bkupidura/dead-man-hand 0.4.0

on GitHub

READ BEFORE UPGRADE - BREAKING CHANGES

This release introduced breaking changes. Please read release notes before upgrading.

• When using DMH in docker container, ensure proper permissions for data directory (owner: 1000:1000). 0.4.0 image is non-root.
• Add authentication configuration to your config

docker container

Docker container now is running as 1000 user and not root. Please fix data directory permissions before upgrading.

Authentication

All dmh and vault HTTP endpoints are protected by bearer token authentication or signed url.

auth:
  bearer:
    token:
      - name: admin
        hash: 3508e4e2d9e4132482a50de623689a419230eff69dc7a8b6cc9562957be51587 
        scope:
          - api
      - name: vault
        hash: 330cc58d97a21f52dcff6b74c3f0db026b6653fe67816bc228b72bf88bf40688 # MUST MATCH bearer plain text in remote_vault
        scope:
          - api:vault:store:random-uuid-dont-copy
          - api:vault:alive:random-uuid-dont-copy
  signed_url:
    secret: "72abede41abd424d838f93a1508d7007278df6ab057d35e037bface291adae49" # random string `dmh-cli crypt generate-signed-secret`
    ttl: 24
  anonymous_scope:
    - ready
    - healtz
    - metrics
remote_vault:
  client_uuid: random-uuid-dont-copy
  url: http://127.0.0.1:8080
  token: 4YTclBnBxaoPnzXi_f55KaDgKa9mi2krlX7lNe0tztI # MUST MATCH bearer token for vault

bearer token can be generated with dmh-cli crypt generate-bearer. auth.bearer.token stores hashed values, software which will authenticate should use plain bearer.

vault endpoints are also protected, auth.bearer.token needs to match remote_vault.token to dmh is able to communicate with vault.
dmh is using /api/vault/store/<client_uuid_from_config> and /api/vault/alive/<client_uuid_from_config> vault endpoints and those scopes should be allowed.

Scope is endpoint path:

• api scope allows access to /api and /api/*.
• api:vault:store scope allows access to /api/vault/store and /api/vault/store/*

auth.anonymous_scope disabled authentication for specified endpoints. Useful for metrics, healtchecks etc.

If you need to disable authentication complety add to config auth.enabled: false.

/alive vs /api/alive endpoint

0.4.0 introduces /alive endpoint, this endpoint should be used manualy by user (not by computers). Under alive there is simple html webpage which 'alive' button, which needs to be clicked. It should be signed by signer url authentication.
If you are using action to send alive reminders, you can use message like Please confirm you are still alive, https://dmh.domain/{sig_auth:alive}. On every action execution dmh will generate valid authentication for specified url.

/api/alive is still available and should be used by anything else than human (automations, scripts, tools, ...), requests should be authenticated with valid bearer token.

{sig_auth:path} template

Any data action field can contain {sig_auth:<page>} placeholders, eg. {sig_auth:alive}. When the action runs, DMH replaces the placeholder with a time-limited signed URL for <page>, so a mail/sms message can include a pre-authenticated link without exposing a permanent bearer token.

exec plugin

New exec plugin introduced. It allows to execute any local command.

Documentation

For more information about changes please check wiki documentation.

What's Changed

• Initial auth implementation by @bkupidura in #29
• Tests cleanup by @bkupidura in #30
• Add auth to AWS lambda vault implementation by @bkupidura in #31
• Add human friendly /alive endpoint by @bkupidura in #32
• Add signed url auth. by @bkupidura in #33
• Enable signed url, add {sig_auth:} template by @bkupidura in #34
• Sigauth template by @bkupidura in #35
• Code maintenance by @bkupidura in #36
• Extend cli with crypto subcommands (bearer, signer url) by @bkupidura in #37
• Post on /api/alive is needed as some software is able to sent only POST by @bkupidura in #38
• Config cleanup by @bkupidura in #39
• Add HTTP logger by @bkupidura in #40
• Add http prometheus metrics: by @bkupidura in #41
• Change .save() from log.Panicf to log.Fatalf by @bkupidura in #42
• Ensure dmh is running non-root inside docker by @bkupidura in #43
• Use HEAD by metric.go to check if secret is available by @bkupidura in #44
• Extend integration test by @bkupidura in #45
• Chi cleanup by @bkupidura in #46
• Startup validation by @bkupidura in #47
• Exec plugin by @bkupidura in #48
• Rework cli tests by @bkupidura in #49

Full Changelog: 0.3.5...0.4.0