826cca39
feat: wire up CA and scanner in nono-proxy main
a73x 2026-03-29 16:42
Commit message
cmd/nono-proxy/main.go
| Old | New | ||
|---|---|---|---|
| @@ -7,16 +7,20 @@ import ( | |||
| 7 | "os" | 7 | "os" |
| 8 | "path/filepath" | 8 | "path/filepath" |
| 9 | 9 | ||
| 10 | "github.com/xanderle/nono/ca" | ||
| 10 | "github.com/xanderle/nono/proxy" | 11 | "github.com/xanderle/nono/proxy" |
| 12 | "github.com/xanderle/nono/scanner" | ||
| 11 | ) | 13 | ) |
| 12 | 14 | ||
| 13 | func main() { | 15 | func main() { |
| 16 | store := storePath() | ||
| 17 | |||
| 14 | if len(os.Args) > 1 && os.Args[1] == "allow" { | 18 | if len(os.Args) > 1 && os.Args[1] == "allow" { |
| 15 | if len(os.Args) < 3 { | 19 | if len(os.Args) < 3 { |
| 16 | fmt.Fprintln(os.Stderr, "usage: nono-proxy allow <host>") | 20 | fmt.Fprintln(os.Stderr, "usage: nono-proxy allow <host>") |
| 17 | os.Exit(1) | 21 | os.Exit(1) |
| 18 | } | 22 | } |
| 19 | hostsFile := approvedHostsPath() | 23 | hostsFile := filepath.Join(store, "approved_hosts") |
| 20 | if err := proxy.Allow(hostsFile, os.Args[2]); err != nil { | 24 | if err := proxy.Allow(hostsFile, os.Args[2]); err != nil { |
| 21 | log.Fatalf("failed to allow host: %v", err) | 25 | log.Fatalf("failed to allow host: %v", err) |
| 22 | } | 26 | } |
| @@ -25,20 +29,36 @@ func main() { | |||
| 25 | } | 29 | } |
| 26 | 30 | ||
| 27 | addr := ":9854" | 31 | addr := ":9854" |
| 28 | hostsFile := approvedHostsPath() | 32 | os.MkdirAll(store, 0755) |
| 33 | |||
| 34 | hostsFile := filepath.Join(store, "approved_hosts") | ||
| 35 | rulesPath := filepath.Join(store, "rules.yaml") | ||
| 36 | |||
| 37 | if err := scanner.WriteDefaultRules(rulesPath); err != nil { | ||
| 38 | log.Fatalf("failed to write default rules: %v", err) | ||
| 39 | } | ||
| 29 | 40 | ||
| 30 | os.MkdirAll(filepath.Dir(hostsFile), 0755) | 41 | caCert, caKey, err := ca.LoadOrCreate(store) |
| 42 | if err != nil { | ||
| 43 | log.Fatalf("failed to load/create CA: %v", err) | ||
| 44 | } | ||
| 45 | log.Printf("CA cert: %s/ca.pem", store) | ||
| 46 | |||
| 47 | opts := []proxy.Option{ | ||
| 48 | proxy.WithRules(rulesPath), | ||
| 49 | proxy.WithCA(caCert, caKey), | ||
| 50 | } | ||
| 31 | 51 | ||
| 32 | p := proxy.New(hostsFile) | 52 | p := proxy.New(hostsFile, opts...) |
| 33 | log.Printf("nono-proxy listening on %s (hosts: %s)", addr, hostsFile) | 53 | log.Printf("nono-proxy listening on %s (hosts: %s, rules: %s)", addr, hostsFile, rulesPath) |
| 34 | log.Fatal(http.ListenAndServe(addr, p)) | 54 | log.Fatal(http.ListenAndServe(addr, p)) |
| 35 | } | 55 | } |
| 36 | 56 | ||
| 37 | func approvedHostsPath() string { | 57 | func storePath() string { |
| 38 | store := os.Getenv("NONO_STORE") | 58 | store := os.Getenv("NONO_STORE") |
| 39 | if store == "" { | 59 | if store == "" { |
| 40 | home, _ := os.UserHomeDir() | 60 | home, _ := os.UserHomeDir() |
| 41 | store = filepath.Join(home, ".local", "share", "nono") | 61 | store = filepath.Join(home, ".local", "share", "nono") |
| 42 | } | 62 | } |
| 43 | return filepath.Join(store, "approved_hosts") | 63 | return store |
| 44 | } | 64 | } |