feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)
Backend: - Audit-Log: Search-Endpoint mit ILIKE-Filter (actor/action/subject/date) - NTP: /ntp/status via chronyc tracking (Stratum, Offset, Quelle) - System: /service-restart mit Allowlist (haproxy/squid/unbound/chrony/scheduler) - Domain-Response-Headers + Rate-Limit (Migration 0024) - Join-Tokens (Migration 0025), Cluster-mTLS, Aggregator-Fan-Out - apt-Service für Update-Banner (apt-get update + Versionsprüfung) - Backup-Retry mit exponential backoff (retry_apt 3×) - publish.sh fail-fast + cleanup-old.sh (max 10 Versionen) Frontend: - Audit-Log-Page (/audit) mit Filter + Pagination - ErrorBoundary an React-Root + Vite build-target festgenagelt (iOS 15+) - Storage-Schema-Stamp: auto-wipe bei Versions-Mismatch (blank-page-Fix) - EmptyState-Komponente überall ausgerollt - SSL: Aggregate-Karte (total/expiring/expired/errors) - Backups: Aggregate-Karte (letzter Backup/Größe/Fehlschläge 24h) + Backup-Now - NTP: Sync-Status-Karte (chronyc tracking live) - Domains: Backend-UP/DOWN-Chip aus HAProxy-Stats - Backends: HAProxy-Status-Spalte (UP/DEGRADED/DOWN) - Settings: Service-Neustart-Karte (haproxy/squid/unbound/chrony/scheduler) - Settings: Upgrade-Status-Card, Wartungsmodus, Auto-Update, Retention - Dashboard: Recent-Alerts, Cluster-Health, License-Chip, Onboarding-Hint - System-Regeln im Firewall als eigener Tab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
@@ -41,6 +41,13 @@ func TestRender_BaselineHasFrontendsAndApiBackend(t *testing.T) {
|
||||
"backend api_backend",
|
||||
"server api1 127.0.0.1:9443 check",
|
||||
"bind :443 ssl crt /etc/edgeguard/tls/",
|
||||
// HTTP/3 (QUIC) zusätzlich zum h2/http1.1-Listener.
|
||||
"bind quic4@:443 ssl crt /etc/edgeguard/tls/ alpn h3",
|
||||
// limited-quic global muss gesetzt sein, sonst weigert sich
|
||||
// HAProxy 3.0 das quic4-bind anzunehmen (OpenSSL-Kompat-Layer).
|
||||
"limited-quic",
|
||||
// Alt-Svc damit Browser auf h3 upgraden.
|
||||
`Alt-Svc "h3=\":443\"; ma=86400"`,
|
||||
"path_beg /.well-known/acme-challenge/",
|
||||
"http-request redirect scheme https",
|
||||
// Client-IP-Weiterleitung an Backends — XFF kommt aus
|
||||
@@ -54,6 +61,326 @@ func TestRender_BaselineHasFrontendsAndApiBackend(t *testing.T) {
|
||||
t.Errorf("missing %q in baseline output:\n%s", w, out)
|
||||
}
|
||||
}
|
||||
// Globales HSTS auf public_https darf NICHT mehr drin sein —
|
||||
// das wird jetzt pro Domain via ACL gesetzt (siehe HSTS-Test).
|
||||
// mgmt_https hat aber weiterhin ein globales HSTS.
|
||||
publicIdx := strings.Index(out, "frontend public_https")
|
||||
mgmtIdx := strings.Index(out, "frontend mgmt_https")
|
||||
if publicIdx < 0 || mgmtIdx < 0 || publicIdx >= mgmtIdx {
|
||||
t.Fatalf("frontend ordering unexpected:\n%s", out)
|
||||
}
|
||||
publicBlock := out[publicIdx:mgmtIdx]
|
||||
if strings.Contains(publicBlock, "set-header Strict-Transport-Security") {
|
||||
t.Errorf("public_https soll KEIN globales HSTS mehr enthalten (pro-Domain ACL):\n%s", publicBlock)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_HSTSPerDomain(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 1, Name: "a.example.com", Active: true,
|
||||
HSTSEnabled: true, HSTSMaxAge: 63072000,
|
||||
HSTSSubdomains: true, HSTSPreload: true,
|
||||
},
|
||||
HSTSHeader: "max-age=63072000; includeSubDomains; preload",
|
||||
},
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 2, Name: "b.example.com", Active: true,
|
||||
HSTSEnabled: false,
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
for _, w := range []string{
|
||||
// Erst löschen (gegen Backend-set HSTS), dann setzen.
|
||||
`http-response del-header Strict-Transport-Security if { hdr(host) -i a.example.com }`,
|
||||
`http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" if { hdr(host) -i a.example.com }`,
|
||||
} {
|
||||
if !strings.Contains(out, w) {
|
||||
t.Errorf("missing %q in per-domain HSTS output:\n%s", w, out)
|
||||
}
|
||||
}
|
||||
if strings.Contains(out, "Strict-Transport-Security \"\" if { hdr(host) -i b.example.com }") ||
|
||||
strings.Contains(out, "if { hdr(host) -i b.example.com }") && strings.Contains(out, "Strict-Transport-Security") &&
|
||||
strings.Contains(out, "b.example.com") && strings.Count(out, "Strict-Transport-Security") > 2 {
|
||||
// HSTS soll für Domain ohne HSTSEnabled gar nicht erst gerendert werden.
|
||||
// (mgmt_https hat noch eins, plus die eine Zeile von a.example.com → 2 Vorkommen erwartet.)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_MaintenanceModeBlocksWith503(t *testing.T) {
|
||||
msg := `Wartung — bitte später wiederkommen.`
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 1, Name: "down.example.com", Active: true,
|
||||
MaintenanceMode: true, MaintenanceMessage: &msg,
|
||||
},
|
||||
MaintMessage: msg,
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
want := `http-request return status 503 content-type "text/plain; charset=utf-8" string "Wartung — bitte später wiederkommen." if { hdr(host) -i down.example.com }`
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("missing maintenance-503 line:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_WWWRedirectToNaked(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 1, Name: "example.com", Active: true,
|
||||
WWWRedirect: "to-naked",
|
||||
},
|
||||
RedirectFromHost: "www.example.com",
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
want := `http-request redirect prefix https://example.com code 301 if { hdr(host) -i www.example.com }`
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("missing www→naked redirect line:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_WWWRedirectToWWW(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 1, Name: "www.example.com", Active: true,
|
||||
WWWRedirect: "to-www",
|
||||
},
|
||||
RedirectFromHost: "example.com",
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
want := `http-request redirect prefix https://www.example.com code 301 if { hdr(host) -i example.com }`
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("missing naked→www redirect line:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildHSTSHeader(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
d models.Domain
|
||||
want string
|
||||
}{
|
||||
{"disabled", models.Domain{HSTSEnabled: false}, ""},
|
||||
{"defaults", models.Domain{HSTSEnabled: true}, "max-age=31536000"},
|
||||
{"explicit", models.Domain{HSTSEnabled: true, HSTSMaxAge: 7200}, "max-age=7200"},
|
||||
{"sub", models.Domain{HSTSEnabled: true, HSTSMaxAge: 60, HSTSSubdomains: true}, "max-age=60; includeSubDomains"},
|
||||
{"sub+preload", models.Domain{HSTSEnabled: true, HSTSMaxAge: 60, HSTSSubdomains: true, HSTSPreload: true}, "max-age=60; includeSubDomains; preload"},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if got := buildHSTSHeader(tc.d); got != tc.want {
|
||||
t.Errorf("buildHSTSHeader: got %q want %q", got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildMaintMessage(t *testing.T) {
|
||||
msg := `He said "hi"` + "\n" + `and left`
|
||||
d := models.Domain{MaintenanceMode: true, MaintenanceMessage: &msg}
|
||||
got := buildMaintMessage(d)
|
||||
// Quotes durch ' ersetzt, Newline → Space.
|
||||
want := `He said 'hi' and left`
|
||||
if got != want {
|
||||
t.Errorf("buildMaintMessage: got %q want %q", got, want)
|
||||
}
|
||||
if buildMaintMessage(models.Domain{MaintenanceMode: false}) != "" {
|
||||
t.Errorf("buildMaintMessage should be empty when MaintenanceMode is off")
|
||||
}
|
||||
if got := buildMaintMessage(models.Domain{MaintenanceMode: true}); got == "" {
|
||||
t.Errorf("buildMaintMessage should emit fallback text when no message set")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_GlobalMaintenanceBlocksAllCustomerTraffic(t *testing.T) {
|
||||
v := View{
|
||||
GlobalMaintenance: true,
|
||||
GlobalMaintenanceMessage: "Wartung läuft.",
|
||||
Domains: []DomainView{
|
||||
{Domain: models.Domain{ID: 1, Name: "site.example.com", Active: true}},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
want := `http-request return status 503 content-type "text/plain; charset=utf-8" string "Wartung läuft."`
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("missing global-maintenance 503 block:\n%s", out)
|
||||
}
|
||||
// Block muss VOR den use_backend-Zeilen IM SELBEN public_https-
|
||||
// Frontend stehen (sonst ineffektiv — HAProxy execut'ed in-order,
|
||||
// return-actions terminieren die Chain). public_http hat ein
|
||||
// frühes use_backend api_backend für ACME — das hier nicht
|
||||
// matchen.
|
||||
pubIdx := strings.Index(out, "frontend public_https")
|
||||
mgmtIdxStart := strings.Index(out, "frontend mgmt_https")
|
||||
if pubIdx < 0 || mgmtIdxStart < 0 {
|
||||
t.Fatalf("frontends not found in output:\n%s", out)
|
||||
}
|
||||
publicBlock := out[pubIdx:mgmtIdxStart]
|
||||
idxBlock := strings.Index(publicBlock, want)
|
||||
idxUseBackend := strings.Index(publicBlock, "use_backend")
|
||||
if idxBlock < 0 || (idxUseBackend > 0 && idxBlock > idxUseBackend) {
|
||||
t.Errorf("global-maintenance block must precede use_backend in public_https\n block at %d, use_backend at %d", idxBlock, idxUseBackend)
|
||||
}
|
||||
// mgmt_https darf NICHT betroffen sein.
|
||||
mgmtIdx := strings.Index(out, "frontend mgmt_https")
|
||||
if mgmtIdx > 0 {
|
||||
mgmtBlock := out[mgmtIdx:]
|
||||
if strings.Contains(mgmtBlock, want) {
|
||||
t.Errorf("mgmt_https must NOT contain global-maintenance block:\n%s", mgmtBlock)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_GlobalMaintenanceOff_NoBlock(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{Domain: models.Domain{ID: 1, Name: "site.example.com", Active: true}},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
if strings.Contains(out, "Whole-Box-Maintenance") {
|
||||
t.Errorf("global-maintenance comment should not be rendered when off:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_RateLimitEmitsStickTableAndDeny(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 7, Name: "api.example.com", Active: true,
|
||||
RateLimitRPS: 50,
|
||||
},
|
||||
RateLimitThreshold: 500, // 50 rps × 10s
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
for _, w := range []string{
|
||||
"backend rl_7",
|
||||
"stick-table type ip size 100k expire 10s store http_req_rate(10s)",
|
||||
`http-request track-sc0 src table rl_7 if { hdr(host) -i api.example.com }`,
|
||||
`http-request deny deny_status 429 if { hdr(host) -i api.example.com } { sc_http_req_rate(0) gt 500 }`,
|
||||
} {
|
||||
if !strings.Contains(out, w) {
|
||||
t.Errorf("missing %q in rate-limit output:\n%s", w, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_NoRateLimitNoStickTable(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{ID: 9, Name: "a.example.com", Active: true},
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
if strings.Contains(out, "backend rl_9") {
|
||||
t.Errorf("stick-table backend rendered for domain without rate-limit:\n%s", out)
|
||||
}
|
||||
if strings.Contains(out, "track-sc0") {
|
||||
t.Errorf("track-sc0 emitted without rate-limit:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_BodySizeDeny413(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{
|
||||
ID: 1, Name: "upload.example.com", Active: true,
|
||||
MaxBodyKB: 2048,
|
||||
},
|
||||
MaxBodyBytes: 2048 * 1024,
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
want := `http-request deny deny_status 413 if { hdr(host) -i upload.example.com } { req.hdr_val(content-length) -m int gt 2097152 }`
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("missing 413 body-size deny:\n%s", out)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_CustomResponseHeaders(t *testing.T) {
|
||||
v := View{
|
||||
Domains: []DomainView{
|
||||
{
|
||||
Domain: models.Domain{ID: 1, Name: "x.example.com", Active: true},
|
||||
ResponseHeaders: []ResponseHeaderView{
|
||||
{Name: "X-Frame-Options", Value: "DENY"},
|
||||
{Name: "Content-Security-Policy", Value: "default-src 'self'"},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
out := renderView(t, v)
|
||||
for _, w := range []string{
|
||||
// del + set pro Custom-Header, damit Upstream-Werte
|
||||
// garantiert überschrieben werden.
|
||||
`http-response del-header X-Frame-Options if { hdr(host) -i x.example.com }`,
|
||||
`http-response set-header X-Frame-Options "DENY" if { hdr(host) -i x.example.com }`,
|
||||
`http-response del-header Content-Security-Policy if { hdr(host) -i x.example.com }`,
|
||||
`http-response set-header Content-Security-Policy "default-src 'self'" if { hdr(host) -i x.example.com }`,
|
||||
} {
|
||||
if !strings.Contains(out, w) {
|
||||
t.Errorf("missing %q:\n%s", w, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSanitizeHeaderValue(t *testing.T) {
|
||||
cases := map[string]string{
|
||||
`plain`: `plain`,
|
||||
`with "quotes"`: `with 'quotes'`,
|
||||
"with\nnewline": "with newline",
|
||||
"crlf\r\nattack": "crlf attack",
|
||||
`csp default-src 'self'`: `csp default-src 'self'`,
|
||||
}
|
||||
for in, want := range cases {
|
||||
if got := sanitizeHeaderValue(in); got != want {
|
||||
t.Errorf("sanitizeHeaderValue(%q) = %q want %q", in, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildRedirectFromHost(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
d models.Domain
|
||||
want string
|
||||
}{
|
||||
{"none", models.Domain{Name: "example.com"}, ""},
|
||||
{"to-naked", models.Domain{Name: "example.com", WWWRedirect: "to-naked"}, "www.example.com"},
|
||||
{"to-naked invalid (name already has www)", models.Domain{Name: "www.example.com", WWWRedirect: "to-naked"}, ""},
|
||||
{"to-www", models.Domain{Name: "www.example.com", WWWRedirect: "to-www"}, "example.com"},
|
||||
{"to-www invalid (name lacks www)", models.Domain{Name: "example.com", WWWRedirect: "to-www"}, ""},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
if got := buildRedirectFromHost(tc.d); got != tc.want {
|
||||
t.Errorf("buildRedirectFromHost: got %q want %q", got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestRender_DomainRoutesEmitUseBackend(t *testing.T) {
|
||||
|
||||
Reference in New Issue
Block a user