1 files changed, 122 insertions, 55 deletions

diff --git a/echo/echo_default.go b/echo/echo_default.go
index ddaab44..92a5cfd 100644
--- a/echo/echo_default.go
+++ b/echo/echo_default.go
@@ -6,13 +6,17 @@ import (
         "fmt"
         "html/template"
         "io/fs"
+        "net"
         "net/http"
         "path"
+        "strconv"
         "sync"
 
         gltls "code.crute.us/mcrute/golib/crypto/tls"
         glmw "code.crute.us/mcrute/golib/echo/middleware"
         "code.crute.us/mcrute/golib/echo/prometheus"
+        glnet "code.crute.us/mcrute/golib/net"
+        glservice "code.crute.us/mcrute/golib/service"
 
         "github.com/labstack/echo/v4"
         "github.com/labstack/echo/v4/middleware"
@@ -22,21 +26,23 @@ import (
 // Docs: https://echo.labstack.com/guide/
 
 // TODO:
-// - Intgrate prometheus
-// - Integrate CORS
-// - Access control prometheus by IP
-// - Fix redirectors to consider port
-// - Fix redirectors to not redirect IP addresses
 // - Integrate CSRF
 // - Integrate session
-// - Use bodylimit e.Use(middleware.BodyLimit("2M"))
+// - Enable auto cert management by passing hostnames
+
+const (
+        defaultBodySizeLimit = "10M"
+)
 
 type EchoConfig struct {
         Debug                 bool
-        BindAddress           string
-        BindTLSAddress        string
+        Hostnames             []string
+        BindAddresses         []string
+        BindTLSAddresses      []string
         TLSCacheDir           string
+        BodySizeLimit         string
         TrustedProxyIPRanges  []string
+        ManagementIPRanges    []string
         EmbeddedTemplates     fs.FS
         DiskTemplates         fs.FS
         TemplateGlob          *string
@@ -44,14 +50,16 @@ type EchoConfig struct {
         CombinedHostLogFile   string
         RedirectToWWW         bool
         ContentSecurityPolicy *glmw.ContentSecurityPolicyConfig
+        DisablePrometheus     bool
         PrometheusConfig      *prometheus.PrometheusConfig
+        CORSConfig            *middleware.CORSConfig
 }
 
 type EchoWrapper struct {
         *echo.Echo
-        tlsServer   http.Server
+        servers     []*http.Server
+        tlsServers  []*http.Server
         templateFS  fs.FS
-        bindAddress string
         ocspErrors  chan gltls.OcspError
         ocspManager *gltls.OcspManager
         initDone    bool
@@ -79,45 +87,56 @@ func (w *EchoWrapper) RunCertificateManager(ctx context.Context, wg *sync.WaitGr
         return w.ocspManager.Run(ctx, wg)
 }
 
-func (w *EchoWrapper) run(ctx context.Context, wg *sync.WaitGroup, f func() error, sf func(context.Context) error) error {
-        if !w.initDone {
-                return fmt.Errorf("Echo is not initialized. Call Init()")
-        }
+func (w *EchoWrapper) makeServerJob(s *http.Server, echoInit bool) glservice.RunnerFunc {
+        return func(ctx context.Context, wg *sync.WaitGroup) error {
+                if !w.initDone {
+                        return fmt.Errorf("Echo is not initialized. Call Init()")
+                }
 
-        wg.Add(1)
-        defer wg.Done()
+                wg.Add(1)
+                defer wg.Done()
 
-        err := make(chan error)
-        go func() { err <- f() }()
-        select {
-        case e := <-err:
-                return e
-        default:
-        }
+                w.Logger.Infof("Starting server with address: %s", s.Addr)
 
-        select {
-        case <-ctx.Done():
-                w.Logger.Info("Shutting down web server")
-                return sf(ctx)
+                err := make(chan error)
+                go func() {
+                        if s.TLSConfig == nil && echoInit {
+                                err <- w.Echo.StartServer(s)
+                        } else if s.TLSConfig == nil && !echoInit {
+                                err <- s.ListenAndServe()
+                        } else {
+                                err <- s.ListenAndServeTLS("", "")
+                        }
+                }()
+                select {
+                case e := <-err:
+                        return e
+                default:
+                }
+
+                select {
+                case <-ctx.Done():
+                        w.Logger.Info("Shutting down web server")
+                        return s.Shutdown(ctx)
+                }
         }
 }
 
-func (w *EchoWrapper) Serve(ctx context.Context, wg *sync.WaitGroup) error {
-        return w.run(
-                ctx,
-                wg,
-                func() error { return w.Echo.Start(w.bindAddress) },
-                func(ctx context.Context) error { return w.Echo.Shutdown(ctx) },
-        )
-}
+func (w *EchoWrapper) MakeServerJobs() []glservice.RunnerFunc {
+        out := []glservice.RunnerFunc{}
 
-func (w *EchoWrapper) ServeTLS(ctx context.Context, wg *sync.WaitGroup) error {
-        return w.run(
-                ctx,
-                wg,
-                func() error { return w.tlsServer.ListenAndServeTLS("", "") },
-                func(ctx context.Context) error { return w.tlsServer.Shutdown(ctx) },
-        )
+        for i, s := range w.servers {
+                // The first http (not https) server should do an echo.StartServer to
+                // configure some internal echo state and print the banner (if
+                // configured).
+                out = append(out, w.makeServerJob(s, i == 0))
+        }
+
+        for _, s := range w.tlsServers {
+                out = append(out, w.makeServerJob(s, false))
+        }
+
+        return out
 }
 
 func (w *EchoWrapper) GetTemplateFS() fs.FS {
@@ -183,25 +202,55 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
                 Errors:   cmek,
         }
 
-        ts := http.Server{
-                Addr: c.BindTLSAddress,
-                TLSConfig: &tls.Config{
-                        MinVersion:     tls.VersionTLS12,
-                        GetCertificate: cm.GetCertificate,
-                },
-                Handler: e,
+        servers := make([]*http.Server, len(c.BindAddresses))
+        for i, a := range c.BindAddresses {
+                servers[i] = &http.Server{
+                        Addr:    a,
+                        Handler: e,
+                }
+        }
+
+        tlsServers := make([]*http.Server, len(c.BindTLSAddresses))
+        for i, a := range c.BindTLSAddresses {
+                tlsServers[i] = &http.Server{
+                        Addr: a,
+                        TLSConfig: &tls.Config{
+                                MinVersion:     tls.VersionTLS12,
+                                GetCertificate: cm.GetCertificate,
+                        },
+                        Handler: e,
+                }
         }
 
         e.Use(middleware.Logger())
         e.Use(glmw.Recover())
-        e.Use(middleware.HTTPSRedirect())
+
+        if c.BodySizeLimit == "" {
+                e.Use(middleware.BodyLimit(defaultBodySizeLimit))
+        } else if c.BodySizeLimit != "0" {
+                e.Use(middleware.BodyLimit(c.BodySizeLimit))
+        }
+
+        _, tlsPort, err := net.SplitHostPort(tlsServers[0].Addr)
+        if err != nil {
+                return nil, fmt.Errorf("Unable to split TLS addr and port: %w", err)
+        }
+        tlsPortI, err := strconv.Atoi(tlsPort)
+        if err != nil {
+                return nil, fmt.Errorf("Unable to convert TLS port to int: %w", err)
+        }
+        e.Use(glmw.HTTPSRedirectWithConfig(glmw.HTTPSRedirectConfig{Port: tlsPortI}))
+
         if c.RedirectToWWW {
                 e.Use(middleware.WWWRedirect())
         }
+
         e.Use(middleware.Decompress())
         e.Use(middleware.GzipWithConfig(middleware.GzipConfig{
                 // TODO: This mw causes prometheus responses to show up compressed for
                 // browsers. Why?
+                //
+                // Also, this path should use the config path if we keep it
                 Skipper: func(c echo.Context) bool {
                         if c.Path() == "/metrics" {
                                 return true
@@ -210,24 +259,42 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
                 },
                 Level: 5,
         }))
+
         e.Use(glmw.StrictSecure())
 
+        if c.CORSConfig != nil {
+                e.Use(middleware.CORSWithConfig(*c.CORSConfig))
+        } else {
+                e.Use(middleware.CORS())
+        }
+
         if c.ContentSecurityPolicy != nil {
                 e.Use(glmw.ContentSecurityPolicyWithConfig(*c.ContentSecurityPolicy))
         } else {
                 return nil, fmt.Errorf("ContentSecurityPolicy is required")
         }
 
-        if c.PrometheusConfig != nil {
-                prom := prometheus.NewPrometheusWithConfig(c.PrometheusConfig)
+        if !c.DisablePrometheus {
+                mips, err := glnet.ParseCIDRSlice(c.ManagementIPRanges)
+                if err != nil {
+                        return nil, err
+                }
+
+                var prom *prometheus.Prometheus
+                if c.PrometheusConfig != nil {
+                        prom = prometheus.NewPrometheusWithConfig(c.PrometheusConfig)
+                } else {
+                        prom = prometheus.NewPrometheus()
+                }
+
                 e.Use(prom.MiddlewareHandler)
-                e.GET(c.PrometheusConfig.MetricsPath, prom.MetricsHandler)
+                e.GET(prom.Config.MetricsPath, prom.MetricsHandler, glmw.NewIPFilter(mips))
         }
 
         return &EchoWrapper{
                 Echo:        e,
-                tlsServer:   ts,
-                bindAddress: c.BindAddress,
+                servers:     servers,
+                tlsServers:  tlsServers,
                 ocspErrors:  cmek,
                 ocspManager: cm,
                 templateFS:  templates,