Added ephemeral ssh keys.

docker/docker.go

@@ -50,12 +50,6 @@ func Run(Config cfg.Config){
 		panic("Node is not a swarm manager.");
 	}
 
-	sshKeypair := generateKeypair();
-	ApiClient.ConfigCreate(context.Background(), swarm.ConfigSpec{
-		Data: sshKeypair.public,
-		Annotations: swarm.Annotations{Name: "blazenaSSHPublicKey"},
-	});
-
 	server := &http.Server{
 		Addr: ":1234",
 	}
@@ -65,6 +59,7 @@ func Run(Config cfg.Config){
 	http.HandleFunc("/scale/down", scaleDown);
 	http.HandleFunc("/prepare", prepare);
 	http.HandleFunc("/cleanup", cleanup);
+	http.HandleFunc("/keys", exchangeKeys);
 	// I'll make it better someday.
 	http.HandleFunc("/shutdown", func(w http.ResponseWriter, r *http.Request) {
 		if !bearerAuth(w, r){return}
@@ -103,6 +98,8 @@ func Run(Config cfg.Config){
 
 	ApiClient.NetworkRemove(context.Background(), "blazenaPohar");
 	ApiClient.ConfigRemove(context.Background(), "blazenaSSHPublicKey")
+	ApiClient.SecretRemove(context.Background(), "blazenaSSHHostPrivateKey");
+
 	fmt.Println("Exiting!");
 }
 

docker/keys.go

@@ -0,0 +1,54 @@
+package docker
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"context"
+	"github.com/docker/docker/api/types/swarm"
+
+	"github.com/rony5394/blazena/shared"
+)
+
+func exchangeKeys(w http.ResponseWriter, r *http.Request){
+	if r.Method != http.MethodPost{
+		w.WriteHeader(http.StatusMethodNotAllowed);
+		fmt.Fprint(w, "Method Not Allowed");
+		return;
+	}
+	if !bearerAuth(w, r) {return;}
+
+	rawBody, err := io.ReadAll(r.Body);
+	if err != nil {
+		panic("Failed to read body!");
+	}
+
+	var bodyDecoded struct{
+		SshPkPem string `json:"sshPkPem"`
+	};
+
+	err = json.Unmarshal(rawBody, &bodyDecoded);
+	if err != nil {
+		panic("Failed to unmarshal json."+ err.Error());
+	}
+	sshPkPem := bodyDecoded.SshPkPem;
+	hostKeypair := shared.GenerateSSHKeypair();
+	encoded, err := json.Marshal(struct{HostPkPem string `json:"hostPkPem"`}{HostPkPem: hostKeypair.Public});
+	if err != nil {
+		panic("I wonder how. I wonder why?"+err.Error());
+	}
+
+	ApiClient.ConfigCreate(context.Background(), swarm.ConfigSpec{
+		Data: []byte(sshPkPem), 
+		Annotations: swarm.Annotations{Name: "blazenaSSHPublicKey"},
+	});
+
+	ApiClient.SecretCreate(context.Background(), swarm.SecretSpec{
+		Data: []byte(hostKeypair.Private),
+		Annotations: swarm.Annotations{Name: "blazenaSSHHostPrivateKey"},
+	});
+
+
+	fmt.Fprint(w, string(encoded));
+}

docker/prepare.go

@@ -65,7 +65,6 @@ func contains(slice []string, str string) bool {
     return false
 }
 
-//By gpt (I'm lazy)
 func getConfigIDByName(cli *client.Client, name string) (string, error) {
 	ctx := context.Background()
 
@@ -83,6 +82,23 @@ func getConfigIDByName(cli *client.Client, name string) (string, error) {
 	return "", fmt.Errorf("config not found: %s", name)
 }
 
+func getSecretIDByName(cli *client.Client, name string) (string, error) {
+	ctx := context.Background()
+
+	secrets, err := cli.SecretList(ctx, swarm.SecretListOptions{}) 
+	if err != nil {
+		return "", err
+	}
+
+	for _, sec := range secrets {
+		if sec.Spec.Name == name {
+			return sec.ID, nil
+		}
+	}
+
+	return "", fmt.Errorf("config not found: %s", name)
+}
+
 func pullBlazenaImage(){
 	authConfig := registry.AuthConfig{
 		Username: theConfig.RegistryAuth.Username, 
@@ -109,14 +125,15 @@ func createHelper(targetNode string, targetVolume string){
 	maxConcurrent := uint64(1);
 	totalCompletions := uint64(1);
 	stopGracePeriod := time.Second * 5;
-	helperCommand := `ssh-keygen -t ed25519 -f /host_key && \
-			/usr/sbin/sshd -h /host_key -p 2222 -D`;
+	helperCommand := `/usr/sbin/sshd -h /host-key -p 2222 -D`;
 
 	sshKeyConfigId, err := getConfigIDByName(ApiClient, "blazenaSSHPublicKey");
 
 	if err != nil {
 		panic("Docker needs both id and name to mount config for some reason and getting id of it failed!"+err.Error());
 	}
+
+	sshHostKeySecretId, err := getSecretIDByName(ApiClient, "blazenaSSHHostPrivateKey")
 	_, err = ApiClient.ServiceCreate(context.Background(), swarm.ServiceSpec{
 		Annotations: swarm.Annotations{
 			Name: "BlazenaHelper",
@@ -153,6 +170,18 @@ func createHelper(targetNode string, targetVolume string){
 						},
 					},
 				},
+				Secrets: []*swarm.SecretReference{
+					&swarm.SecretReference{
+						SecretID: sshHostKeySecretId,
+						SecretName: "blazenaSSHHostPrivateKey",
+						File: &swarm.SecretReferenceFileTarget{
+							Name: "/host-key",
+							Mode: 0600,
+							UID: "0",
+							GID: "0",
+						},
+					},
+				},
 			},
 			Placement: &swarm.Placement{
 				Constraints: []string{"node.hostname=="+targetNode},

docker/ssh.go

@@ -1,45 +0,0 @@
-package docker 
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"crypto/x509"
-	"encoding/pem"
-
-	"golang.org/x/crypto/ssh"
-)
-
-type Keypair struct {
-	public []byte
-	private []byte
-}
-
-func generateKeypair() Keypair {
-	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		panic(err)
-	}
-
-	privBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
-	if err != nil {
-		panic(err)
-	}
-
-	privPem := pem.EncodeToMemory(&pem.Block{
-		Type:  "PRIVATE KEY",
-		Bytes: privBytes,
-	})
-
-	sshPubKey, err := ssh.NewPublicKey(publicKey)
-	if err != nil {
-		panic(err)
-	}
-
-	pubBytes := ssh.MarshalAuthorizedKey(sshPubKey)
-
-	return Keypair{
-		private: privPem,
-		public: pubBytes,
-	};
-
-}