable IPv6 path first,
// adding 250ms-2s latency on LAN.
resolution_section += fmt.Sprintf("local=/%s/\naddress=/%s/%s\n", entry.Domain, entry.Domain, entry.IP)
if entry.Wildcard {
// Wildcard: resolves domain + all subdomains to this IP.
// Note: address=/ blocks forwarding for the entire subtree,
// so SOA walks stop here. For non-apex domains this is fine —
// the walk continues up to the parent (which uses host-record=).
resolution_section += fmt.Sprintf("address=/%s/%s\n", entry.Domain, entry.IP)
} else {
// Exact match: only this specific name. SOA/NS/TXT queries
// are forwarded upstream, enabling ACME DNS-01 validation.
resolution_section += fmt.Sprintf("host-record=%s,%s\n", entry.Domain, entry.IP)
}
}
template := `# Configuration file for dnsmasq.
@@ -91,8 +96,9 @@ bind-interfaces
domain-needed
bogus-priv
no-resolv
filter-AAAA
# DNS Local Resolution - Central server handles these domains authoritatively
# DNS Local Resolution - registered domain A records
%s
server=1.1.1.1
server=8.8.8.8
@@ -113,10 +119,12 @@ log-dhcp
return result
}
// RestartService reloads the dnsmasq service (SIGHUP — no downtime).
// Falls back to restart if reload fails.
// RestartService fully restarts the dnsmasq service.
// A full restart is required because SIGHUP (reload) does not re-read
// host-record= directives — only address=/ and a few other directives
// are reloaded on SIGHUP.
func (g *ConfigGenerator) RestartService() error {
cmd := exec.Command("systemctl", "reload-or-restart", "dnsmasq.service")
cmd := exec.Command("systemctl", "restart", "dnsmasq.service")
output, err := cmd.CombinedOutput()
if err != nil {
return fmt.Errorf("failed to reload dnsmasq: %w (output: %s)", err, string(output))
@@ -187,9 +195,10 @@ func (g *ConfigGenerator) GetStatus() (*ServiceStatus, error) {
}
}
// Count domains in config by counting local=/ directives
// Count domains in config by counting host-record= and address=/ directives
if data, err := os.ReadFile(g.configPath); err == nil {
status.DomainsConfigured = strings.Count(string(data), "\nlocal=/")
config := string(data)
status.DomainsConfigured = strings.Count(config, "host-record=") + strings.Count(config, "\naddress=/")
}
return status, nil
@@ -303,17 +312,10 @@ func (g *ConfigGenerator) ValidateConfig(configPath string) error {
return nil
}
// ReloadService sends a SIGHUP to dnsmasq to reload configuration.
// Lighter weight than a full restart. Falls back to RestartService on failure.
// ReloadService restarts dnsmasq to apply configuration changes.
// Uses a full restart because SIGHUP does not re-read host-record= directives.
func (g *ConfigGenerator) ReloadService() error {
cmd := exec.Command("systemctl", "reload", "dnsmasq.service")
_, err := cmd.CombinedOutput()
if err != nil {
slog.Error("reload failed, attempting restart", "component", "dnsmasq", "error", err)
return g.RestartService()
}
slog.Info("dnsmasq service reloaded", "component", "dnsmasq")
return nil
return g.RestartService()
}
// ConfigureSystemDNS configures systemd-resolved to use the local dnsmasq server

141
internal/dnsmasq/config_test.go
View File

@@ -12,7 +12,11 @@ func entry(domain, ip string) DNSEntry {
return DNSEntry{Domain: domain, IP: ip}
}
// Test: Generate with entries produces expected DNS entries
func wildcardEntry(domain, ip string) DNSEntry {
return DNSEntry{Domain: domain, IP: ip, Wildcard: true}
}
// Test: Generate with exact-match entries produces host-record= directives
func TestGenerate_WithEntries(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
entries := []DNSEntry{
@@ -22,17 +26,11 @@ func TestGenerate_WithEntries(t *testing.T) {
out := g.Generate(nil, entries)
if !strings.Contains(out, "local=/cloud.example.com/") {
t.Errorf("expected local=/ for domain, got:\n%s", out)
if !strings.Contains(out, "host-record=cloud.example.com,192.168.1.10") {
t.Errorf("expected host-record for domain, got:\n%s", out)
}
if !strings.Contains(out, "address=/cloud.example.com/192.168.1.10") {
t.Errorf("expected address entry for domain, got:\n%s", out)
}
if !strings.Contains(out, "local=/internal.example.com/") {
t.Errorf("expected local=/ for internal domain, got:\n%s", out)
}
if !strings.Contains(out, "address=/internal.example.com/192.168.1.10") {
t.Errorf("expected address entry for internal domain, got:\n%s", out)
if !strings.Contains(out, "host-record=internal.example.com,192.168.1.10") {
t.Errorf("expected host-record for internal domain, got:\n%s", out)
}
if !strings.Contains(out, "server=1.1.1.1") {
t.Errorf("expected upstream DNS server, got:\n%s", out)
@@ -62,8 +60,8 @@ func TestGenerate_EntryWithoutIP(t *testing.T) {
out := g.Generate(nil, []DNSEntry{entry("cloud.example.com", "")})
if strings.Contains(out, "address=/") {
t.Errorf("expected no address= entries for empty IP, got:\n%s", out)
if strings.Contains(out, "host-record=") {
t.Errorf("expected no host-record entries for empty IP, got:\n%s", out)
}
}
@@ -198,78 +196,98 @@ func TestNewConfigGenerator_DefaultPath(t *testing.T) {
}
}
// Test: Domain-only entry (no internal domain pair)
func TestGenerate_DomainOnly(t *testing.T) {
// Test: Exact-match domain produces host-record=
func TestGenerate_ExactMatchDomain(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
globalCfg := &config.State{}
out := g.Generate(globalCfg, []DNSEntry{entry("my-api.payne.io", "192.168.8.151")})
if !strings.Contains(out, "address=/my-api.payne.io/192.168.8.151") {
t.Errorf("expected address entry for domain, got:\n%s", out)
if !strings.Contains(out, "host-record=my-api.payne.io,192.168.8.151") {
t.Errorf("expected host-record entry for domain, got:\n%s", out)
}
if !strings.Contains(out, "local=/my-api.payne.io/") {
t.Errorf("expected local=/ entry for domain, got:\n%s", out)
if strings.Contains(out, "address=/") {
t.Errorf("exact-match domain must not produce address=/ directive:\n%s", out)
}
// Must NOT have empty entries
if strings.Contains(out, "local=//") {
t.Errorf("unexpected empty local=// in output:\n%s", out)
}
if strings.Contains(out, "address=//") {
t.Errorf("unexpected empty address=// in output:\n%s", out)
if strings.Contains(out, "local=/") {
t.Errorf("must not produce local=/ directive:\n%s", out)
}
}
// Test: All domains get local=/ to prevent AAAA leaking upstream
func TestGenerate_AllDomainsGetLocal(t *testing.T) {
// Test: Wildcard domain produces address=/ without local=/
func TestGenerate_WildcardDomain(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
globalCfg := &config.State{}
out := g.Generate(globalCfg, []DNSEntry{wildcardEntry("cloud.payne.io", "192.168.8.240")})
if !strings.Contains(out, "address=/cloud.payne.io/192.168.8.240") {
t.Errorf("expected address=/ entry for wildcard domain, got:\n%s", out)
}
if strings.Contains(out, "host-record=") {
t.Errorf("wildcard domain must not produce host-record= directive:\n%s", out)
}
if strings.Contains(out, "local=/") {
t.Errorf("must not produce local=/ directive:\n%s", out)
}
}
// Test: No local=/ directives are ever generated
func TestGenerate_NoLocalDirectives(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
globalCfg := &config.State{}
// Both "internal" and "public" domains should get local=/ —
// prevents AAAA queries from leaking to upstream DNS (Happy Eyeballs).
entries := []DNSEntry{
entry("internal-api.payne.io", "192.168.8.151"),
entry("cloud.payne.io", "192.168.8.240"),
wildcardEntry("cloud.payne.io", "192.168.8.240"),
}
out := g.Generate(globalCfg, entries)
if !strings.Contains(out, "local=/internal-api.payne.io/") {
t.Errorf("expected local=/ for internal domain, got:\n%s", out)
}
if !strings.Contains(out, "local=/cloud.payne.io/") {
t.Errorf("expected local=/ for public domain (prevents AAAA leaking), got:\n%s", out)
if strings.Contains(out, "local=/") {
t.Errorf("must never produce local=/ directives:\n%s", out)
}
}
// Test: Mix of domains each get their own entries
// Test: filter-AAAA appears in generated config
func TestGenerate_FilterAAAA(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
out := g.Generate(nil, nil)
if !strings.Contains(out, "filter-AAAA") {
t.Errorf("expected filter-AAAA in config, got:\n%s", out)
}
}
// Test: Mix of exact and wildcard domains
func TestGenerate_MixedDomains(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
globalCfg := &config.State{}
entries := []DNSEntry{
entry("cloud.payne.io", "192.168.8.240"), // k8s passthrough
entry("central.payne.io", "192.168.8.151"), // Central HTTP
entry("wild-cloud.payne.io", "192.168.8.151"), // service HTTP
wildcardEntry("cloud.payne.io", "192.168.8.240"), // wildcard
entry("central.payne.io", "192.168.8.151"), // exact
entry("wild-cloud.payne.io", "192.168.8.151"), // exact
}
out := g.Generate(globalCfg, entries)
if !strings.Contains(out, "address=/cloud.payne.io/192.168.8.240") {
t.Errorf("expected address for cloud domain, got:\n%s", out)
t.Errorf("expected address=/ for wildcard domain, got:\n%s", out)
}
if !strings.Contains(out, "address=/central.payne.io/192.168.8.151") {
t.Errorf("expected address for central, got:\n%s", out)
if !strings.Contains(out, "host-record=central.payne.io,192.168.8.151") {
t.Errorf("expected host-record for exact domain, got:\n%s", out)
}
if !strings.Contains(out, "address=/wild-cloud.payne.io/192.168.8.151") {
t.Errorf("expected address for wild-cloud, got:\n%s", out)
if !strings.Contains(out, "host-record=wild-cloud.payne.io,192.168.8.151") {
t.Errorf("expected host-record for exact domain, got:\n%s", out)
}
if strings.Contains(out, "local=//") {
t.Errorf("unexpected empty local=// in output:\n%s", out)
if strings.Contains(out, "local=/") {
t.Errorf("must not produce local=/ directives:\n%s", out)
}
}
// Test: empty entries list produces base config with no address= entries
// Test: empty entries list produces base config with no DNS entries
func TestGenerate_EmptyEntries(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
globalCfg := &config.State{}
@@ -282,15 +300,15 @@ func TestGenerate_EmptyEntries(t *testing.T) {
if !strings.Contains(out, "server=1.1.1.1") {
t.Errorf("expected upstream DNS server, got:\n%s", out)
}
if strings.Contains(out, "address=/") {
t.Errorf("expected no address= entries with empty entries, got:\n%s", out)
if strings.Contains(out, "host-record=") {
t.Errorf("expected no host-record entries with empty entries, got:\n%s", out)
}
if strings.Contains(out, "local=/") {
t.Errorf("expected no local=/ entries with empty entries, got:\n%s", out)
if strings.Contains(out, "address=/") {
t.Errorf("expected no address=/ entries with empty entries, got:\n%s", out)
}
}
// Test: multiple entries each get their own DNS records
// Test: multiple exact-match entries each get their own DNS records
func TestGenerate_MultipleEntries(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
globalCfg := &config.State{}
@@ -304,11 +322,8 @@ func TestGenerate_MultipleEntries(t *testing.T) {
out := g.Generate(globalCfg, entries)
for _, e := range entries {
if !strings.Contains(out, fmt.Sprintf("address=/%s/%s", e.Domain, e.IP)) {
t.Errorf("expected address entry for %s, got:\n%s", e.Domain, out)
}
if !strings.Contains(out, fmt.Sprintf("local=/%s/", e.Domain)) {
t.Errorf("expected local=/ entry for %s, got:\n%s", e.Domain, out)
if !strings.Contains(out, fmt.Sprintf("host-record=%s,%s", e.Domain, e.IP)) {
t.Errorf("expected host-record entry for %s, got:\n%s", e.Domain, out)
}
}
}
@@ -377,7 +392,7 @@ func TestGenerate_ConfiguredDnsmasqIP(t *testing.T) {
}
}
// Test: verify no address=// or local=// entries appear
// Test: verify no leaked empty entries appear
func TestGenerate_NoLeakedEmptyEntries(t *testing.T) {
g := NewConfigGenerator("/tmp/test-dnsmasq.conf")
cfg := &config.State{}
@@ -387,7 +402,8 @@ func TestGenerate_NoLeakedEmptyEntries(t *testing.T) {
entries []DNSEntry
}{
{"empty", nil},
{"domain_only", []DNSEntry{entry("example.com", "10.0.0.1")}},
{"exact_domain", []DNSEntry{entry("example.com", "10.0.0.1")}},
{"wildcard_domain", []DNSEntry{wildcardEntry("example.com", "10.0.0.1")}},
{"no_ip", []DNSEntry{entry("example.com", "")}},
{"no_domain", []DNSEntry{entry("", "10.0.0.1")}},
}
@@ -395,11 +411,14 @@ func TestGenerate_NoLeakedEmptyEntries(t *testing.T) {
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
out := g.Generate(cfg, tc.entries)
if strings.Contains(out, "host-record=,") {
t.Errorf("leaked empty host-record in output:\n%s", out)
}
if strings.Contains(out, "address=//") {
t.Errorf("leaked empty address=// in output:\n%s", out)
}
if strings.Contains(out, "local=//") {
t.Errorf("leaked empty local=// in output:\n%s", out)
if strings.Contains(out, "local=/") {
t.Errorf("must not produce local=/ directives:\n%s", out)
}
})
}

1
web/src/components/AppSidebar.tsx
View File

@@ -104,6 +104,7 @@ export function AppSidebar() {
{ to: '/advanced/wireguard', icon: Lock, label: 'WireGuard', daemon: 'wireguard' as const },
{ to: '/advanced/crowdsec', icon: ShieldAlert, label: 'CrowdSec', daemon: 'crowdsec' as const },
{ to: '/advanced/authelia', icon: KeyRound, label: 'Authelia', daemon: 'authelia' as const },
{ to: '/advanced/ddns', icon: Globe, label: 'DDNS', daemon: undefined },
];
return (

160
web/src/components/advanced/DdnsSubsystem.tsx Normal file
View File

@@ -0,0 +1,160 @@
import { Card, CardContent } from '../ui/card';
import { Button } from '../ui/button';
import { Alert, AlertDescription } from '../ui/alert';
import { Badge } from '../ui/badge';
import { Loader2, CheckCircle, AlertCircle, RefreshCw, Globe } from 'lucide-react';
import { useDdns } from '../../hooks/useDdns';
import { useQuery } from '@tanstack/react-query';
import { ddnsConfigApi } from '../../services/api/settings';
function formatTime(iso?: string): string {
if (!iso) return '--';
const d = new Date(iso);
if (isNaN(d.getTime())) return '--';
return d.toLocaleString();
}
export function DdnsSubsystem() {
const { status, isLoadingStatus, trigger, isTriggering } = useDdns();
const configQuery = useQuery({
queryKey: ['ddns', 'config'],
queryFn: () => ddnsConfigApi.get(),
});
const config = configQuery.data;
const records = status?.records ?? [];
return (
<div className="space-y-4">
{/* Header */}
<div className="flex items-center justify-between mb-2">
<div className="flex items-center gap-4">
<div className="p-2 bg-primary/10 rounded-lg">
<Globe className="h-6 w-6 text-primary" />
</div>
<div>
<h2 className="text-2xl font-semibold">Dynamic DNS</h2>
<p className="text-muted-foreground">Cloudflare DNS records managed by Wild Central</p>
</div>
</div>
{status && (
<Badge variant={status.enabled ? 'success' : 'secondary'} className="gap-1">
{status.enabled ? <CheckCircle className="h-3 w-3" /> : <AlertCircle className="h-3 w-3" />}
{status.enabled ? 'Enabled' : 'Disabled'}
</Badge>
)}
</div>
{/* Global error */}
{status?.lastError && (
<Alert variant="error">
<AlertCircle className="h-4 w-4" />
<AlertDescription>{status.lastError}</AlertDescription>
</Alert>
)}
{/* Status + Actions */}
<Card>
<CardContent className="p-4 space-y-4">
<div className="flex items-center justify-between">
<div className="grid grid-cols-2 md:grid-cols-4 gap-4 text-sm flex-1">
<div>
<span className="text-muted-foreground">Public IP</span>
<div className="font-mono mt-0.5">{status?.currentIP ?? '--'}</div>
</div>
<div>
<span className="text-muted-foreground">Provider</span>
<div className="font-mono mt-0.5">{config?.provider ?? '--'}</div>
</div>
<div>
<span className="text-muted-foreground">Last Checked</span>
<div className="font-mono mt-0.5 text-xs">{formatTime(status?.lastChecked)}</div>
</div>
<div>
<span className="text-muted-foreground">Last Updated</span>
<div className="font-mono mt-0.5 text-xs">{formatTime(status?.lastUpdated)}</div>
</div>
</div>
<Button
variant="outline"
size="sm"
className="gap-1 ml-4 shrink-0"
onClick={() => trigger()}
disabled={isTriggering || !status?.enabled}
>
{isTriggering ? <Loader2 className="h-3 w-3 animate-spin" /> : <RefreshCw className="h-3 w-3" />}
Sync Now
</Button>
</div>
{config?.intervalMinutes && (
<p className="text-xs text-muted-foreground">
Checks every {config.intervalMinutes} minute{config.intervalMinutes !== 1 ? 's' : ''}
</p>
)}
</CardContent>
</Card>
{/* Records table */}
<Card>
<CardContent className="p-4">
<h3 className="text-sm font-medium mb-3">Managed Records</h3>
{isLoadingStatus ? (
<div className="flex items-center justify-center py-8">
<Loader2 className="h-6 w-6 text-primary animate-spin" />
</div>
) : records.length === 0 ? (
<div className="text-center py-8">
<Globe className="h-10 w-10 text-muted-foreground mx-auto mb-2" />
<p className="text-sm text-muted-foreground">
{status?.enabled
? 'No public domains registered. Mark a domain as public to create a DDNS record.'
: 'DDNS is disabled. Enable it in the Domains settings to manage DNS records.'}
</p>
</div>
) : (
<div className="overflow-x-auto">
<table className="w-full text-sm">
<thead>
<tr className="border-b text-left">
<th className="pb-2 font-medium text-muted-foreground">Record</th>
<th className="pb-2 font-medium text-muted-foreground">IP</th>
<th className="pb-2 font-medium text-muted-foreground text-right">Status</th>
</tr>
</thead>
<tbody>
{records.map((r) => (
<tr key={r.name} className="border-b last:border-0">
<td className="py-2 font-mono text-xs">{r.name}</td>
<td className="py-2 font-mono text-xs">{r.ip ?? '--'}</td>
<td className="py-2 text-right">
{r.ok ? (
<Badge variant="success" className="gap-1 text-xs">
<CheckCircle className="h-3 w-3" />
Synced
</Badge>
) : (
<span className="inline-flex items-center gap-1">
<Badge variant="destructive" className="gap-1 text-xs">
<AlertCircle className="h-3 w-3" />
Error
</Badge>
{r.error && (
<span className="text-xs text-muted-foreground max-w-[200px] truncate" title={r.error}>
{r.error}
</span>
)}
</span>
)}
</td>
</tr>
))}
</tbody>
</table>
</div>
)}
</CardContent>
</Card>
</div>
);
}

1
web/src/components/advanced/index.ts
View File

@@ -4,3 +4,4 @@ export { NftablesSubsystem } from './NftablesSubsystem';
export { WireguardSubsystem } from './WireguardSubsystem';
export { CrowdsecSubsystem } from './CrowdsecSubsystem';
export { AutheliaSubsystem } from './AutheliaSubsystem';
export { DdnsSubsystem } from './DdnsSubsystem';

10
web/src/router/pages/advanced/DdnsPage.tsx Normal file
View File

@@ -0,0 +1,10 @@
import { ErrorBoundary } from '../../../components';
import { DdnsSubsystem } from '../../../components/advanced';
export function DdnsPage() {
return (
<ErrorBoundary>
<DdnsSubsystem />
</ErrorBoundary>
);
}

1
web/src/router/pages/advanced/index.ts
View File

@@ -4,3 +4,4 @@ export { NftablesPage } from './NftablesPage';
export { WireguardPage } from './WireguardPage';
export { CrowdsecPage } from './CrowdsecPage';
export { AutheliaAdvancedPage } from './AutheliaPage';
export { DdnsPage } from './DdnsPage';

2
web/src/router/routes.tsx
View File

@@ -13,6 +13,7 @@ import {
HaproxyPage, DnsmasqPage, NftablesPage, WireguardPage,
CrowdsecPage as CrowdsecAdvancedPage,
AutheliaAdvancedPage,
DdnsPage,
} from './pages/advanced';
export const routes: RouteObject[] = [
@@ -34,6 +35,7 @@ export const routes: RouteObject[] = [
{ path: 'advanced/wireguard', element: <WireguardPage /> },
{ path: 'advanced/crowdsec', element: <CrowdsecAdvancedPage /> },
{ path: 'advanced/authelia', element: <AutheliaAdvancedPage /> },
{ path: 'advanced/ddns', element: <DdnsPage /> },
],
},
{