wmantly
e613874de5
Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13). WireGuard mesh client (signed, WSS-delivered): - wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new wireguard capability. Linux applies via wg-quick up/down; Windows installs the peer config as a WireGuardTunnel service via wireguard.exe (/installtunnelservice, /uninstalltunnelservice) - state polling in the home monitor drives the blue tray icon and auto-VPN: connect when away from home + auto_vpn, disconnect on return (2m cooldown) - tray VPN toggle and the auto-VPN checkbox are now live; the preference persists to agent.yml (PersistAutoVPN) IAM on Windows (iam_windows.go): - allowed_login_groups -> net localgroup; ssh_keys -> per-profile authorized_keys + %ProgramData%\ssh\administrators_authorized_keys; revoke_users -> helper logs off all of the user's WTS sessions; sudo_rules logged as no direct equivalent Tray enrichment: - Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items - set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands handled by the daemon (tray_server.go) Packaging & release: - installer/windows/installer.iss: fully-offline Inno Setup bundle (agent, tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist), /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray autostart, Users-writable %ProgramData%\Theta42 for the IPC socket - .github/workflows/build-windows.yml: build + test, pinned vendor downloads, ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach, optional SSO resource publish - agent.yml.example documents auto_vpn, wireguard, service_name, desktop_helper, public_ip_detect Tests: - wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN, ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf - end-to-end verified against a local mock SSO on Windows: join-key enrollment (token persisted, join key blanked), discovery/telemetry pushed, signed arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389; helper update swap verified Rebuilds all tracked dist binaries (v2.1.0).
58 lines
1.8 KiB
Go
58 lines
1.8 KiB
Go
package main
|
|
|
|
// Platform paths. Windows has no /etc, /run or /tmp, so the agent's
|
|
// filesystem touchpoints move under %ProgramData%\Theta42, which SYSTEM (the
|
|
// service) and authenticated users (the tray) can both reach.
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
)
|
|
|
|
// windowsDataDir returns %ProgramData%\Theta42.
|
|
func windowsDataDir() string {
|
|
pd := os.Getenv("ProgramData")
|
|
if pd == "" {
|
|
pd = `C:\ProgramData`
|
|
}
|
|
return filepath.Join(pd, "Theta42")
|
|
}
|
|
|
|
// defaultConfigPath returns the platform's agent.yml location.
|
|
func defaultConfigPath() string {
|
|
if runtime.GOOS == "windows" {
|
|
return filepath.Join(windowsDataDir(), "agent.yml")
|
|
}
|
|
return "/etc/theta42/agent.yml"
|
|
}
|
|
|
|
// defaultLdapSocketPath returns the local LDAP byte-pump socket. Windows has no
|
|
// AF_UNIX in a stable location that both service and clients share, so it
|
|
// relies on the TCP loopback listener (127.0.0.1:389) that ldapTunnel.start
|
|
// falls back to.
|
|
func defaultLdapSocketPath() string {
|
|
if runtime.GOOS == "windows" {
|
|
return ""
|
|
}
|
|
return "/run/theta/ldap.sock"
|
|
}
|
|
|
|
// windowsTraySocketPath returns the tray IPC socket path. It lives in the
|
|
// shared data dir (not the per-user temp dir) because the daemon runs as the
|
|
// SYSTEM service while the tray runs as the logged-in user; the installer
|
|
// grants Users write access to this directory and its children.
|
|
func windowsTraySocketPath() string {
|
|
return filepath.Join(windowsDataDir(), "tray.sock")
|
|
}
|
|
|
|
// defaultWireGuardConfPath returns where the pushed peer config is persisted.
|
|
// Linux uses /etc/wireguard so wg-quick finds it by interface name; Windows
|
|
// keeps it in the shared data dir next to the tray socket.
|
|
func defaultWireGuardConfPath(name string) string {
|
|
if runtime.GOOS == "windows" {
|
|
return filepath.Join(windowsDataDir(), "wg", name+".conf")
|
|
}
|
|
return filepath.Join("/etc/wireguard", name+".conf")
|
|
}
|