eaa6a04234
cluster-init-replication: - listen_addresses = '*' damit Cluster-Peers PG auf :5432 erreichen können - max_replication_slots = 20 / max_wal_senders = 10 (verhindert Slot-Erschöpfung bei initaler Tabellen-Synchronisation mit vielen gleichzeitigen Sync-Workern) - pg-replication-secret: Ownership an edgeguard-User (API-Lesezugriff) - detectPGConfig() statt hardcoded PG 16 (System läuft PG 17) cluster-setup-standby: - syncMasterKey(): holt /var/lib/edgeguard/.master_key via mTLS vom Primary — ohne identischen Master-Key können replizierte WireGuard-Keys nicht entschlüsselt werden - render-config: sudo -u edgeguard statt als root (DB-Zugriff) nftables Template: - Port 5432 (PG) + 6379 (KeyDB) für Cluster-Peers (@peer_ipv4/@peer_ipv6) freigegeben handlers/cluster.go: - GET /agent/cluster/master-key: gibt .master_key via mTLS zurück (hex-kodiert) v1.2.15 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
110 lines
4.4 KiB
Go
110 lines
4.4 KiB
Go
// Command edgeguard-ctl is the admin CLI for setup, migrations and
|
|
// cluster ops. v1.2 implements PG streaming replication setup,
|
|
// VIP/Keepalived config and manual failover (promote).
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
|
|
)
|
|
|
|
var version = "1.2.15"
|
|
|
|
const usage = `edgeguard-ctl — EdgeGuard CLI
|
|
|
|
Usage:
|
|
edgeguard-ctl <command> [args]
|
|
|
|
Commands:
|
|
version Print version and exit
|
|
migrate up Apply pending migrations
|
|
migrate down Roll back the most recent migration (dev only)
|
|
migrate check Validate embedded migrations (no DB connect)
|
|
migrate dump [dir] Write embedded SQL files to dir (default: ./migrations)
|
|
initdb Create PostgreSQL role + database (idempotent)
|
|
render-config Regenerate all configs from PG (--no-reload, --only=svc)
|
|
Services: haproxy nftables squid wireguard unbound chrony keepalived
|
|
wg-import [--path <dir>] [iface…]
|
|
Import /etc/wireguard/*.conf files into the DB.
|
|
reset-password Generate a one-time token for the /reset-password UI flow
|
|
cluster-join <primary> --token <…>
|
|
Provision Cluster-TLS material; writes ca.crt + peer.{crt,key}
|
|
cluster-init-replication Richtet PG Logical Replication auf dem Primary ein.
|
|
Erstellt edgeguard_replicator-Rolle, setzt wal_level=logical,
|
|
erstellt PUBLICATION edgeguard_shared (alle geteilten Tabellen).
|
|
Auf dem Primary ausführen bevor der Secondary joined.
|
|
cluster-setup-standby <ip> Richtet diesen Node als Logical-Replication-Subscriber ein.
|
|
Erstellt SUBSCRIPTION gegen den Primary (Initialkopiierung
|
|
aller geteilten Tabellen). Node-eigene Daten (Interfaces,
|
|
IPs, Routen, VIP-Settings) bleiben unangetastet.
|
|
Voraussetzung: cluster-join + cluster-init-replication.
|
|
cluster-renew-self Re-issue this node's peer.{crt,key} using the local cluster CA.
|
|
promote Promote diesen PG-Standby zum Primary (manueller Failover).
|
|
Kein Auto-Promote — Split-Brain-Schutz durch manuelle Entscheidung.
|
|
dump-config Print effective config (Phase 3, not yet implemented)
|
|
`
|
|
|
|
func main() {
|
|
if len(os.Args) < 2 {
|
|
fmt.Fprint(os.Stderr, usage)
|
|
os.Exit(2)
|
|
}
|
|
switch os.Args[1] {
|
|
case "-h", "--help", "help":
|
|
fmt.Print(usage)
|
|
case "version", "--version":
|
|
fmt.Println(version)
|
|
case "migrate":
|
|
os.Exit(cmdMigrate(os.Args[2:]))
|
|
case "initdb":
|
|
os.Exit(cmdInitDB(os.Args[2:]))
|
|
case "render-config":
|
|
os.Exit(cmdRenderConfig(os.Args[2:]))
|
|
case "wg-import":
|
|
os.Exit(cmdWGImport(os.Args[2:]))
|
|
case "reset-password":
|
|
os.Exit(cmdResetPassword())
|
|
case "cluster-join":
|
|
os.Exit(cmdClusterJoin(os.Args[2:]))
|
|
case "cluster-renew-self":
|
|
os.Exit(cmdClusterRenewSelf(os.Args[2:]))
|
|
case "cluster-init-replication":
|
|
os.Exit(cmdClusterInitReplication(os.Args[2:]))
|
|
case "cluster-setup-standby":
|
|
os.Exit(cmdClusterSetupStandby(os.Args[2:]))
|
|
case "promote":
|
|
os.Exit(cmdPromote(os.Args[2:]))
|
|
case "cluster-leave", "dump-config":
|
|
fmt.Fprintf(os.Stderr, "edgeguard-ctl: %q is a Phase-3 stub — not yet implemented\n", os.Args[1])
|
|
os.Exit(1)
|
|
default:
|
|
fmt.Fprintf(os.Stderr, "edgeguard-ctl: unknown command %q\n", os.Args[1])
|
|
fmt.Fprint(os.Stderr, usage)
|
|
os.Exit(2)
|
|
}
|
|
}
|
|
|
|
// cmdResetPassword generates a single-use reset token and prints it to
|
|
// stdout. Operator pastes it into the /reset-password UI within 30 min.
|
|
// File mode 0600, owned by the edgeguard user — the CLI muss als sudo
|
|
// edgeguard ausgeführt werden (oder als root); fremde User sehen das
|
|
// Token nicht.
|
|
func cmdResetPassword() int {
|
|
store := setup.NewStore(setup.DefaultDir)
|
|
token, err := store.GenerateResetToken()
|
|
if err != nil {
|
|
fmt.Fprintf(os.Stderr, "edgeguard-ctl reset-password: %v\n", err)
|
|
return 1
|
|
}
|
|
fmt.Println("Admin-Password-Reset-Token (gültig 30 Minuten):")
|
|
fmt.Println()
|
|
fmt.Println(" " + token)
|
|
fmt.Println()
|
|
fmt.Println("→ UI öffnen: https://<box-fqdn>/reset-password")
|
|
fmt.Println("→ Token eingeben, neues Passwort setzen (min. 12 Zeichen)")
|
|
fmt.Println("→ Token ist single-use und wird beim erfolgreichen Reset gelöscht.")
|
|
return 0
|
|
}
|