mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-02 07:34:45 +08:00
Drew Newberry
a67567e583
* fix(snap): require mTLS for the snap gateway Replace the installer opt-in with an authenticated snap gateway. The wrapper no longer forces plaintext, so the gateway serves TLS from the bundle it already generates in $SNAP_COMMON/tls. The install hook writes a config that enables mTLS user auth instead of unauthenticated access, and a new post-refresh hook migrates the exact legacy default on existing installs. install.sh waits for the gateway, detects whether it serves TLS, copies the client bundle into the target user's snap state directory, and registers the gateway over HTTPS. Older plaintext snap revisions still register over HTTP with a warning. The release canary asserts mTLS auth and HTTPS registration. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): pass config preflight and detect the mTLS gateway reliably An explicit [openshell.gateway.mtls_auth] table fails config preflight, which validates mTLS auth before the local TLS bundle supplies the client CA. Write a default that pins the Docker driver instead; with the wrapper's TLS bundle the gateway requires client certificates and enables mTLS user auth automatically, as the native packages do. The mTLS gateway rejects TLS handshakes without a client certificate, and it still answers plaintext loopback HTTP for sandbox service routing, so the installer could misdetect it as a legacy plaintext gateway. Probe HTTPS with the root-owned client bundle, and treat a gateway as legacy only when a plaintext gRPC Health call succeeds. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * chore(snap): simplify install hook comment Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): migrate insecure gateway configs on refresh Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(snap): simplify mTLS detection and config migration Detect the mTLS snap from the installed revision's post-refresh hook instead of probing plaintext gRPC, and drop the scheme global. Remove the installer's pre-hook config fallback, which is dead now that every channel ships the install hook and which wrote the insecure default. Give the install hook a single write path with a simple backup name, and shorten the manual client certificate steps. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): stop keeping a copy of replaced insecure configs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(install): make the snap an opt-in install method Stop selecting the OpenShell snap just because the snap command exists. Linux installs default to the Debian or RPM package; OPENSHELL_INSTALL_METHOD=snap (or deb, rpm) selects the package explicitly. Hosts that already have the OpenShell snap keep refreshing it rather than gaining a second gateway on the same port. The release canary and snap repro script opt in explicitly. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): let the gateway auto-detect its compute driver Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): restart the gateway after refresh Published revisions use refresh-mode: endure, and snapd honors the old revision's setting during a refresh, so the plaintext gateway kept running with the migrated config unused until a manual restart. Restart the gateway from the post-refresh hook so the mTLS config takes effect immediately. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(snap): drop refresh notes from the snap description Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(snap): trim snap refresh notes from installation docs Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
87 lines
3.1 KiB
Bash
Executable File
87 lines
3.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Snap wrapper for openshell-gateway. Sets snap-specific defaults:
|
|
# - OPENSHELL_DB_URL -> sqlite:$SNAP_COMMON/gateway.db (overridable)
|
|
# - OPENSHELL_LOCAL_TLS_DIR -> $SNAP_COMMON/tls (overridable)
|
|
# The gateway serves TLS from the generated bundle and requires client
|
|
# certificates. It bootstraps package-managed credentials and validates, but
|
|
# never creates or rewrites, an operator-provided config before starting.
|
|
|
|
set -eu
|
|
|
|
CANONICAL_CONFIG_FILE="${SNAP_COMMON}/gateway.toml"
|
|
export OPENSHELL_DB_URL="${OPENSHELL_DB_URL:-sqlite:${SNAP_COMMON}/gateway.db?mode=rwc}"
|
|
export OPENSHELL_LOCAL_TLS_DIR="${OPENSHELL_LOCAL_TLS_DIR:-${SNAP_COMMON}/tls}"
|
|
|
|
# Mirror clap's CLI-over-environment precedence so preflight always inspects
|
|
# the same file the daemon will load. Reject ambiguous duplicate selectors
|
|
# before either command runs.
|
|
cli_config=""
|
|
config_seen=false
|
|
expect_config_path=false
|
|
options_done=false
|
|
for argument in "$@"; do
|
|
if [ "$options_done" = true ]; then
|
|
continue
|
|
fi
|
|
if [ "$expect_config_path" = true ]; then
|
|
case "$argument" in
|
|
-*)
|
|
echo "openshell-gateway: --config requires a nonempty path" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
if [ "$config_seen" = true ]; then
|
|
echo "openshell-gateway: duplicate --config option" >&2
|
|
exit 2
|
|
fi
|
|
cli_config=$argument
|
|
config_seen=true
|
|
expect_config_path=false
|
|
continue
|
|
fi
|
|
case "$argument" in
|
|
--)
|
|
options_done=true
|
|
;;
|
|
--config)
|
|
expect_config_path=true
|
|
;;
|
|
--config=*)
|
|
if [ "$config_seen" = true ]; then
|
|
echo "openshell-gateway: duplicate --config option" >&2
|
|
exit 2
|
|
fi
|
|
cli_config=${argument#--config=}
|
|
config_seen=true
|
|
;;
|
|
esac
|
|
done
|
|
if [ "$expect_config_path" = true ] || { [ "$config_seen" = true ] && [ -z "$cli_config" ]; }; then
|
|
echo "openshell-gateway: --config requires a nonempty path" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# Generate the local TLS bundle and the JWT bundle used for launch-scoped
|
|
# supervisor credentials; generate-certs is idempotent and preserves an
|
|
# existing bundle.
|
|
"${SNAP}/bin/openshell-gateway" generate-certs \
|
|
--output-dir "$OPENSHELL_LOCAL_TLS_DIR" \
|
|
--server-san host.openshell.internal
|
|
|
|
if [ "$config_seen" = true ]; then
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" "$@"
|
|
elif [ -n "${OPENSHELL_GATEWAY_CONFIG:-}" ]; then
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" "$@"
|
|
elif [ -e "$CANONICAL_CONFIG_FILE" ] || [ -L "$CANONICAL_CONFIG_FILE" ]; then
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- --config "$CANONICAL_CONFIG_FILE" "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" --config "$CANONICAL_CONFIG_FILE" "$@"
|
|
else
|
|
"${SNAP}/bin/openshell-gateway" config preflight -- "$@"
|
|
exec "${SNAP}/bin/openshell-gateway" "$@"
|
|
fi
|