Staging update#46
Merged
Merged
Conversation
…lidated iga-core endpoints (multiAdmin, enclave-signed, no delegation)
…ted iga-core endpoints
…t change-set model)
… not KEYLESSH placeholder)
…OPT CRs; don't hang) + per-poll diagnostics
…so admin user + tide-realm-admin actually land
…json) so login uses the new realm/host
…ris so browser token exchange isn't CORS-blocked
…so ORK PreSign has its policy
…stead of bare 500
…ommit; remove dead server-relay admin-policy endpoint + broken list-time attach
… iga-core rows The consolidated iga-core CR carries the target user/role/client under the new UPPERCASE rows[] (per-actionType: GRANT_ROLES has USER_ID/ROLE_ID only, CREATE_USER has USERNAME, CREATE_ROLE has NAME/CLIENT_ID), not the old payload userRecord/role/clientId. The old field lookups missed and the table showed Unknown for User/Role/Client. Resolve GRANT_ROLES UUIDs against the cached users + roles lists and alias userRecord/role/compositeRole/clientId back onto the CR data object so api.ts and AdminApprovals.tsx keep working unchanged.
The Change Requests review step only covered the user admin access CR and the ssh:user policy. Granting the ssh:user role also produces its own change request in the Change Requests (Access) tab that must be reviewed and committed, so add that step before switching to the Policies tab.
Reorder Step 2 so the change-request commits follow the actual dependency order: create the ssh:user role, commit it under the Roles tab, commit its policy under the Policies tab, then add the role to the user and commit the resulting access change request under the Access tab. Also fixes the broken item numbering (list jumped from 2 to 4).
New docs/PUNCHD-GATEWAY.md aimed at users new to gateways: what punchd is and when it is needed (direct-reachable vs NAT'd target), a plain-words path diagram, the direct-vs-gateway routing decision (bridgeId gateway: convention), the pieces (gateway + signal server) and ports, the TideCloak JWT/DPoP + shared API_SECRET auth model, a minimal local/offline SSH-gateway quick start, the remote signal-server path, an SSH-relevant config/env reference verified against punchd-bridge-rs config.rs, troubleshooting, and an explicit assumptions list (punchd.keylessh.com, keylessh-vs-s5 realm, Node-vs-Rust). Cross-links to DEPLOYMENT.md and flow-diagram.md for full detail. README gets a one-line pointer.
New docs/SIGNAL-SERVER.md, companion to PUNCHD-GATEWAY.md, for users new to the signal/STUN server: what it is and when it is needed (only remote-mode NAT traversal, not local targets), a plain-words gateway/signal/coturn diagram, the signal-vs-coturn split of responsibilities, the API_SECRET gateway-registration flow and gateways:N health check, the Rust deploy.sh + coturn flags (verified), a config/env reference from config.rs, ports/firewall, troubleshooting, and an explicit assumptions list (live punchd.keylessh.com, keylessh-vs-s5 realm and myclient-stun, and the genuinely ambiguous Node-vs-Rust choice). README gets a one-line pointer next to the punchd guide.
The project is converging on Rust and removing the Node/TS duplicate bridge and signal-server implementations. Strip all Node references from both easy guides and drop the Node-vs-Rust open question: document only bridges/punchd-bridge-rs and signal-server-rs (which has its own deploy.sh + coturn setup). Present a single Rust path in each doc.
The Node/TS implementations are superseded by their Rust ports, so remove them
and preserve their test coverage in the Rust crates.
Removed:
- bridges/punchd-bridge/ (Node gateway -> bridges/punchd-bridge-rs)
- bridges/tcp-bridge/ (Node WS-TCP bridge -> bridges/ssh-bridge-rs)
- signal-server/ (Node signal server -> signal-server-rs)
- tests/gateway/{der-codec,rdcleanpath}.test.ts and
tests/signal-server/{pairing,registry}.test.ts (ported to Rust)
Ported coverage (all passing):
- der_codec.rs + rdcleanpath.rs: 26 #[test]s mirroring the TS DER/RDCleanPath
encode/decode + parse/build/error assertions
- signal-server-rs registry/mod.rs: 11 #[test]s (register/remove, fewest-clients
selection, realm lookup, re-registration, unpairing, counts)
- signal-server-rs signaling/handler.rs: 5 #[test]s (auto/explicit pairing +
the exact paired/error JSON frames, via channel senders)
quic-relay: no such directory exists and the Rust stack removed the QUIC relay
(WebRTC DataChannel is used instead), so the stale .gitignore line and the
pkill hint went with the Node server; nothing depends on it.
References updated: .gitignore (drop dead line, add ssh-bridge-rs/target),
docker-compose.yml (drop commented tcp-bridge block), .env.example, README,
docs/{ARCHITECTURE,DEPLOYMENT,DEVELOPERS,PUNCHD-GATEWAY} point at the Rust dirs;
docs/flow-diagram.md keeps its historical Node source citations with a note that
the current code is the Rust crates. CI already builds only the Rust crates.
Wire the Rust SSH bridge into CI so the image the Azure marketplace already pulls (tideorg/keylessh-bridge:latest) is actually built again after the Node tcp-bridge was removed. Add a build-ssh-bridge job to docker-build.yml, mirroring build-gateway exactly (same login/buildx/metadata tag scheme/ platforms/cache), building bridges/ssh-bridge-rs via its Dockerfile. Reuses the existing registry name so no Azure template changes are needed; the image keeps port 8080 + PORT/TIDECLOAK_CONFIG_B64, matching the tcp-bridge container app. Also fix two pre-existing defects that broke the ssh-bridge-rs Docker build from a clean checkout: - Track Cargo.lock (was gitignored and absent) so the Dockerfile's COPY Cargo.toml Cargo.lock step works, matching signal-server-rs. - Bump the builder base image rust:1.84 -> rust:1.94.0-bookworm; the crate uses edition 2024, unsupported by 1.84 (punchd-bridge-rs already uses 1.94). Verified: local docker build of bridges/ssh-bridge-rs succeeds; the image exposes 8080, sets PORT=8080, entrypoint ./ssh-bridge-rs.
The Deploy to Azure Container App step only echoed guidance to update a container app named keylessh-tcp-bridge with the gateway image. That app name exists nowhere else in the repo, and no azure template or deploy script defines any gateway container app (tideorg/punchd-gateway / port 7891) for it to target, so the step was non-executing, misleading dead code. Remove it and rename the workflow to Build and Push Punchd Gateway. The build+push of tideorg/punchd- gateway is unchanged.
New docs/VPN-SETUP.md, companion to the gateway + signal-server guides, for users new to the VPN: what it is and when to use it (network-level LAN reach vs one-service SSH/gateway access), a plain-words data-path diagram, the roles (gateway = VPN server, punchd-vpn = client; not TideSSP/PunchdEndpoint), the TideCloak JWT/DPoP auth + vpn:<gatewayId> role firewall model, gateway-side and client-side setup steps, a client args reference verified against punchd_vpn.rs, ports (QUIC 7893 + signal/TURN), troubleshooting, and an assumptions list (custom IP-over-QUIC not WireGuard, hardcoded 10.66.0.0/24 + MTU + TUN name, IPv4-only, punchd-vpn vs PunchdEndpoint). Grounded in bridges/punchd-bridge-rs vpn code; Rust-only. README gets a pointer next to the gateway/signal guides.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.