Paul Payne
beb643f76f
Extract the Central networking functionality from wild-cloud/api into a standalone service. Wild Central manages DNS (dnsmasq), gateway (HAProxy), firewall (nftables), VPN (WireGuard), TLS (certbot), security (CrowdSec), and DDNS — all the network appliance concerns. All Cloud-specific code (instances, clusters, nodes, apps, backups, operations, kubectl/talosctl tooling) has been removed. The API struct and route registration contain only Central endpoints. Tests updated to match the new API signature. Builds and all tests pass. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
104 lines
3.1 KiB
Go
104 lines
3.1 KiB
Go
package v1
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"github.com/wild-cloud/wild-central/internal/config"
|
|
)
|
|
|
|
// CertStatus returns the TLS certificate status for the central domain.
|
|
func (api *API) CertStatus(w http.ResponseWriter, r *http.Request) {
|
|
domain := api.getCentralDomain()
|
|
if domain == "" {
|
|
respondJSON(w, http.StatusOK, map[string]any{
|
|
"configured": false,
|
|
"message": "No central domain configured",
|
|
})
|
|
return
|
|
}
|
|
status := api.certbot.GetStatus(domain)
|
|
respondJSON(w, http.StatusOK, map[string]any{
|
|
"configured": true,
|
|
"domain": domain,
|
|
"cert": status,
|
|
})
|
|
}
|
|
|
|
// CertProvision provisions a TLS certificate for the central domain using DNS-01.
|
|
func (api *API) CertProvision(w http.ResponseWriter, r *http.Request) {
|
|
domain := api.getCentralDomain()
|
|
if domain == "" {
|
|
respondError(w, http.StatusBadRequest, "No central domain configured in global config")
|
|
return
|
|
}
|
|
|
|
globalCfg, err := config.LoadGlobalConfig(api.getGlobalConfigPath())
|
|
if err != nil {
|
|
respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to load config: %v", err))
|
|
return
|
|
}
|
|
email := globalCfg.Operator.Email
|
|
if email == "" {
|
|
respondError(w, http.StatusBadRequest, "Operator email not configured")
|
|
return
|
|
}
|
|
|
|
// Get Cloudflare API token
|
|
token := api.getCloudflareToken()
|
|
if token == "" {
|
|
respondError(w, http.StatusBadRequest, "Cloudflare API token not configured — set it on the Cloudflare page")
|
|
return
|
|
}
|
|
|
|
// Write credentials file for certbot
|
|
if err := api.certbot.EnsureCredentials(token); err != nil {
|
|
respondError(w, http.StatusInternalServerError, fmt.Sprintf("Failed to write credentials: %v", err))
|
|
return
|
|
}
|
|
|
|
// Provision the certificate. The deploy hook builds the HAProxy PEM and reloads HAProxy.
|
|
if err := api.certbot.Provision(domain, email); err != nil {
|
|
respondError(w, http.StatusInternalServerError, fmt.Sprintf("Certificate provisioning failed: %v", err))
|
|
return
|
|
}
|
|
|
|
// Regenerate HAProxy config to ensure central domain SNI routing is active
|
|
if _, _, _, err := api.syncHAProxy(); err != nil {
|
|
respondError(w, http.StatusInternalServerError, fmt.Sprintf("Certificate provisioned but HAProxy config update failed: %v", err))
|
|
return
|
|
}
|
|
|
|
status := api.certbot.GetStatus(domain)
|
|
respondJSON(w, http.StatusOK, map[string]any{
|
|
"message": "Certificate provisioned successfully",
|
|
"cert": status,
|
|
})
|
|
}
|
|
|
|
// CertRenew renews all certbot-managed certificates.
|
|
func (api *API) CertRenew(w http.ResponseWriter, r *http.Request) {
|
|
if err := api.certbot.Renew(); err != nil {
|
|
respondError(w, http.StatusInternalServerError, fmt.Sprintf("Certificate renewal failed: %v", err))
|
|
return
|
|
}
|
|
|
|
// Rebuild HAProxy PEM for any renewed certs
|
|
domain := api.getCentralDomain()
|
|
if domain != "" {
|
|
_ = api.certbot.BuildHAProxyCert(domain)
|
|
_, _, _, _ = api.syncHAProxy()
|
|
}
|
|
|
|
respondJSON(w, http.StatusOK, map[string]string{"message": "Certificates renewed"})
|
|
}
|
|
|
|
// getCentralDomain returns the configured central domain or empty string.
|
|
func (api *API) getCentralDomain() string {
|
|
globalCfg, err := config.LoadGlobalConfig(api.getGlobalConfigPath())
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return globalCfg.Cloud.Central.Domain
|
|
}
|