feat: add Deploy Keys function to Machines UI

- sshmanager/deploy.go: new DeployKeysToMachine function that uploads private keys, populates known_hosts via ssh-keyscan, and adds server pub key to authorized_keys on remote machines - handlers_machines.go: new DeployKeys handler with auto-detection of keys needed per sync pair (source->dest uploads dest key, dest->source uploads source key) - router.go: POST /machines/{id}/deploy-keys route - client.ts: deployKeys() API method - Machines.tsx: Deploy Keys button + modal with result display
2026-07-09 20:33:04 -04:00
parent 5d708e1d7b
commit dbf998703f
5 changed files with 390 additions and 5 deletions
@@ -6,12 +6,14 @@ import (
 	"encoding/json"
 	"log/slog"
 	"net/http"
+	"os"
 	"path/filepath"
 	"regexp"
 	"strconv"
 	"time"

 	"github.com/go-chi/chi/v5"
+	"github.com/syncserver/internal/config"
 	"github.com/syncserver/internal/models"
 	"github.com/syncserver/internal/sshmanager"
 	"github.com/syncserver/internal/syncengine"
@@ -21,10 +23,11 @@ import (
 type MachineHandler struct {
 	db     *sql.DB
 	engine *syncengine.Engine
+	cfg    *config.Config
 }

-func NewMachineHandler(db *sql.DB, engine *syncengine.Engine) *MachineHandler {
-	return &MachineHandler{db: db, engine: engine}
+func NewMachineHandler(db *sql.DB, engine *syncengine.Engine, cfg *config.Config) *MachineHandler {
+	return &MachineHandler{db: db, engine: engine, cfg: cfg}
 }

 var macRegex = regexp.MustCompile(`^([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}$`)
@@ -318,6 +321,118 @@ func (h *MachineHandler) ApproveFingerprint(w http.ResponseWriter, r *http.Reque
 	writeJSON(w, machineToResp(*m))
 }

+func (h *MachineHandler) DeployKeys(w http.ResponseWriter, r *http.Request) {
+	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid id")
+		return
+	}
+	repo := models.NewMachineRepository(h.db)
+	m, err := repo.GetByID(id)
+	if err == sql.ErrNoRows {
+		writeError(w, http.StatusNotFound, "machine not found")
+		return
+	}
+	if err != nil {
+		slog.Error("failed to fetch machine", "id", id, "error", err)
+		writeError(w, http.StatusInternalServerError, "failed to fetch machine")
+		return
+	}
+
+	var req struct {
+		KnownHostsHost    string `json:"known_hosts_host"`
+		IncludeServerKey  bool   `json:"include_server_key"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	serverKeyPath := h.cfg.SSHDir() + "/id_ed25519"
+	serverPubKeyPath := h.cfg.SSHDir() + "/id_ed25519.pub"
+
+	if m.SSHKeyID != nil {
+		sshKeyRepo := models.NewSSHKeyRepository(h.db)
+		sshKey, err := sshKeyRepo.GetByID(*m.SSHKeyID)
+		if err == nil && sshKey.PrivateKeyPath != "" {
+			serverKeyPath = sshKey.PrivateKeyPath
+		}
+	}
+
+	serverPubKey := ""
+	if req.IncludeServerKey {
+		data, err := os.ReadFile(serverPubKeyPath)
+		if err == nil {
+			serverPubKey = string(data)
+		}
+	}
+
+	pairRepo := models.NewSyncPairRepository(h.db)
+	allPairs, err := pairRepo.GetAll()
+	if err != nil {
+		slog.Warn("failed to fetch sync pairs for auto-detect", "error", err)
+	}
+
+	var keys []sshmanager.DeployKey
+
+	for _, pair := range allPairs {
+		if pair.SourceMachineID != nil && *pair.SourceMachineID == m.ID {
+			if pair.DestMachineID != nil {
+				destMachine, err := repo.GetByID(*pair.DestMachineID)
+				if err == nil && destMachine.SSHKeyID != nil {
+					skRepo := models.NewSSHKeyRepository(h.db)
+					sk, err := skRepo.GetByID(*destMachine.SSHKeyID)
+					if err == nil && sk.PrivateKeyPath != "" {
+						keys = append(keys, sshmanager.DeployKey{
+							LocalPath:  sk.PrivateKeyPath,
+							RemotePath: "/var/lib/syncserver/ssh/keys/" + filepath.Base(sk.PrivateKeyPath),
+							Mode:       0600,
+						})
+					}
+				}
+			}
+		}
+		if pair.DestMachineID != nil && *pair.DestMachineID == m.ID {
+			if pair.SourceMachineID != nil {
+				srcMachine, err := repo.GetByID(*pair.SourceMachineID)
+				if err == nil && srcMachine.SSHKeyID != nil {
+					skRepo := models.NewSSHKeyRepository(h.db)
+					sk, err := skRepo.GetByID(*srcMachine.SSHKeyID)
+					if err == nil && sk.PrivateKeyPath != "" {
+						keys = append(keys, sshmanager.DeployKey{
+							LocalPath:  sk.PrivateKeyPath,
+							RemotePath: "/var/lib/syncserver/ssh/keys/" + filepath.Base(sk.PrivateKeyPath),
+							Mode:       0600,
+						})
+					}
+				}
+			}
+		}
+	}
+
+	if len(keys) == 0 {
+		slog.Info("no keys auto-detected for machine, using empty key list", "machine", m.Name)
+	}
+
+	result, err := sshmanager.DeployKeysToMachine(
+		context.Background(),
+		serverKeyPath,
+		serverPubKey,
+		m.Host,
+		m.Port,
+		m.SSHUser,
+		keys,
+		req.KnownHostsHost,
+		req.IncludeServerKey,
+	)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+
+	writeJSON(w, result)
+}
+
 func (h *MachineHandler) Refresh(w http.ResponseWriter, r *http.Request) {
 	if h.engine == nil {
 		writeError(w, http.StatusInternalServerError, "engine not available")
@@ -34,7 +34,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 	s := &Server{router: r, cfg: cfg, engine: engine}

 	authHandler := NewAuthHandler(db)
-	machineHandler := NewMachineHandler(db, engine)
+	machineHandler := NewMachineHandler(db, engine, cfg)
 	syncPairHandler := NewSyncPairHandler(db)
 	jobHandler := NewJobHandler(db, engine)
 	sseHandler := NewSSEHandler(engine)
@@ -57,6 +57,7 @@ func NewServer(cfg *config.Config, db *sql.DB, engine *syncengine.Engine) *Serve
 			r.Post("/{id}/test-wol", machineHandler.TestWoL)
 			r.Post("/{id}/test-connection", machineHandler.TestConnection)
 			r.Post("/{id}/approve-fingerprint", machineHandler.ApproveFingerprint)
+			r.Post("/{id}/deploy-keys", machineHandler.DeployKeys)
 		})

 		r.With(auth.RequireAuth).Route("/sync-pairs", func(r chi.Router) {
@@ -0,0 +1,175 @@
+package sshmanager
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+type DeployKey struct {
+	LocalPath  string
+	RemotePath string
+	Mode       uint32
+}
+
+type DeployResult struct {
+	Success  bool
+	Messages []string
+	Errors   []string
+}
+
+func DeployKeysToMachine(ctx context.Context, serverKeyPath, serverPubKey string, host string, port int, user string, keys []DeployKey, knownHostsHost string, addServerPubKey bool) (*DeployResult, error) {
+	result := &DeployResult{Success: true}
+
+	addr := fmt.Sprintf("%s:%d", host, port)
+
+	keyData, err := os.ReadFile(serverKeyPath)
+	if err != nil {
+		return nil, fmt.Errorf("reading server key: %w", err)
+	}
+	signer, err := ssh.ParsePrivateKey(keyData)
+	if err != nil {
+		return nil, fmt.Errorf("parsing server key: %w", err)
+	}
+
+	hostKeyCallback := func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+		return nil
+	}
+
+	cfg := &ssh.ClientConfig{
+		User:            user,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
+		HostKeyCallback: hostKeyCallback,
+		Timeout:         10 * time.Second,
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 60*time.Second)
+	defer cancel()
+
+	conn, err := ssh.Dial("tcp", addr, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("connecting to %s: %w", addr, err)
+	}
+	defer conn.Close()
+
+	remoteSSHDir := "/var/lib/syncserver/ssh"
+	remoteKeysDir := filepath.Join(remoteSSHDir, "keys")
+
+	session, err := conn.NewSession()
+	if err != nil {
+		return nil, fmt.Errorf("creating session: %w", err)
+	}
+	defer session.Close()
+
+	var stdout, stderr bytes.Buffer
+	session.Stdout = &stdout
+	session.Stderr = &stderr
+
+	if err := session.Run(fmt.Sprintf("mkdir -p %s && chmod 700 %s", remoteKeysDir, remoteKeysDir)); err != nil {
+		return nil, fmt.Errorf("creating remote ssh dir: %s %w", stderr.String(), err)
+	}
+	result.Messages = append(result.Messages, fmt.Sprintf("Created %s on %s", remoteKeysDir, host))
+
+	for _, k := range keys {
+		keyContent, err := os.ReadFile(k.LocalPath)
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("reading local key %s: %v", k.LocalPath, err))
+			result.Success = false
+			continue
+		}
+
+		mode := k.Mode
+		if mode == 0 {
+			mode = 0600
+		}
+
+		sess2, err := conn.NewSession()
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("session for key upload: %v", err))
+			result.Success = false
+			continue
+		}
+		defer sess2.Close()
+
+		sess2.Stdout = &stdout
+		sess2.Stderr = &stderr
+
+		cmd := fmt.Sprintf("cat > %s && chmod 0%o %s", k.RemotePath, mode, k.RemotePath)
+		if err := sess2.Start(cmd); err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("starting command for %s: %v", k.RemotePath, err))
+			result.Success = false
+			continue
+		}
+
+		stdin, err := sess2.StdinPipe()
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("stdin pipe for %s: %v", k.RemotePath, err))
+			result.Success = false
+			continue
+		}
+
+		_, err = stdin.Write(keyContent)
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("writing key %s: %v", k.RemotePath, err))
+			result.Success = false
+			continue
+		}
+		stdin.Close()
+
+		if err := sess2.Wait(); err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("uploading %s: %v (stderr: %s)", k.RemotePath, err, stderr.String()))
+			result.Success = false
+			continue
+		}
+
+		result.Messages = append(result.Messages, fmt.Sprintf("Uploaded %s to %s:%s", filepath.Base(k.LocalPath), host, k.RemotePath))
+	}
+
+	if knownHostsHost != "" {
+		session2, err := conn.NewSession()
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("session for ssh-keyscan: %v", err))
+			result.Success = false
+		} else {
+			session2.Stdout = &stdout
+			session2.Stderr = &stderr
+			err := session2.Run(fmt.Sprintf("ssh-keyscan -H -p %d %s 2>/dev/null >> %s/known_hosts", port, knownHostsHost, remoteSSHDir))
+			session2.Close()
+			if err != nil {
+				result.Errors = append(result.Errors, fmt.Sprintf("ssh-keyscan %s: %v (stderr: %s)", knownHostsHost, err, stderr.String()))
+				result.Success = false
+			} else {
+				result.Messages = append(result.Messages, fmt.Sprintf("Populated known_hosts with %s:%d", knownHostsHost, port))
+			}
+		}
+	}
+
+	if addServerPubKey && serverPubKey != "" {
+		session3, err := conn.NewSession()
+		if err != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("session for authorized_keys: %v", err))
+			result.Success = false
+		} else {
+			session3.Stdout = &stdout
+			session3.Stderr = &stderr
+			pubKeyClean := strings.TrimSpace(serverPubKey)
+			err := session3.Run(fmt.Sprintf("mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '%s' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys", pubKeyClean))
+			session3.Close()
+			if err != nil {
+				result.Errors = append(result.Errors, fmt.Sprintf("adding to authorized_keys: %v (stderr: %s)", err, stderr.String()))
+				result.Success = false
+			} else {
+				result.Messages = append(result.Messages, fmt.Sprintf("Added server public key to %s@%s:~/.ssh/authorized_keys", user, host))
+			}
+		}
+	}
+
+	return result, nil
+}