feat(configgen): Phase 2 Config-Generator + nginx → HAProxy-only Pivot
Architektur-Pivot: nginx fällt komplett weg. HAProxy 2.8+ übernimmt
TLS-Termination, L7-Routing per Host-Header und LB. ACME-Webroot
und Management-UI werden von edgeguard-api ausgeliefert (Phase 3
implementiert die zugehörigen Handler); HAProxy proxied
/.well-known/acme-challenge/* und Management-FQDN-Traffic an
127.0.0.1:9443. Eine Distro-Abhängigkeit weniger, ein Renderer
weniger, sauberere Trennung.
Renderer (alle mit Embed-Templates + Tests):
* internal/configgen/ — atomic write + systemctl reload helpers
* internal/haproxy/ — :80 + :443, ACME-ACL, Host-Header-Routing,
Stats-Frontend, api_backend Fallback
* internal/firewall/ — default-deny input, stateful baseline,
SSH-Rate-Limit, :80/:443 accept,
Cluster-Peer-Set für mTLS :8443,
Custom-Rules aus PG
* internal/{squid,wireguard,unbound}/ — Stubs (ErrNotImplemented)
Orchestrator + CLI:
* internal/services/configorch/ — fester Reihenfolge-Run, Stubs
sind soft-skip statt fatal
* cmd/edgeguard-ctl render-config [--no-reload] [--only=svc1,svc2]
Packaging:
* postinst: /etc/edgeguard/nginx raus, /var/lib/edgeguard/acme rein,
self-signed _default.pem via openssl req (damit HAProxy startet
bevor certbot etwas issuet hat)
* control: Depends nginx raus, openssl rein
* edgeguard-ui: dependency auf nginx weg, "Served by edgeguard-api
gin StaticFS"
Live-Smoke: render-config gegen lokale PG schreibt /etc/edgeguard/
haproxy/haproxy.cfg + nftables.d/ruleset.nft korrekt; CRUD-Test aus
Phase 2 läuft weiter unverändert.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Debian
@@ -4,14 +4,15 @@ Architecture: __ARCH__
|
||||
Maintainer: NetCell IT <support@netcell-it.de>
|
||||
Homepage: https://edgeguard.netcell-it.de
|
||||
Description: EdgeGuard — native Reverse-Proxy / LB / Forward-Proxy / VPN / Firewall
|
||||
EdgeGuard is a native Debian/Ubuntu edge gateway combining HAProxy,
|
||||
nginx, Squid, WireGuard, Unbound and nftables, configured from
|
||||
a PostgreSQL single-source-of-truth via a Go management API.
|
||||
EdgeGuard is a native Debian/Ubuntu edge gateway combining HAProxy
|
||||
(TLS termination + L7 routing + LB), Squid, WireGuard, Unbound and
|
||||
nftables, configured from a PostgreSQL single-source-of-truth via
|
||||
a Go management API.
|
||||
Deployable as a cluster of symmetric peers (KeyDB Active-Active +
|
||||
PG Streaming Replication + provider Floating-IP for HTTP ingress).
|
||||
.
|
||||
This package ships the management API, scheduler and CLI.
|
||||
Depends: postgresql-16 | postgresql-17, edgeguard-keydb (>= 6.3.4-edgeguard1), nginx, haproxy (>= 2.8), squid, wireguard-tools, unbound, nftables, certbot, sudo, adduser, systemd, ca-certificates
|
||||
Depends: postgresql-16 | postgresql-17, edgeguard-keydb (>= 6.3.4-edgeguard1), haproxy (>= 2.8), squid, wireguard-tools, unbound, nftables, certbot, openssl, sudo, adduser, systemd, ca-certificates
|
||||
Recommends: apparmor, fail2ban
|
||||
Section: admin
|
||||
Priority: optional
|
||||
|
||||
@@ -21,13 +21,35 @@ case "$1" in
|
||||
|
||||
# ── Directories ──────────────────────────────────────────────
|
||||
for d in /etc/edgeguard /var/lib/edgeguard /var/log/edgeguard \
|
||||
/etc/edgeguard/haproxy /etc/edgeguard/nginx \
|
||||
/etc/edgeguard/squid /etc/edgeguard/wireguard \
|
||||
/etc/edgeguard/unbound /etc/edgeguard/nftables.d \
|
||||
/etc/edgeguard/tls; do
|
||||
/etc/edgeguard/haproxy /etc/edgeguard/squid \
|
||||
/etc/edgeguard/wireguard /etc/edgeguard/unbound \
|
||||
/etc/edgeguard/nftables.d /etc/edgeguard/tls \
|
||||
/var/lib/edgeguard/acme; do
|
||||
install -d -m 0750 -o "$EG_USER" -g "$EG_USER" "$d"
|
||||
done
|
||||
|
||||
# ── Self-signed default cert so HAProxy starts cleanly ───────
|
||||
# HAProxy `bind :443 ssl crt /etc/edgeguard/tls/` needs at least
|
||||
# one PEM in the directory to come up. Operator runs certbot
|
||||
# later; until then, browsers see an unverified cert which is
|
||||
# the expected first-boot UX.
|
||||
DEFAULT_PEM="/etc/edgeguard/tls/_default.pem"
|
||||
if [ ! -f "$DEFAULT_PEM" ]; then
|
||||
HOSTNAME_FQDN="$(hostname -f 2>/dev/null || hostname)"
|
||||
TMP_KEY="$(mktemp)"
|
||||
TMP_CRT="$(mktemp)"
|
||||
openssl req -x509 -nodes -newkey rsa:2048 \
|
||||
-keyout "$TMP_KEY" -out "$TMP_CRT" \
|
||||
-days 3650 \
|
||||
-subj "/CN=$HOSTNAME_FQDN" \
|
||||
-addext "subjectAltName = DNS:$HOSTNAME_FQDN,DNS:localhost" \
|
||||
>/dev/null 2>&1
|
||||
cat "$TMP_CRT" "$TMP_KEY" > "$DEFAULT_PEM"
|
||||
chown "$EG_USER:$EG_USER" "$DEFAULT_PEM"
|
||||
chmod 0640 "$DEFAULT_PEM"
|
||||
rm -f "$TMP_KEY" "$TMP_CRT"
|
||||
fi
|
||||
|
||||
# ── Pre-flight: validate embedded migration set ──────────────
|
||||
# Catches duplicate version prefixes BEFORE we touch the DB,
|
||||
# so a broken upgrade can't half-apply migrations and leave
|
||||
|
||||
@@ -5,7 +5,7 @@ Maintainer: NetCell IT <support@netcell-it.de>
|
||||
Homepage: https://edgeguard.netcell-it.de
|
||||
Description: EdgeGuard — meta package
|
||||
Pulls the full EdgeGuard stack: management API, UI, configured
|
||||
third-party services (HAProxy, nginx, Squid, WireGuard, Unbound, nftables).
|
||||
third-party services (HAProxy, Squid, WireGuard, Unbound, nftables).
|
||||
.
|
||||
Install this package to get a complete EdgeGuard node.
|
||||
Depends: edgeguard-api (= __VERSION__), edgeguard-ui (= __VERSION__)
|
||||
|
||||
@@ -5,8 +5,9 @@ Maintainer: NetCell IT <support@netcell-it.de>
|
||||
Homepage: https://edgeguard.netcell-it.de
|
||||
Description: EdgeGuard — management UI (static React build)
|
||||
React 19 + Ant Design 6 single-page admin UI for EdgeGuard.
|
||||
Served by the nginx reverse proxy bundled in edgeguard-api.
|
||||
Depends: edgeguard-api (= __VERSION__), nginx
|
||||
Static build artefacts under /usr/share/edgeguard/ui/, served by
|
||||
edgeguard-api (gin StaticFS) on the management FQDN.
|
||||
Depends: edgeguard-api (= __VERSION__)
|
||||
Section: admin
|
||||
Priority: optional
|
||||
Installed-Size: 0
|
||||
|
||||
Reference in New Issue
Block a user