+1

knotserver/config/config.go

Reviewed

··· 24 24 Owner string `env:"OWNER, required"` 25 25 LogDids bool `env:"LOG_DIDS, default=true"` 26 26 MaxResponseKB int `env:"MAX_RESPONSE_KB, default=5120"` 27 27 + AdminSecret string `env:"ADMIN_SECRET"` 27 28 28 29 // This disables signature verification so use with caution. 29 30 Dev bool `env:"DEV, default=false"`

+71

knotserver/xrpc/admin.go

Reviewed

··· 1 1 + package xrpc 2 2 + 3 3 + import ( 4 4 + "crypto/subtle" 5 5 + "encoding/json" 6 6 + "errors" 7 7 + "net/http" 8 8 + 9 9 + "github.com/bluesky-social/indigo/atproto/syntax" 10 10 + "github.com/go-chi/chi/v5" 11 11 + "tangled.org/core/api/tangled" 12 12 + xrpcerr "tangled.org/core/xrpc/errors" 13 13 + ) 14 14 + 15 15 + const maxAdminBodyBytes = 4 << 10 16 16 + 17 17 + func (x *Xrpc) AdminRouter() http.Handler { 18 18 + r := chi.NewRouter() 19 19 + r.Use(x.VerifyAdminSecret) 20 20 + r.Post("/addMember", x.AddMemberAdmin) 21 21 + return r 22 22 + } 23 23 + 24 24 + func (x *Xrpc) VerifyAdminSecret(next http.Handler) http.Handler { 25 25 + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 26 26 + secret := x.Config.Server.AdminSecret 27 27 + user, pass, ok := r.BasicAuth() 28 28 + valid := secret != "" && 29 29 + ok && 30 30 + user == "admin" && 31 31 + subtle.ConstantTimeCompare([]byte(pass), []byte(secret)) == 1 32 32 + if !valid { 33 33 + writeError(w, xrpcerr.AuthError(errors.New("invalid admin credentials")), http.StatusUnauthorized) 34 34 + return 35 35 + } 36 36 + next.ServeHTTP(w, r) 37 37 + }) 38 38 + } 39 39 + 40 40 + func (x *Xrpc) AddMemberAdmin(w http.ResponseWriter, r *http.Request) { 41 41 + l := x.Logger.With("handler", "AddMemberAdmin") 42 42 + fail := func(e xrpcerr.XrpcError, status int) { 43 43 + l.Error("failed", "kind", e.Tag, "error", e.Message) 44 44 + writeError(w, e, status) 45 45 + } 46 46 + 47 47 + var data tangled.KnotAddMember_Input 48 48 + if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, maxAdminBodyBytes)).Decode(&data); err != nil { 49 49 + fail(xrpcerr.GenericError(err), http.StatusBadRequest) 50 50 + return 51 51 + } 52 52 + 53 53 + subject, err := syntax.ParseDID(data.Subject) 54 54 + if err != nil { 55 55 + fail(xrpcerr.GenericError(err), http.StatusBadRequest) 56 56 + return 57 57 + } 58 58 + 59 59 + owner, err := syntax.ParseDID(x.Config.Server.Owner) 60 60 + if err != nil { 61 61 + fail(xrpcerr.GenericError(err), http.StatusInternalServerError) 62 62 + return 63 63 + } 64 64 + 65 65 + status, xerr := x.addMemberToKnot(r.Context(), l, owner, subject) 66 66 + if xerr != nil { 67 67 + fail(*xerr, status) 68 68 + return 69 69 + } 70 70 + w.WriteHeader(status) 71 71 + }

+14

nix/modules/knot.nix

Reviewed

··· 190 190 description = "Maximum response size in kilobytes"; 191 191 }; 192 192 }; 193 193 + 194 194 + environmentFile = mkOption { 195 195 + type = with types; nullOr path; 196 196 + default = null; 197 197 + example = "/etc/knot.env"; 198 198 + description = '' 199 199 + Additional environment file as defined in {manpage}`systemd.exec(5)`. 200 200 + 201 201 + Sensitive secrets such as {env}`KNOT_SERVER_ADMIN_SECRET` may be 202 202 + passed to the service without making them world readable in the nix 203 203 + store. 204 204 + ''; 205 205 + }; 193 206 }; 194 207 }; 195 208 ··· 336 349 else "false" 337 350 }" 338 351 ]; 352 352 + EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile; 339 353 ExecStart = "${cfg.package}/bin/knot server"; 340 354 Restart = "always"; 341 355 }