feat: complete SyncServer implementation

Full-stack Go monolith with embedded React frontend for orchestrating rsync-over-SSH file synchronization with Wake-on-LAN support. Features: - JWT auth (HS256) with bcrypt password hashing - CRUD for machines (with WoL config) and sync_pairs - Ed25519 SSH key generation and known_hosts management - WoL magic packet sender + TCP-connect waiter with backoff - Sync engine: rsync subprocess, per-pair job queue, progress parsing - Homebrew cron parser for scheduled syncs - SSE stream for live job status (queued/waking_up/running/success/failed) - React+TS+Vite+Tailwind SPA embedded via embed.FS - Debian packaging with systemd unit, postinst/prerm/postrm Tech stack: - Go 1.22+ (CGO_ENABLED=0, pure SQLite via modernc.org/sqlite) - chi router for HTTP API - TypeScript + React 18 + Tailwind CSS frontend - Cross-compiled to Linux amd64 for Proxmox LXC deployment Tests: wol (MAC parsing, magic packet), syncengine/queue, scheduler/cron
2026-07-07 15:03:22 -04:00
parent 1a66ac58cd
commit 8e08c73f60
69 changed files with 7949 additions and 152 deletions
@@ -0,0 +1,68 @@
+package sshmanager
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const ServerKeyLabel = "server"
+
+func EnsureServerKey(sshDir string) (privPath, pubPath string, pubKey string, err error) {
+	if err := os.MkdirAll(sshDir, 0700); err != nil {
+		return "", "", "", fmt.Errorf("creating ssh dir: %w", err)
+	}
+
+	privPath = filepath.Join(sshDir, "id_ed25519")
+	pubPath = filepath.Join(sshDir, "id_ed25519.pub")
+
+	if _, err := os.Stat(privPath); os.IsNotExist(err) {
+		pub, priv, err := ed25519.GenerateKey(rand.Reader)
+		if err != nil {
+			return "", "", "", fmt.Errorf("generating ed25519 key: %w", err)
+		}
+
+		privFile, err := os.OpenFile(privPath, os.O_CREATE|os.O_WRONLY, 0600)
+		if err != nil {
+			return "", "", "", fmt.Errorf("creating private key file: %w", err)
+		}
+		defer privFile.Close()
+
+		privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
+		if err != nil {
+			return "", "", "", fmt.Errorf("marshaling private key: %w", err)
+		}
+		pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
+
+		pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), "syncserver")
+		if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
+			return "", "", "", fmt.Errorf("writing public key: %w", err)
+		}
+		return privPath, pubPath, pubKey, nil
+	} else if err != nil {
+		return "", "", "", fmt.Errorf("checking private key: %w", err)
+	}
+
+	data, err := os.ReadFile(pubPath)
+	if err != nil {
+		return "", "", "", fmt.Errorf("reading public key: %w", err)
+	}
+	return privPath, pubPath, strings.TrimSpace(string(data)), nil
+}
+
+func ReadPrivateKey(path string) ([]byte, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return nil, fmt.Errorf("no PEM block found")
+	}
+	return block.Bytes, nil
+}
@@ -0,0 +1,143 @@
+package sshmanager
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type KnownHost struct {
+	Host       string
+	Port       int
+	KeyType    string
+	Fingerprint string
+}
+
+func EnsureKnownHosts(sshDir string) (string, error) {
+	path := filepath.Join(sshDir, "known_hosts")
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDONLY, 0644)
+	if err != nil {
+		return "", err
+	}
+	f.Close()
+	return path, nil
+}
+
+func AddKnownHost(sshDir, host string, port int, keyData []byte) error {
+	path := filepath.Join(sshDir, "known_hosts")
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	addr := host
+	if port != 22 {
+		addr = fmt.Sprintf("[%s]:%d", host, port)
+	}
+
+	line := fmt.Sprintf("%s %s\n", addr, strings.TrimSpace(string(keyData)))
+	if _, err := f.WriteString(line); err != nil {
+		return err
+	}
+	return nil
+}
+
+func parseHostPort(entry string) (string, int) {
+	if strings.HasPrefix(entry, "[") {
+		var h string
+		var p int
+		if n, _ := fmt.Sscanf(entry, "[%[^]]]:%d", &h, &p); n == 2 {
+			return h, p
+		}
+	}
+	parts := strings.Split(entry, ":")
+	if len(parts) == 2 {
+		return parts[0], 22
+	}
+	return entry, 22
+}
+
+func GetKnownHost(sshDir, host string, port int) (*KnownHost, error) {
+	path := filepath.Join(sshDir, "known_hosts")
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	var targetAddr string
+	if port != 22 {
+		targetAddr = fmt.Sprintf("[%s]:%d", host, port)
+	} else {
+		targetAddr = host
+	}
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		parts := strings.Fields(line)
+		if len(parts) < 2 {
+			continue
+		}
+		h, p := parseHostPort(parts[0])
+		if (h == host || parts[0] == targetAddr) && p == port {
+			return &KnownHost{
+				Host:       h,
+				Port:       p,
+				KeyType:    parts[1],
+				Fingerprint: parts[1] + " " + parts[2],
+			}, nil
+		}
+	}
+	return nil, nil
+}
+
+func HasKnownHost(sshDir, host string, port int) (bool, error) {
+	kh, err := GetKnownHost(sshDir, host, port)
+	if err != nil {
+		return false, err
+	}
+	return kh != nil, nil
+}
+
+func RemoveKnownHost(sshDir, host string, port int) error {
+	path := filepath.Join(sshDir, "known_hosts")
+	f, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	var lines []string
+	targetAddr := host
+	if port != 22 {
+		targetAddr = fmt.Sprintf("[%s]:%d", host, port)
+	}
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		h, p := parseHostPort(line)
+		if h == host && p == port {
+			continue
+		}
+		if line == targetAddr {
+			continue
+		}
+		lines = append(lines, line)
+	}
+
+	tmp := path + ".tmp"
+	wf, err := os.Create(tmp)
+	if err != nil {
+		return err
+	}
+	for _, l := range lines {
+		wf.WriteString(l + "\n")
+	}
+	wf.Close()
+	return os.Rename(tmp, path)
+}
@@ -0,0 +1,107 @@
+package sshmanager
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+type ConnResult struct {
+	Success    bool
+	Output     string
+	Error      string
+	Fingerprint string
+}
+
+func TestSSHConnection(ctx context.Context, host string, port int, user, privKeyPath, knownHostsPath string, strictHostKeyChecking bool) (*ConnResult, error) {
+	addr := fmt.Sprintf("%s:%d", host, port)
+
+	auths := []ssh.AuthMethod{}
+	if privKeyPath != "" {
+		key, err := os.ReadFile(privKeyPath)
+		if err != nil {
+			return nil, fmt.Errorf("reading private key: %w", err)
+		}
+		signer, err := ssh.ParsePrivateKey(key)
+		if err != nil {
+			return nil, fmt.Errorf("parsing private key: %w", err)
+		}
+		auths = append(auths, ssh.PublicKeys(signer))
+	}
+
+	hostKeyPolicy := ssh.InsecureIgnoreHostKey()
+	if strictHostKeyChecking && knownHostsPath != "" {
+		hostKeyCallback, err := getHostKeyCallback(knownHostsPath, host, port)
+		if err != nil {
+			return &ConnResult{Success: false, Error: fmt.Sprintf("known_hosts: %v", err)}, nil
+		}
+		hostKeyPolicy = hostKeyCallback
+	}
+
+	cfg := &ssh.ClientConfig{
+		User:            user,
+		Auth:            auths,
+		HostKeyCallback: hostKeyPolicy,
+		Timeout:         10 * time.Second,
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	conn, err := ssh.Dial("tcp", addr, cfg)
+	if err != nil {
+		if strings.Contains(err.Error(), "known_hosts") || strings.Contains(err.Error(), "host key") {
+			return &ConnResult{
+				Success: false,
+				Error:   fmt.Sprintf("host key verification failed: %v", err),
+			}, nil
+		}
+		return &ConnResult{
+			Success: false,
+			Error:   fmt.Sprintf("connection failed: %v", err),
+		}, nil
+	}
+	defer conn.Close()
+
+	session, err := conn.NewSession()
+	if err != nil {
+		return &ConnResult{Success: false, Error: fmt.Sprintf("session: %v", err)}, nil
+	}
+	defer session.Close()
+
+	var stdout, stderr bytes.Buffer
+	session.Stdout = &stdout
+	session.Stderr = &stderr
+
+	if err := session.Run("echo ok && uname -a"); err != nil {
+		return &ConnResult{
+			Success: false,
+			Error:   fmt.Sprintf("exec: %v, stderr: %s", err, stderr.String()),
+		}, nil
+	}
+
+	return &ConnResult{
+		Success: true,
+		Output:  stdout.String(),
+	}, nil
+}
+
+func getHostKeyCallback(knownHostsPath, host string, port int) (ssh.HostKeyCallback, error) {
+	return ssh.HostKeyCallback(func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+		kh, err := GetKnownHost(filepath.Dir(knownHostsPath), host, port)
+		if err != nil {
+			return fmt.Errorf("checking known_hosts: %w", err)
+		}
+		if kh == nil {
+			return fmt.Errorf("host key not found in known_hosts: %s", hostname)
+		}
+		return nil
+	}), nil
+}