feat: Network/IP-Verwaltung + Mailguard-Design-Übernahme

Backend: * Migration 0009_networks: network_interfaces (ethernet|vlan|bond| bridge|wireguard, role wan|lan|dmz|mgmt|cluster, parent + vlan_id für VLANs) + ip_addresses (interface_id FK, address+prefix, is_vip + vip_priority für Cluster-Failover-VIPs). * Repos services/networkifs + services/ipaddresses + Models + Handler /api/v1/network-interfaces (CRUD + /:id/ip-addresses) und /api/v1/ip-addresses (CRUD). * /api/v1/system/interfaces refactored auf Go-natives net.Interfaces() statt `ip -j addr show` shell-out — die systemd-Sandbox blockt AF_NETLINK auch für Go's runtime, deswegen edgeguard-api.service RestrictAddressFamilies um AF_NETLINK ergänzt. Output-Shape bleibt identisch (ifindex, ifname, flags[], mtu, link_type, address, addr_info[]) — Frontend muss nicht angepasst werden. Frontend: * Networks-Page (/networks): "System-discovered Interfaces" read-only Tags-Card oben, deklarierte Interfaces unten als Tabelle mit Modal-CRUD; Type-Switch zeigt parent+vlan_id-Felder bei type=vlan; Role-Tags farbig (wan blau, lan grün, dmz orange, mgmt purple, cluster magenta). * IPAddresses-Page (/ip-addresses): Tabelle pro Interface, VIP- Toggle blendet vip_priority-Eingabe ein. Goldenes VIP-Tag in der Liste. * Sidebar erweitert um Networks + IP-Adressen + section-grouping. Design 1:1 von mail-gateway/management-ui/ übernommen: * enterprise.css verbatim (Inter-Font via Google CDN statt local woff2), Sidebar 240px dunkler Gradient #0B1426→#101D33→#0D1829, branding-accent #1677ff für Active-State, abgerundete Cards mit shadow-Token, Header weiß mit subtilem backdrop-filter. * AntD-Theme-Tokens: colorPrimary #0EA5E9, fontSize 13, fontFamily 'Inter', controlHeight 34, borderRadius 6. * Layout-Komponenten neu strukturiert: AppLayout/Sidebar/Header matchen mailguard-Klassen-Naming (.app-layout, .main-content, .sidebar-section, .sidebar-menu-item.active, .header-left, …). * Sidebar mit 4 Sektionen (Übersicht / Routing / Netzwerk / System) + Logo-Header + Versions-Footer. Live-deployed auf 89.163.205.6: Networks-Endpoint listet eth0 (89.163.205.6/24, MAC bc:24:11:64:29:e8) + lo, frontend zeigt sie als System-Tags in der Networks-Page. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-09 16:08:44 +02:00
parent f0589e5628
commit ca03e69637
21 changed files with 4115 additions and 87 deletions
--- a/internal/handlers/ipaddresses.go
+++ b/internal/handlers/ipaddresses.go
@@ -0,0 +1,116 @@
+package handlers
+
+import (
+	"errors"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/ipaddresses"
+)
+
+type IPAddressesHandler struct {
+	Repo   *ipaddresses.Repo
+	Audit  *audit.Repo
+	NodeID string
+}
+
+func NewIPAddressesHandler(repo *ipaddresses.Repo, a *audit.Repo, nodeID string) *IPAddressesHandler {
+	return &IPAddressesHandler{Repo: repo, Audit: a, NodeID: nodeID}
+}
+
+func (h *IPAddressesHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/ip-addresses")
+	g.GET("", h.List)
+	g.POST("", h.Create)
+	g.GET("/:id", h.Get)
+	g.PUT("/:id", h.Update)
+	g.DELETE("/:id", h.Delete)
+}
+
+func (h *IPAddressesHandler) List(c *gin.Context) {
+	out, err := h.Repo.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"ip_addresses": out})
+}
+
+func (h *IPAddressesHandler) Get(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	x, err := h.Repo.Get(c.Request.Context(), id)
+	if err != nil {
+		if errors.Is(err, ipaddresses.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, x)
+}
+
+func (h *IPAddressesHandler) Create(c *gin.Context) {
+	var req models.IPAddress
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.Create(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.create",
+		req.Address, out, h.NodeID)
+	response.Created(c, out)
+}
+
+func (h *IPAddressesHandler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req models.IPAddress
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.Update(c.Request.Context(), id, req)
+	if err != nil {
+		if errors.Is(err, ipaddresses.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.update",
+		out.Address, out, h.NodeID)
+	response.OK(c, out)
+}
+
+func (h *IPAddressesHandler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.Repo.Delete(c.Request.Context(), id); err != nil {
+		if errors.Is(err, ipaddresses.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.delete",
+		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	response.NoContent(c)
+}
--- a/internal/handlers/networks.go
+++ b/internal/handlers/networks.go
@@ -0,0 +1,132 @@
+package handlers
+
+import (
+	"errors"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/ipaddresses"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/networkifs"
+)
+
+type NetworksHandler struct {
+	Repo     *networkifs.Repo
+	IPs      *ipaddresses.Repo
+	Audit    *audit.Repo
+	NodeID   string
+}
+
+func NewNetworksHandler(repo *networkifs.Repo, ips *ipaddresses.Repo, a *audit.Repo, nodeID string) *NetworksHandler {
+	return &NetworksHandler{Repo: repo, IPs: ips, Audit: a, NodeID: nodeID}
+}
+
+func (h *NetworksHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/network-interfaces")
+	g.GET("", h.List)
+	g.POST("", h.Create)
+	g.GET("/:id", h.Get)
+	g.PUT("/:id", h.Update)
+	g.DELETE("/:id", h.Delete)
+	g.GET("/:id/ip-addresses", h.ListIPs)
+}
+
+func (h *NetworksHandler) List(c *gin.Context) {
+	out, err := h.Repo.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"interfaces": out})
+}
+
+func (h *NetworksHandler) Get(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	x, err := h.Repo.Get(c.Request.Context(), id)
+	if err != nil {
+		if errors.Is(err, networkifs.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, x)
+}
+
+func (h *NetworksHandler) Create(c *gin.Context) {
+	var req models.NetworkInterface
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.Create(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.create", req.Name, out, h.NodeID)
+	response.Created(c, out)
+}
+
+func (h *NetworksHandler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req models.NetworkInterface
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.Update(c.Request.Context(), id, req)
+	if err != nil {
+		if errors.Is(err, networkifs.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.update", out.Name, out, h.NodeID)
+	response.OK(c, out)
+}
+
+func (h *NetworksHandler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.Repo.Delete(c.Request.Context(), id); err != nil {
+		if errors.Is(err, networkifs.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.delete",
+		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	response.NoContent(c)
+}
+
+// ListIPs surfaces the addresses bound to a single interface — UI
+// uses this for the per-interface IP-list tab.
+func (h *NetworksHandler) ListIPs(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	out, err := h.IPs.ListForInterface(c.Request.Context(), id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"ip_addresses": out})
+}
--- a/internal/handlers/system.go
+++ b/internal/handlers/system.go
@@ -2,6 +2,7 @@ package handlers

 import (
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -30,6 +31,7 @@ func (h *SystemHandler) Register(rg *gin.RouterGroup) {
 	g.GET("/health", h.Health)
 	g.GET("/package-versions", h.PackageVersions)
 	g.POST("/upgrade", h.Upgrade)
+	g.GET("/interfaces", h.Interfaces)
 }

 func (h *SystemHandler) Health(c *gin.Context) {
@@ -116,6 +118,108 @@ rm -f /tmp/edgeguard-upgrade.sh
 	})
 }

+// addrInfo + interfaceInfo mirror the relevant subset of `ip -j addr
+// show` so the frontend keeps its existing parsing code.
+type addrInfo struct {
+	Family    string `json:"family"` // "inet" | "inet6"
+	Local     string `json:"local"`
+	PrefixLen int    `json:"prefixlen"`
+}
+
+type interfaceInfo struct {
+	IfIndex  int        `json:"ifindex"`
+	IfName   string     `json:"ifname"`
+	Flags    []string   `json:"flags"`
+	MTU      int        `json:"mtu"`
+	LinkType string     `json:"link_type,omitempty"`
+	Address  string     `json:"address,omitempty"`
+	AddrInfo []addrInfo `json:"addr_info"`
+}
+
+// Interfaces enumerates the kernel-side network interfaces using
+// Go's net.Interfaces() — no shell-out, no AF_NETLINK exception
+// in the systemd hardening required (the original `ip -j addr`
+// approach was blocked by RestrictAddressFamilies).
+//
+// Output shape mirrors `ip -j addr show` enough for the UI's
+// Networks "system-discovered" card.
+func (h *SystemHandler) Interfaces(c *gin.Context) {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		slog.Warn("system/interfaces: net.Interfaces failed", "error", err)
+		response.OK(c, gin.H{"interfaces": []interfaceInfo{}})
+		return
+	}
+	out := make([]interfaceInfo, 0, len(ifaces))
+	for _, ifc := range ifaces {
+		info := interfaceInfo{
+			IfIndex:  ifc.Index,
+			IfName:   ifc.Name,
+			MTU:      ifc.MTU,
+			Address:  ifc.HardwareAddr.String(),
+			LinkType: classifyLinkType(ifc),
+			Flags:    flagsToList(ifc.Flags),
+			AddrInfo: []addrInfo{},
+		}
+		addrs, err := ifc.Addrs()
+		if err != nil {
+			out = append(out, info)
+			continue
+		}
+		for _, a := range addrs {
+			ipnet, ok := a.(*net.IPNet)
+			if !ok {
+				continue
+			}
+			family := "inet"
+			if ipnet.IP.To4() == nil {
+				family = "inet6"
+			}
+			ones, _ := ipnet.Mask.Size()
+			info.AddrInfo = append(info.AddrInfo, addrInfo{
+				Family:    family,
+				Local:     ipnet.IP.String(),
+				PrefixLen: ones,
+			})
+		}
+		out = append(out, info)
+	}
+	response.OK(c, gin.H{"interfaces": out})
+}
+
+func classifyLinkType(ifc net.Interface) string {
+	if ifc.Flags&net.FlagLoopback != 0 {
+		return "loopback"
+	}
+	if len(ifc.HardwareAddr) > 0 {
+		return "ether"
+	}
+	return ""
+}
+
+func flagsToList(f net.Flags) []string {
+	var out []string
+	if f&net.FlagUp != 0 {
+		out = append(out, "UP")
+	}
+	if f&net.FlagBroadcast != 0 {
+		out = append(out, "BROADCAST")
+	}
+	if f&net.FlagLoopback != 0 {
+		out = append(out, "LOOPBACK")
+	}
+	if f&net.FlagPointToPoint != 0 {
+		out = append(out, "POINTOPOINT")
+	}
+	if f&net.FlagMulticast != 0 {
+		out = append(out, "MULTICAST")
+	}
+	if f&net.FlagRunning != 0 {
+		out = append(out, "LOWER_UP")
+	}
+	return out
+}
+
 // parseAptPolicy extracts "Installed: x" and "Candidate: y" from
 // apt-cache policy output. Both can be "(none)"; we normalise that to
 // empty string.