darroyo
bfa006f4ab
- SSH key management: generate ed25519 keypairs or import public keys from UI (/ssh-keys), per-machine key selection in Machines form, one-time private key download with hash verification - Fix engine to use machine-specific SSH key (was hardcoded to server key) - Job log persistence: write to job_logs table (DB) with batched inserts, buffer of 50 lines; GetAllFiltered with status/pair/date range filters - EventBus refactor: per-job subscriber channels, global channel, non-blocking - SSE endpoints: /jobs/stream (all), /jobs/:id/log/stream (per-job live) - JobDetail page: live log streaming, auto-scroll, cancel, duration - JobHistory: filters (pair, status, date range), pagination, link to detail - Cleanup scheduler: daily purge of job_logs and finished jobs older than SYNCSERVER_RETENTION_DAYS (default 30) - Migration 0002: indexes on job_logs(job_id), jobs(status,created_at), jobs(sync_pair_id)
90 lines
2.6 KiB
Go
90 lines
2.6 KiB
Go
package sshmanager
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
func Fingerprint(publicKey string) (string, error) {
|
|
pubKey := strings.TrimSpace(publicKey)
|
|
parts := strings.Fields(pubKey)
|
|
if len(parts) < 2 {
|
|
return "", fmt.Errorf("invalid public key format")
|
|
}
|
|
keyData, err := base64.StdEncoding.DecodeString(parts[1])
|
|
if err != nil {
|
|
return "", fmt.Errorf("decoding public key: %w", err)
|
|
}
|
|
if len(keyData) == ed25519.PublicKeySize {
|
|
h := sha256.Sum256(keyData)
|
|
return "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
|
|
}
|
|
h := sha256.Sum256(keyData)
|
|
return "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
|
|
}
|
|
|
|
func ParsePublicKey(data []byte) ([]byte, string, error) {
|
|
block, _ := pem.Decode(data)
|
|
if block == nil {
|
|
return nil, "", fmt.Errorf("no PEM block found")
|
|
}
|
|
var pubKey []byte
|
|
var err error
|
|
switch block.Type {
|
|
case "PUBLIC KEY":
|
|
pubKey = block.Bytes
|
|
case "OPENSSH KEY":
|
|
parts := strings.Fields(string(block.Bytes))
|
|
if len(parts) < 2 {
|
|
return nil, "", fmt.Errorf("invalid openssh key format")
|
|
}
|
|
pubKey, err = base64.StdEncoding.DecodeString(parts[1])
|
|
if err != nil {
|
|
return nil, "", err
|
|
}
|
|
default:
|
|
return nil, "", fmt.Errorf("unknown PEM type: %s", block.Type)
|
|
}
|
|
h := sha256.Sum256(pubKey)
|
|
return pubKey, "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:]), nil
|
|
}
|
|
|
|
func GenerateKeyPair(label string, sshDir string) (privPath, pubPath, pubKey, fingerprint string, err error) {
|
|
if err := os.MkdirAll(sshDir, 0700); err != nil {
|
|
return "", "", "", "", fmt.Errorf("creating ssh dir: %w", err)
|
|
}
|
|
privPath = filepath.Join(sshDir, label+".key")
|
|
pubPath = privPath + ".pub"
|
|
if _, err := os.Stat(privPath); err == nil {
|
|
return "", "", "", "", fmt.Errorf("key already exists")
|
|
}
|
|
pub, priv, err := ed25519.GenerateKey(rand.Reader)
|
|
if err != nil {
|
|
return "", "", "", "", fmt.Errorf("generating ed25519 key: %w", err)
|
|
}
|
|
privFile, err := os.OpenFile(privPath, os.O_CREATE|os.O_WRONLY, 0600)
|
|
if err != nil {
|
|
return "", "", "", "", fmt.Errorf("creating private key file: %w", err)
|
|
}
|
|
defer privFile.Close()
|
|
privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
|
|
if err != nil {
|
|
return "", "", "", "", fmt.Errorf("marshaling private key: %w", err)
|
|
}
|
|
pem.Encode(privFile, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
|
|
pubKey = fmt.Sprintf("%s %s", strings.TrimSpace(string(pub)), label)
|
|
if err := os.WriteFile(pubPath, []byte(pubKey), 0644); err != nil {
|
|
return "", "", "", "", fmt.Errorf("writing public key: %w", err)
|
|
}
|
|
fp, _ := Fingerprint(pubKey)
|
|
return privPath, pubPath, pubKey, fp, nil
|
|
}
|