enricobuehlerandClaude Opus 5
4575134c21
The console's login throttle was documented as per-IP and was not. Nitro's `localFetch` hands the app a synthetic request whose socket has no `remoteAddress`, so `getRequestIP()` returned undefined for every request and every attempt was charged to one shared "unknown" bucket. Five wrong guesses from any LAN peer locked out everyone — including the operator, and including the update-apply route, which shares that budget. The Bun entry is the only place the real peer is knowable, so it now stamps it into a header (deleting any client-supplied copy first) and `peerAddress()` reads it back. Verified on a real build bound to 0.0.0.0: seven wrong logins from 127.0.0.1 lock 127.0.0.1 out, a different peer still logs in on the first try, and a request forging the header is charged to its real address. Also on the way through: - Installing an unreviewed package and adding a catalog source now re-ask for the console password, like applying an update already did. A 7-day session cookie should not be able to run new code on the host, and `store/install` with `accept_unverified` did exactly that through the generic passthrough. The gate sits at the trust boundary — adding a source, or a raw spec — not on every install from a source the operator already chose to trust. - The ui-credential denylist is matched against the normalised path too, so `/api//v1/...` and friends can no longer walk around it. - The console serves nosniff, a no-referrer policy, and a CSP that pins frame-ancestors, object-src and base-uri. - A plugin UI's response no longer re-emits the content-encoding that `fetch` already decoded (which made compressed plugin pages fail to load), no longer sets cookies on the console's origin, and OPTIONS reaches the plugin instead of being refused 405 by us. - An unreachable host reads as 502 on these routes, matching the passthrough, instead of a bare 500. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
87 lines
4.1 KiB
JavaScript
87 lines
4.1 KiB
JavaScript
// Custom Nitro server entry for the punktfunk web console.
|
|
//
|
|
// It is the stock Nitro `bun` preset entry
|
|
// (node_modules/nitropack/dist/presets/bun/runtime/bun.mjs) plus **TLS**, so the console is served
|
|
// over **HTTPS (HTTP/1.1 over TLS)** using the HOST's own identity cert (the cert native clients
|
|
// already pin). One trust anchor across the data plane, the management API, and this console. Wired
|
|
// in via `entry:` in vite.config.ts on top of Nitro's `bun` preset (which bundles the handler in).
|
|
//
|
|
// NOTE on HTTP/2 + HTTP/3: NOT offered here, on purpose. `Bun.serve` has no HTTP/2 server, and
|
|
// HTTP/3 (which Bun *can* do) is useless to a browser against this cert: QUIC refuses any cert error,
|
|
// and the host identity cert is a CN-only, no-SAN, self-signed cert (correct for native fingerprint
|
|
// PINNING, rejected by browsers). So browsers stay on HTTP/1.1 regardless — advertising h3 would just
|
|
// dangle an `Alt-Svc` no browser can use. Real h2/h3 would need a browser-TRUSTED, SAN-matching cert
|
|
// (a local CA installed per device) fronted by a server that speaks them (e.g. Caddy) — deliberately
|
|
// out of scope for a LAN console; TLS (no cleartext login/session) is the win.
|
|
//
|
|
// Env (set by the launchers / the systemd unit — see web.env.example):
|
|
// PUNKTFUNK_UI_TLS_CERT / _KEY PEM file paths (the host's cert.pem / key.pem). BOTH set ⇒ HTTPS.
|
|
// Unset ⇒ plain HTTP (local dev only).
|
|
// PORT / HOST standard Nitro bind (3000 / 0.0.0.0).
|
|
import "#nitro-internal-pollyfills";
|
|
import wsAdapter from "crossws/adapters/bun";
|
|
import { useNitroApp } from "nitropack/runtime";
|
|
import { startScheduleRunner } from "nitropack/runtime/internal";
|
|
|
|
const nitroApp = useNitroApp();
|
|
const ws = import.meta._websocket
|
|
? wsAdapter(nitroApp.h3App.websocket)
|
|
: undefined;
|
|
|
|
// The socket peer, handed to the app as a trusted header.
|
|
//
|
|
// Nitro's `localFetch` (below) hands the app a SYNTHETIC request whose socket has no
|
|
// `remoteAddress`, so h3's `getRequestIP()` returns undefined *inside* the app and every
|
|
// per-peer decision collapses onto one shared bucket. That silently defeated the login
|
|
// throttle: five wrong passwords from anywhere locked out everyone, including the operator
|
|
// (and, since the update-apply route shares that budget, locked out host updates too).
|
|
// `server.requestIP(req)` is the only place the real peer is knowable, so we stamp it here.
|
|
// Any inbound copy is deleted first, so a client cannot forge it.
|
|
// Read back by `peerAddress()` in server/util/auth.ts — keep the two names in sync.
|
|
const PEER_IP_HEADER = "x-pf-peer-ip";
|
|
|
|
// TLS from the host's identity cert (file PATHS → Bun.file, not PEM-in-env). Absent ⇒ plain HTTP.
|
|
const certPath = process.env.PUNKTFUNK_UI_TLS_CERT;
|
|
const keyPath = process.env.PUNKTFUNK_UI_TLS_KEY;
|
|
const tls =
|
|
certPath && keyPath
|
|
? { cert: Bun.file(certPath), key: Bun.file(keyPath) }
|
|
: undefined;
|
|
|
|
const server = Bun.serve({
|
|
port: process.env.NITRO_PORT || process.env.PORT || 3000,
|
|
host: process.env.NITRO_HOST || process.env.HOST,
|
|
idleTimeout:
|
|
Number.parseInt(process.env.NITRO_BUN_IDLE_TIMEOUT, 10) || undefined,
|
|
// `tls: undefined` ⇒ plain HTTP (dev); otherwise HTTPS over HTTP/1.1.
|
|
tls,
|
|
websocket: import.meta._websocket ? ws.websocket : undefined,
|
|
async fetch(req, server) {
|
|
if (import.meta._websocket && req.headers.get("upgrade") === "websocket") {
|
|
return ws.handleUpgrade(req, server);
|
|
}
|
|
const url = new URL(req.url);
|
|
let body;
|
|
if (req.body) {
|
|
body = await req.arrayBuffer();
|
|
}
|
|
// Strip any client-supplied value BEFORE stamping the real one (see PEER_IP_HEADER).
|
|
const headers = new Headers(req.headers);
|
|
headers.delete(PEER_IP_HEADER);
|
|
const peer = server.requestIP(req)?.address;
|
|
if (peer) headers.set(PEER_IP_HEADER, peer);
|
|
return nitroApp.localFetch(url.pathname + url.search, {
|
|
host: url.hostname,
|
|
protocol: url.protocol,
|
|
headers,
|
|
method: req.method,
|
|
redirect: req.redirect,
|
|
body,
|
|
});
|
|
},
|
|
});
|
|
console.log(`punktfunk web console listening on ${server.url} (tls=${!!tls})`);
|
|
if (import.meta._tasks) {
|
|
startScheduleRunner();
|
|
}
|