claude-botandClaude Opus 5.5
a05f1431ca
wlan-setup/ is a Go service that will replace the nginx + njs backend of
wlan.renner.uno (switched over in a follow-up once the first image exists).
- Page, /whoami, /healthz; /{android,apple,windows}/install and /callback:
authentik OAuth code flow (client wlan-setup, client_secret_basic), user
check against X-authentik-username, per-device app password
wlan-<platform>-... (29 days), profile per platform: Android Passpoint
(application/x-wifi-config), Apple .mobileconfig with Passpoint, Windows
CarrierProvisioning with Passpoint.
- Windows: the profile is signed with XML-DSig in the form of Microsoft's
samples (enveloped, C14N 1.0, rsa-sha1, chain in KeyInfo) by the key in
/etc/wlan-signing, kept for 5 minutes under a single-use token, and the
browser is sent to ms-settings:wifi-provisioning?uri=.../windows/profile/<token>.
- Offline tests against a fake authentik; goxmldsig verifies the signature
in the tests only.
- CI: wlan-setup-test (gofmt, vet, test -race) on PRs; build-ci-images
builds gitea.renner.uno/gitea_admin/wlan-setup:YYYY-MM-DD-HHMM on main;
Flux image automation follows the newest tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
60 lines
1.6 KiB
Go
60 lines
1.6 KiB
Go
// wlan-setup serves wlan.renner.uno behind the authentik gate: the setup page for the WLAN
|
|
// "Renner UniFi" and, per device, an authorization-code sign-in that creates an authentik app
|
|
// password as the user and answers with a Passpoint profile (Android, Apple) or a signed
|
|
// CarrierProvisioning document that Windows Settings fetches once.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log/slog"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
)
|
|
|
|
func main() {
|
|
log := slog.New(slog.NewJSONHandler(os.Stdout, nil))
|
|
cfg, err := loadConfig(os.Getenv)
|
|
if err != nil {
|
|
log.Error("invalid configuration", "err", err)
|
|
os.Exit(2)
|
|
}
|
|
ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
|
|
defer stop()
|
|
if err := run(ctx, cfg, log); err != nil {
|
|
log.Error("stopped", "err", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func run(ctx context.Context, cfg Config, log *slog.Logger) error {
|
|
srv := &http.Server{
|
|
Addr: cfg.Listen,
|
|
Handler: newServer(cfg, log).routes(),
|
|
ReadHeaderTimeout: 10 * time.Second,
|
|
ReadTimeout: 30 * time.Second,
|
|
// A callback makes up to four authentik calls of at most 10 s each.
|
|
WriteTimeout: 60 * time.Second,
|
|
IdleTimeout: 2 * time.Minute,
|
|
MaxHeaderBytes: 64 << 10,
|
|
}
|
|
failed := make(chan error, 1)
|
|
go func() { failed <- srv.ListenAndServe() }()
|
|
log.Info("listening", "addr", cfg.Listen)
|
|
|
|
select {
|
|
case <-ctx.Done():
|
|
case err := <-failed:
|
|
if !errors.Is(err, http.ErrServerClosed) {
|
|
return err
|
|
}
|
|
}
|
|
log.Info("shutting down")
|
|
shutdown, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
|
defer cancel()
|
|
return srv.Shutdown(shutdown)
|
|
}
|