71 lines
1.6 KiB
Go
71 lines
1.6 KiB
Go
package nginx
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/havline/havline/internal/config"
|
|
"github.com/havline/havline/internal/proxy"
|
|
)
|
|
|
|
// nginxHtpasswdHash normalizes bcrypt hashes for nginx/apr auth_basic.
|
|
// Go's bcrypt uses the $2a$ prefix; some nginx builds only accept $2y$.
|
|
func nginxHtpasswdHash(hash string) string {
|
|
if strings.HasPrefix(hash, "$2a$") {
|
|
return "$2y$" + hash[4:]
|
|
}
|
|
return hash
|
|
}
|
|
|
|
func HtpasswdDir(cfg config.Config) string {
|
|
return filepath.Join(cfg.NginxDir(), "htpasswd")
|
|
}
|
|
|
|
func HtpasswdPath(cfg config.Config, ruleID int64) string {
|
|
return filepath.Join(HtpasswdDir(cfg), fmt.Sprintf("rule_%d.conf", ruleID))
|
|
}
|
|
|
|
func SyncHtpasswdFiles(cfg config.Config, rules []proxy.Rule) error {
|
|
dir := HtpasswdDir(cfg)
|
|
if err := os.MkdirAll(dir, 0o755); err != nil {
|
|
return err
|
|
}
|
|
ensureNginxReadable(dir, true)
|
|
|
|
active := map[int64]bool{}
|
|
for _, rule := range rules {
|
|
path := HtpasswdPath(cfg, rule.ID)
|
|
if rule.Security.BasicAuthEnabled() {
|
|
active[rule.ID] = true
|
|
line := fmt.Sprintf("%s:%s\n", rule.Security.BasicAuth.Username, nginxHtpasswdHash(rule.Security.BasicAuth.PasswordHash))
|
|
if err := os.WriteFile(path, []byte(line), 0o644); err != nil {
|
|
return err
|
|
}
|
|
ensureNginxReadable(path, false)
|
|
}
|
|
}
|
|
|
|
entries, err := os.ReadDir(dir)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return nil
|
|
}
|
|
return err
|
|
}
|
|
for _, entry := range entries {
|
|
if entry.IsDir() {
|
|
continue
|
|
}
|
|
var id int64
|
|
if _, err := fmt.Sscanf(entry.Name(), "rule_%d.conf", &id); err != nil {
|
|
continue
|
|
}
|
|
if !active[id] {
|
|
_ = os.Remove(filepath.Join(dir, entry.Name()))
|
|
}
|
|
}
|
|
return nil
|
|
}
|