471 lines
16 KiB
Go
471 lines
16 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"html/template"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
// --- Config types ---
|
|
|
|
type ServerConfig struct {
|
|
Port int `yaml:"port"`
|
|
Host string `yaml:"host"`
|
|
}
|
|
|
|
type AppConfig struct {
|
|
Name string `yaml:"name"`
|
|
Description string `yaml:"description"`
|
|
}
|
|
|
|
type Config struct {
|
|
Server ServerConfig `yaml:"server"`
|
|
App AppConfig `yaml:"app"`
|
|
}
|
|
|
|
type AppEntry struct {
|
|
Name string `yaml:"name"`
|
|
Subtitle string `yaml:"subtitle"`
|
|
Path string `yaml:"path"`
|
|
Upstream string `yaml:"upstream"`
|
|
Icon string `yaml:"icon"`
|
|
Groups []string `yaml:"groups"`
|
|
}
|
|
|
|
type AppsFile struct {
|
|
Apps []AppEntry `yaml:"apps"`
|
|
}
|
|
|
|
// --- Config loading ---
|
|
|
|
func loadConfig(configDir string) (*Config, error) {
|
|
path := filepath.Join(configDir, "config.yaml")
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("reading config: %w", err)
|
|
}
|
|
var cfg Config
|
|
if err := yaml.Unmarshal(data, &cfg); err != nil {
|
|
return nil, fmt.Errorf("parsing config: %w", err)
|
|
}
|
|
return &cfg, nil
|
|
}
|
|
|
|
func loadApps(configDir string) ([]AppEntry, error) {
|
|
path := filepath.Join(configDir, "apps.yaml")
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return []AppEntry{}, nil
|
|
}
|
|
return nil, fmt.Errorf("reading apps: %w", err)
|
|
}
|
|
var appsFile AppsFile
|
|
if err := yaml.Unmarshal(data, &appsFile); err != nil {
|
|
return nil, fmt.Errorf("parsing apps: %w", err)
|
|
}
|
|
return appsFile.Apps, nil
|
|
}
|
|
|
|
// --- Helpers ---
|
|
|
|
func userHasAnyGroup(userGroups []string, requiredGroups []string) bool {
|
|
for _, ug := range userGroups {
|
|
for _, rg := range requiredGroups {
|
|
if strings.TrimSpace(ug) == rg {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// --- Auth middleware (trusts Remote-User from Caddy forward auth) ---
|
|
|
|
func authMiddleware(next http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
user := r.Header.Get("Remote-User")
|
|
if user == "" {
|
|
http.Error(w, "Unauthorized", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
r.Header.Set("X-Auth-User", user)
|
|
next(w, r)
|
|
}
|
|
}
|
|
|
|
func adminGroupMiddleware(next http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
groups := r.Header.Get("Remote-Groups")
|
|
if !strings.Contains(groups, "admins") {
|
|
http.Error(w, "Forbidden — admins only", http.StatusForbidden)
|
|
return
|
|
}
|
|
next(w, r)
|
|
}
|
|
}
|
|
|
|
// --- Handlers ---
|
|
|
|
func healthHandler(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
fmt.Fprint(w, "OK")
|
|
}
|
|
|
|
func launcherHandler(cfg *Config, apps []AppEntry) http.HandlerFunc {
|
|
tmpl := template.Must(template.New("launcher").Parse(launcherHTML))
|
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
user := r.Header.Get("Remote-User")
|
|
groupsHeader := r.Header.Get("Remote-Groups")
|
|
userGroups := strings.Split(groupsHeader, ",")
|
|
|
|
var allowedApps []AppEntry
|
|
for _, app := range apps {
|
|
if len(app.Groups) == 0 || userHasAnyGroup(userGroups, app.Groups) {
|
|
allowedApps = append(allowedApps, app)
|
|
}
|
|
}
|
|
|
|
data := struct {
|
|
AppName string
|
|
Description string
|
|
User string
|
|
IsAdmin bool
|
|
Apps []AppEntry
|
|
}{
|
|
AppName: cfg.App.Name,
|
|
Description: cfg.App.Description,
|
|
User: user,
|
|
IsAdmin: strings.Contains(groupsHeader, "admins"),
|
|
Apps: allowedApps,
|
|
}
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
tmpl.Execute(w, data)
|
|
}
|
|
}
|
|
|
|
func proxyToUpstream(upstream string) http.HandlerFunc {
|
|
target, err := url.Parse(upstream)
|
|
if err != nil {
|
|
log.Fatalf("Invalid upstream URL %q: %v", upstream, err)
|
|
}
|
|
proxy := httputil.NewSingleHostReverseProxy(target)
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
r.Header.Set("Remote-User", r.Header.Get("Remote-User"))
|
|
proxy.ServeHTTP(w, r)
|
|
}
|
|
}
|
|
|
|
func adminHandler(w http.ResponseWriter, r *http.Request) {
|
|
apiBase := "http://127.0.0.1:8080"
|
|
apiToken := os.Getenv("AUTHELIA_SECRET")
|
|
|
|
switch r.Method {
|
|
case http.MethodGet:
|
|
// List users from authelia-api
|
|
req, _ := http.NewRequest("GET", apiBase+"/api/users", nil)
|
|
req.Header.Set("Authorization", "Bearer "+apiToken)
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("API error: %v", err), http.StatusBadGateway)
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
body, _ := io.ReadAll(resp.Body)
|
|
|
|
tmpl := template.Must(template.New("admin").Parse(adminHTML))
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
tmpl.Execute(w, map[string]interface{}{
|
|
"Users": string(body),
|
|
"ApiError": resp.StatusCode != 200,
|
|
})
|
|
|
|
case http.MethodPost:
|
|
// Create user
|
|
body, _ := io.ReadAll(r.Body)
|
|
req, _ := http.NewRequest("POST", apiBase+"/api/users/bulk", bytes.NewReader(body))
|
|
req.Header.Set("Authorization", "Bearer "+apiToken)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("API error: %v", err), http.StatusBadGateway)
|
|
return
|
|
}
|
|
w.WriteHeader(resp.StatusCode)
|
|
io.Copy(w, resp.Body)
|
|
|
|
case http.MethodDelete:
|
|
username := r.URL.Query().Get("username")
|
|
req, _ := http.NewRequest("DELETE", apiBase+"/api/users/"+username, nil)
|
|
req.Header.Set("Authorization", "Bearer "+apiToken)
|
|
resp, err := http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("API error: %v", err), http.StatusBadGateway)
|
|
return
|
|
}
|
|
w.WriteHeader(resp.StatusCode)
|
|
io.Copy(w, resp.Body)
|
|
}
|
|
}
|
|
|
|
// --- Templates ---
|
|
|
|
const landingPageHTML = `<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>NextWorkspace</title>
|
|
<style>
|
|
* { margin: 0; padding: 0; box-sizing: border-box; }
|
|
body {
|
|
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
|
|
background: #f0f2f5;
|
|
color: #1a1a2e;
|
|
min-height: 100vh;
|
|
}
|
|
header { background: linear-gradient(135deg, #1a1a2e, #16213e); color: #fff; padding: 3rem 2rem; text-align: center; }
|
|
header h1 { font-size: 2.5rem; margin-bottom: 0.5rem; }
|
|
header p { color: #a0aec0; font-size: 1.2rem; }
|
|
.domain { color: #63b3ed; font-size: 0.9rem; margin-top: 0.5rem; }
|
|
.container { max-width: 800px; margin: 0 auto; padding: 2rem; }
|
|
h2 { font-size: 1.5rem; margin: 2rem 0 1rem; color: #2d3748; }
|
|
ul { list-style: none; padding: 0; }
|
|
li { background: #fff; border-radius: 8px; padding: 1rem 1.25rem; margin-bottom: 0.75rem; box-shadow: 0 1px 4px rgba(0,0,0,0.06); }
|
|
li a { color: #1a1a2e; text-decoration: none; font-weight: 600; }
|
|
li a:hover { color: #63b3ed; }
|
|
li span { color: #718096; font-size: 0.9rem; margin-left: 0.5rem; }
|
|
.ai-credit { background: #edf2f7; border-radius: 8px; padding: 1.5rem; margin-top: 2rem; text-align: center; font-size: 0.9rem; color: #4a5568; }
|
|
footer { text-align: center; padding: 2rem; color: #a0aec0; font-size: 0.85rem; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<header>
|
|
<h1>NextWorkspace</h1>
|
|
<p>Your Self-Hosted Workspace for Startups</p>
|
|
<div class="domain">nextwks.eu</div>
|
|
</header>
|
|
<div class="container">
|
|
<h2>Components</h2>
|
|
<ul>
|
|
<li><a href="https://app.nextwks.eu/home">NextWks Core</a><span>— Launcher & Workspace Hub</span></li>
|
|
<li><a href="https://app.nextwks.eu/drive">OpenCloud</a><span>— File Storage</span></li>
|
|
<li><a href="https://app.nextwks.eu/connect">Alps Webmail</a><span>— Email Client</span></li>
|
|
<li><a href="https://app.nextwks.eu/office">Euro Office</a><span>— Collaborative Suite</span></li>
|
|
<li><a href="https://app.nextwks.eu/enterprise">ERPNext</a><span>— Enterprise ERP</span></li>
|
|
<li><a href="https://app.nextwks.eu/chat">Element Web</a><span>— Matrix Chat</span></li>
|
|
<li><a href="https://app.nextwks.eu/meet">Jitsi</a><span>— Video Conferencing</span></li>
|
|
<li><a href="https://app.nextwks.eu/aida">Open WebUI</a><span>— AI Chat Frontend</span></li>
|
|
</ul>
|
|
<div class="ai-credit">
|
|
<h2>Built with AI</h2>
|
|
<p>NextWorkspace was developed with assistance from AI coding tools, using <strong>DeepSeek</strong> as the provider and <strong>OpenCode</strong> as the development framework.</p>
|
|
</div>
|
|
</div>
|
|
<footer>© 2026 NextWorkspace — nextwks.eu</footer>
|
|
</body>
|
|
</html>`
|
|
|
|
const launcherHTML = `<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>{{.AppName}}</title>
|
|
<style>
|
|
* { margin: 0; padding: 0; box-sizing: border-box; }
|
|
body {
|
|
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
|
|
background: #f0f2f5;
|
|
color: #1a1a2e;
|
|
min-height: 100vh;
|
|
}
|
|
header { background: linear-gradient(135deg, #1a1a2e, #16213e); color: #fff; padding: 2rem; text-align: center; }
|
|
header h1 { font-size: 2rem; margin-bottom: 0.25rem; }
|
|
header p { color: #a0aec0; font-size: 1rem; }
|
|
.user-banner { background: #2d3748; color: #e2e8f0; padding: 0.75rem 2rem; text-align: center; font-size: 0.9rem; display: flex; justify-content: center; gap: 1rem; }
|
|
.user-banner a { color: #63b3ed; text-decoration: none; }
|
|
.user-banner a:hover { text-decoration: underline; }
|
|
.grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 1.5rem; padding: 2rem; max-width: 1200px; margin: 0 auto; }
|
|
.card { background: #fff; border-radius: 12px; padding: 1.5rem; text-align: center; box-shadow: 0 2px 8px rgba(0,0,0,0.08); transition: transform 0.2s; text-decoration: none; color: inherit; display: block; }
|
|
.card:hover { transform: translateY(-4px); box-shadow: 0 8px 24px rgba(0,0,0,0.12); }
|
|
.icon { width: 48px; height: 48px; margin: 0 auto 1rem; background: #edf2f7; border-radius: 12px; display: flex; align-items: center; justify-content: center; font-size: 1.5rem; }
|
|
.card h3 { font-size: 1.1rem; margin-bottom: 0.25rem; }
|
|
.card p { color: #718096; font-size: 0.85rem; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<header>
|
|
<h1>{{.AppName}}</h1>
|
|
<p>{{.Description}}</p>
|
|
</header>
|
|
<div class="user-banner">
|
|
<span>Welcome, {{.User}}</span>
|
|
{{if .IsAdmin}}<a href="/config">Admin Panel</a>{{end}}
|
|
<a href="https://auth.nextwks.eu/logout">Logout</a>
|
|
</div>
|
|
<div class="grid">
|
|
{{range .Apps}}
|
|
{{if .Upstream}}
|
|
<a class="card" href="{{.Path}}/" target="_blank" rel="noopener">
|
|
{{else}}
|
|
<div class="card" style="opacity:0.5; cursor:default;">
|
|
{{end}}
|
|
<div class="icon">{{.Icon}}</div>
|
|
<h3>{{.Name}}</h3>
|
|
<p>{{.Subtitle}}</p>
|
|
{{if .Upstream}}</a>{{else}}</div>{{end}}
|
|
{{end}}
|
|
</div>
|
|
</body>
|
|
</html>`
|
|
|
|
const adminHTML = `<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Admin Panel — NextWorkspace</title>
|
|
<style>
|
|
* { margin: 0; padding: 0; box-sizing: border-box; }
|
|
body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f0f2f5; color: #1a1a2e; }
|
|
header { background: linear-gradient(135deg, #1a1a2e, #16213e); color: #fff; padding: 1.5rem 2rem; display: flex; justify-content: space-between; align-items: center; }
|
|
header h1 { font-size: 1.5rem; }
|
|
header a { color: #63b3ed; text-decoration: none; font-size: 0.9rem; }
|
|
.container { max-width: 1000px; margin: 0 auto; padding: 2rem; }
|
|
.card { background: #fff; border-radius: 8px; padding: 1.5rem; margin-bottom: 1.5rem; box-shadow: 0 1px 4px rgba(0,0,0,0.06); }
|
|
h2 { font-size: 1.2rem; margin-bottom: 1rem; color: #2d3748; }
|
|
table { width: 100%; border-collapse: collapse; }
|
|
th, td { text-align: left; padding: 0.6rem 0.5rem; border-bottom: 1px solid #e2e8f0; font-size: 0.9rem; }
|
|
th { color: #718096; font-weight: 600; }
|
|
.btn { display: inline-block; padding: 0.4rem 0.8rem; border-radius: 4px; text-decoration: none; font-size: 0.85rem; cursor: pointer; border: none; }
|
|
.btn-danger { background: #fc8181; color: #fff; }
|
|
.btn-primary { background: #1a1a2e; color: #fff; }
|
|
.btn-primary:hover { background: #2d3748; }
|
|
input, select { padding: 0.4rem 0.6rem; border: 1px solid #e2e8f0; border-radius: 4px; font-size: 0.9rem; margin-right: 0.5rem; }
|
|
.form-row { display: flex; gap: 0.5rem; align-items: center; flex-wrap: wrap; margin-bottom: 1rem; }
|
|
.error { background: #fed7d7; color: #c53030; padding: 0.75rem; border-radius: 6px; margin-bottom: 1rem; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<header>
|
|
<h1>Admin Panel</h1>
|
|
<a href="/home/">Back to Launcher</a>
|
|
</header>
|
|
<div class="container">
|
|
{{if .ApiError}}<div class="error">Could not fetch users from authelia-api (is it running on :8080?)</div>{{end}}
|
|
|
|
<div class="card">
|
|
<h2>Create User</h2>
|
|
<form id="createForm" onsubmit="createUser(event)">
|
|
<div class="form-row">
|
|
<input name="username" placeholder="Username" required>
|
|
<input name="display_name" placeholder="Display Name" required>
|
|
<input name="email" placeholder="Email" type="email" required>
|
|
<input name="password" placeholder="Password" type="password" required>
|
|
<select name="groups" multiple size="3">
|
|
<option value="users">users</option>
|
|
<option value="drive">drive</option>
|
|
<option value="office">office</option>
|
|
<option value="erp">erp</option>
|
|
<option value="chat">chat</option>
|
|
<option value="meet">meet</option>
|
|
<option value="mail">mail</option>
|
|
<option value="ai">ai</option>
|
|
</select>
|
|
<button type="submit" class="btn btn-primary">Create</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
|
|
<div class="card">
|
|
<h2>Users</h2>
|
|
<pre>{{.Users}}</pre>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
async function createUser(e) {
|
|
e.preventDefault();
|
|
const form = e.target;
|
|
const data = Object.fromEntries(new FormData(form));
|
|
data.groups = Array.from(form.querySelector('[name=groups]').selectedOptions).map(o => o.value);
|
|
const resp = await fetch('/config', {
|
|
method: 'POST',
|
|
headers: {'Content-Type': 'application/json'},
|
|
body: JSON.stringify({users: [data]})
|
|
});
|
|
if (resp.ok) { alert('User created'); location.reload(); }
|
|
else { alert('Error: ' + await resp.text()); }
|
|
}
|
|
</script>
|
|
</body>
|
|
</html>`
|
|
|
|
// --- Main ---
|
|
|
|
func main() {
|
|
configDir := os.Getenv("CONFIG_DIR")
|
|
if configDir == "" {
|
|
configDir = "/opt/nextworkspace/config/nextworkspace"
|
|
}
|
|
|
|
cfg, err := loadConfig(configDir)
|
|
if err != nil {
|
|
log.Fatalf("Failed to load config: %v", err)
|
|
}
|
|
|
|
apps, err := loadApps(configDir)
|
|
if err != nil {
|
|
log.Fatalf("Failed to load apps: %v", err)
|
|
}
|
|
|
|
addr := fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port)
|
|
|
|
mux := http.NewServeMux()
|
|
|
|
// Public
|
|
mux.HandleFunc("/health", healthHandler)
|
|
|
|
// Protected: launcher
|
|
mux.Handle("/home/", authMiddleware(launcherHandler(cfg, apps)))
|
|
mux.Handle("/home", authMiddleware(launcherHandler(cfg, apps)))
|
|
|
|
// Protected: admin — admins only
|
|
mux.Handle("/config", adminGroupMiddleware(authMiddleware(adminHandler)))
|
|
mux.Handle("/config/", adminGroupMiddleware(authMiddleware(adminHandler)))
|
|
|
|
// Protected: upstream app proxies
|
|
for _, app := range apps {
|
|
if app.Path != "" && app.Upstream != "" && app.Path != "/config" && app.Path != "/home" {
|
|
proxyHandler := authMiddleware(proxyToUpstream(app.Upstream))
|
|
mux.Handle(app.Path+"/", proxyHandler)
|
|
mux.Handle(app.Path, proxyHandler)
|
|
}
|
|
}
|
|
|
|
// Default: www landing page or redirect to /home/
|
|
domain := os.Getenv("DOMAIN")
|
|
mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
|
if strings.HasPrefix(r.Host, "www.") || (domain != "" && r.Host == "www."+domain) {
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
fmt.Fprint(w, landingPageHTML)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/home/", http.StatusFound)
|
|
})
|
|
|
|
log.Printf("NextWorkspace listening on %s", addr)
|
|
log.Fatal(http.ListenAndServe(addr, mux))
|
|
}
|