first commit
This commit is contained in:
Mateusz Gruszczyński committed
commit
093e6a7c14
39 files changed
+1112
No files matched your search
@@ -0,0 +1,5 @@
|
||||
*.sh text eol=lf
|
||||
*.php text eol=lf
|
||||
*.xml text eol=lf
|
||||
*.volt text eol=lf
|
||||
Makefile text eol=lf
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
/dist/
|
||||
/.build/
|
||||
/.cache/
|
||||
/app/
|
||||
/opnsense-plugin/www/rustproxy/work/
|
||||
/opnsense-plugin/www/rustproxy/src/sbin/rust-proxy
|
||||
*.log
|
||||
*.key
|
||||
.env
|
||||
builder.env
|
||||
@@ -0,0 +1,66 @@
|
||||
# RustProxy OPNsense packaging repository
|
||||
|
||||
This repository contains only the OPNsense plugin and build/release automation. The RustProxy application source is **not vendored here**. The Debian scheduler downloads it dynamically from:
|
||||
|
||||
`https://git.linuxiarz.pl/gru/RustProxy`
|
||||
|
||||
## What is included
|
||||
|
||||
- `opnsense-plugin/www/rustproxy/` - OPNsense plugin source.
|
||||
- `builder/debian/` - hourly scheduler and optional cross-build helper.
|
||||
- `builder/freebsd/` - native FreeBSD release builder and repository signing helper.
|
||||
- `ci/build-release.sh` - Debian-to-FreeBSD orchestration and publishing.
|
||||
- `deploy/opnsense/` - custom package repository install/update helpers.
|
||||
- `docs/` - setup and architecture notes.
|
||||
|
||||
## Source/update flow
|
||||
|
||||
```text
|
||||
Packaging repository RustProxy upstream
|
||||
(plugin + scripts) https://git.linuxiarz.pl/gru/RustProxy
|
||||
| |
|
||||
+------------------+-------------------+
|
||||
v
|
||||
Debian cron, hourly
|
||||
|
|
||||
detects either commit change
|
||||
|
|
||||
v
|
||||
FreeBSD 15.1 amd64 builder
|
||||
|
|
||||
cargo test + cargo build
|
||||
|
|
||||
OPNsense make package
|
||||
|
|
||||
v
|
||||
signed pkg repository
|
||||
|
|
||||
v
|
||||
OPNsense
|
||||
```
|
||||
|
||||
By default `APP_REPO_REF=HEAD`, so every cron run follows the current default branch of the RustProxy repository. You can instead pin a branch/tag/ref in `/etc/rustproxy-opnsense-builder.env`.
|
||||
|
||||
A release rebuild is triggered when either the packaging repository commit or the RustProxy upstream commit changes. The package version is read at build time from the dynamically downloaded `Cargo.toml`.
|
||||
|
||||
## Recommended release build
|
||||
|
||||
Use the Debian VM only as scheduler/orchestrator and a FreeBSD 15.1 amd64 VM as compiler/packager. The included Docker/cross path (`BUILD_MODE=cross-binary`) is for development validation only and does not publish production `.pkg` files.
|
||||
|
||||
## Quick validation
|
||||
|
||||
```sh
|
||||
./scripts/check.sh
|
||||
```
|
||||
|
||||
## Quick setup
|
||||
|
||||
Read `docs/FIRST_RUN.md`, copy `builder.env.example` to `/etc/rustproxy-opnsense-builder.env` on Debian and fill in your packaging-repository, SSH and publication settings. `APP_REPO_URL` is already set to your RustProxy repository.
|
||||
|
||||
## OPNsense UI scope
|
||||
|
||||
The plugin currently exposes only Enabled / Disabled. RustProxy is supervised by FreeBSD `daemon(8)`, runs as user `rustproxy`, and uses `/var/db/rustproxy` as its private data directory.
|
||||
|
||||
## License
|
||||
|
||||
RustProxy's `Cargo.toml` currently does not declare a license and the supplied source snapshot did not contain LICENSE/COPYING, so the plugin manifest remains `UNKNOWN`. Set the correct license before public redistribution.
|
||||
@@ -0,0 +1,39 @@
|
||||
# This repository: OPNsense plugin + packaging/build scripts.
|
||||
# Push this generated repository to your own Git server and set its URL here.
|
||||
PACKAGING_REPO_URL=git@github.com:YOUR_ORG/rustproxy-opnsense.git
|
||||
PACKAGING_REPO_REF=main
|
||||
PACKAGING_WORKDIR=/srv/rustproxy-opnsense/packaging
|
||||
|
||||
# RustProxy application source. This is fetched independently on every cron run.
|
||||
APP_REPO_URL=https://git.linuxiarz.pl/gru/RustProxy
|
||||
# HEAD follows the default branch of the upstream repository. You can pin a branch,
|
||||
# tag or other fetchable ref instead, for example: main, stable, v0.21.0.
|
||||
APP_REPO_REF=HEAD
|
||||
APP_WORKDIR=/srv/rustproxy-opnsense/source/RustProxy
|
||||
|
||||
# Local Debian state.
|
||||
STATE_DIR=/var/lib/rustproxy-opnsense-builder
|
||||
|
||||
# Release builder. Use a FreeBSD 15.1 amd64 host for production packages.
|
||||
BUILD_MODE=native-freebsd
|
||||
FREEBSD_HOST=freebsd-builder.example.net
|
||||
FREEBSD_USER=builder
|
||||
FREEBSD_SSH_KEY=/root/.ssh/rustproxy_freebsd_builder
|
||||
FREEBSD_REMOTE_DIR=/usr/local/rustproxy-build/project
|
||||
|
||||
# OPNsense branch/ABI targeted by the plugin package.
|
||||
OPNSENSE_PLUGINS_REF=stable/26.7
|
||||
OPNSENSE_ABI=26.7
|
||||
|
||||
# Paths on the FreeBSD builder. Leave empty for an unsigned development repo.
|
||||
PKG_REPO_SIGN_KEY=/usr/local/rustproxy-build/keys/rustproxy-repo.key
|
||||
PKG_REPO_PUBLIC_KEY=/usr/local/rustproxy-build/keys/rustproxy-repo.pub
|
||||
|
||||
# Publish dist/ over SSH/rsync. This should be the document root for RustProxy packages.
|
||||
PUBLISH_TARGET=repo-user@packages.example.net:/srv/www/rustproxy/
|
||||
PUBLISH_SSH_KEY=/root/.ssh/rustproxy_package_publisher
|
||||
|
||||
# Optional automatic upgrade of explicitly listed TEST firewalls after a successful publish.
|
||||
# Disabled by default. Space-separated SSH targets, for example: root@fw-test-01 root@fw-test-02
|
||||
AUTO_DEPLOY_HOSTS=
|
||||
AUTO_DEPLOY_SSH_KEY=/root/.ssh/rustproxy_opnsense_test
|
||||
Executable
+27
@@ -0,0 +1,27 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
SOURCE_DIR="${RUSTPROXY_SOURCE_DIR:-$ROOT/app}"
|
||||
TARGET="x86_64-unknown-freebsd"
|
||||
|
||||
if [[ ! -f "$SOURCE_DIR/Cargo.toml" ]]; then
|
||||
echo "RustProxy source not found. Set RUSTPROXY_SOURCE_DIR to the dynamically fetched checkout." >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "Docker is required for cross mode." >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! command -v cross >/dev/null 2>&1; then
|
||||
echo "cross is not installed. Install it with: cargo install cross --locked" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd "$SOURCE_DIR"
|
||||
cross build --locked --release --target "$TARGET"
|
||||
mkdir -p "$ROOT/dist/cross/$TARGET"
|
||||
cp "target/$TARGET/release/rust-proxy" "$ROOT/dist/cross/$TARGET/rust-proxy"
|
||||
|
||||
echo "Cross-built binary: $ROOT/dist/cross/$TARGET/rust-proxy"
|
||||
echo "Do not publish this as the production OPNsense package without validation on the target FreeBSD ABI."
|
||||
Executable
+86
@@ -0,0 +1,86 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
CONFIG_FILE="${RUSTPROXY_BUILDER_CONFIG:-/etc/rustproxy-opnsense-builder.env}"
|
||||
if [[ ! -r "$CONFIG_FILE" ]]; then
|
||||
echo "Missing builder config: $CONFIG_FILE" >&2
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck disable=SC1090
|
||||
source "$CONFIG_FILE"
|
||||
|
||||
: "${PACKAGING_REPO_URL:?PACKAGING_REPO_URL is required}"
|
||||
: "${PACKAGING_REPO_REF:=main}"
|
||||
: "${PACKAGING_WORKDIR:=/srv/rustproxy-opnsense/packaging}"
|
||||
: "${APP_REPO_URL:=https://git.linuxiarz.pl/gru/RustProxy}"
|
||||
: "${APP_REPO_REF:=HEAD}"
|
||||
: "${APP_WORKDIR:=/srv/rustproxy-opnsense/source/RustProxy}"
|
||||
: "${STATE_DIR:=/var/lib/rustproxy-opnsense-builder}"
|
||||
|
||||
mkdir -p "$STATE_DIR" "$(dirname "$PACKAGING_WORKDIR")" "$(dirname "$APP_WORKDIR")"
|
||||
exec 9>"$STATE_DIR/build.lock"
|
||||
if ! flock -n 9; then
|
||||
echo "Another build is running; exiting."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
SYNC_COMMIT=""
|
||||
sync_checkout()
|
||||
{
|
||||
local dir="$1"
|
||||
local url="$2"
|
||||
local ref="$3"
|
||||
|
||||
if [[ ! -d "$dir/.git" ]]; then
|
||||
rm -rf "$dir"
|
||||
mkdir -p "$dir"
|
||||
git -C "$dir" init
|
||||
git -C "$dir" remote add origin "$url"
|
||||
else
|
||||
git -C "$dir" remote set-url origin "$url"
|
||||
fi
|
||||
|
||||
echo "Fetching $url ($ref)" >&2
|
||||
git -C "$dir" fetch --prune --tags origin "$ref" >&2
|
||||
SYNC_COMMIT="$(git -C "$dir" rev-parse FETCH_HEAD)"
|
||||
git -C "$dir" checkout --detach -f "$SYNC_COMMIT" >&2
|
||||
git -C "$dir" reset --hard "$SYNC_COMMIT" >&2
|
||||
git -C "$dir" clean -ffd >&2
|
||||
}
|
||||
|
||||
# Refresh the packaging repository first so the newest build logic is used.
|
||||
sync_checkout "$PACKAGING_WORKDIR" "$PACKAGING_REPO_URL" "$PACKAGING_REPO_REF"
|
||||
packaging_commit="$SYNC_COMMIT"
|
||||
|
||||
# RustProxy is intentionally NOT vendored in the packaging repository.
|
||||
# Fetch the application directly from its upstream repository every run.
|
||||
sync_checkout "$APP_WORKDIR" "$APP_REPO_URL" "$APP_REPO_REF"
|
||||
app_commit="$SYNC_COMMIT"
|
||||
app_revision="$(git -C "$APP_WORKDIR" rev-list --count "$app_commit")"
|
||||
|
||||
if [[ ! -f "$APP_WORKDIR/Cargo.toml" ]]; then
|
||||
echo "Upstream checkout does not contain Cargo.toml: $APP_WORKDIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
state_file="$STATE_DIR/last-successful-build"
|
||||
current_state="packaging=$packaging_commit app=$app_commit"
|
||||
last_state="$(cat "$state_file" 2>/dev/null || true)"
|
||||
|
||||
if [[ "$current_state" == "$last_state" ]]; then
|
||||
echo "No changes. packaging=$packaging_commit app=$app_commit"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Building RustProxy commit $app_commit (revision $app_revision)"
|
||||
echo "Using packaging commit $packaging_commit"
|
||||
|
||||
RUSTPROXY_SOURCE_DIR="$APP_WORKDIR" \
|
||||
RUSTPROXY_SOURCE_URL="$APP_REPO_URL" \
|
||||
RUSTPROXY_SOURCE_REF="$APP_REPO_REF" \
|
||||
RUSTPROXY_SOURCE_COMMIT="$app_commit" \
|
||||
RUSTPROXY_SOURCE_REVISION="$app_revision" \
|
||||
"$PACKAGING_WORKDIR/ci/build-release.sh"
|
||||
|
||||
printf '%s\n' "$current_state" > "$state_file"
|
||||
echo "Build completed: $current_state"
|
||||
Executable
+22
@@ -0,0 +1,22 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
if [[ ${EUID} -ne 0 ]]; then
|
||||
echo "Run as root" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y docker.io rustup build-essential pkg-config
|
||||
systemctl enable --now docker
|
||||
|
||||
TARGET_USER="${SUDO_USER:-root}"
|
||||
if [[ "$TARGET_USER" == "root" ]]; then
|
||||
rustup default stable
|
||||
cargo install cross --locked
|
||||
else
|
||||
sudo -u "$TARGET_USER" -H sh -c 'rustup default stable && cargo install cross --locked'
|
||||
fi
|
||||
|
||||
echo "Docker + rustup + cross installed for $TARGET_USER."
|
||||
echo "Use BUILD_MODE=cross-binary only for development validation."
|
||||
Executable
+29
@@ -0,0 +1,29 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
if [[ ${EUID} -ne 0 ]]; then
|
||||
echo "Run as root" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
|
||||
apt-get update
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y \
|
||||
ca-certificates cron git openssh-client rsync util-linux curl jq
|
||||
|
||||
install -d -m 0755 /srv/rustproxy-opnsense
|
||||
install -d -m 0755 /var/lib/rustproxy-opnsense-builder
|
||||
install -m 0755 "$REPO_ROOT/builder/debian/hourly-build.sh" /usr/local/sbin/rustproxy-opnsense-hourly
|
||||
install -m 0644 "$REPO_ROOT/builder/debian/rustproxy-opnsense.cron" /etc/cron.d/rustproxy-opnsense
|
||||
|
||||
if [[ ! -e /etc/rustproxy-opnsense-builder.env ]]; then
|
||||
install -m 0600 "$REPO_ROOT/builder.env.example" /etc/rustproxy-opnsense-builder.env
|
||||
echo "Created /etc/rustproxy-opnsense-builder.env. Edit it before the first cron run."
|
||||
fi
|
||||
|
||||
touch /var/log/rustproxy-opnsense-builder.log
|
||||
chmod 0640 /var/log/rustproxy-opnsense-builder.log
|
||||
systemctl enable --now cron
|
||||
|
||||
echo "Debian scheduler installed."
|
||||
@@ -0,0 +1,3 @@
|
||||
SHELL=/bin/bash
|
||||
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||||
17 * * * * root /usr/local/sbin/rustproxy-opnsense-hourly >> /var/log/rustproxy-opnsense-builder.log 2>&1
|
||||
Executable
+35
@@ -0,0 +1,35 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "Run as root" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BUILDER_USER="${1:-builder}"
|
||||
BUILDER_GROUP="$BUILDER_USER"
|
||||
|
||||
ASSUME_ALWAYS_YES=yes pkg bootstrap -f
|
||||
pkg update
|
||||
pkg install -y git rust python3 pkgconf cmake gmake perl5 rsync
|
||||
|
||||
if ! pw groupshow "$BUILDER_GROUP" >/dev/null 2>&1; then
|
||||
pw groupadd "$BUILDER_GROUP"
|
||||
fi
|
||||
if ! pw usershow "$BUILDER_USER" >/dev/null 2>&1; then
|
||||
pw useradd "$BUILDER_USER" -g "$BUILDER_GROUP" -m -s /bin/sh -c "RustProxy package builder"
|
||||
fi
|
||||
|
||||
install -d -o "$BUILDER_USER" -g "$BUILDER_GROUP" -m 0755 /usr/local/rustproxy-build
|
||||
install -d -o "$BUILDER_USER" -g "$BUILDER_GROUP" -m 0700 /usr/local/rustproxy-build/keys
|
||||
|
||||
echo "FreeBSD builder dependencies installed."
|
||||
echo "Builder account: $BUILDER_USER"
|
||||
echo "Add its SSH public key to /home/$BUILDER_USER/.ssh/authorized_keys."
|
||||
echo "Then log in as $BUILDER_USER and create the repository signing key."
|
||||
rust_version="$(rustc --version | awk '{print $2}')"
|
||||
if [ "$(pkg version -t "$rust_version" 1.88)" = "<" ]; then
|
||||
echo "RustProxy requires Rust >= 1.88, found $rust_version" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "Rust version OK: $rust_version"
|
||||
Executable
+108
@@ -0,0 +1,108 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
ROOT="${1:-$(pwd)}"
|
||||
APP_DIR="$ROOT/app"
|
||||
PLUGIN_SOURCE="$ROOT/opnsense-plugin/www/rustproxy"
|
||||
DIST_DIR="$ROOT/dist"
|
||||
CACHE_DIR="${RUSTPROXY_BUILD_CACHE:-$HOME/.cache/rustproxy-opnsense}"
|
||||
PLUGINS_DIR="$CACHE_DIR/opnsense-plugins"
|
||||
OPNSENSE_PLUGINS_REF="${OPNSENSE_PLUGINS_REF:-stable/26.7}"
|
||||
OPNSENSE_ABI="${OPNSENSE_ABI:-26.7}"
|
||||
SOURCE_REVISION="${SOURCE_REVISION:-0}"
|
||||
SOURCE_COMMIT="${RUSTPROXY_SOURCE_COMMIT:-unknown}"
|
||||
SOURCE_URL="${RUSTPROXY_SOURCE_URL:-https://git.linuxiarz.pl/gru/RustProxy}"
|
||||
SOURCE_REF="${RUSTPROXY_SOURCE_REF:-HEAD}"
|
||||
RUN_TESTS="${RUN_TESTS:-1}"
|
||||
|
||||
if [ "$(uname -s)" != "FreeBSD" ]; then
|
||||
echo "This release builder must run on FreeBSD." >&2
|
||||
exit 1
|
||||
fi
|
||||
case "$(uname -m)" in
|
||||
amd64|x86_64) ;;
|
||||
*) echo "Only amd64/x86_64 is supported by this pipeline." >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
for tool in cargo git make pkg rsync; do
|
||||
command -v "$tool" >/dev/null 2>&1 || { echo "Missing tool: $tool" >&2; exit 1; }
|
||||
done
|
||||
|
||||
rust_version="$(rustc --version | awk '{print $2}')"
|
||||
echo "Using rustc $rust_version on $(freebsd-version -ku | tr '\n' ' ')"
|
||||
|
||||
app_version="$(awk -F '"' '/^version = "/ {print $2; exit}' "$APP_DIR/Cargo.toml")"
|
||||
if [ -z "$app_version" ]; then
|
||||
echo "Cannot read app version from Cargo.toml" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$CACHE_DIR"
|
||||
if [ ! -d "$PLUGINS_DIR/.git" ]; then
|
||||
git clone https://github.com/opnsense/plugins.git "$PLUGINS_DIR"
|
||||
fi
|
||||
git -C "$PLUGINS_DIR" fetch --prune origin "$OPNSENSE_PLUGINS_REF"
|
||||
git -C "$PLUGINS_DIR" checkout -f -B rustproxy-build FETCH_HEAD
|
||||
git -C "$PLUGINS_DIR" clean -ffd
|
||||
|
||||
cd "$APP_DIR"
|
||||
if [ "$RUN_TESTS" = "1" ]; then
|
||||
cargo test --locked --release
|
||||
fi
|
||||
cargo build --locked --release
|
||||
|
||||
plugin_dir="$PLUGINS_DIR/www/rustproxy"
|
||||
rm -rf "$plugin_dir"
|
||||
cp -R "$PLUGIN_SOURCE" "$plugin_dir"
|
||||
mkdir -p "$plugin_dir/src/sbin"
|
||||
install -m 0555 "$APP_DIR/target/release/rust-proxy" "$plugin_dir/src/sbin/rust-proxy"
|
||||
|
||||
cd "$plugin_dir"
|
||||
make PLUGIN_VERSION="$app_version" PLUGIN_REVISION="$SOURCE_REVISION" PLUGIN_ABI="$OPNSENSE_ABI" package
|
||||
|
||||
package_file="$(find "$plugin_dir/work/pkg" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' | sort | tail -n 1)"
|
||||
if [ -z "$package_file" ] || [ ! -f "$package_file" ]; then
|
||||
echo "Package was not produced." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
repo_dir="$DIST_DIR/repository/$OPNSENSE_ABI/amd64"
|
||||
rm -rf "$DIST_DIR"
|
||||
mkdir -p "$repo_dir"
|
||||
cp "$package_file" "$repo_dir/"
|
||||
|
||||
if [ -n "${PKG_REPO_SIGN_KEY:-}" ]; then
|
||||
if [ ! -r "$PKG_REPO_SIGN_KEY" ]; then
|
||||
echo "Repository signing key is not readable: $PKG_REPO_SIGN_KEY" >&2
|
||||
exit 1
|
||||
fi
|
||||
pkg repo "$repo_dir" "$PKG_REPO_SIGN_KEY"
|
||||
else
|
||||
echo "WARNING: creating unsigned development repository" >&2
|
||||
pkg repo "$repo_dir"
|
||||
fi
|
||||
|
||||
if [ -n "${PKG_REPO_PUBLIC_KEY:-}" ]; then
|
||||
if [ ! -r "$PKG_REPO_PUBLIC_KEY" ]; then
|
||||
echo "Repository public key is not readable: $PKG_REPO_PUBLIC_KEY" >&2
|
||||
exit 1
|
||||
fi
|
||||
cp "$PKG_REPO_PUBLIC_KEY" "$DIST_DIR/rustproxy-repo.pub"
|
||||
fi
|
||||
|
||||
cat > "$DIST_DIR/BUILD-INFO.txt" <<INFO
|
||||
app_version=$app_version
|
||||
plugin_revision=$SOURCE_REVISION
|
||||
source_url=$SOURCE_URL
|
||||
source_ref=$SOURCE_REF
|
||||
source_commit=$SOURCE_COMMIT
|
||||
opnsense_plugins_ref=$OPNSENSE_PLUGINS_REF
|
||||
opnsense_abi=$OPNSENSE_ABI
|
||||
freebsd_kernel=$(freebsd-version -k)
|
||||
freebsd_userland=$(freebsd-version -u)
|
||||
rustc=$rust_version
|
||||
package=$(basename "$package_file")
|
||||
INFO
|
||||
|
||||
sha256 "$repo_dir/$(basename "$package_file")" > "$DIST_DIR/SHA256"
|
||||
echo "Release artifacts created in $DIST_DIR"
|
||||
Executable
+21
@@ -0,0 +1,21 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
KEY_DIR="${1:-/usr/local/rustproxy-build/keys}"
|
||||
KEY="$KEY_DIR/rustproxy-repo.key"
|
||||
PUB="$KEY_DIR/rustproxy-repo.pub"
|
||||
|
||||
umask 077
|
||||
mkdir -p "$KEY_DIR"
|
||||
if [ -e "$KEY" ] || [ -e "$PUB" ]; then
|
||||
echo "Key already exists in $KEY_DIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
openssl genrsa -out "$KEY" 2048
|
||||
chmod 0400 "$KEY"
|
||||
openssl rsa -in "$KEY" -out "$PUB" -pubout
|
||||
chmod 0444 "$PUB"
|
||||
|
||||
echo "Private key: $KEY"
|
||||
echo "Public key: $PUB"
|
||||
Executable
+120
@@ -0,0 +1,120 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
CONFIG_FILE="${RUSTPROXY_BUILDER_CONFIG:-/etc/rustproxy-opnsense-builder.env}"
|
||||
if [[ -r "$CONFIG_FILE" ]]; then
|
||||
# shellcheck disable=SC1090
|
||||
source "$CONFIG_FILE"
|
||||
fi
|
||||
|
||||
: "${BUILD_MODE:=native-freebsd}"
|
||||
: "${STATE_DIR:=/var/lib/rustproxy-opnsense-builder}"
|
||||
: "${OPNSENSE_PLUGINS_REF:=stable/26.7}"
|
||||
: "${OPNSENSE_ABI:=26.7}"
|
||||
: "${RUSTPROXY_SOURCE_DIR:?RUSTPROXY_SOURCE_DIR must point to a checked-out RustProxy repository}"
|
||||
: "${RUSTPROXY_SOURCE_URL:=https://git.linuxiarz.pl/gru/RustProxy}"
|
||||
: "${RUSTPROXY_SOURCE_REF:=HEAD}"
|
||||
: "${RUSTPROXY_SOURCE_COMMIT:=$(git -C "$RUSTPROXY_SOURCE_DIR" rev-parse HEAD)}"
|
||||
: "${RUSTPROXY_SOURCE_REVISION:=$(git -C "$RUSTPROXY_SOURCE_DIR" rev-list --count "$RUSTPROXY_SOURCE_COMMIT")}"
|
||||
|
||||
if [[ ! -f "$RUSTPROXY_SOURCE_DIR/Cargo.toml" ]]; then
|
||||
echo "RustProxy source directory is invalid: $RUSTPROXY_SOURCE_DIR" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
revision="$RUSTPROXY_SOURCE_REVISION"
|
||||
|
||||
safe_value()
|
||||
{
|
||||
[[ "$1" =~ ^[A-Za-z0-9_./:@+-]*$ ]]
|
||||
}
|
||||
|
||||
publish_dist()
|
||||
{
|
||||
if [[ -z "${PUBLISH_TARGET:-}" ]]; then
|
||||
echo "PUBLISH_TARGET is empty; artifacts remain in $ROOT/dist"
|
||||
return 0
|
||||
fi
|
||||
local ssh_cmd=(ssh)
|
||||
if [[ -n "${PUBLISH_SSH_KEY:-}" ]]; then
|
||||
ssh_cmd+=( -i "$PUBLISH_SSH_KEY" )
|
||||
fi
|
||||
rsync -az --delete-delay -e "${ssh_cmd[*]}" "$ROOT/dist/" "$PUBLISH_TARGET"
|
||||
}
|
||||
|
||||
auto_deploy_tests()
|
||||
{
|
||||
[[ -n "${AUTO_DEPLOY_HOSTS:-}" ]] || return 0
|
||||
for host in $AUTO_DEPLOY_HOSTS; do
|
||||
echo "Upgrading RustProxy on test firewall: $host"
|
||||
ssh_args=( -o BatchMode=yes )
|
||||
if [[ -n "${AUTO_DEPLOY_SSH_KEY:-}" ]]; then
|
||||
ssh_args+=( -i "$AUTO_DEPLOY_SSH_KEY" )
|
||||
fi
|
||||
ssh "${ssh_args[@]}" "$host" \
|
||||
'pkg update -f -r RustProxy && pkg install -y -r RustProxy os-rustproxy'
|
||||
done
|
||||
}
|
||||
|
||||
case "$BUILD_MODE" in
|
||||
native-freebsd)
|
||||
: "${FREEBSD_HOST:?FREEBSD_HOST is required}"
|
||||
: "${FREEBSD_USER:?FREEBSD_USER is required}"
|
||||
: "${FREEBSD_REMOTE_DIR:?FREEBSD_REMOTE_DIR is required}"
|
||||
for value in "$FREEBSD_HOST" "$FREEBSD_USER" "$FREEBSD_REMOTE_DIR" \
|
||||
"$OPNSENSE_PLUGINS_REF" "$OPNSENSE_ABI" \
|
||||
"${PKG_REPO_SIGN_KEY:-}" "${PKG_REPO_PUBLIC_KEY:-}" \
|
||||
"$RUSTPROXY_SOURCE_URL" "$RUSTPROXY_SOURCE_REF" \
|
||||
"$RUSTPROXY_SOURCE_COMMIT" "$revision"; do
|
||||
if ! safe_value "$value"; then
|
||||
echo "Unsafe character in builder configuration value: $value" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
ssh_args=( -o BatchMode=yes )
|
||||
if [[ -n "${FREEBSD_SSH_KEY:-}" ]]; then
|
||||
ssh_args+=( -i "$FREEBSD_SSH_KEY" )
|
||||
fi
|
||||
remote="${FREEBSD_USER}@${FREEBSD_HOST}"
|
||||
ssh "${ssh_args[@]}" "$remote" "mkdir -p '$FREEBSD_REMOTE_DIR' '$FREEBSD_REMOTE_DIR/app'"
|
||||
|
||||
# Send packaging/plugin sources separately from the application source.
|
||||
rsync -az --delete \
|
||||
--exclude .git/ --exclude app/ --exclude dist/ --exclude .cache/ \
|
||||
-e "ssh ${ssh_args[*]}" \
|
||||
"$ROOT/" "$remote:$FREEBSD_REMOTE_DIR/"
|
||||
|
||||
rsync -az --delete \
|
||||
--exclude .git/ --exclude target/ \
|
||||
-e "ssh ${ssh_args[*]}" \
|
||||
"$RUSTPROXY_SOURCE_DIR/" "$remote:$FREEBSD_REMOTE_DIR/app/"
|
||||
|
||||
remote_command="OPNSENSE_PLUGINS_REF=$OPNSENSE_PLUGINS_REF OPNSENSE_ABI=$OPNSENSE_ABI RUSTPROXY_SOURCE_URL=$RUSTPROXY_SOURCE_URL RUSTPROXY_SOURCE_REF=$RUSTPROXY_SOURCE_REF RUSTPROXY_SOURCE_COMMIT=$RUSTPROXY_SOURCE_COMMIT SOURCE_REVISION=$revision"
|
||||
if [[ -n "${PKG_REPO_SIGN_KEY:-}" ]]; then
|
||||
remote_command+=" PKG_REPO_SIGN_KEY=$PKG_REPO_SIGN_KEY"
|
||||
fi
|
||||
if [[ -n "${PKG_REPO_PUBLIC_KEY:-}" ]]; then
|
||||
remote_command+=" PKG_REPO_PUBLIC_KEY=$PKG_REPO_PUBLIC_KEY"
|
||||
fi
|
||||
remote_command+=" sh '$FREEBSD_REMOTE_DIR/builder/freebsd/build-release.sh' '$FREEBSD_REMOTE_DIR'"
|
||||
ssh "${ssh_args[@]}" "$remote" "$remote_command"
|
||||
|
||||
rm -rf "$ROOT/dist"
|
||||
mkdir -p "$ROOT/dist"
|
||||
rsync -az -e "ssh ${ssh_args[*]}" "$remote:$FREEBSD_REMOTE_DIR/dist/" "$ROOT/dist/"
|
||||
;;
|
||||
cross-binary)
|
||||
RUSTPROXY_SOURCE_DIR="$RUSTPROXY_SOURCE_DIR" "$ROOT/builder/debian/build-freebsd-cross.sh"
|
||||
echo "Cross mode builds a binary only and is not accepted as a release package pipeline."
|
||||
exit 0
|
||||
;;
|
||||
*)
|
||||
echo "Unknown BUILD_MODE: $BUILD_MODE" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
publish_dist
|
||||
auto_deploy_tests
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "Run as root on OPNsense" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REPO_URL="${1:-}"
|
||||
PUBLIC_KEY_FILE="${2:-}"
|
||||
|
||||
if [ -z "$REPO_URL" ] || [ -z "$PUBLIC_KEY_FILE" ]; then
|
||||
echo "usage: $0 https://packages.example.net/rustproxy/26.7/amd64 /path/to/rustproxy-repo.pub" >&2
|
||||
exit 64
|
||||
fi
|
||||
if [ ! -r "$PUBLIC_KEY_FILE" ]; then
|
||||
echo "Public key not readable: $PUBLIC_KEY_FILE" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
install -d -m 0755 /usr/local/etc/pkg/repos /usr/local/etc/pkg/keys
|
||||
install -m 0444 "$PUBLIC_KEY_FILE" /usr/local/etc/pkg/keys/rustproxy-repo.pub
|
||||
|
||||
cat > /usr/local/etc/pkg/repos/RustProxy.conf <<EOF_CONF
|
||||
RustProxy: {
|
||||
url: "$REPO_URL",
|
||||
enabled: yes,
|
||||
signature_type: "pubkey",
|
||||
pubkey: "/usr/local/etc/pkg/keys/rustproxy-repo.pub"
|
||||
}
|
||||
EOF_CONF
|
||||
|
||||
pkg update -f -r RustProxy
|
||||
pkg install -y -r RustProxy os-rustproxy
|
||||
|
||||
echo "RustProxy plugin installed. Open Services -> RustProxy in OPNsense."
|
||||
Executable
+6
@@ -0,0 +1,6 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
rm -f /usr/local/etc/pkg/repos/RustProxy.conf
|
||||
rm -f /usr/local/etc/pkg/keys/rustproxy-repo.pub
|
||||
pkg update -f
|
||||
Executable
+5
@@ -0,0 +1,5 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
|
||||
pkg update -f -r RustProxy
|
||||
pkg install -y -r RustProxy os-rustproxy
|
||||
@@ -0,0 +1,46 @@
|
||||
# Architecture
|
||||
|
||||
## Release path
|
||||
|
||||
1. Debian cron runs once per hour.
|
||||
2. It refreshes the packaging repository containing this plugin/build logic.
|
||||
3. Independently, it fetches `APP_REPO_REF` from `https://git.linuxiarz.pl/gru/RustProxy` into `APP_WORKDIR`.
|
||||
4. It compares both current commits with the last successful build state.
|
||||
5. If either commit changed, Debian rsyncs the packaging tree and the RustProxy checkout separately to a FreeBSD 15.1 amd64 builder.
|
||||
6. FreeBSD reads the application version from the downloaded `Cargo.toml`, runs Cargo tests and a release build.
|
||||
7. The binary is injected into `opnsense-plugin/www/rustproxy/src/sbin/rust-proxy` inside a clean checkout of the official OPNsense plugins tree.
|
||||
8. `make package` creates `os-rustproxy-<version>_<revision>.pkg`.
|
||||
9. `pkg repo` creates a signed package repository.
|
||||
10. Debian downloads `dist/` and optionally publishes it over rsync/SSH.
|
||||
11. OPNsense consumes only the custom RustProxy package repository.
|
||||
|
||||
The packaging repository deliberately contains no `app/` directory. This prevents stale application code from accidentally being packaged.
|
||||
|
||||
## Upstream selection
|
||||
|
||||
Default configuration:
|
||||
|
||||
```text
|
||||
APP_REPO_URL=https://git.linuxiarz.pl/gru/RustProxy
|
||||
APP_REPO_REF=HEAD
|
||||
```
|
||||
|
||||
`HEAD` follows the repository's default branch. To freeze releases, set `APP_REPO_REF` to a branch, tag or other fetchable ref. The exact commit used for each package is written to `dist/BUILD-INFO.txt`.
|
||||
|
||||
## Why native FreeBSD for releases
|
||||
|
||||
Rust can cross-compile to `x86_64-unknown-freebsd`, but a release also needs the target ABI and FreeBSD/OPNsense packaging behavior. A native FreeBSD builder makes both the Rust link step and `pkg` metadata/catalog generation match the target platform. The Docker/cross path is intended for fast developer validation only.
|
||||
|
||||
## OPNsense plugin behavior
|
||||
|
||||
The first UI version exposes only `general.enabled`.
|
||||
|
||||
- Enabled: the service controller renders configuration and starts RustProxy through configd.
|
||||
- Disabled: the service controller stops RustProxy.
|
||||
- Boot: an OPNsense syshook regenerates configuration and starts the service only when enabled.
|
||||
|
||||
RustProxy runs as the unprivileged `rustproxy` user. Its data is stored in `/var/db/rustproxy` and logs in `/var/log/rustproxy/rustproxy.log`.
|
||||
|
||||
## Ports 80 and 443
|
||||
|
||||
The MVP does not run RustProxy as root. Keep initial listeners above port 1023. If public 80/443 is required later, prefer an explicit PF redirect from 80/443 to high RustProxy listener ports instead of running the whole proxy as root.
|
||||
@@ -0,0 +1,109 @@
|
||||
# First run
|
||||
|
||||
## 1. Push this packaging repository
|
||||
|
||||
Create a repository for the generated OPNsense plugin/build files and push this tree there. RustProxy itself must not be copied into this repository; it will be fetched dynamically from:
|
||||
|
||||
```text
|
||||
https://git.linuxiarz.pl/gru/RustProxy
|
||||
```
|
||||
|
||||
After pushing, set that new repository address as `PACKAGING_REPO_URL` in the Debian configuration.
|
||||
|
||||
## 2. Prepare the FreeBSD release builder
|
||||
|
||||
Use FreeBSD 15.1 amd64.
|
||||
|
||||
```sh
|
||||
sudo sh builder/freebsd/bootstrap.sh builder
|
||||
sudo -u builder sh builder/freebsd/create-repo-key.sh
|
||||
```
|
||||
|
||||
The bootstrap creates a non-root `builder` account and gives it `/usr/local/rustproxy-build`.
|
||||
|
||||
## 3. Prepare Debian
|
||||
|
||||
From a checkout of this packaging repository:
|
||||
|
||||
```sh
|
||||
sudo bash builder/debian/install.sh
|
||||
sudo editor /etc/rustproxy-opnsense-builder.env
|
||||
```
|
||||
|
||||
At minimum configure:
|
||||
|
||||
```text
|
||||
PACKAGING_REPO_URL=<URL of this new packaging repository>
|
||||
PACKAGING_REPO_REF=main
|
||||
|
||||
APP_REPO_URL=https://git.linuxiarz.pl/gru/RustProxy
|
||||
APP_REPO_REF=HEAD
|
||||
|
||||
FREEBSD_HOST=<FreeBSD builder>
|
||||
FREEBSD_USER=builder
|
||||
FREEBSD_REMOTE_DIR=/usr/local/rustproxy-build/project
|
||||
```
|
||||
|
||||
`APP_REPO_REF=HEAD` means "build the current default branch". If you want controlled releases, change it to a specific branch or tag.
|
||||
|
||||
Run the first cycle manually:
|
||||
|
||||
```sh
|
||||
sudo /usr/local/sbin/rustproxy-opnsense-hourly
|
||||
```
|
||||
|
||||
Cron runs at minute 17 of every hour. Each run fetches the RustProxy upstream. A new build starts when either the upstream RustProxy commit or this packaging repository commit changed. A failed build does not update `last-successful-build`, so it is retried on the next run.
|
||||
|
||||
## 4. Build state
|
||||
|
||||
Debian stores checkouts separately:
|
||||
|
||||
```text
|
||||
/srv/rustproxy-opnsense/packaging/ # this repository
|
||||
/srv/rustproxy-opnsense/source/RustProxy # dynamically fetched app
|
||||
/var/lib/rustproxy-opnsense-builder/ # lock + last successful commit pair
|
||||
```
|
||||
|
||||
The FreeBSD build machine receives the two trees separately. Its temporary `$FREEBSD_REMOTE_DIR/app/` always comes from the upstream checkout, never from the packaging repository.
|
||||
|
||||
## 5. Publish `dist/`
|
||||
|
||||
Set `PUBLISH_TARGET`. The published layout is similar to:
|
||||
|
||||
```text
|
||||
/rustproxy/
|
||||
BUILD-INFO.txt
|
||||
SHA256
|
||||
rustproxy-repo.pub
|
||||
repository/
|
||||
26.7/
|
||||
amd64/
|
||||
os-rustproxy-<Cargo-version>_<revision>.pkg
|
||||
meta.conf
|
||||
data.pkg
|
||||
packagesite.pkg
|
||||
```
|
||||
|
||||
`BUILD-INFO.txt` contains the RustProxy source URL, ref and exact commit used to create the package.
|
||||
|
||||
## 6. Install on OPNsense
|
||||
|
||||
Copy `rustproxy-repo.pub` to the firewall and run:
|
||||
|
||||
```sh
|
||||
sh deploy/opnsense/install-repo.sh \
|
||||
https://packages.example.net/rustproxy/repository/26.7/amd64 \
|
||||
/tmp/rustproxy-repo.pub
|
||||
```
|
||||
|
||||
Then open `Services -> RustProxy`, enable it and click Apply.
|
||||
|
||||
## 7. Update
|
||||
|
||||
Publishing a new package does not automatically upgrade production firewalls. Run:
|
||||
|
||||
```sh
|
||||
sh deploy/opnsense/update.sh
|
||||
```
|
||||
|
||||
`AUTO_DEPLOY_HOSTS` exists only for explicitly listed test firewalls and is empty by default.
|
||||
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
|
||||
if ! /usr/sbin/pw groupshow rustproxy >/dev/null 2>&1; then
|
||||
/usr/sbin/pw groupadd rustproxy
|
||||
fi
|
||||
|
||||
if ! /usr/sbin/pw usershow rustproxy >/dev/null 2>&1; then
|
||||
/usr/sbin/pw useradd rustproxy -g rustproxy -c "RustProxy daemon" -d /var/db/rustproxy -s /usr/sbin/nologin
|
||||
fi
|
||||
|
||||
/usr/bin/install -d -o rustproxy -g rustproxy -m 0750 /var/db/rustproxy
|
||||
/usr/bin/install -d -o rustproxy -g rustproxy -m 0750 /var/log/rustproxy
|
||||
/usr/bin/install -d -o root -g wheel -m 0755 /usr/local/etc/rustproxy
|
||||
@@ -0,0 +1,4 @@
|
||||
#!/bin/sh
|
||||
|
||||
/usr/local/sbin/configctl rustproxy stop >/dev/null 2>&1 || true
|
||||
exit 0
|
||||
@@ -0,0 +1,9 @@
|
||||
PLUGIN_NAME= rustproxy
|
||||
PLUGIN_VERSION?= 0.20.0
|
||||
PLUGIN_REVISION?= 0
|
||||
PLUGIN_COMMENT= RustProxy reverse proxy service
|
||||
PLUGIN_MAINTAINER?= local@localhost
|
||||
PLUGIN_WWW?= https://example.invalid/rustproxy
|
||||
PLUGIN_LICENSE= UNKNOWN
|
||||
|
||||
.include "../../Mk/plugins.mk"
|
||||
@@ -0,0 +1,4 @@
|
||||
RustProxy packaged as an OPNsense plugin.
|
||||
|
||||
The initial OPNsense UI intentionally exposes only one setting: Enabled.
|
||||
Runtime proxy configuration remains managed by RustProxy itself.
|
||||
+45
@@ -0,0 +1,45 @@
|
||||
#!/bin/sh
|
||||
|
||||
# PROVIDE: rustproxy
|
||||
# REQUIRE: LOGIN NETWORKING
|
||||
# KEYWORD: shutdown
|
||||
|
||||
. /etc/rc.subr
|
||||
|
||||
name="rustproxy"
|
||||
rcvar="${name}_enable"
|
||||
|
||||
load_rc_config "$name"
|
||||
|
||||
: ${rustproxy_enable:="NO"}
|
||||
: ${rustproxy_user:="rustproxy"}
|
||||
: ${rustproxy_group:="rustproxy"}
|
||||
: ${rustproxy_data_dir:="/var/db/rustproxy"}
|
||||
: ${rustproxy_log_dir:="/var/log/rustproxy"}
|
||||
: ${rustproxy_log_file:="${rustproxy_log_dir}/rustproxy.log"}
|
||||
: ${rustproxy_command:="/usr/local/sbin/rust-proxy"}
|
||||
: ${rustproxy_restart_delay:="5"}
|
||||
|
||||
pidfile="/var/run/rustproxy-daemon.pid"
|
||||
child_pidfile="/var/run/rustproxy.pid"
|
||||
command="/usr/sbin/daemon"
|
||||
command_args="-r -R ${rustproxy_restart_delay} -P ${pidfile} -p ${child_pidfile} -u ${rustproxy_user} -o ${rustproxy_log_file} ${rustproxy_command} --data-dir ${rustproxy_data_dir} --update-check-interval-secs 0 serve"
|
||||
required_files="${rustproxy_command}"
|
||||
start_precmd="rustproxy_prestart"
|
||||
stop_postcmd="rustproxy_poststop"
|
||||
|
||||
rustproxy_prestart()
|
||||
{
|
||||
/usr/bin/install -d -o "${rustproxy_user}" -g "${rustproxy_group}" -m 0750 "${rustproxy_data_dir}"
|
||||
/usr/bin/install -d -o "${rustproxy_user}" -g "${rustproxy_group}" -m 0750 "${rustproxy_log_dir}"
|
||||
/usr/bin/touch "${rustproxy_log_file}"
|
||||
/usr/sbin/chown "${rustproxy_user}:${rustproxy_group}" "${rustproxy_log_file}"
|
||||
/bin/chmod 0640 "${rustproxy_log_file}"
|
||||
}
|
||||
|
||||
rustproxy_poststop()
|
||||
{
|
||||
/bin/rm -f "${child_pidfile}"
|
||||
}
|
||||
|
||||
run_rc_command "$1"
|
||||
@@ -0,0 +1,4 @@
|
||||
#!/bin/sh
|
||||
|
||||
/usr/local/sbin/configctl template reload OPNsense/RustProxy >/dev/null 2>&1 || true
|
||||
/usr/local/sbin/configctl rustproxy boot >/dev/null 2>&1 || true
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
<?php
|
||||
|
||||
namespace OPNsense\RustProxy\Api;
|
||||
|
||||
use OPNsense\Base\ApiMutableServiceControllerBase;
|
||||
|
||||
class ServiceController extends ApiMutableServiceControllerBase
|
||||
{
|
||||
protected static $internalServiceClass = '\\OPNsense\\RustProxy\\RustProxy';
|
||||
protected static $internalServiceTemplate = 'OPNsense/RustProxy';
|
||||
protected static $internalServiceEnabled = 'general.enabled';
|
||||
protected static $internalServiceName = 'rustproxy';
|
||||
|
||||
protected function reconfigureForceRestart()
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
+11
@@ -0,0 +1,11 @@
|
||||
<?php
|
||||
|
||||
namespace OPNsense\RustProxy\Api;
|
||||
|
||||
use OPNsense\Base\ApiMutableModelControllerBase;
|
||||
|
||||
class SettingsController extends ApiMutableModelControllerBase
|
||||
{
|
||||
protected static $internalModelClass = 'OPNsense\RustProxy\RustProxy';
|
||||
protected static $internalModelName = 'rustproxy';
|
||||
}
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
<?php
|
||||
|
||||
namespace OPNsense\RustProxy;
|
||||
|
||||
class IndexController extends \OPNsense\Base\IndexController
|
||||
{
|
||||
public function indexAction()
|
||||
{
|
||||
$this->view->generalForm = $this->getForm('general');
|
||||
$this->view->pick('OPNsense/RustProxy/index');
|
||||
}
|
||||
}
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
<form>
|
||||
<field>
|
||||
<id>rustproxy.general.enabled</id>
|
||||
<label>Enabled</label>
|
||||
<type>checkbox</type>
|
||||
<help>Start RustProxy and keep it enabled after OPNsense restarts.</help>
|
||||
</field>
|
||||
</form>
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
<acl>
|
||||
<page-services-rustproxy>
|
||||
<name>Services: RustProxy</name>
|
||||
<description>Allow access to RustProxy settings and service controls</description>
|
||||
<patterns>
|
||||
<pattern>ui/rustproxy/*</pattern>
|
||||
<pattern>api/rustproxy/*</pattern>
|
||||
</patterns>
|
||||
</page-services-rustproxy>
|
||||
</acl>
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
<menu>
|
||||
<Services>
|
||||
<RustProxy cssClass="fa fa-exchange fa-fw">
|
||||
<General VisibleName="General" order="10" url="/ui/rustproxy/"/>
|
||||
</RustProxy>
|
||||
</Services>
|
||||
</menu>
|
||||
+9
@@ -0,0 +1,9 @@
|
||||
<?php
|
||||
|
||||
namespace OPNsense\RustProxy;
|
||||
|
||||
use OPNsense\Base\BaseModel;
|
||||
|
||||
class RustProxy extends BaseModel
|
||||
{
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
<model>
|
||||
<mount>//OPNsense/rustproxy</mount>
|
||||
<version>1.0.0</version>
|
||||
<description>RustProxy service settings</description>
|
||||
<items>
|
||||
<general>
|
||||
<enabled type="BooleanField">
|
||||
<default>0</default>
|
||||
<Required>Y</Required>
|
||||
</enabled>
|
||||
</general>
|
||||
</items>
|
||||
</model>
|
||||
+43
@@ -0,0 +1,43 @@
|
||||
<script type="text/javascript">
|
||||
$(document).ready(function() {
|
||||
mapDataToFormUI({'frm_GeneralSettings': '/api/rustproxy/settings/get'}).done(function() {
|
||||
updateServiceControlUI('rustproxy');
|
||||
});
|
||||
|
||||
$('#reconfigureAct').SimpleActionButton({
|
||||
onPreAction: function() {
|
||||
const deferred = new $.Deferred();
|
||||
saveFormToEndpoint(
|
||||
'/api/rustproxy/settings/set',
|
||||
'frm_GeneralSettings',
|
||||
function() { deferred.resolve(); },
|
||||
true,
|
||||
function() { deferred.reject(); }
|
||||
);
|
||||
return deferred;
|
||||
},
|
||||
onAction: function() {
|
||||
updateServiceControlUI('rustproxy');
|
||||
}
|
||||
});
|
||||
});
|
||||
</script>
|
||||
|
||||
<section class="page-content-main">
|
||||
<div class="content-box">
|
||||
{{ partial("layout_partials/base_form", ['fields': generalForm, 'id': 'frm_GeneralSettings']) }}
|
||||
</div>
|
||||
<br/>
|
||||
<div class="content-box">
|
||||
<div class="col-md-12">
|
||||
<br/>
|
||||
<button class="btn btn-primary"
|
||||
id="reconfigureAct"
|
||||
data-endpoint="/api/rustproxy/service/reconfigure"
|
||||
data-label="{{ lang._('Apply') }}"
|
||||
data-error-title="{{ lang._('Error reconfiguring RustProxy') }}"
|
||||
type="button"></button>
|
||||
<br/><br/>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
@@ -0,0 +1,45 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -u
|
||||
|
||||
CONFIG_FILE="/usr/local/etc/rustproxy/opnsense.conf"
|
||||
RC_SCRIPT="/usr/local/etc/rc.d/rustproxy"
|
||||
enabled="0"
|
||||
|
||||
if [ -r "$CONFIG_FILE" ]; then
|
||||
. "$CONFIG_FILE"
|
||||
fi
|
||||
|
||||
start_service()
|
||||
{
|
||||
if [ "$enabled" != "1" ]; then
|
||||
echo "RustProxy is disabled in OPNsense configuration"
|
||||
return 0
|
||||
fi
|
||||
"$RC_SCRIPT" onestart
|
||||
}
|
||||
|
||||
stop_service()
|
||||
{
|
||||
"$RC_SCRIPT" onestop >/dev/null 2>&1 || true
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
start|boot)
|
||||
start_service
|
||||
;;
|
||||
stop)
|
||||
stop_service
|
||||
;;
|
||||
restart|reload)
|
||||
stop_service
|
||||
start_service
|
||||
;;
|
||||
status)
|
||||
"$RC_SCRIPT" status
|
||||
;;
|
||||
*)
|
||||
echo "usage: $0 {start|stop|restart|reload|status|boot}" >&2
|
||||
exit 64
|
||||
;;
|
||||
esac
|
||||
+35
@@ -0,0 +1,35 @@
|
||||
[start]
|
||||
command:/usr/local/opnsense/scripts/rustproxy/service.sh start
|
||||
parameters:
|
||||
type:script
|
||||
message:starting RustProxy
|
||||
|
||||
[stop]
|
||||
command:/usr/local/opnsense/scripts/rustproxy/service.sh stop
|
||||
parameters:
|
||||
type:script
|
||||
message:stopping RustProxy
|
||||
|
||||
[restart]
|
||||
command:/usr/local/opnsense/scripts/rustproxy/service.sh restart
|
||||
parameters:
|
||||
type:script
|
||||
message:restarting RustProxy
|
||||
|
||||
[reload]
|
||||
command:/usr/local/opnsense/scripts/rustproxy/service.sh restart
|
||||
parameters:
|
||||
type:script
|
||||
message:reloading RustProxy
|
||||
|
||||
[status]
|
||||
command:/usr/local/opnsense/scripts/rustproxy/service.sh status
|
||||
parameters:
|
||||
type:script_output
|
||||
message:RustProxy status
|
||||
|
||||
[boot]
|
||||
command:/usr/local/opnsense/scripts/rustproxy/service.sh boot
|
||||
parameters:
|
||||
type:script
|
||||
message:starting RustProxy at boot
|
||||
+1
@@ -0,0 +1 @@
|
||||
rustproxy.conf:/usr/local/etc/rustproxy/opnsense.conf
|
||||
+1
@@ -0,0 +1 @@
|
||||
enabled="{% if not helpers.empty('OPNsense.rustproxy.general.enabled') %}1{% else %}0{% endif %}"
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
|
||||
while IFS= read -r file; do
|
||||
first_line="$(head -n 1 "$file")"
|
||||
if [[ "$first_line" == *bash* ]]; then
|
||||
bash -n "$file"
|
||||
else
|
||||
sh -n "$file"
|
||||
fi
|
||||
done < <(find "$ROOT" -type f \( -name '*.sh' -o -path '*/src/etc/rc.d/rustproxy' -o -path '*/src/etc/rc.syshook.d/*.start' \))
|
||||
|
||||
python3 - "$ROOT" <<'PY'
|
||||
import pathlib
|
||||
import sys
|
||||
import xml.etree.ElementTree as ET
|
||||
root = pathlib.Path(sys.argv[1])
|
||||
for path in root.glob('opnsense-plugin/**/*.xml'):
|
||||
ET.parse(path)
|
||||
print('xml ok:', path.relative_to(root))
|
||||
PY
|
||||
|
||||
if command -v php >/dev/null 2>&1; then
|
||||
while IFS= read -r file; do php -l "$file" >/dev/null; done < <(find "$ROOT/opnsense-plugin" -type f -name '*.php')
|
||||
fi
|
||||
|
||||
if [[ -n "${RUSTPROXY_SOURCE_DIR:-}" ]] && [[ -f "$RUSTPROXY_SOURCE_DIR/Cargo.toml" ]] && command -v cargo >/dev/null 2>&1; then
|
||||
cargo metadata --locked --no-deps --format-version 1 --manifest-path "$RUSTPROXY_SOURCE_DIR/Cargo.toml" >/dev/null
|
||||
fi
|
||||
|
||||
if [[ -d "$ROOT/app" ]]; then
|
||||
echo "RustProxy source must not be vendored in this packaging repository: $ROOT/app" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -e "$ROOT/opnsense-plugin/www/rustproxy/src/sbin/rust-proxy" ]]; then
|
||||
echo "Generated binary must not be committed in plugin source." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Repository checks passed."
|
||||
Reference in new issue
Block a user