# Dioad Connect

# Configuration

## Server Configuration

### Example
```yaml
log-level: trace

control-listen-address: 0.0.0.0:8119
management-listen-address: 0.0.0.0:5555
traffic-listen-address: 0.0.0.0:8443

default-agent-domain: local.lab.dioad.net

tls-server-config:
  cert: .local-dev/TestServerCertificate.pem
  key: .local-dev/TestServerCertificate.key
  client-ca-file: .local-dev/TestClientCertificateCA.pem

auth:
  github:
    client-id: abcdefghijk1234567890
    client-secret: aabbccddeeffgghhiijjkkllmmnnooppqqrrsstt

# agent-event-callback-url: https://127.0.0.1:8120


```

### Auth Support
Uses configuration definitions from `github.com/dioad/net/auth`

Provides support for authenticating agents

#### No Auth
If no `auth` block is present in the `server.yaml` file no authentication is required.
#### Basic Auth

##### Inline Specification
`server.yaml`

```yaml
auth:
  basic:
    users:
      - dummy:$2y$10$Xi5ZxfWOyXpCanRc/20Nzuc2jivfTd82dif/RliZ9WOPKyQPJRSbu
```

##### External Specification
You can specify external users using a `htpasswd` file.

This file can be managed using the `htpasswd` command that usually ships with https://httpd.apache.org

`server.yaml`

```yaml
auth:
  basic:
    htpasswd-file: .local-dev/htpasswd
```
#### HMAC Auth
`server.yaml`

##### Inline Specification
`server.yaml`
```yaml
auth:
  hmac:
    shared-key: "f91457f8-deadBeaf-11ea-8d00-93f9cfa8cc35"
    http-header: "X-Agent-ID"
```

##### External Specification
Requires implementation 
```yaml
auth:
  hmac:
    shared-key-path: "/etc/dioad/connect/auth.yaml"
    http-header: "X-Agent-ID"
```
### Other
```yaml
auth:
  hmac:
    allow-insecure-http: true
```
`allow-insecure-http` is a setting to enable if the auth procedure should still proceed even if the request is not using TLS. 

The intention for this is to be used in the case that TLS is either being terminated by an NLB or other ingress router and not directly
by the server service.

#### GitHub Auth
`server.yaml`

##### Inline Specification
```yaml
auth:
  github:
    client-id: "abcdefghijk1234567890"
    client-secret: "aabbccddeeffgghhiijjkkllmmnnooppqqrrsstt"
```

##### External Specification
```yaml
auth:
  github:
    config-file: /etc/dioad/connect/auth.yaml
```

#### User Access Control Lists
##### User Allow List
To only allow named Github users to authenticate
`server.yaml`

```yaml
auth:
  github:
    ...
    user-allow-list:
      - joeblogs
      - johndoe
```

##### User Deny List
To allow everyone except the named Github accounts

`server.yaml`

```yaml
auth:
  github:
    ...
    user-deny-list:
      - joeblogs
      - johndoe
```

### TLS Support
Uses configuration definitions from `github.com/dioad/net/tls`

Provides support for TLS for HTTP connections to the server.
#### Certificates on Disk

`server.yaml`

```yaml
tls-server-config:
  cert: .local-dev/TestServerCertificate.pem
  key: .local-dev/TestServerCertificate.key
  client-ca-file: .local-dev/TestClientCertificateCA.pem
```

#### ACME/Let's Encrypt Support

`server.yaml`

```yaml
tls-server-config:
  auto-cert-config:
    cache-directory: /etc/dioad/autocert
    email: someone@example.com
    allowed-hosts:
      - name.example.com
      - other.example.com
```



## Client Configuration

`agent.yaml`

```
tls-client-config:
  root-ca-file: .local-dev/TestServerCertificateCA.pem
  cert: .local-dev/TestClientCertificate.pem
  key: .local-dev/TestClientCertificate.key
```

## Examples

### Generate basic auth creds

Enter password with on command line

```
htpasswd -bnB -C 10 <username> <password>
```

Enter password with verification on command line

```
htpasswd -nB -C 10 <username>
```

Create htpasswd file

```
htpasswd -B -C 10 <passwordfile> <user>
```

### Agent Authentication

#### HMAC Shared Token

#### Github

`agent.yaml`

```
auth:
  github:
    access-token-file: /root/.config/dioad/connect/auth.yaml
```

Inline

Access Token File

```
token: e82b1ebeafe7ce6ca2661183c0624333f5cd7bd5
type: bearer
```

#### HTTP Basic Auth

### Echo service

`agent.yaml`

```
tunnels:
  - type: echo
    name: echo
    endpoint: https://connect.lab.dioad.net/reverse/tcp
    config:
      enable-prometheus-metrics: true
      debug: true
      tls-server-config:
        auto-cert-config:
          cache-directory: /path/to/.autocert
          email: someone@example.com
          allowed-hosts:
            - echo.foo-bar.traffic.lab.dioad.net
```

### Hello Service

`agent.yaml`

```
tunnels:
  - type: hello
    name: hello
    endpoint: https://connect.lab.dioad.net/reverse/tcp
    config:
      custom-message: "your message here"
      tls-server-config:
        auto-cert-config:
          cache-directory: /path/to/.autocert
          email: someone@example.com
          allowed-hosts:
            - hello.foo-bar.traffic.lab.dioad.net
```

### File Service

`agent.yaml`

```
tunnel:
  - type: file
    name: file
    endpoint: https://connect.lab.dioad.net/reverse/tcp
    config:
      enable-dynamic-prefix: true
      enable-prometheus-metrics: true
      debug: true
      tls-server-config:
        auto-cert-config:
          cache-directory: /path/to/.autocert
          email: someone@example.com
          allowed-hosts:
            - file.foo-bar.traffic.lab.dioad.net
      auth:
        basic:
          file: /path/to/htpasswd
```

### SSH through reverse tunnel

If you have a rever tunnel set up to forward to ssh, you can use `socat` or `stunnel` to route ssh connections over the
tunnel. You can also use mutual TLS to secure these connections to the agent before sending SSH traffic over the tunnel.

`agent.yaml`

```
tunnel:
  - name: ssh
    type: tcp
    subdomain: ssh
    target-address: 127.0.0.1:22
    tls-config:
      autocert: true
```

`~/.ssh/config`

```
Host ssh.tradition-unwanted.local.lab.dioad.net
  ProxyCommand socat - OPENSSL:ssh.%h:9443,verify=0
```
