pitchfork_cli/web/
server.rs

1use crate::Result;
2use crate::settings::settings;
3use axum::{
4    Router,
5    body::Body,
6    extract::Request,
7    http::StatusCode,
8    middleware::{self, Next},
9    response::{Redirect, Response},
10    routing::{get, post},
11};
12use std::net::SocketAddr;
13
14use super::routes;
15use super::static_files::{set_static_base, set_static_token, static_handler};
16
17/// API token middleware - rejects requests without valid X-Pitchfork-Token header
18/// when the server is bound to a non-loopback address and a token is configured.
19async fn token_auth(
20    request: Request<Body>,
21    next: Next,
22    expected_token: String,
23) -> Result<Response, StatusCode> {
24    if expected_token.is_empty() {
25        return Ok(next.run(request).await);
26    }
27    let token = request
28        .headers()
29        .get("X-Pitchfork-Token")
30        .and_then(|v| v.to_str().ok())
31        .unwrap_or("");
32    if token != expected_token {
33        let addr: std::borrow::Cow<'_, str> = request
34            .extensions()
35            .get::<axum::extract::ConnectInfo<SocketAddr>>()
36            .map(|a| a.0.to_string().into())
37            .unwrap_or_else(|| "unknown".into());
38        warn!(
39            "API request rejected: invalid or missing X-Pitchfork-Token from {} to {}",
40            addr,
41            request.uri()
42        );
43        return Err(StatusCode::UNAUTHORIZED);
44    }
45    Ok(next.run(request).await)
46}
47
48/// Check if an IP address is loopback (127.0.0.1 or ::1).
49fn is_loopback(addr: &str) -> bool {
50    addr.parse::<SocketAddr>()
51        .map(|a| a.ip().is_loopback())
52        .unwrap_or_else(|_| {
53            // Try parsing as just an IP without port
54            addr.parse::<std::net::IpAddr>()
55                .map(|ip| ip.is_loopback())
56                .unwrap_or(false)
57        })
58}
59/// Generate a random 32-byte hex token (64 characters).
60fn generate_token() -> String {
61    let a = uuid::Uuid::new_v4();
62    let b = uuid::Uuid::new_v4();
63    format!("{}{}", a.simple(), b.simple())
64}
65
66/// Build the API router (no CSRF - SPA uses JSON).
67fn api_router(token: String) -> Router {
68    let token_clone = token.clone();
69    Router::new()
70        .route("/api/stats", get(routes::api::stats::stats))
71        .route("/api/daemons", get(routes::api::daemons::list))
72        .route("/api/daemons/{id}", get(routes::api::daemons::show))
73        .route("/api/daemons/{id}/start", post(routes::api::daemons::start))
74        .route("/api/daemons/{id}/stop", post(routes::api::daemons::stop))
75        .route(
76            "/api/daemons/{id}/restart",
77            post(routes::api::daemons::restart),
78        )
79        .route(
80            "/api/daemons/{id}/enable",
81            post(routes::api::daemons::enable),
82        )
83        .route(
84            "/api/daemons/{id}/disable",
85            post(routes::api::daemons::disable),
86        )
87        .route("/api/logs/{id}/tail", get(routes::api::logs::tail))
88        .route("/api/namespaces", get(routes::api::namespaces::list))
89        .route("/api/namespaces", post(routes::api::namespaces::register))
90        .route(
91            "/api/namespaces/{name}",
92            axum::routing::delete(routes::api::namespaces::remove),
93        )
94        .route("/api/proxies", get(routes::api::proxies::list))
95        .route(
96            "/api/processes/{id}/tree",
97            get(routes::api::processes::tree),
98        )
99        .route("/logs/{id}/stream", get(routes::logs::stream_sse))
100        .layer(middleware::from_fn(move |req, next| {
101            let t = token_clone.clone();
102            async move { token_auth(req, next, t).await }
103        }))
104}
105
106/// Bind a `TcpListener` and return `(listener, actual_port)`, trying
107/// `port_attempts` ports starting from `port`.
108async fn try_bind(
109    bind_address: &str,
110    port: u16,
111    port_attempts: u16,
112) -> Result<(tokio::net::TcpListener, u16)> {
113    let ip_addr: std::net::IpAddr = bind_address
114        .parse()
115        .map_err(|e| miette::miette!("Invalid bind address '{}': {}", bind_address, e))?;
116
117    let mut last_error = None;
118    for offset in 0..port_attempts {
119        let try_port = port.saturating_add(offset);
120        let addr = SocketAddr::from((ip_addr, try_port));
121
122        match tokio::net::TcpListener::bind(addr).await {
123            Ok(listener) => {
124                let actual_port = listener
125                    .local_addr()
126                    .map_err(|e| miette::miette!("Failed to inspect bound port: {}", e))?;
127                return Ok((listener, actual_port.port()));
128            }
129            Err(e) => {
130                debug!("Port {try_port} unavailable: {e}");
131                last_error = Some(e);
132            }
133        }
134    }
135
136    Err(miette::miette!(
137        "Failed to bind: tried ports {}-{}, all in use. Last error: {}",
138        port,
139        port.saturating_add(port_attempts - 1),
140        last_error.map(|e| e.to_string()).unwrap_or_default()
141    ))
142}
143
144pub async fn serve(port: u16, web_path: Option<String>) -> Result<()> {
145    let base_path = super::normalize_base_path(web_path.as_deref())?;
146    super::BASE_PATH
147        .set(base_path.clone())
148        .expect("BASE_PATH already set; serve() must only be called once per process");
149    let s = settings();
150    let bind_address = &s.web.bind_address;
151    let port_attempts: u16 = u16::try_from(s.web.port_attempts)
152        .unwrap_or_else(|_| {
153            warn!(
154                "web.port_attempts value {} is out of range (1-65535), clamping to 10",
155                s.web.port_attempts
156            );
157            10
158        })
159        .max(1);
160
161    // Determine token: use configured token, or auto-generate one if binding to non-loopback
162    let mut token = s.api.token.clone();
163    if token.is_empty() && !is_loopback(bind_address) {
164        token = generate_token();
165        info!(
166            "Web UI bound to non-loopback address {}. Auto-generated API token: {}",
167            bind_address, token
168        );
169        // Also print to stderr so it's visible even with log level filtering
170        eprintln!("pitchfork API security token (auto-generated): {}", token);
171    }
172
173    set_static_token(token.clone());
174    set_static_base(base_path.clone());
175
176    let inner = api_router(token.clone()).fallback(static_handler);
177
178    let app = if base_path.is_empty() {
179        inner
180    } else {
181        let redirect_target = format!("{base_path}/");
182        Router::new()
183            .route(
184                "/",
185                get(move || async move { Redirect::temporary(&redirect_target) }),
186            )
187            .nest(&base_path, inner)
188    };
189
190    let (listener, actual_port) = try_bind(bind_address, port, port_attempts).await?;
191    let _ = super::WEB_PORT.set(actual_port);
192    let actual_addr = listener.local_addr().unwrap();
193
194    info!("Web UI listening on http://{actual_addr}");
195
196    axum::serve(listener, app)
197        .await
198        .map_err(|e| miette::miette!("Web server error: {}", e))
199}
200
201/// Serve the API on a dedicated port, separate from the web UI.
202/// Called by the supervisor when `settings.api.bind_port` is configured.
203pub async fn serve_api(port: u16, _web_path: Option<String>) -> Result<()> {
204    let s = settings();
205    let bind_address = &s.api.bind_address;
206    let port_attempts: u16 = u16::try_from(s.api.port_attempts)
207        .unwrap_or_else(|_| {
208            warn!(
209                "api.port_attempts value {} is out of range (1-65535), clamping to 10",
210                s.api.port_attempts
211            );
212            10
213        })
214        .max(1);
215
216    // Determine token for standalone API server
217    let mut token = s.api.token.clone();
218    if token.is_empty() && !is_loopback(bind_address) {
219        token = generate_token();
220        info!(
221            "API server bound to non-loopback address {}. Auto-generated API token: {}",
222            bind_address, token
223        );
224        eprintln!("pitchfork API security token (auto-generated): {}", token);
225    }
226
227    let app = api_router(token);
228
229    let (listener, _actual_port) = try_bind(bind_address, port, port_attempts).await?;
230    let actual_addr = listener.local_addr().unwrap();
231    info!("API server listening on http://{actual_addr}");
232
233    axum::serve(listener, app)
234        .await
235        .map_err(|e| miette::miette!("API server error: {}", e))
236}
pitchfork_cli/web/server.rs

pitchfork_cli/web/
server.rs
