mirror of
https://github.com/versity/versitygw.git
synced 2026-02-04 01:12:03 +00:00
68d7924afa
Implements a web interface for VersityGW with role-based access: - Object explorer for all users to browse, upload, and download S3 objects - Admin dashboard showing system overview and gateway status - Admin-only user management for IAM user administration - Admin-only bucket management for creating and configuring S3 buckets - User authentication with automatic role-based page access The web UI is disabled by default and only enabled with the --webui or VGW_WEBUI_PORT env options that specify the listening address/port for the web UI server. This preserves previous version behavior to not enable any new ports/services unless opted in. Login to the web UI login page with accesskey/secretkey credentials as either user or admin account. UI functionality will auto detect login role. Regular users have access to the object explorer for managing files within their accessible buckets. Admins additionally have access to user and bucket management interfaces. The web UI is served on a separate port from the S3 server and integrates with existing S3 and Admin API endpoints. All requests to the S3 and Admin services are signed by the browser and sent directly to the S3/Admin service handlers. The login credentials are never sent over the network for security purposes. This requires the S3/Admin service to configure CORS Access-Control-Allow-Origin headers for these requests.
122 lines
3.4 KiB
Go
122 lines
3.4 KiB
Go
// Copyright 2023 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package s3api
|
|
|
|
import (
|
|
"crypto/tls"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
"github.com/gofiber/fiber/v2/middleware/logger"
|
|
"github.com/gofiber/fiber/v2/middleware/recover"
|
|
"github.com/versity/versitygw/auth"
|
|
"github.com/versity/versitygw/backend"
|
|
"github.com/versity/versitygw/debuglogger"
|
|
"github.com/versity/versitygw/s3api/controllers"
|
|
"github.com/versity/versitygw/s3api/middlewares"
|
|
"github.com/versity/versitygw/s3log"
|
|
)
|
|
|
|
type S3AdminServer struct {
|
|
app *fiber.App
|
|
backend backend.Backend
|
|
router *S3AdminRouter
|
|
port string
|
|
cert *tls.Certificate
|
|
quiet bool
|
|
debug bool
|
|
corsAllowOrigin string
|
|
}
|
|
|
|
func NewAdminServer(be backend.Backend, root middlewares.RootUserConfig, port, region string, iam auth.IAMService, l s3log.AuditLogger, ctrl controllers.S3ApiController, opts ...AdminOpt) *S3AdminServer {
|
|
server := &S3AdminServer{
|
|
backend: be,
|
|
router: &S3AdminRouter{
|
|
s3api: ctrl,
|
|
},
|
|
port: port,
|
|
}
|
|
|
|
for _, opt := range opts {
|
|
opt(server)
|
|
}
|
|
|
|
app := fiber.New(fiber.Config{
|
|
AppName: "versitygw",
|
|
ServerHeader: "VERSITYGW",
|
|
Network: fiber.NetworkTCP,
|
|
DisableStartupMessage: true,
|
|
ErrorHandler: globalErrorHandler,
|
|
})
|
|
|
|
server.app = app
|
|
|
|
app.Use(recover.New(
|
|
recover.Config{
|
|
EnableStackTrace: true,
|
|
StackTraceHandler: stackTraceHandler,
|
|
}))
|
|
|
|
// Logging middlewares
|
|
if !server.quiet {
|
|
app.Use(logger.New(logger.Config{
|
|
Format: "${time} | adm | ${status} | ${latency} | ${ip} | ${method} | ${path} | ${error} | ${queryParams}\n",
|
|
}))
|
|
}
|
|
app.Use(controllers.WrapMiddleware(middlewares.DecodeURL, l, nil))
|
|
|
|
// initialize the debug logger in debug mode
|
|
if debuglogger.IsDebugEnabled() {
|
|
app.Use(middlewares.DebugLogger())
|
|
}
|
|
|
|
server.router.Init(app, be, iam, l, root, region, server.debug, server.corsAllowOrigin)
|
|
|
|
return server
|
|
}
|
|
|
|
type AdminOpt func(s *S3AdminServer)
|
|
|
|
func WithAdminSrvTLS(cert tls.Certificate) AdminOpt {
|
|
return func(s *S3AdminServer) { s.cert = &cert }
|
|
}
|
|
|
|
// WithQuiet silences default logging output
|
|
func WithAdminQuiet() AdminOpt {
|
|
return func(s *S3AdminServer) { s.quiet = true }
|
|
}
|
|
|
|
// WithAdminDebug enables the debug logging
|
|
func WithAdminDebug() AdminOpt {
|
|
return func(s *S3AdminServer) { s.debug = true }
|
|
}
|
|
|
|
// WithAdminCORSAllowOrigin sets the default CORS Access-Control-Allow-Origin value
|
|
// for the standalone admin server.
|
|
func WithAdminCORSAllowOrigin(origin string) AdminOpt {
|
|
return func(s *S3AdminServer) { s.corsAllowOrigin = origin }
|
|
}
|
|
|
|
func (sa *S3AdminServer) Serve() (err error) {
|
|
if sa.cert != nil {
|
|
return sa.app.ListenTLSWithCertificate(sa.port, *sa.cert)
|
|
}
|
|
return sa.app.Listen(sa.port)
|
|
}
|
|
|
|
// ShutDown gracefully shuts down the server with a context timeout
|
|
func (sa S3AdminServer) Shutdown() error {
|
|
return sa.app.ShutdownWithTimeout(shutDownDuration)
|
|
}
|