Initial import of rewrite

4 files changed, 712 insertions, 0 deletions

diff --git a/cmd/client/client.go b/cmd/client/client.go
new file mode 100644
index 0000000..62f1f48
--- /dev/null
+++ b/cmd/client/client.go
@@ -0,0 +1,226 @@
+package client
+
+import (
+        "bytes"
+        "context"
+        "crypto/ed25519"
+        "crypto/rand"
+        "fmt"
+        "io"
+        "log"
+        "net"
+        "net/http"
+        "os"
+
+        "code.crute.us/mcrute/ssh-proxy/app"
+        "code.crute.us/mcrute/ssh-proxy/proxy"
+        "golang.org/x/crypto/ssh"
+        "golang.org/x/crypto/ssh/agent"
+
+        "code.crute.us/mcrute/golib/cli"
+        "github.com/gorilla/websocket"
+        "github.com/mdp/qrterminal"
+        "github.com/spf13/cobra"
+)
+
+// This should be compiled into the binary
+var clientId string
+
+func Register(root *cobra.Command) {
+        clientCmd := &cobra.Command{
+                Use:   "client proxy-host ssh-to-host ssh-port username",
+                Short: "Run websocket client",
+                Args:  cobra.ExactArgs(4),
+                Run: func(c *cobra.Command, args []string) {
+                        cfg := app.Config{}
+                        cli.MustGetConfig(c, &cfg)
+                        clientMain(cfg, args[0], args[1], args[2], args[3])
+                },
+        }
+        cli.AddFlags(clientCmd, &app.Config{}, app.DefaultConfig, "client")
+        root.AddCommand(clientCmd)
+}
+
+func generateCertificateRequest(username, host string) (ed25519.PrivateKey, []byte, error) {
+        pub, priv, err := ed25519.GenerateKey(rand.Reader)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        pubKey, err := ssh.NewPublicKey(pub)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        cert := &ssh.Certificate{
+                Key:             pubKey,
+                CertType:        ssh.UserCert,
+                ValidPrincipals: []string{username},
+                Permissions: ssh.Permissions{
+                        Extensions: map[string]string{
+                                // Used for CA policy checks, removed by the CA server
+                                // Server supports a comma separated list without spaces
+                                "allowed-hosts": host,
+                        },
+                },
+        }
+
+        signer, err := ssh.NewSignerFromKey(priv)
+        if err != nil {
+                return nil, nil, err
+        }
+
+        // Signatures are required to un/marshal to ASCII. The server will
+        // discard this anyhow and replace it with its own signature.
+        if err := cert.SignCert(rand.Reader, signer); err != nil {
+                return nil, nil, err
+        }
+
+        return priv, ssh.MarshalAuthorizedKey(cert), nil
+}
+
+func getCertificateFromCA(ctx context.Context, oauthToken string, certRequest []byte, host string) (*ssh.Certificate, error) {
+        req, err := http.NewRequestWithContext(ctx, http.MethodPost, fmt.Sprintf("https://%s/ca/issue", host), bytes.NewReader(certRequest))
+        if err != nil {
+                return nil, err
+        }
+
+        req.Header.Add("Content-Type", "application/x-ssh-certificate")
+        req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", oauthToken))
+
+        resp, err := http.DefaultClient.Do(req)
+        if err != nil {
+                return nil, err
+        }
+
+        res, err := io.ReadAll(resp.Body)
+        if err != nil {
+                return nil, err
+        }
+        defer resp.Body.Close()
+
+        if resp.StatusCode != http.StatusOK {
+                return nil, fmt.Errorf("CA returned error: %s", res)
+        }
+
+        pubkey, _, _, _, err := ssh.ParseAuthorizedKey(res)
+        if err != nil {
+                return nil, err
+        }
+
+        cert, ok := pubkey.(*ssh.Certificate)
+        if !ok {
+                return nil, fmt.Errorf("Parsed certificate is of incorrect type")
+        }
+
+        return cert, nil
+}
+
+func addCertificateToAgent(private any, cert *ssh.Certificate) error {
+        socket := os.Getenv("SSH_AUTH_SOCK")
+        conn, err := net.Dial("unix", socket)
+        if err != nil {
+                return err
+        }
+
+        agentConn := agent.NewClient(conn)
+
+        return agentConn.Add(agent.AddedKey{
+                PrivateKey:   private,
+                Certificate:  cert,
+                LifetimeSecs: 10,
+        })
+}
+
+func dialProxyHost(ctx context.Context, oauthToken, proxyHost, host, port string) (io.ReadWriteCloser, error) {
+        addr := fmt.Sprintf("wss://%s/proxy-to/%s/%s", proxyHost, host, port)
+
+        hdr := http.Header{}
+        hdr.Add("Authorization", fmt.Sprintf("Bearer %s", oauthToken))
+
+        conn, _, err := websocket.DefaultDialer.DialContext(ctx, addr, hdr)
+        if err != nil {
+                return nil, err
+        }
+
+        return &proxy.WebsocketReadWriter{W: conn}, nil
+}
+
+func fetchOauthToken(ctx context.Context, clientId, proxyHost string) (string, error) {
+        client := &Oauth2PKCEDeviceClient{
+                Host:     proxyHost,
+                ClientId: clientId,
+                Scope:    "ssh:proxy ca:issue",
+        }
+
+        authResponse, err := client.Authorize(ctx)
+        if err != nil {
+                return "", err
+        }
+
+        fmt.Fprintf(os.Stderr,
+                "To authenticate, please visit: \n\n\t%s \n\nEnter code: %s\n\n",
+                authResponse.VerificationUri, authResponse.UserCode)
+
+        if authResponse.VerificationUriComplete != "" {
+                qrterminal.GenerateWithConfig(authResponse.VerificationUriComplete, qrterminal.Config{
+                        Level:     qrterminal.M,
+                        Writer:    os.Stderr,
+                        BlackChar: "\033[7m  \033[0m", // White
+                        WhiteChar: "\033[0m  \033[0m", // Black
+                        QuietZone: 1,
+                })
+                fmt.Fprintf(os.Stderr, "\n")
+        }
+
+        tokenResponse, err := client.AwaitToken(ctx, authResponse.DeviceCode)
+        if err != nil {
+                return "", err
+        }
+
+        return tokenResponse.AccessToken, nil
+}
+
+func clientMain(cfg app.Config, proxyHost, host, port, username string) {
+        log.SetOutput(os.Stderr)
+
+        ctx, cancel := context.WithCancel(context.Background())
+        defer cancel()
+
+        oauthToken, err := fetchOauthToken(ctx, clientId, proxyHost)
+        if err != nil {
+                log.Fatalf("Error fetching oauth token: %s", err)
+        }
+
+        privateKey, certRequest, err := generateCertificateRequest(username, host)
+        if err != nil {
+                log.Fatalf("Error generating certificate request: %s", err)
+        }
+
+        certificate, err := getCertificateFromCA(ctx, oauthToken, certRequest, proxyHost)
+        if err != nil {
+                log.Fatalf("Error fetching certificate: %s", err)
+        }
+
+        if err := addCertificateToAgent(privateKey, certificate); err != nil {
+                log.Fatalf("Error adding certificate to agent: %s", err)
+        }
+
+        ws, err := dialProxyHost(ctx, oauthToken, proxyHost, host, port)
+        if err != nil {
+                log.Fatalf("Error dialing proxy host: %s", err)
+        }
+        defer ws.Close()
+
+        errc := make(chan error)
+
+        go proxy.CopyWithErrors(os.Stdout, ws, errc)
+        go proxy.CopyWithErrors(ws, os.Stdin, errc)
+
+        err = <-errc
+        if err != nil {
+                log.Printf("Closing client connection: %s", <-errc)
+        } else {
+                log.Printf("Closing client connection")
+        }
+}
diff --git a/cmd/client/oauth2.go b/cmd/client/oauth2.go
new file mode 100644
index 0000000..6667c5a
--- /dev/null
+++ b/cmd/client/oauth2.go
@@ -0,0 +1,158 @@
+package client
+
+import (
+        "context"
+        "encoding/json"
+        "fmt"
+        "net/http"
+        "strings"
+        "time"
+
+        "code.crute.us/mcrute/ssh-proxy/app/models"
+
+        "github.com/google/go-querystring/query"
+)
+
+// Oauth2PKCEDeviceClient is not safe for concurrent use and should be
+// created anew for each request.
+type Oauth2PKCEDeviceClient struct {
+        Host     string
+        ClientId string
+        Scope    string
+        pkce     *models.PKCEChallenge
+        interval time.Duration
+}
+
+func (c *Oauth2PKCEDeviceClient) Authorize(ctx context.Context) (*models.DeviceAuthorizationResponse, error) {
+        challenge, err := models.NewPKCEChallenge()
+        if err != nil {
+                return nil, err
+        }
+        c.pkce = challenge
+
+        values, err := query.Values(models.AuthorizationRequest{
+                Challenge:       c.pkce.Challenge(),
+                ChallengeMethod: models.ChallengeS256,
+                ClientId:        c.ClientId,
+                Scope:           c.Scope,
+        })
+        if err != nil {
+                return nil, err
+        }
+
+        url := fmt.Sprintf("https://%s/auth/device", c.Host)
+        req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(values.Encode()))
+        if err != nil {
+                return nil, err
+        }
+        req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+        res, err := http.DefaultClient.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer res.Body.Close()
+
+        if res.StatusCode != 200 {
+                var resError models.Oauth2Error
+                if err := json.NewDecoder(res.Body).Decode(&resError); err != nil {
+                        return nil, err
+                }
+                return nil, resError
+        }
+
+        var resp models.DeviceAuthorizationResponse
+        if err := json.NewDecoder(res.Body).Decode(&resp); err != nil {
+                return nil, err
+        }
+
+        c.interval = time.Duration(resp.Interval) * time.Second
+        if c.interval == 0 {
+                c.interval = 5 * time.Second
+        }
+
+        return &resp, nil
+}
+
+func (c *Oauth2PKCEDeviceClient) fetchToken(ctx context.Context, deviceCode string) (*models.AccessTokenResponse, error) {
+        values, err := query.Values(models.DeviceAccessTokenRequest{
+                GrantType:    models.DEVICE_CODE_GRANT_TYPE,
+                DeviceCode:   deviceCode,
+                ClientId:     c.ClientId,
+                CodeVerifier: c.pkce.Verifier,
+        })
+        if err != nil {
+                return nil, err
+        }
+
+        url := fmt.Sprintf("https://%s/auth/token", c.Host)
+        req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(values.Encode()))
+        if err != nil {
+                return nil, err
+        }
+        req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
+
+        res, err := http.DefaultClient.Do(req)
+        if err != nil {
+                return nil, err
+        }
+        defer res.Body.Close()
+
+        if res.StatusCode != 200 {
+                var resError models.Oauth2Error
+                if err := json.NewDecoder(res.Body).Decode(&resError); err != nil {
+                        return nil, err
+                }
+
+                if resError.Type == models.ErrSlowDown {
+                        c.interval += 5 * time.Second
+                }
+
+                return nil, resError
+        }
+
+        var resp models.AccessTokenResponse
+        if err := json.NewDecoder(res.Body).Decode(&resp); err != nil {
+                return nil, err
+        }
+
+        return &resp, nil
+}
+
+func (c *Oauth2PKCEDeviceClient) AwaitToken(ctx context.Context, deviceCode string) (*models.AccessTokenResponse, error) {
+        t := time.NewTicker(c.interval)
+        defer t.Stop()
+
+        res, err := c.fetchToken(ctx, deviceCode)
+        if err == nil {
+                return res, nil
+        } else if e, ok := err.(models.Oauth2Error); ok {
+                if e.Type == models.ErrSlowDown {
+                        t.Reset(c.interval)
+                } else if e.Type != models.ErrAuthorizationPending {
+                        return nil, err
+                }
+        } else {
+                return nil, err
+        }
+
+        for {
+                select {
+                case <-t.C:
+                        res, err := c.fetchToken(ctx, deviceCode)
+                        if err == nil {
+                                return res, nil
+                        } else if e, ok := err.(models.Oauth2Error); ok {
+                                if e.Type == models.ErrSlowDown {
+                                        t.Reset(c.interval)
+                                } else if e.Type != models.ErrAuthorizationPending {
+                                        return nil, err
+                                }
+                        } else {
+                                return nil, err
+                        }
+                case <-ctx.Done():
+                        return nil, fmt.Errorf("Context has expired")
+                }
+        }
+}
diff --git a/cmd/register/register.go b/cmd/register/register.go
new file mode 100644
index 0000000..fdd083c
--- /dev/null
+++ b/cmd/register/register.go
@@ -0,0 +1,71 @@
+package register
+
+import (
+        "context"
+        "log"
+        "time"
+
+        "code.crute.us/mcrute/golib/cli"
+        "code.crute.us/mcrute/golib/db/mongodb/v2"
+        glecho "code.crute.us/mcrute/golib/echo"
+        "code.crute.us/mcrute/ssh-proxy/app"
+        "code.crute.us/mcrute/ssh-proxy/app/models"
+        "code.crute.us/mcrute/ssh-proxy/db"
+        "github.com/spf13/cobra"
+)
+
+func Register(root *cobra.Command) {
+        registerCmd := &cobra.Command{
+                Use:   "register username",
+                Short: "Create registration invite for user",
+                Args:  cobra.ExactArgs(1),
+                Run: func(c *cobra.Command, args []string) {
+                        cfg := app.Config{}
+                        cli.MustGetConfig(c, &cfg)
+                        registerMain(cfg, args[0])
+                },
+        }
+        cli.AddFlags(registerCmd, &app.Config{}, app.DefaultConfig, "register")
+        root.AddCommand(registerCmd)
+}
+
+func registerMain(cfg app.Config, username string) {
+        ctx, cancel := context.WithCancel(context.Background())
+        defer cancel()
+
+        vc, err := glecho.MakeVaultSecretsClient(ctx)
+        if err != nil {
+                log.Fatalf("Error making vault client %s", err)
+        }
+
+        mongo, err := mongodb.Connect(ctx, cfg.MongoDbUri, vc)
+        if err != nil {
+                log.Fatalf("Error connecting to mongodb: %s", err)
+        }
+
+        userStore := &db.MongoDbBasicStore[*models.User]{
+                Db:             mongo,
+                CollectionName: "users",
+        }
+
+        authSessionStore := &models.AuthSessionStoreMongodb{
+                MongoDbBasicStore: &db.MongoDbBasicStore[*models.AuthSession]{
+                        Db:             mongo,
+                        CollectionName: "oauth_sessions",
+                },
+        }
+
+        if _, err := userStore.Get(ctx, username); err != nil {
+                log.Fatalf("User %s does not exist", username)
+        }
+
+        authSession := models.NewAuthSession("invite-only", time.Now().Add(cfg.InviteTimeout))
+        authSession.IsRegistration = true
+        authSession.UserId = username
+
+        if err := authSessionStore.Upsert(ctx, authSession); err != nil {
+                log.Fatalf("Error inserting registration: %s", err)
+        }
+
+        log.Printf("Invitation created, user code is: %s", authSession.UserCode)
+}
diff --git a/cmd/web/server.go b/cmd/web/server.go
new file mode 100644
index 0000000..6eb585a
--- /dev/null
+++ b/cmd/web/server.go
@@ -0,0 +1,257 @@
+package web
+
+import (
+        "context"
+        "fmt"
+        "io/fs"
+        "log"
+        "os"
+        "strings"
+        "text/template"
+        "time"
+
+        "code.crute.us/mcrute/ssh-proxy/app"
+        "code.crute.us/mcrute/ssh-proxy/app/controllers"
+        "code.crute.us/mcrute/ssh-proxy/app/middleware"
+        "code.crute.us/mcrute/ssh-proxy/app/models"
+        "code.crute.us/mcrute/ssh-proxy/db"
+
+        "code.crute.us/mcrute/golib/cli"
+        "code.crute.us/mcrute/golib/clients/autocert/v2"
+        "code.crute.us/mcrute/golib/clients/netbox/v3"
+        "code.crute.us/mcrute/golib/db/mongodb/v2"
+        glecho "code.crute.us/mcrute/golib/echo"
+        glcontroller "code.crute.us/mcrute/golib/echo/controller"
+        glmiddleware "code.crute.us/mcrute/golib/echo/middleware"
+        "code.crute.us/mcrute/golib/echo/session"
+        "code.crute.us/mcrute/golib/secrets"
+
+        "github.com/go-webauthn/webauthn/webauthn"
+        "github.com/gorilla/websocket"
+        "github.com/labstack/echo/v4"
+        "github.com/spf13/cobra"
+)
+
+func Register(root *cobra.Command, embeddedTemplates fs.FS, appVersion string) {
+        webCmd := &cobra.Command{
+                Use:   "web [options]",
+                Short: "Run web server",
+                Run: func(c *cobra.Command, args []string) {
+                        cfg := app.Config{}
+                        cli.MustGetConfig(c, &cfg)
+                        webMain(cfg, embeddedTemplates, appVersion)
+                },
+        }
+        cli.AddFlags(webCmd, &app.Config{}, app.DefaultConfig, "web")
+        root.AddCommand(webCmd)
+}
+
+func PopulateTemplateContext(c echo.Context) (interface{}, error) {
+        // May not be set if we're being called from something other than
+        // the generic template controller, which can happen in the order
+        // redirect controller.
+        cp, _ := c.Get("CanonicalPath").(string)
+
+        return &app.PageContext{
+                PageName:   strings.SplitN(cp, ".", 2)[0],
+                Year:       time.Now().Year(),
+                RenderTime: time.Now().Format(time.RFC1123),
+                Flags:      glcontroller.NewFeatureFlags(),
+                CSRFToken:  glmiddleware.GetCSRFToken(c),
+                Context:    glcontroller.NewPageContext(),
+        }, nil
+}
+
+func webMain(cfg app.Config, embeddedTemplates fs.FS, appVersion string) {
+        ctx, cancel := context.WithCancel(context.Background())
+        defer cancel()
+
+        gt := &glcontroller.GenericTemplateHandler{Render: PopulateTemplateContext}
+
+        s, err := glecho.NewEchoWrapper(ctx, cfg.Debug)
+        if err != nil {
+                log.Fatalf("Error building echo: %s", err)
+        }
+
+        vc, err := glecho.MakeVaultSecretsClient(ctx)
+        if err != nil {
+                log.Fatalf("Error making vault client %s", err)
+        }
+
+        if err = s.Configure(glecho.EchoConfig{
+                ApplicationName:      "app-server",
+                ApplicationVersion:   appVersion,
+                BindAddresses:        cfg.Bind,
+                DiskTemplates:        os.DirFS("templates/"),
+                EmbeddedTemplates:    embeddedTemplates,
+                RedirectToWWW:        false,
+                TrustedProxyIPRanges: cfg.TrustedIPRanges,
+                ContentSecurityPolicy: &glmiddleware.ContentSecurityPolicyConfig{
+                        DefaultSrc: []glmiddleware.CSPDirective{
+                                glmiddleware.CSPSelf,
+                                glmiddleware.CSPUnsafeInline,
+                        },
+                },
+                TemplateFunctions: template.FuncMap{
+                        "cacheBustUrl": gt.TmplMakeCacheBustUrl,
+                },
+                Autocert: autocert.MustNewAutocertWrapper(ctx, autocert.AutocertConfig{
+                        ApiKey:   secrets.MustGetApiKey(vc, ctx, cfg.DNSApiKeyVaultPath).Key,
+                        Hosts:    cfg.Hostnames,
+                        Email:    cfg.AutocertEmail,
+                        CertHost: cfg.AutocertHost,
+                }),
+                NetboxClient: &netbox.BasicNetboxClient{
+                        Endpoint: cfg.NetboxHost,
+                        ApiKey:   secrets.MustGetApiKey(vc, ctx, cfg.NetboxApiKeyVaultPath).Key,
+                },
+        }); err != nil {
+                log.Fatalf("Error configuring echo: %s", err)
+        }
+
+        glecho.AttachSecretsClient(vc, cancel, s.Runner(), s.Logger)
+
+        mongo, err := mongodb.Connect(ctx, cfg.MongoDbUri, vc)
+        if err != nil {
+                log.Fatalf("Error connecting to mongodb: %s", err)
+        }
+
+        cookieKey := secrets.MustGetRSAKey(vc, ctx, cfg.CookieKeyPath)
+        pk, err := cookieKey.RSAPrivateKey()
+        if err != nil {
+                log.Fatalf("Error fetching cookie key from vault: %s", err)
+        }
+
+        ss, err := session.NewCookieStore[*app.Session](pk, app.NewSession)
+        if err != nil {
+                log.Fatalf("Error creating session store: %s", err)
+        }
+
+        userStore := &db.MongoDbBasicStore[*models.User]{
+                Db:             mongo,
+                CollectionName: "users",
+        }
+
+        oauthClientStore := &db.MongoDbBasicStore[*models.OauthClient]{
+                Db:             mongo,
+                CollectionName: "oauth_clients",
+        }
+
+        authSessionStore := &models.AuthSessionStoreMongodb{
+                MongoDbBasicStore: &db.MongoDbBasicStore[*models.AuthSession]{
+                        Db:             mongo,
+                        CollectionName: "oauth_sessions",
+                },
+        }
+
+        wauthn, err := webauthn.New(&webauthn.Config{
+                RPDisplayName: cfg.OauthRPName,
+                RPID:          cfg.Hostnames[0],
+                RPOrigins: []string{
+                        fmt.Sprintf("https://%s:8070", cfg.Hostnames[0]), // TODO: Expose port in echo server for use here
+                },
+        })
+        if err != nil {
+                log.Fatalf("Error constructing webauthn: %s", err)
+        }
+
+        lc := &controllers.LoginController[*app.Session]{
+                Logger:            s.Logger,
+                Sessions:          ss,
+                Users:             userStore,
+                AuthSessions:      authSessionStore,
+                Webauthn:          wauthn,
+                SessionExpiration: cfg.OauthSessionTimeout,
+        }
+
+        rc := &controllers.RegisterController[*app.Session]{
+                Logger:       s.Logger,
+                Sessions:     ss,
+                Users:        userStore,
+                AuthSessions: authSessionStore,
+                Webauthn:     wauthn,
+        }
+
+        o2dc := &controllers.OAuth2DeviceController[*app.Session]{
+                Logger:            s.Logger,
+                AuthSessions:      authSessionStore,
+                OauthClients:      oauthClientStore,
+                Hostname:          fmt.Sprintf("https://%s:8070", cfg.Hostnames[0]), // TODO
+                PollSeconds:       cfg.OauthDevicePollSecs,
+                SessionExpiration: cfg.OauthSessionTimeout,
+        }
+
+        ph := &controllers.ProxyHandler{
+                Logger: s.Logger,
+                Users:  userStore,
+                Upgrader: websocket.Upgrader{
+                        ReadBufferSize:  1024,
+                        WriteBufferSize: 1024,
+                },
+        }
+
+        caAuthMw := &middleware.TokenAuthMiddleware{
+                Logger:        s.Logger,
+                RequiredScope: "ca:issue",
+                AuthSessions:  authSessionStore,
+        }
+
+        proxyAuthMw := &middleware.TokenAuthMiddleware{
+                Logger:        s.Logger,
+                RequiredScope: "ssh:proxy",
+                AuthSessions:  authSessionStore,
+        }
+
+        var caSecret controllers.CASecret
+        if _, err := vc.Secret(ctx, cfg.SSHCAKeyPath, &caSecret); err != nil {
+                log.Fatalf("Error fetching SSH CA secret from Vault: %s", err)
+        }
+
+        ca, err := controllers.NewCAHandler(controllers.CAHandlerConfig{
+                Logger:     s.Logger,
+                Users:      userStore,
+                Expiration: cfg.SSHCertificateExpiration,
+                Secret:     caSecret,
+        })
+        if err != nil {
+                log.Fatalf("Error building CA controller: %s", err)
+        }
+
+        s.Use(session.Middleware(ss))
+
+        csm := glmiddleware.CSRFProtect(ss)
+
+        s.GET("/login", gt.Handle, csm)
+        s.GET("/register", gt.Handle, csm)
+
+        ag := s.Group("/auth")
+        {
+                ag.POST("/device", o2dc.HandleStart)
+                ag.POST("/token", o2dc.HandleToken)
+
+                lg := ag.Group("/login")
+                lg.Use(csm)
+                {
+                        lg.GET("/:username", lc.HandleStart)
+                        lg.POST("/:username", lc.HandleFinish)
+                }
+
+                rg := ag.Group("/register")
+                rg.Use(csm)
+                {
+                        rg.GET("/:username", rc.HandleStart)
+                        rg.POST("/:username", rc.HandleFinish)
+                }
+        }
+
+        s.POST("/ca/issue", ca.HandleIssue, caAuthMw.Middleware)
+
+        pg := s.Group("/proxy-to")
+        pg.Use(proxyAuthMw.Middleware)
+        {
+                pg.GET("/:host", ph.Handle)
+                pg.GET("/:host/:port", ph.Handle)
+        }
+
+        s.RunForever(!cfg.DisableBackgroundJobs)
+}