Kyle Isom
ed94548dfa
Extend the config, database schema, and server internals to support per-route L4/L7 mode selection and PROXY protocol fields. This is the foundation for L7 HTTP/2 reverse proxying and multi-hop PROXY protocol support described in the updated ARCHITECTURE.md. Config: Listener gains ProxyProtocol; Route gains Mode, TLSCert, TLSKey, BackendTLS, SendProxyProtocol. L7 routes validated at load time (cert/key pair must exist and parse). Mode defaults to "l4". DB: Migration v2 adds columns to listeners and routes tables. CRUD and seeding updated to persist all new fields. Server: RouteInfo replaces bare backend string in route lookup. handleConn dispatches on route.Mode (L7 path stubbed with error). ListenerState and ListenerData carry ProxyProtocol flag. All existing L4 tests pass unchanged. New tests cover migration v2, L7 field persistence, config validation for mode/cert/key, and proxy_protocol flag round-tripping. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
66 lines
1.8 KiB
Go
66 lines
1.8 KiB
Go
package db
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"git.wntrmute.dev/kyle/mc-proxy/internal/config"
|
|
)
|
|
|
|
// Seed populates the database from TOML config data. Only called when the
|
|
// database is empty (first run).
|
|
func (s *Store) Seed(listeners []config.Listener, fw config.Firewall) error {
|
|
tx, err := s.db.Begin()
|
|
if err != nil {
|
|
return fmt.Errorf("beginning seed transaction: %w", err)
|
|
}
|
|
defer tx.Rollback()
|
|
|
|
for _, l := range listeners {
|
|
result, err := tx.Exec(
|
|
"INSERT INTO listeners (addr, proxy_protocol) VALUES (?, ?)",
|
|
l.Addr, l.ProxyProtocol,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("seeding listener %q: %w", l.Addr, err)
|
|
}
|
|
listenerID, _ := result.LastInsertId()
|
|
|
|
for _, r := range l.Routes {
|
|
mode := r.Mode
|
|
if mode == "" {
|
|
mode = "l4"
|
|
}
|
|
_, err := tx.Exec(
|
|
`INSERT INTO routes (listener_id, hostname, backend, mode, tls_cert, tls_key, backend_tls, send_proxy_protocol)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
|
|
listenerID, strings.ToLower(r.Hostname), r.Backend,
|
|
mode, r.TLSCert, r.TLSKey, r.BackendTLS, r.SendProxyProtocol,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("seeding route %q on listener %q: %w", r.Hostname, l.Addr, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, ip := range fw.BlockedIPs {
|
|
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('ip', ?)", ip); err != nil {
|
|
return fmt.Errorf("seeding blocked IP %q: %w", ip, err)
|
|
}
|
|
}
|
|
|
|
for _, cidr := range fw.BlockedCIDRs {
|
|
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('cidr', ?)", cidr); err != nil {
|
|
return fmt.Errorf("seeding blocked CIDR %q: %w", cidr, err)
|
|
}
|
|
}
|
|
|
|
for _, code := range fw.BlockedCountries {
|
|
if _, err := tx.Exec("INSERT INTO firewall_rules (type, value) VALUES ('country', ?)", strings.ToUpper(code)); err != nil {
|
|
return fmt.Errorf("seeding blocked country %q: %w", code, err)
|
|
}
|
|
}
|
|
|
|
return tx.Commit()
|
|
}
|