
# Dioad Connect

# Configuration
## TLS Configuration
Uses configuration definitions from github.co/dioad/net/tls

### Server Configuration

`server.yaml`
```
tls-server-config:
  cert: .local-dev/TestServerCertificate.pem
  key: .local-dev/TestServerCertificate.key
  client-ca-file: .local-dev/TestClientCertificateCA.pem
```


#### ACME/Let's Encrypt Support

`server.yaml`
```
tls-server-config:
  auto-cert-config:
    cache-directory: /etc/dioad/autocert
    email: someone@example.com
    allowed-hosts:
      - name.example.com
      - other.example.com
```

### Client Configuration

`agent.yaml`
```
tls-client-config:
  root-ca-file: .local-dev/TestServerCertificateCA.pem
  cert: .local-dev/TestClientCertificate.pem
  key: .local-dev/TestClientCertificate.key
```

## Examples
### Generate basic auth creds

Enter password with on command line
```
htpasswd -bnB -C 10 <username> <password>
```


Enter password with verification on command line
```
htpasswd -nB -C 10 <username>
```

Create htpasswd file
```
htpasswd -B -C 10 <passwordfile> <user>
```

### Agent Authentication
#### HMAC Shared Token

#### Github
`agent.yaml`
```
auth:
  github:
    access-token-file: /root/.config/dioad/connect/auth.yaml
```

Inline


Access Token File
```
token: e82b1ebeafe7ce6ca2661183c0624333f5cd7bd5
type: bearer
```
#### HTTP Basic Auth

### Echo service
`agent.yaml`
```
tunnels:
  - type: echo
    name: echo
    endpoint: https://connect.lab.dioad.net/reverse/tcp
    config:
      enable-prometheus-metrics: true
      debug: true
      tls-server-config:
        auto-cert-config:
          cache-directory: /path/to/.autocert
          email: someone@example.com
          allowed-hosts:
            - echo.foo-bar.traffic.lab.dioad.net
```

### Hello Service
`agent.yaml`
```
tunnels:
  - type: hello
    name: hello
    endpoint: https://connect.lab.dioad.net/reverse/tcp
    config:
      custom-message: "your message here"
      tls-server-config:
        auto-cert-config:
          cache-directory: /path/to/.autocert
          email: someone@example.com
          allowed-hosts:
            - hello.foo-bar.traffic.lab.dioad.net
```

### File Service
`agent.yaml`
```
tunnel:
  - type: file
    name: file
    endpoint: https://connect.lab.dioad.net/reverse/tcp
    config:
      enable-dynamic-prefix: true
      enable-prometheus-metrics: true
      debug: true
      tls-server-config:
        auto-cert-config:
          cache-directory: /path/to/.autocert
          email: someone@example.com
          allowed-hosts:
            - file.foo-bar.traffic.lab.dioad.net
      auth:
        basic:
          file: /path/to/htpasswd
```

### SSH through reverse tunnel
If you have a rever tunnel set up to forward to ssh, you can use `socat` or `stunnel` to route ssh connections over the tunnel. You can also use mutual TLS to secure these connections to the agent before sending SSH traffic over the tunnel.

`agent.yaml`
```
tunnel:
  - name: ssh
    type: tcp
    subdomain: ssh
    target-address: 127.0.0.1:22
    tls-config:
      autocert: true
```

`~/.ssh/config`
```
Host ssh.tradition-unwanted.local.lab.dioad.net
  ProxyCommand socat - OPENSSL:ssh.%h:9443,verify=0
```
