wmantly
e613874de5
Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13). WireGuard mesh client (signed, WSS-delivered): - wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new wireguard capability. Linux applies via wg-quick up/down; Windows installs the peer config as a WireGuardTunnel service via wireguard.exe (/installtunnelservice, /uninstalltunnelservice) - state polling in the home monitor drives the blue tray icon and auto-VPN: connect when away from home + auto_vpn, disconnect on return (2m cooldown) - tray VPN toggle and the auto-VPN checkbox are now live; the preference persists to agent.yml (PersistAutoVPN) IAM on Windows (iam_windows.go): - allowed_login_groups -> net localgroup; ssh_keys -> per-profile authorized_keys + %ProgramData%\ssh\administrators_authorized_keys; revoke_users -> helper logs off all of the user's WTS sessions; sudo_rules logged as no direct equivalent Tray enrichment: - Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items - set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands handled by the daemon (tray_server.go) Packaging & release: - installer/windows/installer.iss: fully-offline Inno Setup bundle (agent, tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist), /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray autostart, Users-writable %ProgramData%\Theta42 for the IPC socket - .github/workflows/build-windows.yml: build + test, pinned vendor downloads, ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach, optional SSO resource publish - agent.yml.example documents auto_vpn, wireguard, service_name, desktop_helper, public_ip_detect Tests: - wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN, ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf - end-to-end verified against a local mock SSO on Windows: join-key enrollment (token persisted, join key blanked), discovery/telemetry pushed, signed arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389; helper update swap verified Rebuilds all tracked dist binaries (v2.1.0).
66 lines
2.7 KiB
Go
66 lines
2.7 KiB
Go
package main
|
|
|
|
// PlatformOps abstracts the system operations the command dispatcher needs.
|
|
// Command dispatch, capability gating and Ed25519 verification are
|
|
// platform-neutral (websocket.go); the actual mechanics differ per OS:
|
|
//
|
|
// - linuxPlatformOps (platform_linuxops.go) — systemctl, journalctl, bash, ...
|
|
// - windowsPlatformOps (platform_windows.go) — sc.exe, powershell, the
|
|
// theta-agent-helper for session-0 ops and staged self-update.
|
|
//
|
|
// defaultPlatformOps is pinned at startup (runAgent) and swappable in tests so
|
|
// command dispatch can be exercised identically on any host.
|
|
|
|
type PlatformOps interface {
|
|
// Reboot restarts the host.
|
|
Reboot() ([]byte, error)
|
|
|
|
// Shutdown powers the host off.
|
|
Shutdown() ([]byte, error)
|
|
|
|
// FetchLogs returns the last `lines` log lines for a service.
|
|
FetchLogs(service string, lines int) ([]byte, error)
|
|
|
|
// ServiceControl runs an action (start/stop/restart/status/...) against a
|
|
// Windows service. Actions that don't map are executed best-effort.
|
|
ServiceControl(service, action string) ([]byte, error)
|
|
|
|
// RunScript executes an operator-supplied script (arbitrary_bash).
|
|
RunScript(script string) ([]byte, error)
|
|
|
|
// DesktopControl runs a desktop-control subaction (lock/logout/display/sleep)
|
|
// for a target user.
|
|
DesktopControl(subAction, targetUser string) ([]byte, error)
|
|
|
|
// ConfigureLDAP writes the pushed LDAP configuration. Linux configures
|
|
// SSSD; Windows manages logon via OpenCredential instead and declines.
|
|
ConfigureLDAP(configData string) error
|
|
|
|
// ApplyUpdate downloads, verifies and stages a new binary. The swap is
|
|
// platform-specific: Linux renames over the running binary, Windows writes
|
|
// a `.new` next to it and hands the swap to theta-agent-helper (the running
|
|
// exe is locked and the service must stop first).
|
|
ApplyUpdate(downloadURL, checksum string) error
|
|
|
|
// SelfRestart terminates the agent so a staged update takes effect. Linux
|
|
// exits; the Windows service handler stops itself (the helper restarts it).
|
|
SelfRestart()
|
|
|
|
// WireGuard mesh client (DESIGN-WINDOWS.md §5). ApplyWireGuard persists and
|
|
// brings up a peer tunnel; RemoveWireGuard tears it down; WireGuardState
|
|
// reports whether the tunnel is up; ConnectWireGuard/DisconnectWireGuard
|
|
// drive the tunnel from the persisted config (auto-VPN).
|
|
ApplyWireGuard(conf string) error
|
|
RemoveWireGuard() error
|
|
WireGuardState() (active bool)
|
|
ConnectWireGuard() error
|
|
DisconnectWireGuard() error
|
|
|
|
// ApplyIAM applies a verified node identity payload (DESIGN.md §6).
|
|
ApplyIAM(payload IAMPayload) error
|
|
}
|
|
|
|
// defaultPlatformOps is the ops implementation the command dispatcher uses.
|
|
// Pinned by runAgent after config load; tests override it directly.
|
|
var defaultPlatformOps = NewPlatformOps(&Config{}, &SystemExecutor{})
|