Documentation ¶
Overview ¶
Package internal contains internal implementation details of the server and proxy
Index ¶
- Constants
- Variables
- func AddUser(args []string, user string, w io.Writer) error
- func FullVersion() string
- func Help(args []string, user string, w io.Writer) error
- func NewChainInterceptor(interceptor ...proxy.Interceptor) proxy.Interceptor
- func SetupCerts(dataDir, serviceAddr, serviceName string) error
- func Who(args []string, user string, w io.Writer) error
- type AuthHandler
- type AuthInterceptor
- type ChainInterceptor
- type CommandHandler
- type Config
- type InfoInterceptor
- type Option
- func WithDataDir(dataDir string) Option
- func WithDebugMode(debug bool) Option
- func WithDockerURL(dockerURL string) Option
- func WithProxyAddr(proxyAddr string) Option
- func WithSSHAddr(sshAddr string) Option
- func WithServiceFQDN(serviceFQDN string) Option
- func WithServiceName(serviceName string) Option
- type ReadOnlyInterceptor
- type RulesInterceptor
- type SSHServer
- type SSHServerOption
- type Server
- type Setup
Constants ¶
const ( // DefaultDebugMode is the default debug mode DefaultDebugMode = false // DefaultDataDir is the default data directory for storage DefaultDataDir = "./data" // DefaultDockerURL is the default Docker URL to proxy to DefaultDockerURL = "unix:///var/run/docker.sock" // DefaultProxyAddr is the default [int]:<port> to bind the proxy to DefaultProxyAddr = "0.0.0.0:2376" // DefaultSSHAddr is the default [int]:<port> to bind the ssh server to DefaultSSHAddr = "0.0.0.0:2222" // DefaultServiceFQDN is the default fully qualified hostname for the proxy DefaultServiceFQDN = "localhost" // DefaultServiceName is the default friendly name for the proxy DefaultServiceName = "localhost" )
Variables ¶
var ( // Version is the tagged release version in the form <major>.<minor>.<patch> // following semantic versioning and is overwritten by the build system. Version = defaultVersion // Commit is the commit sha of the build (normally from Git) and is overwritten // by the build system. Commit = defaultCommit // Build is the date and time of the build as an RFC3339 formatted string // and is overwritten by the build system. Build = defaultBuild )
Functions ¶
func NewChainInterceptor ¶
func NewChainInterceptor(interceptor ...proxy.Interceptor) proxy.Interceptor
NewChainInterceptor returns a new instance of the ChainInterceptor with the provided interceptors.
func SetupCerts ¶
SetupCerts ensures that the CA and Proxy certificates exists, if not creates them
Types ¶
type AuthHandler ¶
type AuthHandler ssh.PublicKeyHandler
AuthHandler is an alias for ssh.PublicKeyHandler
func AuthorizedKeysAuthHandler ¶
func AuthorizedKeysAuthHandler(keys []ssh.PublicKey) AuthHandler
AuthorizedKeysAuthHandler authenticates SSH sessions by the provided Public SSH keys
func MultiAuthHandler ¶
func MultiAuthHandler(authz ...AuthHandler) AuthHandler
MultiAuthHandler authenticates SSH sessions with multiple authentication methods (in order) The first authentication method to succeed successfully authenticates the User
func RemoteAuthHandler ¶
func RemoteAuthHandler(url string) AuthHandler
RemoteAuthHandler authenticates SSH sessions by fetching Public SSH keys from the provided URL in the form: https://domain/path/%s where %s is replaced with the Username
type AuthInterceptor ¶
type AuthInterceptor struct{}
AuthInterceptor enforces mutual TLS authentication and verification
type ChainInterceptor ¶
type ChainInterceptor struct {
Interceptors []proxy.Interceptor
}
ChainInterceptor is an interceptor that chains multiple interceptors together returning the first non-nil implementation. If all interceptors are exhausted, then the upstream is returned.
type CommandHandler ¶
CommandHandler is a function type for handling custom SSH commands
type Config ¶
type Config struct { DebugMode bool DataDir string DockerURL string ProxyAddr string SSHAddr string ServiceFQDN string ServiceName string }
Config contains the server configuration parameters
type InfoInterceptor ¶
InfoInterceptor intercepts /info (docker info) requests and hides sensitive information about the host(s)
type Option ¶
Option is a function that takes a config struct and modifies it
func WithDataDir ¶
WithDataDir sets the data directory to use for storage
func WithDockerURL ¶
WithDockerURL sets the Docker URL to proxy to
func WithProxyAddr ¶
WithProxyAddr sets the [int]:<port> to bind the proxy to
func WithSSHAddr ¶
WithSSHAddr sets the [int]:<port> to bind the ssh server to
func WithServiceFQDN ¶
WithServiceFQDN sets the fully qualified hostname of the proxy
func WithServiceName ¶
WithServiceName sets the friendly name for the proxy
type ReadOnlyInterceptor ¶
type ReadOnlyInterceptor struct{}
ReadOnlyInterceptor returns an error for any request that make modifications (writes)
type RulesInterceptor ¶
type RulesInterceptor struct { Docker *client.Client AllowBinds []string // AllowEmpty if true allows access to resources with no owner label AllowEmpty bool // ContainerMemory sets default container memory it not specified ContainerMemory uint64 // ContainerCPUPeriod sets the scheduled period in ms for the CFS scheduler to limit CPU resources to containers ContainerCPUPeriod int // ContainerCPUQuota sets the amount of time in ms of the period the container is allowed to ouse. // period=100000 quota=50000 is equivalent to 0.5 Cores // period=100000 quota=100000 is equivalent to 1.0 Cores // period=100000 quota=150000 is equivalent to 1.5 Cores ContainerCPUQuota int // PublicNetworks is a list of publicly accessible networks that users are allowed to connect containers to PublicNetworks []string // User sets the default user if not specified and prevents the use of the root user User string // TODO: Document and test these... AllowHostModeNetworking bool ContainerCgroupParent string ContainerDockerLink string ContainerJoinNetwork string ContainerJoinNetworkAlias string }
RulesInterceptor interests requests and applies a set of rules
type SSHServer ¶
type SSHServer struct {
// contains filtered or unexported fields
}
SSHServer components
func NewSSHServer ¶
func NewSSHServer(bind string, opts ...SSHServerOption) (*SSHServer, error)
NewSSHServer builds a new SSH server binding it to the specified interface and port in bind and configuring it with the provided options for authentication host key path
type SSHServerOption ¶
SSHServerOption is a function type foe configuring SSH Server options
func WithAuthHandler ¶
func WithAuthHandler(auth AuthHandler) SSHServerOption
WithAuthHandler authenticates SSH sessions with the provider AuthHandler
func WithAuthorizedKeysAuth ¶
func WithAuthorizedKeysAuth(fn string) SSHServerOption
WithAuthorizedKeysAuth authenticates SSH sessions with the provided authorized_keys file
func WithGithubAuth ¶
func WithGithubAuth() SSHServerOption
WithGithubAuth authenticates SSH sessions by looking up Github Public SSH Keys of matching Users
func WithHostKeyFile ¶
func WithHostKeyFile(fn string) SSHServerOption
WithHostKeyFile sets the SSH Server's Host Key filename
func WithRemoteAuth ¶
func WithRemoteAuth(url string) SSHServerOption
WithRemoteAuth authenticates SSH sessions with remote authentication
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server components
type Setup ¶
Setup holds a newly created client setup details for templating out a setup script
func CreateClient ¶
CreateClient creates a new client certificate