bergamot
731b60863a
Tunnel method now requires Bearer JWT (HMAC-HS256) in gRPC metadata.
- internal/auth: pure-stdlib verifier + issuer + revoked-jti list
- internal/tunnel: per-target rate limiter + egress allowlist with
wildcard support + crypto/rand frame padding to {1KB, 4KB, 16KB}
- cmd/server reads /etc/stats-gateway/{jwt.key,tunnel.yaml,revoked.txt}
via --config-dir flag
- cmd/issue-token Go binary wraps auth.Issue
- configs/tunnel.yaml example with projectshitpost wildcard
Tests: 13 PASS across 5 packages.
34 lines
669 B
Go
34 lines
669 B
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"flag"
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"time"
|
|
|
|
"github.com/bergabruh/stats-gateway/internal/auth"
|
|
)
|
|
|
|
func main() {
|
|
keyPath := flag.String("key", "/etc/stats-gateway/jwt.key", "path to HMAC secret key file")
|
|
subject := flag.String("sub", "", "client-id (required)")
|
|
days := flag.Int("days", 90, "token validity in days")
|
|
flag.Parse()
|
|
|
|
if *subject == "" {
|
|
log.Fatal("--sub required")
|
|
}
|
|
|
|
secret, err := os.ReadFile(*keyPath)
|
|
if err != nil {
|
|
log.Fatalf("read key: %v", err)
|
|
}
|
|
tok, err := auth.Issue(bytes.TrimSpace(secret), *subject, "tunnel", time.Duration(*days)*24*time.Hour)
|
|
if err != nil {
|
|
log.Fatal(err)
|
|
}
|
|
fmt.Println(tok)
|
|
}
|