Archive: Merge final presentation backend (#173)

This PR merges the presentation day backend, Thanks @AnnsAnns for
reminding me...

node/code/dev/border_router/start_network.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+
+USB_CDC_ECM_DIR="$(dirname "$(readlink -f "$0")")"
+
+INTERFACE_CHECK_COUNTER=5  # 5 attempts to find usb interface
+
+find_interface() {
+    INTERFACE=$(ls -A /sys/bus/usb/drivers/cdc_ether/*/net/ 2>/dev/null)
+    INTERFACE_CHECK=$(echo -n "${INTERFACE}" | head -c1 | wc -c)
+    if [ "${INTERFACE_CHECK}" -eq 0 ] && [ ${INTERFACE_CHECK_COUNTER} != 0 ]; then
+        # We want to have multiple opportunities to find the USB interface
+        # as sometimes it can take a few seconds for it to enumerate after
+        # the device has been flashed.
+        sleep 1
+        ((INTERFACE_CHECK_COUNTER=INTERFACE_CHECK_COUNTER-1))
+        find_interface
+    fi
+    INTERFACE=${INTERFACE%/}
+}
+
+echo "Waiting for network interface."
+find_interface
+
+if [ "${INTERFACE_CHECK}" -eq 0 ]; then
+    echo "Unable to find network interface"
+    exit 1
+else
+    echo "Found interface: ${INTERFACE}"
+fi
+
+setup_interface() {
+    sysctl -w net.ipv6.conf."${INTERFACE}".forwarding=1
+    sysctl -w net.ipv6.conf."${INTERFACE}".accept_ra=0
+    ip link set "${INTERFACE}" up
+    ip a a fe80::1/64 dev "${INTERFACE}"
+    ip a a fd00:dead:beef::1/128 dev lo
+}
+
+cleanup_interface() {
+    ip a d fe80::1/64 dev "${INTERFACE}"
+    ip a d fd00:dead:beef::1/128 dev lo
+    ip route del "${PREFIX}" via fe80::2 dev "${INTERFACE}"
+}
+
+cleanup() {
+    echo "Cleaning up..."
+    cleanup_interface
+    if [ -n "${UHCPD_PID}" ]; then
+        kill "${UHCPD_PID}"
+    fi
+    if [ -n "${DHCPD_PIDFILE}" ]; then
+        kill "$(cat "${DHCPD_PIDFILE}")"
+        rm "${DHCPD_PIDFILE}"
+    fi
+    trap "" INT QUIT TERM EXIT
+}
+
+start_uhcpd() {
+    ip route add "${PREFIX}" via fe80::2 dev "${INTERFACE}"
+    ${UHCPD} "${INTERFACE}" "${PREFIX}" > /dev/null &
+    UHCPD_PID=$!
+}
+
+start_dhcpd() {
+    ip route add "${PREFIX}" via fe80::2 dev "${INTERFACE}"
+    DHCPD_PIDFILE=$(mktemp)
+    ${DHCPD} -d -p "${DHCPD_PIDFILE}" "${INTERFACE}" "${PREFIX}" 2> /dev/null
+}
+
+start_radvd() {
+    ADDR=$(echo "${PREFIX}" | sed -e 's/::\//::1\//')
+    ip a a "${ADDR}" dev "${INTERFACE}"
+    sysctl net.ipv6.conf."${INTERFACE}".accept_ra=2
+    sysctl net.ipv6.conf."${INTERFACE}".accept_ra_rt_info_max_plen=64
+    ${RADVD} -c "${INTERFACE}" "${PREFIX}"
+}
+
+if [ "$1" = "-d" ] || [ "$1" = "--use-dhcpv6" ]; then
+    USE_DHCPV6=1
+    shift 1
+else
+    USE_DHCPV6=0
+fi
+
+if [ "$1" = "-r" ] || [ "$1" = "--use-radvd" ]; then
+    USE_RADVD=1
+    shift 1
+else
+    USE_RADVD=0
+fi
+
+PREFIX=$1
+[ -z "${PREFIX}" ] && {
+    echo "usage: $0 [-d|--use-dhcpv6] [-r|--use-radvd ] <prefix> [<serial-port>]"
+    exit 1
+}
+
+if [ -n "$2" ]; then
+    PORT=$2
+fi
+
+trap "cleanup" INT QUIT TERM EXIT
+
+setup_interface
+
+if [ ${USE_DHCPV6} -eq 1 ]; then
+    DHCPD="$(readlink -f "${USB_CDC_ECM_DIR}/../dhcpv6-pd_ia/")/dhcpv6-pd_ia.py"
+    start_dhcpd
+elif [ ${USE_RADVD} -eq 1 ]; then
+    RADVD="$(readlink -f "${USB_CDC_ECM_DIR}/../radvd/")/radvd.sh"
+    start_radvd
+else
+    UHCPD="$(readlink -f "${USB_CDC_ECM_DIR}/../uhcpd/bin")/uhcpd"
+    start_uhcpd
+fi
+
+if [ -z "${PORT}" ]; then
+    echo "Network enabled over CDC-ECM"
+    echo "Press Return to stop"
+    read -r
+else
+    "${USB_CDC_ECM_DIR}/../pyterm/pyterm" -p "${PORT}"
+fi

platform/compose.common.yml

@@ -13,13 +13,16 @@ x-common-healthcheck: &common-healthcheck
 services:
   proxy:
     image: nginx:1.25-alpine
-    ports:
-      - "127.0.0.1:${PROXY_PUBLIC_PORT}:80"
-      - "[::]:${PROXY_PUBLIC_PORT}:80"
+    #ports:
+      #- "127.0.0.1:${PROXY_PUBLIC_PORT}:80"
+      #- "[::1]:${PROXY_PUBLIC_PORT}:80"
+      #- "127.0.0.1:443:443"
+      #- "[::1]:443:443"
     volumes:
       - "./proxy/proxy_params:/etc/nginx/proxy_params:ro"
       - "./proxy/nginx.conf:/etc/nginx/nginx.conf:ro"
       - "./proxy/templates/default.conf.template:/etc/nginx/templates/default.conf.template:ro"
+      - "./data/ssl/certs:/etc/nginx/ssl"
     environment:
       PROXY_PUBLIC_PORT: ${PROXY_PUBLIC_PORT}
       # NOTE: picky about trailing slash
@@ -104,7 +107,7 @@ services:
       POSTGRES_BACKEND_DB: backend
       POSTGRES_BACKEND_PASSWORD: ${POSTGRES_BACKEND_PASSWORD}
     healthcheck:
-      test: [ "CMD", "pg_isready", "-q", "-d", "postgres", "-U", "postgres" ]
+      test: [ "CMD", "pg_isready", "-q", "-h", "postgres", "-d", "postgres", "-U", "postgres" ]
       <<: *common-healthcheck
     volumes:
       - postgres:/var/lib/postgresql/data

platform/compose.raspi.yml

@@ -4,10 +4,31 @@
 #
 
 services:
+  proxy:
+    environment:
+      PROXY_PUBLIC_PORT: 80
+    ports:
+      - "0.0.0.0:80:80"
+      - "0.0.0.0:443:443"
+      - "[::]:80:80"
+      - "[::]:443:443"
+    volumes:
+      - "./data/htdocs:/usr/share/nginx/html"
+  devdash:
+    build:
+      args:
+        VITE_AUTHORITY: https://teamagochi/kc/realms/teamagochi
+        VITE_CLIENT_ID: teamagochi-webapp
   teashan:
     ports:
-      - "[fd00:dead:beef::1]:5683:5683/udp" # [coap://]      CoAP over UDP (with experimental OSCORE)
-      - "[fd00:dead:beef::1]:5683:5683/tcp" # [coap+tcp://]  CoAP over TCP (experimental) 
-      - "[fd00:dead:beef::1]:5684:5684/udp" # [coaps://]     CoAP over DTLS
-      - "[fd00:dead:beef::1]:5684:5684/tcp" # [coaps+tcp://] CoAP over TLS (experimental)
-      - "[fd00:dead:beef::1]:5685:5685/udp" # [coap://]      CoAP over UDP[::]
+      - "[fd00:dead:beef::1]:5683:5683/udp" # [coap://]
+      - "[fd00:dead:beef::1]:5683:5683/tcp" # [coap+tcp://]
+      - "[fd00:dead:beef::1]:5684:5684/udp" # [coaps://]
+      - "[fd00:dead:beef::1]:5684:5684/tcp" # [coaps+tcp://]
+      - "[fd00:dead:beef::1]:5685:5685/udp" # [coap://]
+  keycloak:
+    environment:
+      KC_HOSTNAME_URL: https://teamagochi/kc
+      KC_HOSTNAME_ADMIN_URL: https://teamagochi/kc
+  backend:
+    pull_policy: never

platform/create-certs.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+openssl genrsa -out ./data/ssl/certs/server.key 2048
+openssl req -new -out ./data/ssl/certs/server.csr -key ./data/ssl/certs/server.key -config ./data/ssl/openssl.cnf
+openssl x509 -req -days 3650 -in ./data/ssl/certs/server.csr -signkey ./data/ssl/certs/server.key -out ./data/ssl/certs/server.crt -extensions v3_req -extfile ./data/ssl/openssl.cnf
+
+#openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./data/nginx.key -out ./data/ssl/nginx.crt

platform/data/htdocs/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitkeep

platform/data/keycloak/import/teamagochi-realm.json

@@ -728,15 +728,15 @@
     "clientId" : "teamagochi-webapp",
     "name" : "Teamagochi Web-Application",
     "description" : "",
-    "rootUrl" : "http://localhost:4000",
+    "rootUrl" : "https://teamagochi",
     "adminUrl" : "",
     "baseUrl" : "/",
     "surrogateAuthRequired" : false,
     "enabled" : true,
     "alwaysDisplayInConsole" : false,
     "clientAuthenticatorType" : "client-secret",
-    "redirectUris" : [ "http://localhost:3030/*", "http://localhost:5173/*", "http://localhost:4000/*" ],
-    "webOrigins" : [ "http://localhost:3030", "+", "http://localhost:4000" ],
+    "redirectUris" : [ "http://teamagochi:3030/*", "http://localhost:5173/*", "http://teamagochi/*", "https://teamagochi/*" ],
+    "webOrigins" : [ "http://teamagochi:3030", "+", "http://teamagochi", "https://teamagochi", "https://teamagochi:5713" ],
     "notBefore" : 0,
     "bearerOnly" : false,
     "consentRequired" : false,
@@ -748,7 +748,7 @@
     "frontchannelLogout" : true,
     "protocol" : "openid-connect",
     "attributes" : {
-      "post.logout.redirect.uris" : "/*##http://localhost:3030##http://localhost:5173/*##http://localhost:4000/*",
+      "post.logout.redirect.uris" : "/*##http://teamagochi:3030##http://localhost:5173/*##http://teamagochi/*##https://teamagochi/*",
       "oauth2.device.authorization.grant.enabled" : "false",
       "backchannel.logout.revoke.offline.tokens" : "false",
       "use.refresh.tokens" : "true",

platform/data/ssl/certs/server.crt

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqDCCApCgAwIBAgIUR0OdADZcrVfEHXFeElxOzUNy8REwDQYJKoZIhvcNAQEL
+BQAwXzELMAkGA1UEBhMCREUxEDAOBgNVBAgMB0hhbWJ1cmcxEDAOBgNVBAcMB0hh
+bWJ1cmcxFzAVBgNVBAoMDlRlYW1hZ29jaGlASEFXMRMwEQYDVQQDDAp0ZWFtYWdv
+Y2hpMB4XDTI0MDcwMTA4NTAxNFoXDTM0MDYyOTA4NTAxNFowXzELMAkGA1UEBhMC
+REUxEDAOBgNVBAgMB0hhbWJ1cmcxEDAOBgNVBAcMB0hhbWJ1cmcxFzAVBgNVBAoM
+DlRlYW1hZ29jaGlASEFXMRMwEQYDVQQDDAp0ZWFtYWdvY2hpMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtfEFZYnTIue1nhW4fhLkKDi8HON9yfrzqFPy
+iDGQK04laAo/1VZoTvjtRJB0WwbH8jkG9pTz/07QCiLhQRoqHluJKr0vL8/qlNEB
+i7Ct0mNgnnFjQjjKN06j9wi5lM9LuHzBHDdou+UwGT0bAWdyxED6HS4t31ncviKq
+8P83TH+6u/3/RnEmQmHXRmNnfZwdZ3gsqJFvGUpTJlDS63THm1RcGI3WSBQt53fF
+sg7F+MIEH7i1dzWKYJqROU1HiasgP6yZaEicMn6UbQWMjijdHxiZqTSWfRU6Z8CO
+JB0ggigAXjdGzJRILkHPtjR7pSDqPRm49s3q6yfUZB43KhU81wIDAQABo1wwWjA5
+BgNVHREEMjAwggwqLnRlYW1hZ29jaGmCDnRlYW1hZ29jaGkuZGV2ghAqLnRlYW1h
+Z29jaGkuZGV2MB0GA1UdDgQWBBT3+Qex8n7ofXOnKBWw9O9JNzt7zTANBgkqhkiG
+9w0BAQsFAAOCAQEAJNZ6A5cHqd4grUL/OZCE42vLpCP5WS3z4mvFTdJWx7lXk5Zu
+QnKHl2yPOb9AZL9FI4xLXTwUpNoSqAxv7cv4OJjdarHGAdNMDxDMkZgpbf70KxH7
+fHoleM0NATLHwW+U4hM8gqcszzlXVbJqxw98wEXwTeClnxPmNSG/7/Hihaxdrdf8
+L0nJN5ELRX6oLz9Lh8ZKIqiJ8bm0ZZcPcRC6wFXPr2MuNHIPnXaWSQPxaeE6wJ0D
+SIEHxYUtXbF52/cNUeVVeP8z61sefJX12+xNUC+0ftf6brRwFq5kvdkHRwDD6mcg
+BGSHIVaQinlzsdS+SjpGAykR9+j7JfRZKqiu0g==
+-----END CERTIFICATE-----

platform/data/ssl/certs/server.csr

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIC8DCCAdgCAQAwXzELMAkGA1UEBhMCREUxEDAOBgNVBAgMB0hhbWJ1cmcxEDAO
+BgNVBAcMB0hhbWJ1cmcxFzAVBgNVBAoMDlRlYW1hZ29jaGlASEFXMRMwEQYDVQQD
+DAp0ZWFtYWdvY2hpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtfEF
+ZYnTIue1nhW4fhLkKDi8HON9yfrzqFPyiDGQK04laAo/1VZoTvjtRJB0WwbH8jkG
+9pTz/07QCiLhQRoqHluJKr0vL8/qlNEBi7Ct0mNgnnFjQjjKN06j9wi5lM9LuHzB
+HDdou+UwGT0bAWdyxED6HS4t31ncviKq8P83TH+6u/3/RnEmQmHXRmNnfZwdZ3gs
+qJFvGUpTJlDS63THm1RcGI3WSBQt53fFsg7F+MIEH7i1dzWKYJqROU1HiasgP6yZ
+aEicMn6UbQWMjijdHxiZqTSWfRU6Z8COJB0ggigAXjdGzJRILkHPtjR7pSDqPRm4
+9s3q6yfUZB43KhU81wIDAQABoEwwSgYJKoZIhvcNAQkOMT0wOzA5BgNVHREEMjAw
+ggwqLnRlYW1hZ29jaGmCDnRlYW1hZ29jaGkuZGV2ghAqLnRlYW1hZ29jaGkuZGV2
+MA0GCSqGSIb3DQEBCwUAA4IBAQANgs+qxKQ1zTcM+sEV90kYE1e1fyH1lAKuk9Bm
+2/7YTLxGAryQSMfWsZgCKCT8FbGBGRTP6cC6O33Yk+7xYWDft23+sBJcZ350jeqC
+pBo3ChigkP5vutl5uyyp/n0T7BvoNqQazgQovBA/iWybP1RLg+PdLB2u8F0x7aDq
+otbI8odrlbkEAkDrADwvNdUI34HwXI+adNgLQdIQvDOKoablEAMUMxdmBnbKbfwt
+38YOmJnHddn/1Oj9g9xh/3/SxcwY1OsxIVbEu97fk8KUJDVdjTnWmk+vhCv0idhp
+ySF+rRQ6McyGLI6tzQvkPTOf9HyzVPABWjJx7AExWdijax4w
+-----END CERTIFICATE REQUEST-----

platform/data/ssl/certs/server.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC18QVlidMi57We
+Fbh+EuQoOLwc433J+vOoU/KIMZArTiVoCj/VVmhO+O1EkHRbBsfyOQb2lPP/TtAK
+IuFBGioeW4kqvS8vz+qU0QGLsK3SY2CecWNCOMo3TqP3CLmUz0u4fMEcN2i75TAZ
+PRsBZ3LEQPodLi3fWdy+Iqrw/zdMf7q7/f9GcSZCYddGY2d9nB1neCyokW8ZSlMm
+UNLrdMebVFwYjdZIFC3nd8WyDsX4wgQfuLV3NYpgmpE5TUeJqyA/rJloSJwyfpRt
+BYyOKN0fGJmpNJZ9FTpnwI4kHSCCKABeN0bMlEguQc+2NHulIOo9Gbj2zerrJ9Rk
+HjcqFTzXAgMBAAECggEAIbWm0NHQ7zosIb6XgLBiWntsixOxNi+LXogzOv2n3wYr
+ExQ3EIFicSNY3qe/DzB58kyTmDMv5AFHtWESCBxfamF+UA9eQ0cMCQeSeD3DbuQf
+vit2/wmDmey1n2sb61DfEC75Ho+7lXiYyUxTiRaQIoGBdc+dCzFcn1PQBTfcGI2P
+rHzDE+TxOIjELLH/AUmJgqcG4AQO8wxg1uEHLtsLDmGorqwzGN1ht63u7fpH7CYs
+6r/1+ovhkhOCg+/sjOORQ5Vkyrju1es1AfLp95BRCGKlh459TbjrAb9DhmkXtO9n
+Qsdok9QxTirNGKRDwHBV4pt7uN+giZzH2XZXQ7WwiQKBgQDoS9isarRU9YRcPUw3
+TMd7WGUAtXksbVHx3GCRIcBLtHTyvOlQAnncnhSZPFkBxDEMuWMDc/TivxNThtnX
+1IJgBdLZL+d+1cFUmZ7+dR6WrVScN7fJVDGVJ3C2UKblwST89xQgikB2F305Me5P
+FLr7Miw7U0Qhdvh0NMzKoyw9bwKBgQDIgch2W9kLlao5NxxxuKAJCOAuktIePPYj
+FrBHhmHfSd+x4FzLZs8WIxj4SATPAFTF62m9jjPtw65WYuf5BmZiPCKAEqWJy4zr
+DECjnQuR2puAgFcOJ3C9DOfoqDfaYhKkZi9cCWiCwbTYDegdWTDJjD4tzPV7Co16
++eZ8fwwTGQKBgQC4h8/Wn2kjeGmt0G/kGhT5Me4CUyawGSOYawU3JUWZnf+s+E6q
+5Vyi2dzpIZxfH9gLEJXMH2gwW7NhjeUtY74xw06Mg1Z1Vh6fMu2vm6Ax9/0Xn9da
+koxUvSD3YzhBmV3lqe0OMGUmqmAqeDSkE4a5l1C1y956awTRY0Qv0NGK9wKBgGnn
+GrFhK8+RmlokALMUF/sNpBMVW0O7YSoBVtRAZztfsnYqEfkg8So5GXwx1dBb1WrA
+P5ZuIIFpxJA+J1YBilxCdNp+fs68I08WpqGEVlMQSufhYZnJPSOtSGQ7TVzcRgpt
+KoCLO5csps8i8UFnFXyuxTy9r77wQO/+RD3ngMIpAoGBAMBmzNVEPj+9XY1Zd5k0
+80PEBjZ+E9qsXTuyNorKPHeELKTQ6Ms6VUIsa9sU0COFO/y0XgYrbqyy/09N8hVs
+Fu/TtyiTiPtNCs43sBgjN8CRjsC+k+7HNA3AdCSGjx1APJC+woAeHngGnmgEplxj
+zYRxxM0+UwjyS3MDig8LneVl
+-----END PRIVATE KEY-----

platform/data/ssl/openssl.cnf

@@ -0,0 +1,17 @@
+[req]
+default_bits       = 2048
+distinguished_name = req_distinguished_name
+req_extensions     = v3_req
+prompt             = no
+[req_distinguished_name]
+countryName         = DE
+stateOrProvinceName = Hamburg
+localityName        = Hamburg
+organizationName    = Teamagochi@HAW
+commonName          = teamagochi
+[v3_req]
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = *.teamagochi
+DNS.2 = teamagochi.dev
+DNS.3 = *.teamagochi.dev

platform/devdash/Dockerfile

@@ -5,6 +5,12 @@ FROM node:20.12-bookworm as base
 #
 FROM base as builder
 
+ARG VITE_AUTHORITY
+ARG VITE_CLIENT_ID
+
+ENV VITE_AUTHORITY=$VITE_AUTHORITY
+ENV VITE_CLIENT_ID=$VITE_CLIENT_ID
+
 WORKDIR /build
 
 COPY package*.json ./

platform/devdash/src/main.tsx

@@ -17,7 +17,7 @@ const theme = createTheme(themeOptions);
 // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
 ReactDOM.createRoot(document.getElementById('root')!).render(
   <React.StrictMode>
-    <BrowserRouter basename="/">
+    <BrowserRouter basename="/dev">
       <AuthProvider userManager={userManager} onSigninCallback={onSigninCallback}>
         <ThemeProvider theme={theme}>
           <SnackbarProvider maxSnack={3}>

platform/devdash/vite.config.ts

@@ -7,7 +7,7 @@ export default defineConfig(({ command, mode }) => {
 
   const commonConfig: UserConfigExport = {
     plugins: [react()],
-    base: '/'
+    base: '/dev'
   };
 
   if (command === 'serve') {

platform/proxy/templates/default.conf.template

@@ -1,15 +1,33 @@
 server {
   listen 80 default_server;
   listen [::]:80 default_server;
+  listen 443 default_server ssl;
+  listen [::]:443 default_server ssl;
 
   server_name _;
 
+  ssl_certificate /etc/nginx/ssl/server.crt;
+  ssl_certificate_key /etc/nginx/ssl/server.key;
+
   include /etc/nginx/conf.d/*.include;
 
   #
-  # Development Dashboard
+  # Frontend
   #
   location / {
+    root /usr/share/nginx/html;
+    index index.html;
+    try_files $uri $uri/ /index.html;
+  }
+
+  #
+  # Development Dashboard
+  #
+  location = /dev {
+    rewrite ^ $scheme://$http_host/dev/ permanent;
+  }
+
+  location /dev/ {
     proxy_pass ${DEVDASH_WEB_URL};
     include proxy_params;
   }

platform/teashan/client/client-wrapper.sh

@@ -34,6 +34,7 @@ shift
 if [ "$USE_BOOTSTRAP" = true ]; then
     # With bootstrap server
     SERVER_URL=coap://localhost:5683
+    #SERVER_URL=coap://[fd00:dead:beef::1]:5683
     #SERVER_URL=coap://teamagochi:5683
     { sleep 5; echo -e "create 32769\n create 32770\n delete 6\n delete 3303\n delete 3442\n"; } \
         | java -jar ./leshan-client-demo.jar \

web_backend/build-and-push.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+echo $TEAMAGOCHI_TOKEN | docker login ghcr.io -u ozfox --password-stdin
+./mvnw install -Dquarkus.profile=prod,publish