1 files changed, 96 insertions, 84 deletions

diff --git a/echo/echo_default.go b/echo/echo_default.go
index a63f25f..e518556 100644
--- a/echo/echo_default.go
+++ b/echo/echo_default.go
@@ -6,16 +6,15 @@ import (
         "fmt"
         "html/template"
         "io/fs"
-        "net"
         "net/http"
-        "path"
-        "strconv"
+        "os"
         "sync"
 
-        gltls "code.crute.us/mcrute/golib/crypto/tls"
+        glautocert "code.crute.us/mcrute/golib/crypto/acme/autocert"
         glmw "code.crute.us/mcrute/golib/echo/middleware"
+        "code.crute.us/mcrute/golib/echo/netbox"
         "code.crute.us/mcrute/golib/echo/prometheus"
-        glnet "code.crute.us/mcrute/golib/net"
+        "code.crute.us/mcrute/golib/service"
         glservice "code.crute.us/mcrute/golib/service"
 
         "github.com/labstack/echo/v4"
@@ -28,11 +27,13 @@ import (
 // TODO:
 // - Integrate CSRF
 // - Integrate session
-// - Enable auto cert management by passing hostnames
 
-const (
-        defaultBodySizeLimit = "10M"
-)
+const defaultBodySizeLimit = "10M"
+
+var mandatoryTemplates = []string{
+        "404.tpl", "40x.tpl", "50x.tpl",
+        "header.tpl", "footer.tpl",
+}
 
 func makeMiddlewareSkipper(c *prometheus.PrometheusConfig) middleware.Skipper {
         var path string
@@ -54,17 +55,17 @@ func makeMiddlewareSkipper(c *prometheus.PrometheusConfig) middleware.Skipper {
 }
 
 type EchoConfig struct {
+        Autocert              glautocert.PrimingCertProvider
+        NetboxClient          netbox.NetboxClient
+        ApplicationName       string
+        ApplicationVersion    string
+        DisableServerHeader   bool
         Debug                 bool
-        Hostnames             []string
         BindAddresses         []string
-        BindTLSAddresses      []string
-        TLSCacheDir           string
         BodySizeLimit         string
         TrustedProxyIPRanges  []string
-        ManagementIPRanges    []string
         EmbeddedTemplates     fs.FS
         DiskTemplates         fs.FS
-        TemplateGlob          *string
         TemplateFunctions     template.FuncMap
         CombinedHostLogFile   string
         RedirectToWWW         bool
@@ -76,42 +77,23 @@ type EchoConfig struct {
 
 type EchoWrapper struct {
         *echo.Echo
-        servers     []*http.Server
-        tlsServers  []*http.Server
-        templateFS  fs.FS
-        ocspErrors  chan gltls.OcspError
-        ocspManager *gltls.OcspManager
-        initDone    bool
-}
-
-// Init does "expensive" work that requires network calls but must be called
-// before using the returned echo instance
-func (w *EchoWrapper) Init() error {
-        if err := w.ocspManager.Init(); err != nil {
-                return fmt.Errorf("Error loading TLS certificates and stapling: %w", err)
-        }
-        w.initDone = true
-        return nil
+        Autocert           glautocert.PrimingCertProvider
+        middlewareJobs     []glservice.RunnerFunc
+        middlewareInitJobs []glservice.SyncRunnerFunc
+        servers            []*http.Server
+        tlsServers         []*http.Server
+        templateFS         fs.FS
 }
 
 func (w *EchoWrapper) CachedStaticRoute(prefix, path string) {
+        if w.templateFS == nil {
+                panic("Attempted to set a static route with no templates loaded")
+        }
         StaticFS(w.GET, w.templateFS, prefix, path, glmw.CacheOneMonthMiddleware)
 }
 
-func (w *EchoWrapper) OcspErrors() chan gltls.OcspError {
-        return w.ocspErrors
-}
-
-func (w *EchoWrapper) RunCertificateManager(ctx context.Context, wg *sync.WaitGroup) error {
-        return w.ocspManager.Run(ctx, wg)
-}
-
 func (w *EchoWrapper) makeServerJob(s *http.Server, echoInit bool) glservice.RunnerFunc {
         return func(ctx context.Context, wg *sync.WaitGroup) error {
-                if !w.initDone {
-                        return fmt.Errorf("Echo is not initialized. Call Init()")
-                }
-
                 wg.Add(1)
                 defer wg.Done()
 
@@ -141,7 +123,7 @@ func (w *EchoWrapper) makeServerJob(s *http.Server, echoInit bool) glservice.Run
         }
 }
 
-func (w *EchoWrapper) MakeServerJobs() []glservice.RunnerFunc {
+func (w *EchoWrapper) makeServerJobs() []glservice.RunnerFunc {
         out := []glservice.RunnerFunc{}
 
         for i, s := range w.servers {
@@ -158,6 +140,16 @@ func (w *EchoWrapper) MakeServerJobs() []glservice.RunnerFunc {
         return out
 }
 
+func (w *EchoWrapper) AddJobsToRunner(r *service.AppRunner) {
+        r.AddInitJob(w.Autocert.PrimeCache)
+        r.AddJob(w.Autocert.PrimingReporter(w.Logger))
+
+        r.AddJobs(w.makeServerJobs())
+
+        r.AddInitJobs(w.middlewareInitJobs)
+        r.AddJobs(w.middlewareJobs)
+}
+
 func (w *EchoWrapper) GetTemplateFS() fs.FS {
         return w.templateFS
 }
@@ -166,17 +158,29 @@ func (w *EchoWrapper) GetTemplateFS() fs.FS {
 // configures it in the default way that it should probably be configured in
 // all cases. The struct returned from this function can be treated like a
 // normal Echo instance (because, for the most part it is).
-//
-// Consumers must call Init() on the returned object before serving with it.
 func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
         var err error
 
+        mwjobs := []glservice.RunnerFunc{}
+        mwinitjobs := []glservice.SyncRunnerFunc{}
+
+        if os.Getenv("POMONA_DC_SITE") == "" {
+                return nil, fmt.Errorf("POMONA_DC_SITE must be in the environment")
+        }
+
         e := echo.New()
         e.Debug = c.Debug
 
-        e.IPExtractor, err = glmw.ExtractIPFromXFFHeaders(false, c.TrustedProxyIPRanges)
-        if err != nil {
-                return nil, fmt.Errorf("Error building XFF IP extractor: %w", err)
+        // This is only required if the app is behind a proxy, for apps that
+        // take traffic directly from the internet the IP should just be
+        // extracted from the requests RemoteAddr.
+        if c.TrustedProxyIPRanges == nil {
+                e.IPExtractor, err = glmw.ExtractIPFromXFFHeaders(false, c.TrustedProxyIPRanges)
+                if err != nil {
+                        return nil, fmt.Errorf("Error building XFF IP extractor: %w", err)
+                }
+        } else {
+                e.IPExtractor = echo.ExtractIPDirect()
         }
 
         // Use templates from disk in debug mode and the embedded ones that are
@@ -186,21 +190,23 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
                 templates = c.DiskTemplates
         } else if c.EmbeddedTemplates != nil && !c.Debug { // Prod Mode
                 templates = c.EmbeddedTemplates
-        } else {
-                return nil, fmt.Errorf("No templates available for use")
         }
 
         // Only install template handlers if the path and glob are set
-        if templates != nil && c.TemplateGlob != nil {
-                // TODO: Should assert the presence of required templates: 404.tpl
-                // 40x.tpl 50x.tpl header.tpl footer.tpl
+        if templates != nil {
                 e.HTTPErrorHandler = ErrorHandler(templates, c.TemplateFunctions)
 
-                tr, err := NewTemplateRenderer(templates, *c.TemplateGlob, c.TemplateFunctions)
+                tr, err := NewTemplateRenderer(templates, "*.tpl", c.TemplateFunctions)
                 if err != nil {
                         return nil, fmt.Errorf("Error loading template renderer: %w", err)
                 }
                 e.Renderer = tr
+
+                for _, t := range mandatoryTemplates {
+                        if !tr.HaveTemplate(e.NewContext(nil, nil), t) {
+                                return nil, fmt.Errorf("Tempalate renderer is missing required template %s", t)
+                        }
+                }
         }
 
         e.Logger.SetLevel(log.INFO)
@@ -216,28 +222,27 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
                 e.Use(middleware.LoggerWithConfig(lc))
         }
 
-        cmek := make(chan gltls.OcspError)
-        cm := &gltls.OcspManager{
-                CertPath: path.Join(c.TLSCacheDir, "cert.pem"),
-                KeyPath:  path.Join(c.TLSCacheDir, "key.pem"),
-                Errors:   cmek,
+        bindings, err := ParseAddressPortBindings(c.BindAddresses)
+        if err != nil {
+                return nil, fmt.Errorf("Error parsing address/port bindings")
         }
 
         servers := make([]*http.Server, len(c.BindAddresses))
-        for i, a := range c.BindAddresses {
+        for i, a := range bindings.HttpBindings() {
                 servers[i] = &http.Server{
                         Addr:    a,
                         Handler: e,
                 }
         }
 
-        tlsServers := make([]*http.Server, len(c.BindTLSAddresses))
-        for i, a := range c.BindTLSAddresses {
+        tlsServers := make([]*http.Server, len(c.BindAddresses))
+        for i, a := range bindings.TlsBindings() {
                 tlsServers[i] = &http.Server{
                         Addr: a,
                         TLSConfig: &tls.Config{
                                 MinVersion:     tls.VersionTLS12,
-                                GetCertificate: cm.GetCertificate,
+                                GetCertificate: c.Autocert.GetCertificate,
+                                NextProtos:     []string{"h2", "http/1.1"}, // enable HTTP/2
                         },
                         Handler: e,
                 }
@@ -254,17 +259,9 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
                 e.Use(middleware.BodyLimit(c.BodySizeLimit))
         }
 
-        _, tlsPort, err := net.SplitHostPort(tlsServers[0].Addr)
-        if err != nil {
-                return nil, fmt.Errorf("Unable to split TLS addr and port: %w", err)
-        }
-        tlsPortI, err := strconv.Atoi(tlsPort)
-        if err != nil {
-                return nil, fmt.Errorf("Unable to convert TLS port to int: %w", err)
-        }
         e.Use(glmw.HTTPSRedirectWithConfig(glmw.HTTPSRedirectConfig{
                 Skipper: metricsSkipper,
-                Port:    tlsPortI,
+                Port:    bindings.TlsPort,
         }))
 
         if c.RedirectToWWW {
@@ -292,14 +289,28 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
         if c.ContentSecurityPolicy != nil {
                 e.Use(glmw.ContentSecurityPolicyWithConfig(*c.ContentSecurityPolicy))
         } else {
-                return nil, fmt.Errorf("ContentSecurityPolicy is required")
+                e.Use(glmw.ContentSecurityPolicyWithConfig(glmw.ContentSecurityPolicyConfig{
+                        DefaultSrc: []glmw.CSPDirective{
+                                glmw.CSPSelf,
+                        },
+                }))
         }
 
-        if !c.DisablePrometheus {
-                mips, err := glnet.ParseCIDRSlice(c.ManagementIPRanges)
-                if err != nil {
-                        return nil, err
+        if c.ApplicationName != "" && c.ApplicationVersion != "" && !c.DisableServerHeader {
+                e.Use(glmw.AddServerHeader(c.ApplicationName, c.ApplicationVersion))
+        }
+
+        if !c.DisablePrometheus && c.NetboxClient != nil {
+                // TODO: Should constrain this by site probably but monitoring happens
+                // across sites so those prefixes need to be included
+                f := &glmw.NetboxIPFilter{
+                        NetboxClient:     c.NetboxClient,
+                        Tag:              "management",
+                        IncludeLocalhost: true,
+                        Logger:           e.Logger,
                 }
+                mwinitjobs = append(mwinitjobs, f.Init)
+                mwjobs = append(mwjobs, f.RunRefresh)
 
                 var prom *prometheus.Prometheus
                 if c.PrometheusConfig != nil {
@@ -309,15 +320,16 @@ func NewDefaultEchoWithConfig(c EchoConfig) (*EchoWrapper, error) {
                 }
 
                 e.Use(prom.MiddlewareHandler)
-                e.GET(prom.Config.MetricsPath, prom.MetricsHandler, glmw.NewIPFilter(mips))
+                e.GET(prom.Config.MetricsPath, prom.MetricsHandler, f.Middleware)
         }
 
         return &EchoWrapper{
-                Echo:        e,
-                servers:     servers,
-                tlsServers:  tlsServers,
-                ocspErrors:  cmek,
-                ocspManager: cm,
-                templateFS:  templates,
+                Echo:               e,
+                Autocert:           c.Autocert,
+                servers:            servers,
+                tlsServers:         tlsServers,
+                templateFS:         templates,
+                middlewareJobs:     mwjobs,
+                middlewareInitJobs: mwinitjobs,
         }, nil
 }