misc: add schema for gateway

backend/src/ee/services/gateway-v2/gateway-v2-service.ts

@@ -200,6 +200,9 @@ export const gatewayV2ServiceFactory = ({
   const registerGateway = async ({ orgId, proxyName }: { orgId: string; actorId: string; proxyName: string }) => {
     const orgCAs = await $getOrgCAs(orgId);
 
+    // TODO: Save gateway to DB and set Gateway ID as principal in SSH certificate
+    // only throw error if proxy is different from existing DB record
+
     const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
     const gatewayServerCaCert = new x509.X509Certificate(orgCAs.gatewayServerCaCertificate);
     const rootGatewayCaCert = new x509.X509Certificate(orgCAs.rootGatewayCaCertificate);
@@ -248,12 +251,14 @@ export const gatewayV2ServiceFactory = ({
       extensions: gatewayServerCertExtensions
     });
 
-    const proxyCredentials = await proxyService.generateSshCredentialsForGateway({
+    const proxyCredentials = await proxyService.getCredentialsForGateway({
       proxyName,
       orgId
     });
 
     return {
+      // TODO: return gateway ID
+      proxyIp: proxyCredentials.proxyIp,
       pki: {
         serverCertificate: gatewayServerCertificate.toString("pem"),
         serverCertificateChain: constructPemChainFromCerts([gatewayServerCaCert, rootGatewayCaCert]),

backend/src/ee/services/proxy/proxy-service.ts

@@ -587,7 +587,7 @@ export const proxyServiceFactory = ({
     };
   };
 
-  const generateSshCredentialsForGateway = async ({ proxyName, orgId }: { proxyName: string; orgId: string }) => {
+  const getCredentialsForGateway = async ({ proxyName, orgId }: { proxyName: string; orgId: string }) => {
     let proxy: TProxies | null;
     if (isInstanceProxy(proxyName)) {
       proxy = await proxyDAL.findOne({
@@ -616,12 +616,13 @@ export const proxyServiceFactory = ({
         caPrivateKey: instanceCAs.instanceProxySshServerCaPrivateKey.toString("utf8"),
         clientPublicKey: proxyClientSshPublicKey,
         keyId: `proxy-client-${proxy.id}`,
-        principals: [orgId],
+        principals: ["gateway ID"], // TODO: set gateway ID as principal in SSH certificate
         certType: SshCertType.USER,
         requestedTtl: "30d"
       });
 
       return {
+        proxyIp: proxy.ip,
         clientSshCert: proxyClientSshCert.signedPublicKey,
         clientSshPrivateKey: proxyClientSshPrivateKey,
         serverCAPublicKey: instanceCAs.instanceProxySshServerCaPublicKey.toString("utf8")
@@ -639,6 +640,7 @@ export const proxyServiceFactory = ({
     });
 
     return {
+      proxyIp: proxy.ip,
       clientSshCert: proxyClientSshCert.signedPublicKey,
       clientSshPrivateKey: proxyClientSshPrivateKey,
       serverCAPublicKey: orgCAs.proxySshServerCaPublicKey.toString("utf8")
@@ -723,7 +725,7 @@ export const proxyServiceFactory = ({
       caPrivateKey: proxySshServerCaPrivateKey.toString("utf8"),
       clientPublicKey: proxyServerSshPublicKey,
       keyId: "proxy-server",
-      principals: [ip],
+      principals: [`${ip}:2222`],
       certType: SshCertType.HOST,
       requestedTtl: "30d"
     });
@@ -873,6 +875,6 @@ export const proxyServiceFactory = ({
 
   return {
     registerProxy,
-    generateSshCredentialsForGateway
+    getCredentialsForGateway
   };
 };