claude-botandClaude Opus 5.5
a05f1431ca
wlan-setup/ is a Go service that will replace the nginx + njs backend of
wlan.renner.uno (switched over in a follow-up once the first image exists).
- Page, /whoami, /healthz; /{android,apple,windows}/install and /callback:
authentik OAuth code flow (client wlan-setup, client_secret_basic), user
check against X-authentik-username, per-device app password
wlan-<platform>-... (29 days), profile per platform: Android Passpoint
(application/x-wifi-config), Apple .mobileconfig with Passpoint, Windows
CarrierProvisioning with Passpoint.
- Windows: the profile is signed with XML-DSig in the form of Microsoft's
samples (enveloped, C14N 1.0, rsa-sha1, chain in KeyInfo) by the key in
/etc/wlan-signing, kept for 5 minutes under a single-use token, and the
browser is sent to ms-settings:wifi-provisioning?uri=.../windows/profile/<token>.
- Offline tests against a fake authentik; goxmldsig verifies the signature
in the tests only.
- CI: wlan-setup-test (gofmt, vet, test -race) on PRs; build-ci-images
builds gitea.renner.uno/gitea_admin/wlan-setup:YYYY-MM-DD-HHMM on main;
Flux image automation follows the newest tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
799 B
Docker
24 lines
799 B
Docker
# wlan-setup — static Go binary in a FROM-scratch image.
|
|
#
|
|
# Nothing in the final image but the binary and the CA bundle (the binary has no shell and no
|
|
# package manager to patch or to exec).
|
|
FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS build
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY *.go index.html ./
|
|
|
|
RUN go vet ./... \
|
|
&& CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /wlan-setup .
|
|
|
|
FROM scratch
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=build /wlan-setup /wlan-setup
|
|
|
|
# Matches runAsUser in the Deployment. There is no /etc/passwd in a scratch image, so this is a
|
|
# bare uid by necessity.
|
|
USER 65534:65534
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["/wlan-setup"]
|