Client/Server mode: sending configuration profile to a remote server #377
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Codecov Report❌ Patch coverage is
❌ Your patch check has failed because the patch coverage (24.47%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #377 +/- ##
==========================================
- Coverage 79.45% 76.61% -2.84%
==========================================
Files 136 150 +14
Lines 13386 14173 +787
==========================================
+ Hits 10635 10858 +223
- Misses 2331 2884 +553
- Partials 420 431 +11
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
creativeprojects
changed the title
creativeprojects
force-pushed
the
client-server
branch
from
008609a to
27b0dba
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Owner
Author
|
I got a fully working proof of concept for the SSH mode 🎉 What do you think @jkellerer ? SSH mode should be secure enough:
Obviously it still needs more work and also unit tests. We'll see for the other modes later (with the security concerns) |
creativeprojects
force-pushed
the
client-server
branch
from
a340c97 to
73896c4
Compare
Collaborator
|
will check it. Was a bit busy these days :) |
creativeprojects
force-pushed
the
client-server
branch
from
73896c4 to
5d698ec
Compare
creativeprojects
force-pushed
the
client-server
branch
from
5d698ec to
7809348
Compare
creativeprojects
force-pushed
the
client-server
branch
from
7809348 to
b7c7296
Compare
creativeprojects
force-pushed
the
client-server
branch
from
b7c7296 to
f38f45b
Compare
creativeprojects
force-pushed
the
client-server
branch
from
f38f45b to
55303b1
Compare
creativeprojects
force-pushed
the
client-server
branch
from
55303b1 to
a7e4c75
Compare
…rove error responses
…for better code organization
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Work in progress
Proof of concept on how to send a configuration profile to a remote server (along necessary files like exclude list, restic password, etc.)
Suggestion of connection type:
SSH: secure connection (would be the default)HTTP: basic http connection to be used within a VPN (do we want to provide that?)mTLS: secure connection with client/server certificatesSSH connection doesn't need to have a resticprofile server waiting for connections. The two other types would need to.
New commands:
send: connects to a remote via SSH and push the specified configurationserve: serves configuration files (New flag:
-r / --remote: download configuration files from the endpoint then run using the downloaded configuration (only). can be used with-w / --waitto inspect the mounted FS.Other security consideration
Ideally we want the remote clients to never save the configuration that was pushed to them. They run the backup and forget everything about it.
We should investigate how to ask the kernel not to swap the file contents<- doesn't seem to be possible in GoConfiguration
New entries in the configuration could look like:
Implementation details:
in order to avoid saving the remotely loaded files to disk, I'm using afero to create a virtual disk in memory. I also looked atos/fsbut it forbids using any rooted path, which sounds like it would be a massive refactoring.go-fuselibrary to create a filesystem in memory from atarstream (not sure how it's going to work on Windows yet)Demo of working SSH mode (logs from both the initiator and the remote)
More information
Discussion here: #69