fury-connect-switch

README

Fury Connect Switch

This tool enables the easy management of host services (systemd and journal) via API and a WEB/UI. It is configurable to enable only the services you require managing to prevent human errors (as a whitelist).

Requirements

To deploy this utility in your hosts, take in mind the following requirements must be already addressed in your host:

WARNING: Only tested on debian based systems.

• libsystemd-dev package installed.
• systemd working
• journal working

Deployment

To install/update the latest version in your hosts:

$ curl -s https://api.github.com/repos/sighupio/fury-connect-switch/releases/latest | grep browser_download_url | grep linux | cut -d '"' -f 4 | xargs curl -Ls -o fury-connect-switch
$ chmod +x fury-connect-switch
$ sudo mv fury-connect-switch /usr/local/bin/fury-connect-switch

Then, don't forget to create a config.yml file:

$ cat config.yml
---
listener: 0.0.0.0:8080
units:
  - name: sshd service
    id: ssh.service
  - name: boundary service
    id: boundary.service

Run

$ fury-connect-switch
[GIN-debug] [WARNING] Creating an Engine instance with the Logger and Recovery middleware already attached.

[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.
 - using env:	export GIN_MODE=release
 - using code:	gin.SetMode(gin.ReleaseMode)

[GIN-debug] GET    /swagger/*any             --> github.com/swaggo/gin-swagger.CustomWrapHandler.func1 (5 handlers)
[GIN-debug] GET    /api/v0/unit/list         --> main.unitList (5 handlers)
[GIN-debug] GET    /api/v0/systemd/:name/status --> main.getStatus (5 handlers)
[GIN-debug] POST   /api/v0/systemd/:name/start --> main.startService (5 handlers)
[GIN-debug] POST   /api/v0/systemd/:name/stop --> main.stopService (5 handlers)
[GIN-debug] GET    /api/v0/journal/:name/log --> main.logService (5 handlers)
[GIN-debug] Listening and serving HTTP on 0.0.0.0:8080

WARNING: It could be interesting to create a systemd unit in order to maintain the agent up and running.

Building

The agent requires to be compiled using golang 1.16 as it embeds the static assets of the frontend application.

Locally (docker)

You can build the linux (amd64) binary using docker by running:

$ make build
[+] Building 53.2s (20/20) FINISHED
 => [internal] load build definition from Dockerfile                                                                        0.0s
 => => transferring dockerfile: 607B                                                                                        0.0s
 => [internal] load .dockerignore                                                                                           0.0s
 => => transferring context: 2B                                                                                             0.0s
 => [internal] load metadata for docker.io/library/debian:buster                                                            1.3s
 => [internal] load metadata for docker.io/library/golang:1.16-buster                                                       2.0s
 => [compile  1/11] FROM docker.io/library/golang:1.16-buster@sha256:84ea53642c79fcf6cc3dbb56cfb80d0fb2fdddad57ca9a822394  10.6s
 => => resolve docker.io/library/golang:1.16-buster@sha256:84ea53642c79fcf6cc3dbb56cfb80d0fb2fdddad57ca9a82239446aaae765d1  0.0s
 => => sha256:84ea53642c79fcf6cc3dbb56cfb80d0fb2fdddad57ca9a82239446aaae765d19 1.86kB / 1.86kB                              0.0s
 => => sha256:9f49582262ce68c2d943f0abaa4475b84c5c44d36e2962327a79603fe837c6b4 129.02MB / 129.02MB                          4.0s
 => => sha256:c133b465a2528ea68235550dfdddf4862eb161f5152d819d72d8e0ce7ba2dfd1 157B / 157B                                  0.2s
 => => sha256:3fc96f3fc8a5566a07ac45759bad6381397f2f629bd9260ab0994ef0dc3b68ca 1.79kB / 1.79kB                              0.0s
 => => sha256:0debfc3e0c9eb23d3fc83219afc614d85f0bc67cf21f2b3c0f21b24641e2bb06 7.09kB / 7.09kB                              0.0s
 => => extracting sha256:9f49582262ce68c2d943f0abaa4475b84c5c44d36e2962327a79603fe837c6b4                                   6.3s
 => => extracting sha256:c133b465a2528ea68235550dfdddf4862eb161f5152d819d72d8e0ce7ba2dfd1                                   0.0s
 => [internal] load build context                                                                                           0.0s
 => => transferring context: 54.13kB                                                                                        0.0s
 => CACHED [stage-1 1/3] FROM docker.io/library/debian:buster@sha256:5c1daf79a2d6202cf1b80a80f522fa0aaec4dc1c0520135ed2776  0.0s
 => [compile  2/11] RUN apt update && apt install -y libsystemd-dev                                                         5.1s
 => [compile  3/11] RUN curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh                   4.4s
 => [compile  4/11] WORKDIR /app                                                                                            0.0s
 => [compile  5/11] COPY ./go.mod go.mod                                                                                    0.0s
 => [compile  6/11] COPY ./go.sum go.sum                                                                                    0.0s
 => [compile  7/11] COPY ./main.go main.go                                                                                  0.0s
 => [compile  8/11] COPY ./internal internal                                                                                0.0s
 => [compile  9/11] COPY ./static static                                                                                    0.0s
 => [compile 10/11] COPY ./.goreleaser.yml .goreleaser.yml                                                                  0.0s
 => [compile 11/11] RUN goreleaser build --debug --snapshot --rm-dist                                                      30.3s
 => [stage-1 2/3] COPY --from=compile /app/dist/fury-connect-switch-linux_linux_amd64/fury-connect-switch /usr/local/bin/f  0.1s
 => [stage-1 3/3] COPY example-config.yml config.yml                                                                        0.0s
 => exporting to image                                                                                                      0.1s
 => => exporting layers                                                                                                     0.1s
 => => writing image sha256:75851ac804064806360eb8ac9182b0bf5debdf59db6cab3b801eca6d0b86ec2a                                0.0s
 => => naming to docker.io/library/fury-connect-switch:build                                                                0.0s
f5e940c4c564eff57eecbb3b4fdf866208f31ed922b6e643e03662e78929a60b
fury-connect-switch-result

You will find the generated binary in the ./bin/linux/fury-connect-switch directory.

NOTE: If you are running !linux system, it could be interesting to use the Vagrant building alternative. This enables you also to test the binary as it requires to be running on a linux system with systemd and journal working.

Vagrant

The project provides another alternative to actually builds the binary, this is using vagrant. The provided Vagrantfile contains a defintion to spin up an ubuntu box containing all the requirements to build the binary using docker.

$ vagrant destroy --force # Just in case
==> fury-connect-switch: Forcing shutdown of VM...
==> fury-connect-switch: Destroying VM and associated drives...
$ vagrant up
Bringing machine 'fury-connect-switch' up with 'virtualbox' provider...
==> fury-connect-switch: Importing base box 'bento/ubuntu-20.04'...
==> fury-connect-switch: Matching MAC address for NAT networking...
==> fury-connect-switch: Checking if box 'bento/ubuntu-20.04' version '202012.23.0' is up to date...
==> fury-connect-switch: Setting the name of the VM: fury-connect-switch_fury-connect-switch_1617633265101_17273
==> fury-connect-switch: Clearing any previously set network interfaces...
==> fury-connect-switch: Preparing network interfaces based on configuration...
    fury-connect-switch: Adapter 1: nat
    fury-connect-switch: Adapter 2: hostonly
==> fury-connect-switch: Forwarding ports...
    fury-connect-switch: 22 (guest) => 2222 (host) (adapter 1)
==> fury-connect-switch: Running 'pre-boot' VM customizations...
==> fury-connect-switch: Booting VM...
==> fury-connect-switch: Waiting for machine to boot. This may take a few minutes...
    fury-connect-switch: SSH address: 127.0.0.1:2222
    fury-connect-switch: SSH username: vagrant
    fury-connect-switch: SSH auth method: private key
    fury-connect-switch:
    fury-connect-switch: Vagrant insecure key detected. Vagrant will automatically replace
    fury-connect-switch: this with a newly generated keypair for better security.
    fury-connect-switch:
    fury-connect-switch: Inserting generated public key within guest...
    fury-connect-switch: Removing insecure key from the guest if it's present...
    fury-connect-switch: Key inserted! Disconnecting and reconnecting using new SSH key...
==> fury-connect-switch: Machine booted and ready!
==> fury-connect-switch: Checking for guest additions in VM...
==> fury-connect-switch: Setting hostname...
==> fury-connect-switch: Configuring and enabling network interfaces...
==> fury-connect-switch: Mounting shared folders...
    fury-connect-switch: /vagrant => /Users/angelbarrerasanchez-sighup/work/sighup/fury-connect-switch
==> fury-connect-switch: Running provisioner: docker...
    fury-connect-switch: Installing Docker onto machine...
==> fury-connect-switch: Running provisioner: shell...
    fury-connect-switch: Running: inline script
    fury-connect-switch: dpkg-preconfigure: unable to re-open stdin: No such file or directory
    fury-connect-switch: Selecting previously unselected package make.
    fury-connect-switch: (Reading database ...
(Reading database ... 55%(Reading database ... 5%
    fury-connect-switch: (Reading database ... 60%
    fury-connect-switch: (Reading database ... 65%
    fury-connect-switch: (Reading database ... 70%
    fury-connect-switch: (Reading database ... 75%
    fury-connect-switch: (Reading database ... 80%
    fury-connect-switch: (Reading database ... 85%
    fury-connect-switch: (Reading database ... 90%
    fury-connect-switch: (Reading database ... 95%
(Reading database ... 41618 files and directories currently installed.)
    fury-connect-switch: Preparing to unpack .../make_4.2.1-1.2_amd64.deb ...
    fury-connect-switch: Unpacking make (4.2.1-1.2) ...
    fury-connect-switch: Setting up make (4.2.1-1.2) ...
    fury-connect-switch: Processing triggers for man-db (2.9.1-1) ...
$ vagrant ssh
vagrant@fury-connect-switch:~$ cd /vagrant
vagrant@fury-connect-switch:~$ make build
Sending build context to Docker daemon  27.57MB
Step 1/14 : FROM golang:1.16-buster AS compile
1.16-buster: Pulling from library/golang
004f1eed87df: Pull complete
5d6f1e8117db: Pull complete
48c2faf66abe: Pull complete
234b70d0479d: Pull complete
f5e9f83ff9bc: Pull complete
9f49582262ce: Pull complete
c133b465a252: Pull complete
Digest: sha256:84ea53642c79fcf6cc3dbb56cfb80d0fb2fdddad57ca9a82239446aaae765d19
Status: Downloaded newer image for golang:1.16-buster
 ---> 0debfc3e0c9e
Step 2/14 : RUN apt update && apt install -y libsystemd-dev
 ---> Running in fd492d7336c5

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Get:1 http://deb.debian.org/debian buster InRelease [121 kB]
Get:2 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:4 http://security.debian.org/debian-security buster/updates/main amd64 Packages [271 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7907 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [9504 B]
Fetched 8426 kB in 2s (3767 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
3 packages can be upgraded. Run 'apt list --upgradable' to see them.

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...
Building dependency tree...
Reading state information...
The following NEW packages will be installed:
  libsystemd-dev
0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.
Need to get 322 kB of archives.
After this operation, 881 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian buster/main amd64 libsystemd-dev amd64 241-7~deb10u7 [322 kB]
debconf: delaying package configuration, since apt-utils is not installed
Fetched 322 kB in 0s (1467 kB/s)
Selecting previously unselected package libsystemd-dev:amd64.
(Reading database ... 15421 files and directories currently installed.)
Preparing to unpack .../libsystemd-dev_241-7~deb10u7_amd64.deb ...
Unpacking libsystemd-dev:amd64 (241-7~deb10u7) ...
Setting up libsystemd-dev:amd64 (241-7~deb10u7) ...
Removing intermediate container fd492d7336c5
 ---> 0d90ef995ce8
Step 3/14 : RUN curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh
 ---> Running in b088c94b5674
goreleaser/goreleaser info checking GitHub for latest tag
goreleaser/goreleaser info found version: 0.162.0 for v0.162.0/Linux/x86_64
goreleaser/goreleaser info installed ./bin/goreleaser
Removing intermediate container b088c94b5674
 ---> 581402731902
Step 4/14 : WORKDIR /app
 ---> Running in a26151e91ceb
Removing intermediate container a26151e91ceb
 ---> 66ba5392df43
Step 5/14 : COPY ./go.mod go.mod
 ---> cff62fcf770d
Step 6/14 : COPY ./go.sum go.sum
 ---> ced99f4bd2d3
Step 7/14 : COPY ./main.go main.go
 ---> 22741f377c15
Step 8/14 : COPY ./internal internal
 ---> ab914cb9c726
Step 9/14 : COPY ./static static
 ---> d0d352815223
Step 10/14 : COPY ./.goreleaser.yml .goreleaser.yml
 ---> bc2126b5306b
Step 11/14 : RUN goreleaser build --debug --snapshot --rm-dist
 ---> Running in 0d11015c500b
   • debug logs enabled
   • building...
   • loading config file       file=.goreleaser.yml
   • loaded config file        config={fury-connect-switch [] {sighupio/fury-connect-switch   false false  {{ .Tag }} [fury-connect-switch-linux-bin] []} [] [] { {  } { }      []  [] []} [{fury-connect-switch-linux [linux] [amd64] [] [] [] []   [] [] fury-connect-switch {[] []} []  [] []  false }] [{fury-connect-switch-linux-bin [fury-connect-switch-linux] {{ .ProjectName }}-{{ .Os }}-{{ .Arch }} map[] binary [] false [] false}] [] [] {{{ .Tag }}} {sha256sum.txt  [] false} [] [] [] [] [] [] {{[^docs: ^test:]} asc false}  [] {  } {[go get -u github.com/swaggo/swag/cmd/swag swag init]} {  false} {false [] } { [] [] [] [] [] []   [] []  {[] []} []  [] []  false } {   false} {  false} {  false}}
   • parallelism: 2
   • loading environment variables
   • getting and validating git state
      • running git               args=[-c log.showSignature=false rev-parse --is-inside-work-tree]
      • git result                stderr=fatal: not a git repository (or any of the parent directories): .git
 stdout=
      • accepting to run without a git repo because this is a snapshot
      • releasing v0.0.0, commit none
      • pipe skipped              error=disabled during snapshot mode
   • parsing tag
   • running before hooks
      • running go get -u github.com/swaggo/swag/cmd/swag
      • go: downloading github.com/swaggo/swag v1.7.0
go: downloading github.com/urfave/cli v1.20.0
go: downloading github.com/KyleBanks/depth v1.2.1
go: downloading github.com/go-openapi/spec v0.20.3
go: downloading github.com/urfave/cli/v2 v2.3.0
go: downloading golang.org/x/tools v0.1.0
go: downloading github.com/urfave/cli v1.22.5
go: downloading github.com/ghodss/yaml v1.0.0
go: downloading github.com/go-openapi/jsonpointer v0.19.5
go: downloading github.com/go-openapi/jsonreference v0.19.5
go: downloading github.com/go-openapi/swag v0.19.15
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d
go: downloading github.com/cpuguy83/go-md2man v1.0.10
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/PuerkitoBio/purell v1.1.1
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading github.com/russross/blackfriday/v2 v2.0.1
go: downloading github.com/russross/blackfriday v1.6.0
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: downloading github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578
go: downloading golang.org/x/net v0.0.0-20210331212208-0fccb6fa2b5c
go: downloading golang.org/x/text v0.3.6
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/shurcooL/sanitized_anchor_name v1.0.0
go: downloading golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57
go get: upgraded github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d => v2.0.0
go get: upgraded github.com/russross/blackfriday/v2 v2.0.1 => v2.1.0
 cmd=go get -u github.com/swaggo/swag/cmd/swag
      • running swag init
      • 2021/04/05 14:37:11 Generate swagger docs....
2021/04/05 14:37:11 Generate general API Info, search dir:./
2021/04/05 14:37:14 Generating response.ResponseStatusSpec
2021/04/05 14:37:14 Generating response.ResponseError
2021/04/05 14:37:14 Generating response.ResponseServiceSpec
2021/04/05 14:37:14 Generating response.ResponseLogSpec
2021/04/05 14:37:14 Generating response.ResponseListSpec
2021/04/05 14:37:14 Generating config.Unit
2021/04/05 14:37:14 create docs.go at docs/docs.go
2021/04/05 14:37:14 create swagger.json at docs/swagger.json
2021/04/05 14:37:14 create swagger.yaml at docs/swagger.yaml
 cmd=swag init
   • setting defaults
      • snapshotting
      • github/gitlab/gitea releases
         • pre-release for tag v0.0.0 set to false
      • project name
      • loading go mod information
      • building binaries
      • creating source archive
      • archives
      • linux packages
      • snapcraft packages
      • calculating checksums
      • signing artifacts
      • docker images
      • artifactory
      • blobs
      • homebrew tap formula
      • scoop manifests
      • milestones
         • running git               args=[-c log.showSignature=false rev-parse --is-inside-work-tree]
         • git result                stderr=fatal: not a git repository (or any of the parent directories): .git
 stdout=
   • snapshotting
   • checking ./dist
      • ./dist doesn't exist, creating empty folder
   • loading go mod information
      • pipe skipped              error=gomod.proxy is disabled
   • writing effective config file
      • writing                   config=dist/config.yaml
   • generating changelog
      • pipe skipped              error=not available for snapshots
   • building binaries
      • building                  build={fury-connect-switch-linux [linux] [amd64] [6] [hardfloat] [linux_amd64] [] . . [-s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}} -X main.builtBy=goreleaser] [] fury-connect-switch {[] []} [] go [] []  false go}
      • building                  binary=/app/dist/fury-connect-switch-linux_linux_amd64/fury-connect-switch
      • running                   cmd=[go build -ldflags=-s -w -X main.version=v0.0.0 -X main.commit=none -X main.date=2021-04-05T14:37:03Z -X main.builtBy=goreleaser -o /app/dist/fury-connect-switch-linux_linux_amd64/fury-connect-switch .] env=[HOSTNAME=0d11015c500b HOME=/root PATH=/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin GOPATH=/go PWD=/app GOLANG_VERSION=1.16.3 GOOS=linux GOARCH=amd64 GOARM= GOMIPS= GOMIPS64=]
      • added new artifact        name=fury-connect-switch path=/app/dist/fury-connect-switch-linux_linux_amd64/fury-connect-switch type=Binary
   • build succeeded after 21.55s
Removing intermediate container 0d11015c500b
 ---> bcda2f80a9e8
Step 12/14 : FROM debian:buster
buster: Pulling from library/debian
004f1eed87df: Already exists
Digest: sha256:5c1daf79a2d6202cf1b80a80f522fa0aaec4dc1c0520135ed277627c12171c3b
Status: Downloaded newer image for debian:buster
 ---> 109b803c6a30
Step 13/14 : COPY --from=compile /app/dist/fury-connect-switch-linux_linux_amd64/fury-connect-switch /usr/local/bin/fury-connect-switch
 ---> d53fca8ec304
Step 14/14 : COPY example-config.yml config.yml
 ---> 237da1fa5505
Successfully built 237da1fa5505
Successfully tagged fury-connect-switch:build
1f8f9c40d810d0581742bc3296bb1cde988c8d59b72e4614b281fef07e33c57e
fury-connect-switch-result
vagrant@fury-connect-switch:~$ cp example-config.yml config.yml
vagrant@fury-connect-switch:~$ ./bin/linux/fury-connect-switch &
vagrant@fury-connect-switch:~$ curl localhost:8080/api/v0/unit/list
[{"Name":"sshd service","ID":"ssh.service"},{"Name":"boundary service","ID":"boundary.service"}]

Generating (and updating) docs

The project uses swaggo/swag utility to create the swagger files under the docs directory/package.

The swagger docs are updated while building; anyway, if you are to update or recreate them manually, make sure you have installed the required golang utility by running:

$ go get -u github.com/swaggo/swag/cmd/swag

Then, you will be able to run

$ swag init
2021/03/31 12:32:07 Generate swagger docs....
2021/03/31 12:32:07 Generate general API Info, search dir:./
2021/03/31 12:32:07 Generating response.ResponseStatusSpec
2021/03/31 12:32:07 Generating response.ResponseError
2021/03/31 12:32:07 Generating response.ResponseServiceSpec
2021/03/31 12:32:07 Generating response.ResponseLogSpec
2021/03/31 12:32:07 Generating response.ResponseListSpec
2021/03/31 12:32:07 Generating config.Unit
2021/03/31 12:32:07 create docs.go at docs/docs.go
2021/03/31 12:32:07 create swagger.json at docs/swagger.json
2021/03/31 12:32:07 create swagger.yaml at docs/swagger.yaml

License

For license details please see LICENSE