awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: add schema for gateway

Browse Source
This commit is contained in:
Sheen Capadngan
2025-08-28 18:21:51 +08:00
parent ae62c59382
commit 2fb13463bc
4 changed files with 37 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts
View File

@@ -104,6 +104,26 @@ export async function up(knex: Knex): Promise<void> {
await createOnUpdateTrigger(knex, TableName.Proxy);
}
if (!(await knex.schema.hasTable(TableName.GatewayV2))) {
await knex.schema.createTable(TableName.GatewayV2, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.timestamps(true, true, true);
t.uuid("orgId");
t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
t.uuid("identityId").unique();
t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
t.uuid("proxyId");
t.foreign("proxyId").references("id").inTable(TableName.Proxy).onDelete("CASCADE");
t.string("name").notNullable().unique();
});
await createOnUpdateTrigger(knex, TableName.GatewayV2);
}
}
export async function down(knex: Knex): Promise<void> {
@@ -118,4 +138,7 @@ export async function down(knex: Knex): Promise<void> {
await dropOnUpdateTrigger(knex, TableName.Proxy);
await knex.schema.dropTableIfExists(TableName.Proxy);
await dropOnUpdateTrigger(knex, TableName.GatewayV2);
await knex.schema.dropTableIfExists(TableName.GatewayV2);
}

3
backend/src/db/schemas/models.ts
View File

@@ -184,7 +184,8 @@ export enum TableName {
InstanceProxyConfig = "instance_proxy_config",
OrgProxyConfig = "org_proxy_config",
OrgGatewayConfigV2 = "org_gateway_config_v2",
Proxy = "proxies"
Proxy = "proxies",
GatewayV2 = "gateways_v2"
}
export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";

7
backend/src/ee/services/gateway-v2/gateway-v2-service.ts
View File

@@ -200,6 +200,9 @@ export const gatewayV2ServiceFactory = ({
const registerGateway = async ({ orgId, proxyName }: { orgId: string; actorId: string; proxyName: string }) => {
const orgCAs = await $getOrgCAs(orgId);
// TODO: Save gateway to DB and set Gateway ID as principal in SSH certificate
// only throw error if proxy is different from existing DB record
const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
const gatewayServerCaCert = new x509.X509Certificate(orgCAs.gatewayServerCaCertificate);
const rootGatewayCaCert = new x509.X509Certificate(orgCAs.rootGatewayCaCertificate);
@@ -248,12 +251,14 @@ export const gatewayV2ServiceFactory = ({
extensions: gatewayServerCertExtensions
});
const proxyCredentials = await proxyService.generateSshCredentialsForGateway({
const proxyCredentials = await proxyService.getCredentialsForGateway({
proxyName,
orgId
});
return {
// TODO: return gateway ID
proxyIp: proxyCredentials.proxyIp,
pki: {
serverCertificate: gatewayServerCertificate.toString("pem"),
serverCertificateChain: constructPemChainFromCerts([gatewayServerCaCert, rootGatewayCaCert]),

10
backend/src/ee/services/proxy/proxy-service.ts
View File

@@ -587,7 +587,7 @@ export const proxyServiceFactory = ({
};
};
const generateSshCredentialsForGateway = async ({ proxyName, orgId }: { proxyName: string; orgId: string }) => {
const getCredentialsForGateway = async ({ proxyName, orgId }: { proxyName: string; orgId: string }) => {
let proxy: TProxies | null;
if (isInstanceProxy(proxyName)) {
proxy = await proxyDAL.findOne({
@@ -616,12 +616,13 @@ export const proxyServiceFactory = ({
caPrivateKey: instanceCAs.instanceProxySshServerCaPrivateKey.toString("utf8"),
clientPublicKey: proxyClientSshPublicKey,
keyId: `proxy-client-${proxy.id}`,
principals: [orgId],
principals: ["gateway ID"], // TODO: set gateway ID as principal in SSH certificate
certType: SshCertType.USER,
requestedTtl: "30d"
});
return {
proxyIp: proxy.ip,
clientSshCert: proxyClientSshCert.signedPublicKey,
clientSshPrivateKey: proxyClientSshPrivateKey,
serverCAPublicKey: instanceCAs.instanceProxySshServerCaPublicKey.toString("utf8")
@@ -639,6 +640,7 @@ export const proxyServiceFactory = ({
});
return {
proxyIp: proxy.ip,
clientSshCert: proxyClientSshCert.signedPublicKey,
clientSshPrivateKey: proxyClientSshPrivateKey,
serverCAPublicKey: orgCAs.proxySshServerCaPublicKey.toString("utf8")
@@ -723,7 +725,7 @@ export const proxyServiceFactory = ({
caPrivateKey: proxySshServerCaPrivateKey.toString("utf8"),
clientPublicKey: proxyServerSshPublicKey,
keyId: "proxy-server",
principals: [ip],
principals: [`${ip}:2222`],
certType: SshCertType.HOST,
requestedTtl: "30d"
});
@@ -873,6 +875,6 @@ export const proxyServiceFactory = ({
return {
registerProxy,
generateSshCredentialsForGateway
getCredentialsForGateway
};
};