diff --git a/.gitignore b/.gitignore index ba48844..440da6e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,3 @@ -etc/passwd -etc/storage/ -node_modules/ +dist/ +staging/ *.swp -.env diff --git a/README.md b/README.md index 02ece43..ae919f4 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# ztncui - ZeroTier network controller UI +# ztncui - ZeroTier network controller user interface ztncui is a web UI for a standalone [ZeroTier](https://zerotier.com) network controller. diff --git a/build/build.sh b/build/build.sh new file mode 100755 index 0000000..30743c7 --- /dev/null +++ b/build/build.sh @@ -0,0 +1,70 @@ +#!/bin/bash + +set -eux -o pipefail + +SRC_DIR=../src +PKG_DIR=../dist +BUILD_DIR=`pwd` +STAGING_DIR=../staging + +NAME='ztncui' +DESCRIPTION='ZeroTier network controller user interface' +VERSION=`grep version ../src/package.json | cut -f4 -d'"'` +VENDOR='Key Networks https://key-networks.com' +MAINTAINER='Key Networks https://key-networks.com' +URL='https://key-networks.com' +LICENSE='GPLv3' + + +rm -fr $STAGING_DIR && mkdir $STAGING_DIR +rm -fr $PKG_DIR && mkdir $PKG_DIR + +cd ../src +npm install +pkg -c ./package.json -t node8-linux-x64 bin/www -o ztncui +cd - + +install -m 750 -d $STAGING_DIR/opt +install -m 750 -d $STAGING_DIR/opt/key-networks +install -m 750 -d $STAGING_DIR/opt/key-networks/ztncui +install -m 750 -d $STAGING_DIR/opt/key-networks/ztncui/etc +install -m 600 $SRC_DIR/etc/default.passwd $STAGING_DIR/opt/key-networks/ztncui/etc/default.passwd +install -m 750 -d $STAGING_DIR/opt/key-networks/ztncui/etc/tls +install -m 750 -d $STAGING_DIR/opt/key-networks/ztncui/node_modules/argon2/build/Release +install -m 755 $SRC_DIR/node_modules/argon2/build/Release/argon2.node $STAGING_DIR/opt/key-networks/ztncui/node_modules/argon2/build/Release/ +install -m 755 $SRC_DIR/ztncui $STAGING_DIR/opt/key-networks/ztncui/ + +openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout $STAGING_DIR/opt/key-networks/ztncui/etc/tls/privkey.pem -out $STAGING_DIR/opt/key-networks/ztncui/etc/tls/fullchain.pem -config $BUILD_DIR/openssl.cnf + +GENERAL_FPM_FLAGS=" + --name $NAME + --version $VERSION + --url $URL + --license $LICENSE + --chdir $STAGING_DIR + --package $PKG_DIR + --directories /opt/key-networks + --after-install /dev/null + --before-install /dev/null + --after-remove /dev/null + --before-remove /dev/null + --after-upgrade /dev/null + --before-upgrade /dev/null +" + +fpm -s dir -t rpm \ + $GENERAL_FPM_FLAGS \ + --vendor "$VENDOR" \ + --maintainer "$MAINTAINER" \ + --description "$DESCRIPTION" \ + --rpm-use-file-permissions \ + . + +fpm -s dir -t deb \ + $GENERAL_FPM_FLAGS \ + --vendor "$VENDOR" \ + --maintainer "$MAINTAINER" \ + --description "$DESCRIPTION" \ + --deb-use-file-permissions \ + . + diff --git a/build/openssl.cnf b/build/openssl.cnf new file mode 100644 index 0000000..832fffb --- /dev/null +++ b/build/openssl.cnf @@ -0,0 +1,342 @@ +# +# OpenSSL example configuration file. +# This is mostly being used for generation of certificate requests. +# + +# This definition stops the following lines choking if HOME isn't +# defined. +HOME = . +RANDFILE = $ENV::HOME/.rnd + +# Extra OBJECT IDENTIFIER info: +#oid_file = $ENV::HOME/.oid +oid_section = new_oids + +# To use this configuration file with the "-extfile" option of the +# "openssl x509" utility, name here the section containing the +# X.509v3 extensions to use: +# extensions = +# (Alternatively, use a configuration file that has only +# X.509v3 extensions in its main [= default] section.) + +[ new_oids ] + +# We can add new OIDs in here for use by 'ca', 'req' and 'ts'. +# Add a simple OID like this: +# testoid1=1.2.3.4 +# Or use config file substitution like this: +# testoid2=${testoid1}.5.6 + +# Policies used by the TSA examples. +tsa_policy1 = 1.2.3.4.1 +tsa_policy2 = 1.2.3.4.5.6 +tsa_policy3 = 1.2.3.4.5.7 + +#################################################################### +[ ca ] +default_ca = CA_default # The default ca section + +#################################################################### +[ CA_default ] + +dir = /etc/pki/CA # Where everything is kept +certs = $dir/certs # Where the issued certs are kept +crl_dir = $dir/crl # Where the issued crl are kept +database = $dir/index.txt # database index file. +#unique_subject = no # Set to 'no' to allow creation of + # several certs with same subject. +new_certs_dir = $dir/newcerts # default place for new certs. + +certificate = $dir/cacert.pem # The CA certificate +serial = $dir/serial # The current serial number +crlnumber = $dir/crlnumber # the current crl number + # must be commented out to leave a V1 CRL +crl = $dir/crl.pem # The current CRL +private_key = $dir/private/cakey.pem# The private key +RANDFILE = $dir/private/.rand # private random number file + +x509_extensions = usr_cert # The extensions to add to the cert + +# Comment out the following two lines for the "traditional" +# (and highly broken) format. +name_opt = ca_default # Subject Name options +cert_opt = ca_default # Certificate field options + +# Extension copying option: use with caution. +# copy_extensions = copy + +# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs +# so this is commented out by default to leave a V1 CRL. +# crlnumber must also be commented out to leave a V1 CRL. +# crl_extensions = crl_ext + +default_days = 365 # how long to certify for +default_crl_days= 30 # how long before next CRL +default_md = sha256 # use SHA-256 by default +preserve = no # keep passed DN ordering + +# A few difference way of specifying how similar the request should look +# For type CA, the listed attributes must be the same, and the optional +# and supplied fields are just that :-) +policy = policy_match + +# For the CA policy +[ policy_match ] +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +# For the 'anything' policy +# At this point in time, you must list all acceptable 'object' +# types. +[ policy_anything ] +countryName = optional +stateOrProvinceName = optional +localityName = optional +organizationName = optional +organizationalUnitName = optional +commonName = supplied +emailAddress = optional + +#################################################################### +[ req ] +prompt = no +default_bits = 2048 +default_md = sha256 +default_keyfile = privkey.pem +distinguished_name = req_distinguished_name +attributes = req_attributes +x509_extensions = v3_ca # The extensions to add to the self signed cert + +# Passwords for private keys if not present they will be prompted for +# input_password = secret +# output_password = secret + +# This sets a mask for permitted string types. There are several options. +# default: PrintableString, T61String, BMPString. +# pkix : PrintableString, BMPString (PKIX recommendation before 2004) +# utf8only: only UTF8Strings (PKIX recommendation after 2004). +# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings). +# MASK:XXXX a literal mask value. +# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings. +string_mask = utf8only + +# req_extensions = v3_req # The extensions to add to a certificate request + +[ req_distinguished_name ] +countryName = AU + +stateOrProvinceName = Western Australia +#stateOrProvinceName_default = Default Province + +localityName = Perth + +0.organizationName = Key Networks (https://key-networks.com) + +# we can do this but it is not needed normally :-) +#1.organizationName = Second Organization Name (eg, company) +#1.organizationName_default = World Wide Web Pty Ltd + +organizationalUnitName = Engineering +#organizationalUnitName_default = + +commonName = localhost + +emailAddress = noreply@key-networks.com + +# SET-ex3 = SET extension number 3 + +[ req_attributes ] +challengePassword = A challenge password +challengePassword_min = 4 +challengePassword_max = 20 + +unstructuredName = An optional company name + +[ usr_cert ] + +# These extensions are added when 'ca' signs a request. + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# Here are some examples of the usage of nsCertType. If it is omitted +# the certificate can be used for anything *except* object signing. + +# This is OK for an SSL server. +# nsCertType = server + +# For an object signing certificate this would be used. +# nsCertType = objsign + +# For normal client use this is typical +# nsCertType = client, email + +# and for everything including object signing: +# nsCertType = client, email, objsign + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# This will be displayed in Netscape's comment listbox. +nsComment = "OpenSSL Generated Certificate" + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem +#nsBaseUrl +#nsRevocationUrl +#nsRenewalUrl +#nsCaPolicyUrl +#nsSslServerName + +# This is required for TSA certificates. +# extendedKeyUsage = critical,timeStamping + +[ v3_req ] + +# Extensions to add to a certificate request + +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +[ v3_ca ] + + +# Extensions for a typical CA + + +# PKIX recommendation. + +subjectKeyIdentifier=hash + +authorityKeyIdentifier=keyid:always,issuer + +basicConstraints = critical,CA:true + +# Key usage: this is typical for a CA certificate. However since it will +# prevent it being used as an test self-signed certificate it is best +# left out by default. +# keyUsage = cRLSign, keyCertSign + +# Some might want this also +# nsCertType = sslCA, emailCA + +# Include email address in subject alt name: another PKIX recommendation +# subjectAltName=email:copy +# Copy issuer details +# issuerAltName=issuer:copy + +# DER hex encoding of an extension: beware experts only! +# obj=DER:02:03 +# Where 'obj' is a standard or added object +# You can even override a supported extension: +# basicConstraints= critical, DER:30:03:01:01:FF + +[ crl_ext ] + +# CRL extensions. +# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL. + +# issuerAltName=issuer:copy +authorityKeyIdentifier=keyid:always + +[ proxy_cert_ext ] +# These extensions should be added when creating a proxy certificate + +# This goes against PKIX guidelines but some CAs do it and some software +# requires this to avoid interpreting an end user certificate as a CA. + +basicConstraints=CA:FALSE + +# Here are some examples of the usage of nsCertType. If it is omitted +# the certificate can be used for anything *except* object signing. + +# This is OK for an SSL server. +# nsCertType = server + +# For an object signing certificate this would be used. +# nsCertType = objsign + +# For normal client use this is typical +# nsCertType = client, email + +# and for everything including object signing: +# nsCertType = client, email, objsign + +# This is typical in keyUsage for a client certificate. +# keyUsage = nonRepudiation, digitalSignature, keyEncipherment + +# This will be displayed in Netscape's comment listbox. +nsComment = "OpenSSL Generated Certificate" + +# PKIX recommendations harmless if included in all certificates. +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# This stuff is for subjectAltName and issuerAltname. +# Import the email address. +# subjectAltName=email:copy +# An alternative to produce certificates that aren't +# deprecated according to PKIX. +# subjectAltName=email:move + +# Copy subject details +# issuerAltName=issuer:copy + +#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem +#nsBaseUrl +#nsRevocationUrl +#nsRenewalUrl +#nsCaPolicyUrl +#nsSslServerName + +# This really needs to be in place for it to be a proxy certificate. +proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo + +#################################################################### +[ tsa ] + +default_tsa = tsa_config1 # the default TSA section + +[ tsa_config1 ] + +# These are used by the TSA reply generation only. +dir = ./demoCA # TSA root directory +serial = $dir/tsaserial # The current serial number (mandatory) +crypto_device = builtin # OpenSSL engine to use for signing +signer_cert = $dir/tsacert.pem # The TSA signing certificate + # (optional) +certs = $dir/cacert.pem # Certificate chain to include in reply + # (optional) +signer_key = $dir/private/tsakey.pem # The TSA private key (optional) +signer_digest = sha256 # Signing digest to use. (Optional) +default_policy = tsa_policy1 # Policy if request did not specify it + # (optional) +other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional) +digests = sha1, sha256, sha384, sha512 # Acceptable message digests (mandatory) +accuracy = secs:1, millisecs:500, microsecs:100 # (optional) +clock_precision_digits = 0 # number of digits after dot. (optional) +ordering = yes # Is ordering defined for timestamps? + # (optional, default: no) +tsa_name = yes # Must the TSA name be included in the reply? + # (optional, default: no) +ess_cert_id_chain = no # Must the ESS cert id chain be included? + # (optional, default: no) diff --git a/src/.gitignore b/src/.gitignore new file mode 100644 index 0000000..b5815a6 --- /dev/null +++ b/src/.gitignore @@ -0,0 +1,6 @@ +etc/passwd +etc/storage/ +node_modules/ +*.swp +.env +ztncui diff --git a/app.js b/src/app.js similarity index 100% rename from app.js rename to src/app.js diff --git a/bin/www b/src/bin/www similarity index 100% rename from bin/www rename to src/bin/www diff --git a/controllers/auth.js b/src/controllers/auth.js similarity index 100% rename from controllers/auth.js rename to src/controllers/auth.js diff --git a/controllers/networkController.js b/src/controllers/networkController.js similarity index 100% rename from controllers/networkController.js rename to src/controllers/networkController.js diff --git a/controllers/token.js b/src/controllers/token.js similarity index 100% rename from controllers/token.js rename to src/controllers/token.js diff --git a/controllers/usersController.js b/src/controllers/usersController.js similarity index 100% rename from controllers/usersController.js rename to src/controllers/usersController.js diff --git a/controllers/zt.js b/src/controllers/zt.js similarity index 100% rename from controllers/zt.js rename to src/controllers/zt.js diff --git a/etc/default.passwd b/src/etc/default.passwd similarity index 100% rename from etc/default.passwd rename to src/etc/default.passwd diff --git a/etc/tls/.gitignore b/src/etc/tls/.gitignore similarity index 100% rename from etc/tls/.gitignore rename to src/etc/tls/.gitignore diff --git a/package-lock.json b/src/package-lock.json similarity index 99% rename from package-lock.json rename to src/package-lock.json index 0a9bccf..a8d2774 100644 --- a/package-lock.json +++ b/src/package-lock.json @@ -1,6 +1,6 @@ { "name": "ztncui", - "version": "0.1.0", + "version": "0.3.0", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/src/package.json similarity index 87% rename from package.json rename to src/package.json index f3c0f73..fcd68f0 100644 --- a/package.json +++ b/src/package.json @@ -1,6 +1,6 @@ { "name": "ztncui", - "version": "0.2.0", + "version": "0.3.0", "private": true, "scripts": { "start": "node ./bin/www", @@ -29,6 +29,10 @@ "nodemon": "^1.12.5" }, "pkg": { - "assets": ["views/*", "public/**/*", "etc/**/*"] + "assets": [ + "views/*", + "public/**/*", + "etc/**/*" + ] } } diff --git a/public/.well-known/acme-challenge/.gitignore b/src/public/.well-known/acme-challenge/.gitignore similarity index 100% rename from public/.well-known/acme-challenge/.gitignore rename to src/public/.well-known/acme-challenge/.gitignore diff --git a/public/favicon.ico b/src/public/favicon.ico similarity index 100% rename from public/favicon.ico rename to src/public/favicon.ico diff --git a/public/images/key-logo.svg b/src/public/images/key-logo.svg similarity index 100% rename from public/images/key-logo.svg rename to src/public/images/key-logo.svg diff --git a/public/stylesheets/style.css b/src/public/stylesheets/style.css similarity index 100% rename from public/stylesheets/style.css rename to src/public/stylesheets/style.css diff --git a/routes/index.js b/src/routes/index.js similarity index 100% rename from routes/index.js rename to src/routes/index.js diff --git a/routes/users.js b/src/routes/users.js similarity index 100% rename from routes/users.js rename to src/routes/users.js diff --git a/routes/zt_controller.js b/src/routes/zt_controller.js similarity index 100% rename from routes/zt_controller.js rename to src/routes/zt_controller.js diff --git a/views/authorized.pug b/src/views/authorized.pug similarity index 100% rename from views/authorized.pug rename to src/views/authorized.pug diff --git a/views/controller_layout.pug b/src/views/controller_layout.pug similarity index 100% rename from views/controller_layout.pug rename to src/views/controller_layout.pug diff --git a/views/error.pug b/src/views/error.pug similarity index 100% rename from views/error.pug rename to src/views/error.pug diff --git a/views/front_door.pug b/src/views/front_door.pug similarity index 100% rename from views/front_door.pug rename to src/views/front_door.pug diff --git a/views/head_layout.pug b/src/views/head_layout.pug similarity index 100% rename from views/head_layout.pug rename to src/views/head_layout.pug diff --git a/views/index.pug b/src/views/index.pug similarity index 100% rename from views/index.pug rename to src/views/index.pug diff --git a/views/ipAssignmentPools.pug b/src/views/ipAssignmentPools.pug similarity index 100% rename from views/ipAssignmentPools.pug rename to src/views/ipAssignmentPools.pug diff --git a/views/login.pug b/src/views/login.pug similarity index 100% rename from views/login.pug rename to src/views/login.pug diff --git a/views/login_layout.pug b/src/views/login_layout.pug similarity index 100% rename from views/login_layout.pug rename to src/views/login_layout.pug diff --git a/views/member_delete.pug b/src/views/member_delete.pug similarity index 100% rename from views/member_delete.pug rename to src/views/member_delete.pug diff --git a/views/member_detail.pug b/src/views/member_detail.pug similarity index 100% rename from views/member_detail.pug rename to src/views/member_detail.pug diff --git a/views/members.pug b/src/views/members.pug similarity index 100% rename from views/members.pug rename to src/views/members.pug diff --git a/views/name.pug b/src/views/name.pug similarity index 100% rename from views/name.pug rename to src/views/name.pug diff --git a/views/network_create.pug b/src/views/network_create.pug similarity index 100% rename from views/network_create.pug rename to src/views/network_create.pug diff --git a/views/network_delete.pug b/src/views/network_delete.pug similarity index 100% rename from views/network_delete.pug rename to src/views/network_delete.pug diff --git a/views/network_detail.pug b/src/views/network_detail.pug similarity index 100% rename from views/network_detail.pug rename to src/views/network_detail.pug diff --git a/views/network_easy.pug b/src/views/network_easy.pug similarity index 100% rename from views/network_easy.pug rename to src/views/network_easy.pug diff --git a/views/network_layout.pug b/src/views/network_layout.pug similarity index 100% rename from views/network_layout.pug rename to src/views/network_layout.pug diff --git a/views/networks.pug b/src/views/networks.pug similarity index 100% rename from views/networks.pug rename to src/views/networks.pug diff --git a/views/not_implemented.pug b/src/views/not_implemented.pug similarity index 100% rename from views/not_implemented.pug rename to src/views/not_implemented.pug diff --git a/views/password.pug b/src/views/password.pug similarity index 100% rename from views/password.pug rename to src/views/password.pug diff --git a/views/routes.pug b/src/views/routes.pug similarity index 100% rename from views/routes.pug rename to src/views/routes.pug diff --git a/views/user_delete.pug b/src/views/user_delete.pug similarity index 100% rename from views/user_delete.pug rename to src/views/user_delete.pug diff --git a/views/users.pug b/src/views/users.pug similarity index 100% rename from views/users.pug rename to src/views/users.pug diff --git a/views/users_layout.pug b/src/views/users_layout.pug similarity index 100% rename from views/users_layout.pug rename to src/views/users_layout.pug diff --git a/views/v4AssignMode.pug b/src/views/v4AssignMode.pug similarity index 100% rename from views/v4AssignMode.pug rename to src/views/v4AssignMode.pug diff --git a/views/v6AssignMode.pug b/src/views/v6AssignMode.pug similarity index 100% rename from views/v6AssignMode.pug rename to src/views/v6AssignMode.pug