Commit Graph

500 Commits

Author SHA1 Message Date
Jamil
0a19c67cd1 Use application_version() to link back to repo (#1181) 2022-12-07 11:11:30 -08:00
Andrew Dryga
28fe571543 Small improvements to make setup process easier for OS contributors (#1171)
* Remove _build folders for umbrella apps

For umbrella apps everything goes into /_build directory so there no need to ignore directories that should never be created

* Change mix aliases to be more aligned with what OS community would expect

1. We want ecto.create and ecto.migrate to be run on each tests, this will simplify setup steps (no need to run migrations manually)

2. ecto.remigrate is not needed because now you can just run ecto.drop and on tests migrations would be executed anyways.

* Rename docker-compose step name in CONTRIBUTING.md

The step was renamed here: dd67baf629 (diff-67a4805fdcc6145d7b3ada2a6099a9b2e91c9d0fd108c22f95d2f01d219793d1R10)

* Remove .devcontainer

This an is opinionated change. Right now devcontainer doesn't work but should be easy to fix (with renaming step name), but at the same time it forces developers that use VS code to have unified development environment (including plugins for the editor itself).

I feel like it's not a good path to go for OS and for small team - everyone should be allowed to use setup they like. Especially for people like me that tend to recompile ls-elixir for Elixir plugin from master branch.

Plus it's yet another thing to maintain while nobody on the team is using it, which means it will be always causing issues.

* Make fz_http mix.exs aliases aligned with umbrella app ones

* Redirect stderr to stdout in a command called from dev.exs

Otherwise I'm getting this on my MacOS (that has a `route` implementation that doesn't show interfaces) when `mix phx.server` is executed:
```
usage: route [-dnqtv] command [[modifiers] args]
```

* Fix race condition due to static device field values

Both public_key and name are unique and we should not use static values for field covered by unique index, otherwise deadlocks and slow tests are expected.

* Remove unwanted transaction block

The changeset code doesn't have any code that accesses the database and individual Ecto.SQL commands are already wrapped in transactions by default, so there is no need to start it manually and hold for longer than expected (while irrelevant Elixir code is running).

* Use netstat to identify egress interface on MacOS

* Rename uninstall.sh to omnibus-uninstall.sh

* Fix uninstall path in omnibus_build.yml
2022-12-06 15:07:45 -08:00
dependabot[bot]
94061a3581 Bump hammer_plug from 2.1.1 to 3.0.0 (#1176)
Bumps [hammer_plug](https://github.com/ExHammer/hammer-plug) from 2.1.1 to 3.0.0.
- [Release notes](https://github.com/ExHammer/hammer-plug/releases)
- [Changelog](https://github.com/ExHammer/hammer-plug/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ExHammer/hammer-plug/compare/v2.1.1...v3.0.0)

---
updated-dependencies:
- dependency-name: hammer_plug
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-06 14:32:58 -08:00
Jamil
f4cc03454e Wrap magic link with url() (#1170)
This broke when I introduced ~p across the codebase.
2022-12-03 08:19:21 -08:00
Jamil
6d1010c21b Use complete Firezone URL for post_logout_uri (#1160) 2022-11-30 22:27:21 -08:00
Gabi
116de06bf4 Disallow netmasks in devices' ip to prevent overlaps in firewall (#1140)
* fix: disallow netmasks in devices' ip to prevent overlaps in firewall

/32 is still allowed for ipv4 and /128 is still allowed for ipv6.
No migration is needed since netmasks for devices ips were broken
before-hand.

* chore: rename `validate_single_ip` function and reword its error message

* Update pre-commit to allow slash

* fix restore cache

* Refactor a bit

* Fix clobbered restore-keys

* Break cache

Co-authored-by: Jamil Bou Kheir <jamilbk@users.noreply.github.com>
2022-11-23 22:56:22 -08:00
Kian-Meng Ang
ec5f0e24ae Fix typos (#1141)
Found via `codespell -S omnibus,*.json,yarn.lock,seeds.exs -L keypair,keypairs,iif,statics,wee`
2022-11-23 21:42:54 -08:00
Jamil
50b2ab83a0 Only test when view is mounted (#1130) 2022-11-18 11:18:17 -08:00
Jamil
340ec59109 Ensure phoenix 1.7 is in subproject (#1128) 2022-11-18 08:01:27 -08:00
Jamil
1054de6585 Fix intermittent assert_{patched,redirected} failures (#1125)
* Fix intermittent assert_{patched,redirected} failures

* Split into two

* Remove empty file dope
2022-11-17 11:58:58 -08:00
Jamil
11695393f7 Update Phoenix to 1.7.0-rc.0 (#1119)
* Update Phoenix to 1.7.0-rc.0

* Should maybe compile without warnings now

* step 1: verified routes

* Use verified routes sigil

* Fix typos

* Formatter not working\?

* Fix formatter

* fix formatter file list
2022-11-17 07:06:39 -08:00
Tore Anderson
6a3fb2bfc2 Allow btree_gist extension to preexist (#1122)
This commit has the exact same rationale as cc280dae, just for a
different extension that I unfortunately missed the first time around.

This time I searched the repo for occurrences of `CREATE EXTENSION`
instead of the name of the extension causing the error, so hopefully I
did not miss anything else.
2022-11-17 06:24:34 -08:00
Tore Anderson
cc280dae50 Allow pgcrypto extension to preexist (#1114)
The CREATE EXTENSION query requires superuser privileges, which means
that the Firezone container may not be allowed to execute it when
accessing an externally hosted database, resulting in the database
failing to initialise properly.

One potential workaround to this problem is to have the database admin
ascertain that the pgcrypto extension is already present and ready for
use, prior to starting the Firezone container for the first time.

Unfortunately, however, this currently fails in the following manner:

14:42:44.731 [info] execute "CREATE EXTENSION pgcrypto"
** (Postgrex.Error) ERROR 42710 (duplicate_object) extension "pgcrypto" already exists

Adding the IF NOT EXISTS condition to the CREATE EXTENSION query should
allow it to succeed.
2022-11-16 07:28:06 -08:00
Jamil
a994f3f350 Update esaml to properly parse signed assertions (#1113)
* Update esaml to properly parse signed assertions

* Add Jumpcloud SAML doc

* Add required fields to config

* Add required fields to config

* Fix typo

* Formatting

* Minor fixes

* More clarifying

* yet more typo fixes

* Fix test
2022-11-15 21:34:31 -08:00
Jamil
1df5db4251 Support end_session_uri, custom redirect_uri and PKCE (#1110)
* Checkpoint PKCE; Refactor state

* tests passing

* id_token_hint working

* Fix WGAdapter setting

* what happened to redirect_uri

* Add redirect_uri custom

* Remove dbg

* Fix nil logout

* session cleanup

* Remove unneeded fixtures

* redis disable

* Fix tests
2022-11-15 18:28:26 -08:00
(╯°□°)╯︵ uᴉǝssnH ɐɟɐʇsoW
4de45306be fetch logo from config instead of default image (#1098)
Signed-off-by: (╯°□°)╯︵ uᴉǝssnH ɐɟɐʇsoW <mostafa.hussein91@gmail.com>

Signed-off-by: (╯°□°)╯︵ uᴉǝssnH ɐɟɐʇsoW <mostafa.hussein91@gmail.com>
2022-11-07 09:55:26 -08:00
Gabi
029891c69e Build/fix no prefix (#1089)
* fix: use caddy in host network_mode and make sure urls have a scheme

* fix: remove unnecesary exposed ports

* fix: remove support for hostnames begining with // since caddy doesn't support it

* Fix schemeless external URLs; error on invalid ones (#1090)

* Fix schemeless external URLs; error on invalid ones

* use different dockerfile for linux vs non-linux

* Use conditional EXTERNAL_URL defaults

* suppress empty warning

* postgres volume location

* Use inline Caddyfile

Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
2022-11-03 19:36:37 -07:00
Jamil
5e5c2d35ac Use :live, not live.html (#1069) 2022-10-27 15:24:52 -07:00
Jamil
27e6ddc293 Fix configure bug for admins (#1045)
* Allow admins to configure devices

* Disable SSL certs

* Update scripts/install.sh

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>
2022-10-18 22:20:16 -07:00
Jamil
0455ee8373 Use /contact/sales over typeform (#1039) 2022-10-18 08:17:10 -07:00
Jamil
3bc19c4c9f allow dns hosts; fix notifications concurrency issues (#1027)
* allow dns hosts; fix notifications concurrency issues

* Make notifications tests a little more robust
2022-10-16 13:44:59 -07:00
Jamil
dd11c728b0 Better validate OIDC and SAML configs (#1026)
* Bump postgres to release; Note on Caddy cert

* default auto_create_users

* Validate SAML and OIDC configs better

* Fix failing test
2022-10-15 18:33:32 -07:00
Jamil
0cf0a82194 Swallow OIDC errors (#1025) 2022-10-14 16:05:10 -07:00
Jamil
aa67b689e5 Add keycloak dev (#1023)
* Add keycloak dev

* Fix test using string keys
2022-10-14 14:19:24 -07:00
Jamil
d963929c07 0.6.0 (#1004)
* 0.6.0

* Make OIDC and SAML user provisioning configurable per-provider (#1015)

* Got ugly migration to work

* Move auto_create_users to per-provider config

* Update deps to bust cache

* Update Process sleep

* Update docs with Auto create users

* working migration script (#1013)

* Add telem for Docker and SAML (#1020)

* Add telem for Docker and SAML

* Omit unneeded format
2022-10-13 15:22:53 -07:00
Jamil
448ef072e5 Docs sec controls (#1018)
* add security controls document

* Add sec controls doc
2022-10-13 12:59:41 -07:00
Jamil
08bf880547 Move persistent term cache to cachex (#1003)
* Move persistent term cache to cachex

* Rename Conf -> Configurations
2022-10-05 05:28:50 -05:00
Jamil
185790dd0f Fix error due to updated LiveView (#1001) 2022-10-03 22:47:34 -05:00
Jamil
6cb6cb1f93 Favor live redirects over patches (#985)
* Checkpoint

* Favor redirect over patch

* Fix tests
2022-09-27 10:15:48 -07:00
Jamil
820abe170c Upgrade to LiveView 0.18 and use replace: true (#980)
* Upgrade to LiveView 0.18 and use replace: true

* Fetch test deps too

* Fix test with new liveview
2022-09-24 12:39:05 -07:00
Jamil
ae111ad437 Add websocket connection troubleshooting section (#977)
* Remove markdown exceptions for table and code blocks

* Fix Zitadel docs errors

* Add trailingSlash: false to prevent 404 bug
2022-09-23 15:35:01 -07:00
Jamil
50845b0ede Open in new tab (#966) 2022-09-15 18:10:23 -07:00
Jamil
aab77656a7 Add admin_count and active_device_count (#956)
* install, compile deps for test env

* Add admin_count and active_device_counts to telemetry

* Update apps/fz_http/test/fz_http/devices_test.exs

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>
2022-09-13 08:50:38 -07:00
Jamil
70e4bf36c1 Add subscribe for updates link (#958) 2022-09-13 08:49:46 -07:00
Jamil
7861977379 (Supercedes #950) Bump elixir (#953)
* Bump elixir to 1.14.0

* gen_env -> compile_env

* Update Dockerfiles

* Update software
2022-09-12 14:40:16 -07:00
Jamil
ea67535f9a Bump runtimes; deps; postgres 13.5 -> 13.8 (#944)
* Bump deps; runtimes; pg to 13.8

* bump npm deps

* Bump nginx

* Use PCRE over PCRE2
2022-09-01 21:08:37 -07:00
Jamil
f384db2444 Trim whitespace on string fields (#941)
* Trim whitespace on string fields

* Update apps/fz_http/lib/fz_http/shared_validators.ex

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>
2022-08-30 14:26:40 -07:00
Gabi
40120b5b26 remove ct != established from rules (#940) 2022-08-30 13:18:33 -07:00
Jamil
a3f5e0613f Prevent autocompleting passwords in FF (#936) 2022-08-29 23:04:53 -07:00
Jamil
bc7bdb3386 Add ip exhaustion error to base to show when fields are hidden (#935)
* Add ip exhaustion error to base to show when fields are hidden

* Add tmp as an empty dir

* Bump deps
2022-08-29 22:32:05 -07:00
Jamil
06e3956317 create-or-reset-admin resets admin role to :admin (#922) 2022-08-17 19:53:29 -07:00
Jamil
5d113ba251 Fix rules form (#917) 2022-08-11 17:18:50 -07:00
Jamil
a4340be61e Fix endpoint placeholder & security overflow (#916)
* Use consistent placeholders

* Remove redundant text and overflow-x
2022-08-11 16:25:59 -07:00
Jamil
db785d7ba2 Allow disabling the configuration of devices by unprivileged users (#909)
* Add all the config options, test should fail

* Don't show fields that can't be edited

* Remove unneeded leading match

* use str not ~r

* Choose Conf.get or @allow

* Add Docker env vars
2022-08-10 15:56:15 -07:00
Jamil
5e60d2b442 Bump Wireguardex (#912) 2022-08-10 14:50:47 -07:00
Jamil
ebb3d383d7 remove beta program (#908) 2022-08-09 11:37:54 -07:00
Jamil
0a7c16af17 Bump Wireguardex (#906) 2022-08-09 11:09:44 -07:00
Jamil
5617a72910 Clarify when UI config is overriding ENV config (#872)
* Some minor clarification and UI polish

* Pull overrides from changeset
2022-08-08 21:14:06 -07:00
Gabi
f03617b07f nft rules match wireguard interface name (#901) 2022-08-08 12:56:33 -07:00
Gabi
038f025220 Re-add port-based rules and gate them behind kernel version (#890)
* Revert "Revert "Add initial rough version of port based rules (#874)" (#888)"

This reverts commit 58e48457ad.

* gate port rule depending on kernel version

* fix version comparision

* allow for no port-related values when creating rule event

* Fix struct accessor

* fix getting port type in rule list component

* small fix

* oops

* hide port-related display on disabled port-rules

* Gate table headers

* update port-based rule for boot-up only and update ui

* fix tests

* fix disable button

* Minor UI and wording update

* Add firewall functional tests

* fix functional testing

* add debug log for functional debugging

* fix

* Fix functional testing by preventing overlap

* remove sudo from functional firewall tests

* fix error message

* fix firewall ci

* re-adding sudo to functional test

* fix expected results in functional test

* Apply suggestions

* Update apps/fz_http/lib/fz_http_web/live/rule_live/rule_list_component.html.heex

Signed-off-by: Jamil <jamilbk@users.noreply.github.com>

Co-authored-by: Jamil <jamilbk@users.noreply.github.com>
2022-08-05 16:11:33 -07:00