mirror of
https://github.com/fosrl/pangolin.git
synced 2026-10-21 20:19:07 +02:00
Merge branch 'dev' into feat/redirect-tables
This commit is contained in:
miloschwartz
@@ -38,6 +38,9 @@
|
||||
"Mac16,7": "MacBook Pro",
|
||||
"Mac16,8": "MacBook Pro",
|
||||
"Mac16,9": "Mac Studio",
|
||||
"Mac17,14": "Mac Studio",
|
||||
"Mac17,15": "Mac Studio",
|
||||
"Mac17,16": "Mac mini",
|
||||
"Mac17,2": "MacBook Pro",
|
||||
"Mac17,3": "MacBook Air",
|
||||
"Mac17,4": "MacBook Air",
|
||||
@@ -46,6 +49,7 @@
|
||||
"Mac17,7": "MacBook Pro",
|
||||
"Mac17,8": "MacBook Pro",
|
||||
"Mac17,9": "MacBook Pro",
|
||||
"Mac18,5": "Mac mini",
|
||||
"MacBook1,1": "MacBook",
|
||||
"MacBook10,1": "MacBook",
|
||||
"MacBook2,1": "MacBook",
|
||||
@@ -173,7 +177,7 @@
|
||||
"PowerMac12,1": "iMac",
|
||||
"PowerMac2,1": "iMac",
|
||||
"PowerMac2,2": "iMac",
|
||||
"PowerMac3,1": "Mac Server",
|
||||
"PowerMac3,1": "Power Macintosh",
|
||||
"PowerMac3,3": "Power Macintosh",
|
||||
"PowerMac3,4": "Power Macintosh",
|
||||
"PowerMac3,5": "Power Macintosh",
|
||||
@@ -232,4 +236,4 @@
|
||||
"iMac8,1": "iMac",
|
||||
"iMac9,1": "iMac",
|
||||
"iMacPro1,1": "iMac Pro"
|
||||
}
|
||||
}
|
||||
@@ -78,7 +78,8 @@ export const orgs = pgTable("orgs", {
|
||||
"settingsEnableGlobalNewtAutoUpdate"
|
||||
)
|
||||
.notNull()
|
||||
.default(false)
|
||||
.default(false),
|
||||
settingsJitModeLimit: integer("settingsJitModeLimit").notNull().default(250)
|
||||
});
|
||||
|
||||
export const orgDomains = pgTable("orgDomains", {
|
||||
@@ -180,6 +181,10 @@ export const resources = pgTable(
|
||||
applyRules: boolean("applyRules"),
|
||||
enabled: boolean("enabled").notNull().default(true),
|
||||
stickySession: boolean("stickySession").notNull().default(false),
|
||||
loadBalancingStrategy: varchar("loadBalancingStrategy", { length: 32 })
|
||||
.$type<"wrr" | "p2c" | "hrw" | "leasttime">()
|
||||
.notNull()
|
||||
.default("wrr"), // traefik http loadBalancer.strategy
|
||||
tlsServerName: varchar("tlsServerName"),
|
||||
setHostHeader: varchar("setHostHeader"),
|
||||
enableProxy: boolean("enableProxy").default(true),
|
||||
@@ -199,6 +204,7 @@ export const resources = pgTable(
|
||||
maintenanceTitle: text("maintenanceTitle"),
|
||||
maintenanceMessage: text("maintenanceMessage"),
|
||||
maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
|
||||
mtlsEnabled: boolean("mtlsEnabled").notNull().default(false),
|
||||
postAuthPath: text("postAuthPath"),
|
||||
health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
|
||||
wildcard: boolean("wildcard").notNull().default(false),
|
||||
@@ -494,6 +500,7 @@ export const exitNodes = pgTable("exitNodes", {
|
||||
endpoint: varchar("endpoint").notNull(),
|
||||
publicKey: varchar("publicKey").notNull(),
|
||||
listenPort: integer("listenPort").notNull(),
|
||||
relayPort: integer("relayPort").notNull(),
|
||||
reachableAt: varchar("reachableAt"),
|
||||
maxConnections: integer("maxConnections"),
|
||||
online: boolean("online").notNull().default(false),
|
||||
@@ -526,8 +533,8 @@ export const siteResources = pgTable(
|
||||
name: varchar("name").notNull(),
|
||||
ssl: boolean("ssl").notNull().default(false),
|
||||
mode: varchar("mode")
|
||||
.$type<"host" | "cidr" | "http" | "ssh" | "inference">()
|
||||
.notNull(), // "host" | "cidr" | "http"
|
||||
.$type<"host" | "cidr" | "http" | "ssh" | "inference" | "gateway">()
|
||||
.notNull(),
|
||||
scheme: varchar("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
|
||||
proxyPort: integer("proxyPort"), // only for port mode
|
||||
destinationPort: integer("destinationPort"), // only for port mode
|
||||
@@ -841,6 +848,27 @@ export const userOrgRoles = pgTable(
|
||||
(t) => [unique().on(t.userId, t.orgId, t.roleId)]
|
||||
);
|
||||
|
||||
// roles assigned to machine clients (clients with no userId) so they can be
|
||||
// granted access to site resources through roleSiteResources like users are
|
||||
export const clientOrgRoles = pgTable(
|
||||
"clientOrgRoles",
|
||||
{
|
||||
clientId: integer("clientId")
|
||||
.notNull()
|
||||
.references(() => clients.clientId, { onDelete: "cascade" }),
|
||||
orgId: varchar("orgId")
|
||||
.notNull()
|
||||
.references(() => orgs.orgId, { onDelete: "cascade" }),
|
||||
roleId: integer("roleId")
|
||||
.notNull()
|
||||
.references(() => roles.roleId, { onDelete: "cascade" })
|
||||
},
|
||||
(t) => [
|
||||
unique().on(t.clientId, t.orgId, t.roleId),
|
||||
index("idx_clientorgroles_roleid").on(t.roleId)
|
||||
]
|
||||
);
|
||||
|
||||
export const roleActions = pgTable(
|
||||
"roleActions",
|
||||
{
|
||||
@@ -1141,6 +1169,22 @@ export const resourceWhitelist = pgTable("resourceWhitelist", {
|
||||
.references(() => resources.resourceId, { onDelete: "cascade" })
|
||||
});
|
||||
|
||||
export const resourceMtlsCertificates = pgTable("resourceMtlsCertificates", {
|
||||
mtlsCertificateId: serial("mtlsCertificateId").primaryKey(),
|
||||
resourceId: integer("resourceId")
|
||||
.notNull()
|
||||
.references(() => resources.resourceId, { onDelete: "cascade" }),
|
||||
name: varchar("name"),
|
||||
certificate: text("certificate").notNull(),
|
||||
subject: varchar("subject"),
|
||||
issuer: varchar("issuer"),
|
||||
serialNumber: varchar("serialNumber"),
|
||||
fingerprint: varchar("fingerprint"),
|
||||
notBefore: bigint("notBefore", { mode: "number" }),
|
||||
notAfter: bigint("notAfter", { mode: "number" }),
|
||||
createdAt: bigint("createdAt", { mode: "number" }).notNull()
|
||||
});
|
||||
|
||||
export const resourceOtp = pgTable("resourceOtp", {
|
||||
otpId: serial("otpId").primaryKey(),
|
||||
resourceId: integer("resourceId")
|
||||
@@ -2043,6 +2087,7 @@ export type UserInvite = InferSelectModel<typeof userInvites>;
|
||||
export type UserInviteRole = InferSelectModel<typeof userInviteRoles>;
|
||||
export type UserOrg = InferSelectModel<typeof userOrgs>;
|
||||
export type UserOrgRole = InferSelectModel<typeof userOrgRoles>;
|
||||
export type ClientOrgRole = InferSelectModel<typeof clientOrgRoles>;
|
||||
export type ResourceSession = InferSelectModel<typeof resourceSessions>;
|
||||
export type ResourcePincode = InferSelectModel<typeof resourcePincode>;
|
||||
export type ResourcePassword = InferSelectModel<typeof resourcePassword>;
|
||||
@@ -2053,6 +2098,9 @@ export type ResourceHeaderAuthExtendedCompatibility = InferSelectModel<
|
||||
export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
|
||||
export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
|
||||
export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
|
||||
export type ResourceMtlsCertificate = InferSelectModel<
|
||||
typeof resourceMtlsCertificates
|
||||
>;
|
||||
export type ResourcePolicyPincode = InferSelectModel<
|
||||
typeof resourcePolicyPincode
|
||||
>;
|
||||
|
||||
@@ -78,7 +78,8 @@ export const orgs = sqliteTable("orgs", {
|
||||
{ mode: "boolean" }
|
||||
)
|
||||
.notNull()
|
||||
.default(false)
|
||||
.default(false),
|
||||
settingsJitModeLimit: integer("settingsJitModeLimit").notNull().default(250)
|
||||
});
|
||||
|
||||
export const userDomains = sqliteTable("userDomains", {
|
||||
@@ -129,7 +130,7 @@ export const sites = sqliteTable(
|
||||
address: text("address"), // this is the address of the wireguard interface in newt
|
||||
endpoint: text("endpoint"), // this is how to reach gerbil externally - gets put into the wireguard config
|
||||
localEndpoints: text("localEndpoints"), // JSON encoded list of string ips on the local machine to try to connect to
|
||||
publicKey: text("publicKey"), // TODO: Fix typo in publicKey
|
||||
publicKey: text("publicKey"),
|
||||
lastHolePunch: integer("lastHolePunch"),
|
||||
listenPort: integer("listenPort"),
|
||||
dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
|
||||
@@ -196,6 +197,10 @@ export const resources = sqliteTable(
|
||||
stickySession: integer("stickySession", { mode: "boolean" })
|
||||
.notNull()
|
||||
.default(false),
|
||||
loadBalancingStrategy: text("loadBalancingStrategy")
|
||||
.$type<"wrr" | "p2c" | "hrw" | "leasttime">()
|
||||
.notNull()
|
||||
.default("wrr"), // traefik http loadBalancer.strategy
|
||||
tlsServerName: text("tlsServerName"),
|
||||
setHostHeader: text("setHostHeader"),
|
||||
enableProxy: integer("enableProxy", { mode: "boolean" }).default(true),
|
||||
@@ -219,6 +224,9 @@ export const resources = sqliteTable(
|
||||
maintenanceTitle: text("maintenanceTitle"),
|
||||
maintenanceMessage: text("maintenanceMessage"),
|
||||
maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
|
||||
mtlsEnabled: integer("mtlsEnabled", { mode: "boolean" })
|
||||
.notNull()
|
||||
.default(false),
|
||||
postAuthPath: text("postAuthPath"),
|
||||
health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
|
||||
wildcard: integer("wildcard", { mode: "boolean" })
|
||||
@@ -517,6 +525,7 @@ export const exitNodes = sqliteTable("exitNodes", {
|
||||
endpoint: text("endpoint").notNull(), // this is how to reach gerbil externally - gets put into the wireguard config
|
||||
publicKey: text("publicKey").notNull(),
|
||||
listenPort: integer("listenPort").notNull(),
|
||||
relayPort: integer("relayPort").notNull(),
|
||||
reachableAt: text("reachableAt"), // this is the internal address of the gerbil http server for command control
|
||||
maxConnections: integer("maxConnections"),
|
||||
online: integer("online", { mode: "boolean" }).notNull().default(false),
|
||||
@@ -549,8 +558,8 @@ export const siteResources = sqliteTable("siteResources", {
|
||||
name: text("name").notNull(),
|
||||
ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
|
||||
mode: text("mode")
|
||||
.$type<"host" | "cidr" | "http" | "ssh" | "inference">()
|
||||
.notNull(), // "host" | "cidr" | "http"
|
||||
.$type<"host" | "cidr" | "http" | "ssh" | "inference" | "gateway">()
|
||||
.notNull(),
|
||||
scheme: text("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
|
||||
proxyPort: integer("proxyPort"), // only for port mode
|
||||
destinationPort: integer("destinationPort"), // only for port mode
|
||||
@@ -1130,6 +1139,27 @@ export const userOrgRoles = sqliteTable(
|
||||
(t) => [unique().on(t.userId, t.orgId, t.roleId)]
|
||||
);
|
||||
|
||||
// roles assigned to machine clients (clients with no userId) so they can be
|
||||
// granted access to site resources through roleSiteResources like users are
|
||||
export const clientOrgRoles = sqliteTable(
|
||||
"clientOrgRoles",
|
||||
{
|
||||
clientId: integer("clientId")
|
||||
.notNull()
|
||||
.references(() => clients.clientId, { onDelete: "cascade" }),
|
||||
orgId: text("orgId")
|
||||
.notNull()
|
||||
.references(() => orgs.orgId, { onDelete: "cascade" }),
|
||||
roleId: integer("roleId")
|
||||
.notNull()
|
||||
.references(() => roles.roleId, { onDelete: "cascade" })
|
||||
},
|
||||
(t) => [
|
||||
unique().on(t.clientId, t.orgId, t.roleId),
|
||||
index("idx_clientOrgRoles_roleId").on(t.roleId)
|
||||
]
|
||||
);
|
||||
|
||||
export const roleActions = sqliteTable("roleActions", {
|
||||
roleId: integer("roleId")
|
||||
.notNull()
|
||||
@@ -1413,6 +1443,27 @@ export const resourceWhitelist = sqliteTable("resourceWhitelist", {
|
||||
.references(() => resources.resourceId, { onDelete: "cascade" })
|
||||
});
|
||||
|
||||
export const resourceMtlsCertificates = sqliteTable(
|
||||
"resourceMtlsCertificates",
|
||||
{
|
||||
mtlsCertificateId: integer("mtlsCertificateId").primaryKey({
|
||||
autoIncrement: true
|
||||
}),
|
||||
resourceId: integer("resourceId")
|
||||
.notNull()
|
||||
.references(() => resources.resourceId, { onDelete: "cascade" }),
|
||||
name: text("name"),
|
||||
certificate: text("certificate").notNull(),
|
||||
subject: text("subject"),
|
||||
issuer: text("issuer"),
|
||||
serialNumber: text("serialNumber"),
|
||||
fingerprint: text("fingerprint"),
|
||||
notBefore: integer("notBefore"),
|
||||
notAfter: integer("notAfter"),
|
||||
createdAt: integer("createdAt").notNull()
|
||||
}
|
||||
);
|
||||
|
||||
export const resourceOtp = sqliteTable("resourceOtp", {
|
||||
otpId: integer("otpId").primaryKey({
|
||||
autoIncrement: true
|
||||
@@ -2088,6 +2139,7 @@ export type UserInvite = InferSelectModel<typeof userInvites>;
|
||||
export type UserInviteRole = InferSelectModel<typeof userInviteRoles>;
|
||||
export type UserOrg = InferSelectModel<typeof userOrgs>;
|
||||
export type UserOrgRole = InferSelectModel<typeof userOrgRoles>;
|
||||
export type ClientOrgRole = InferSelectModel<typeof clientOrgRoles>;
|
||||
export type ResourceSession = InferSelectModel<typeof resourceSessions>;
|
||||
export type ResourcePincode = InferSelectModel<typeof resourcePincode>;
|
||||
export type ResourcePassword = InferSelectModel<typeof resourcePassword>;
|
||||
@@ -2098,6 +2150,9 @@ export type ResourceHeaderAuthExtendedCompatibility = InferSelectModel<
|
||||
export type ResourceOtp = InferSelectModel<typeof resourceOtp>;
|
||||
export type ResourceAccessToken = InferSelectModel<typeof resourceAccessToken>;
|
||||
export type ResourceWhitelist = InferSelectModel<typeof resourceWhitelist>;
|
||||
export type ResourceMtlsCertificate = InferSelectModel<
|
||||
typeof resourceMtlsCertificates
|
||||
>;
|
||||
export type VersionMigration = InferSelectModel<typeof versionMigrations>;
|
||||
export type ResourceRule = InferSelectModel<typeof resourceRules>;
|
||||
export type Domain = InferSelectModel<typeof domains>;
|
||||
|
||||
Reference in New Issue
Block a user