server

package
v0.9.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 10, 2026 License: MIT Imports: 52 Imported by: 0

Documentation

Index

Constants

View Source 
const ServiceAuthUsername = "service"

ServiceAuthUsername is the conventional HTTP Basic username for the machine-generated service secret. The username is not actually checked (all the entropy is in the secret); it exists so client configs and docs have a stable principal to show, and so the injected identity header has a value.

Variables

This section is empty.

Functions

This section is empty.

Types

type AuthPolicyState added in v0.9.0 

type AuthPolicyState struct {
	ID         string
	Users      map[string]bool // allowed user IDs
	Header     string
	SecretHash string
}

AuthPolicyState is the runtime form of a config AuthPolicy. A request passes if it is a logged-in user in Users, or (optionally) presents the service secret via HTTP Basic.

type ClientInfo 

type ClientInfo struct {
	Addr        string
	ConnectedAt time.Time
	Version     string
}

ClientInfo holds exported details about a connected client.

type IPAllowStore added in v0.8.16 

type IPAllowStore struct {
	// contains filtered or unexported fields
}

IPAllowStore persists per-tunnel self-service IP grants to a JSON file. It is safe for concurrent use. Permanent allowlist entries live in the tunnel config (AllowIPs); this store holds only the dynamic, TTL'd grants.

func NewIPAllowStore added in v0.8.16 

func NewIPAllowStore(path string) (*IPAllowStore, error)

NewIPAllowStore loads grants from path (creating an empty store if absent).

func (*IPAllowStore) Grant added in v0.8.16 

func (s *IPAllowStore) Grant(tunnelID, ip, by string, ttl time.Duration) error

Grant authorizes ip for the tunnel for ttl, refreshing any existing grant for the same IP. by identifies who created the grant (for the audit trail / UI).

func (*IPAllowStore) GrantFor added in v0.8.19 

func (s *IPAllowStore) GrantFor(tunnelID string, ip net.IP) (IPGrant, bool)

GrantFor returns the live grant for a tunnel/IP, or ok=false if none.

func (*IPAllowStore) IsGranted added in v0.8.16 

func (s *IPAllowStore) IsGranted(tunnelID string, ip net.IP) bool

IsGranted reports whether ip currently has a live grant for the tunnel.

func (*IPAllowStore) List added in v0.8.16 

func (s *IPAllowStore) List(tunnelID string) []IPGrant

List returns the live (non-expired) grants for a tunnel, newest first.

func (*IPAllowStore) Revoke added in v0.8.16 

func (s *IPAllowStore) Revoke(tunnelID, ip string) error

Revoke removes a grant for the given tunnel/IP. It is not an error if absent.

type IPGrant added in v0.8.16 

type IPGrant struct {
	IP        string    `json:"ip"`
	GrantedBy string    `json:"granted_by"`
	GrantedAt time.Time `json:"granted_at"`
	ExpiresAt time.Time `json:"expires_at"`
}

IPGrant is a single self-service IP authorization for a tunnel. Grants are created when an authenticated admin authorizes their current source IP, and expire after a TTL (dynamic IPs change, so grants are intentionally temporary).

type IPPolicyState added in v0.9.0 

type IPPolicyState struct {
	ID          string
	Ranges      []config.IPRange // raw entries (cidr + comment), for display
	EnrollToken string
	// contains filtered or unexported fields
}

IPPolicyState is the runtime form of a config IPPolicy: a reusable source-IP allowlist that tunnels reference by ID.

func (*IPPolicyState) Allows added in v0.9.0 

func (p *IPPolicyState) Allows(ip net.IP) bool

Allows reports whether ip matches one of the policy's permanent ranges. Self-service (TTL'd) grants are checked separately via the IPAllowStore.

func (*IPPolicyState) CIDRs added in v0.9.0 

func (p *IPPolicyState) CIDRs() []string

CIDRs returns the raw range strings (for display/serialization).

type RedirectView 

type RedirectView struct {
	From         string
	To           string
	PreservePath bool
	CertValid    bool
	CertExpiry   string
	CertError    string
}

RedirectView is the template data for a single redirect row.

type Registry 

type Registry struct {
	// contains filtered or unexported fields
}

Registry holds all configured tunnels and provides lookups.

func NewRegistry 

func NewRegistry() *Registry

func (*Registry) AllAuthPolicies added in v0.9.0 

func (r *Registry) AllAuthPolicies() []*AuthPolicyState

AllAuthPolicies returns all auth policies, sorted by ID.

func (*Registry) AllIPPolicies added in v0.9.0 

func (r *Registry) AllIPPolicies() []*IPPolicyState

AllIPPolicies returns all IP policies, sorted by ID.

func (*Registry) AllTunnels 

func (r *Registry) AllTunnels() []*TunnelState

func (*Registry) FindAuthPolicy added in v0.9.0 

func (r *Registry) FindAuthPolicy(id string) *AuthPolicyState

func (*Registry) FindByHostname 

func (r *Registry) FindByHostname(host string) *TunnelState

func (*Registry) FindByID 

func (r *Registry) FindByID(id string) *TunnelState

func (*Registry) FindByPort 

func (r *Registry) FindByPort(port int) *TunnelState

func (*Registry) FindIPPolicy added in v0.9.0 

func (r *Registry) FindIPPolicy(id string) *IPPolicyState

func (*Registry) Register 

func (r *Registry) Register(t *TunnelState)

func (*Registry) Reload 

func (r *Registry) Reload(specs []TunnelSpec)

Reload updates the registry with new tunnel specs. Existing tunnels keep their connection state and metrics. New tunnels are added, removed tunnels are dropped (connections will be closed by SSH).

func (*Registry) SetPolicies added in v0.9.0 

func (r *Registry) SetPolicies(ip []*IPPolicyState, auth []*AuthPolicyState)

SetPolicies replaces the registry's access policies (called at startup and on config reload).

type SSEBroadcaster 

type SSEBroadcaster struct {
	// contains filtered or unexported fields
}

SSEBroadcaster manages Server-Sent Events connections.

func NewSSEBroadcaster 

func NewSSEBroadcaster() *SSEBroadcaster

NewSSEBroadcaster creates a new SSE broadcaster.

func (*SSEBroadcaster) Broadcast 

func (b *SSEBroadcaster) Broadcast(event, data string)

Broadcast sends an event to all connected clients.

func (*SSEBroadcaster) ServeHTTP 

func (b *SSEBroadcaster) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP handles SSE connections.

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server is the main gatecrash server orchestrator.

func New 

func New(cfg *config.Config, configPath, version string) *Server

New creates a new server instance.

func (*Server) Run 

func (s *Server) Run(ctx context.Context) error

Run starts all server components and blocks until shutdown.

func (*Server) ServeHTTP 

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP routes requests based on Host header.

type TunnelMetrics 

type TunnelMetrics struct {
	BytesIn       atomic.Int64
	BytesOut      atomic.Int64
	RequestCount  atomic.Int64
	ActiveConns   atomic.Int32
	LastRequestAt atomic.Value // time.Time
}

TunnelMetrics tracks in-memory stats for a tunnel (not persisted).

type TunnelSpec added in v0.8.16 

type TunnelSpec struct {
	ID             string
	Type           string
	Hostnames      []string
	ListenPort     int
	PreserveHost   bool
	TLSPassthrough bool
	IPPolicyID     string
	AuthPolicyID   string
}

TunnelSpec is the config-derived subset of a tunnel that the registry needs.

type TunnelState 

type TunnelState struct {
	ID             string
	Type           string // "http" or "tcp"
	Hostnames      []string
	ListenPort     int
	PreserveHost   bool
	TLSPassthrough bool
	IPPolicyID     string // referenced ip_policy, or ""
	AuthPolicyID   string // referenced auth_policy, or ""

	Metrics TunnelMetrics
	// contains filtered or unexported fields
}

TunnelState holds the runtime state for a configured tunnel.

func (*TunnelState) AddClient 

func (t *TunnelState) AddClient(conn ssh.Conn, addr string)

AddClient registers a new client connection.

func (*TunnelState) AuthPolicy added in v0.9.0 

func (t *TunnelState) AuthPolicy() string

func (*TunnelState) ClientCount 

func (t *TunnelState) ClientCount() int

ClientCount returns the number of connected clients.

func (*TunnelState) ClientInfos 

func (t *TunnelState) ClientInfos() []ClientInfo

ClientInfos returns details for all connected clients.

func (*TunnelState) HostnameList added in v0.9.0 

func (t *TunnelState) HostnameList() []string

HostnameList returns a copy of the tunnel's hostnames so callers can range over them without holding the lock or aliasing the live slice.

func (*TunnelState) IPPolicy added in v0.9.0 

func (t *TunnelState) IPPolicy() string

func (*TunnelState) IsConnected 

func (t *TunnelState) IsConnected() bool

func (*TunnelState) IsTLSPassthrough added in v0.9.0 

func (t *TunnelState) IsTLSPassthrough() bool

func (*TunnelState) PickConn 

func (t *TunnelState) PickConn() ssh.Conn

PickConn returns a randomly selected SSH connection, or nil if none.

func (*TunnelState) Port added in v0.9.0 

func (t *TunnelState) Port() int

func (*TunnelState) PreservesHost added in v0.9.0 

func (t *TunnelState) PreservesHost() bool

func (*TunnelState) RemoveClient 

func (t *TunnelState) RemoveClient(conn ssh.Conn)

RemoveClient removes a specific client connection.

func (*TunnelState) SetClientVersion added in v0.8.1 

func (t *TunnelState) SetClientVersion(conn ssh.Conn, version string)

SetClientVersion updates the version for a connected client.

func (*TunnelState) TunnelType added in v0.9.0 

func (t *TunnelState) TunnelType() string

Config accessors read the reload-mutable fields under t.mu so request handlers never race with applySpec. Direct field reads are only safe at construction time (before the tunnel is published) or in single-threaded tests.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.