Add permissioned setupHEADmaster

3 files changed, 24 insertions, 0 deletions

diff --git a/api/handlers/peer.go b/api/handlers/peer.go
index 51fa047..af6e42a 100644
--- a/api/handlers/peer.go
+++ b/api/handlers/peer.go
@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"crypto/subtle"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -36,6 +37,13 @@ func NewPeer(storeService store.Service, wireguardService wireguard.Service, con
 	return func(w http.ResponseWriter, r *http.Request) {
 		params := mux.Vars(r)
 		port := params["port"]
+		key := r.URL.Query().Get("key")
+
+		if configService.Config().Permissions.Enabled {
+			if subtle.ConstantTimeCompare([]byte(key), []byte(configService.Config().Permissions.SecretKey)) != 1 {
+				http.Error(w, "bad key", http.StatusForbidden)
+			}
+		}
 
 		peer, err := wireguardService.NewPeer()
 		if err != nil {
diff --git a/pkg/config/service.go b/pkg/config/service.go
index 3c9a27e..90d0d11 100644
--- a/pkg/config/service.go
+++ b/pkg/config/service.go
@@ -22,6 +22,10 @@ type Config struct {
 		Port          string `yaml:"port" validate:"required"`
 		InterfaceName string `yaml:"interfaceName" validate:"required"`
 	} `yaml:"wireGuard"`
+	Permissions struct {
+		Enabled   bool   `yaml:"enabled"`
+		SecretKey string `yaml:"secretKey"`
+	}
 	ExpireAfter int `yaml:"expireAfter"`
 }
 
@@ -95,5 +99,9 @@ func (s *service) validateConfig(c *Config) error {
 		}
 	}
 
+	if c.Permissions.Enabled && len(c.Permissions.SecretKey) == 0 {
+		return fmt.Errorf("requested permissioned setup but no secret key was given")
+	}
+
 	return nil
 }
diff --git a/web/index.html b/web/index.html
index cdb46ed..4cc5a7f 100644
--- a/web/index.html
+++ b/web/index.html
@@ -52,6 +52,14 @@ curl -sSL http://{{.Host}}/8080 | sh
 
         <dt>Inactivity time: {{.ExpireAfter}} seconds</dt>
         <dd>Tunnels will expire after this amount of time. (You will need to re-create a new one.)</dd>
+
+        <dt>Permissioned: {{.Permissioned}}</dt>
+        <dd>If true, a secret key will also need to be passed to create a tunnel.</dd>
+        <dd>
+            <pre>
+curl -sSL http://{{.Host}}/[PORT YOU WANT TO FORWARD]?key=[SECRET KEY] | sh
+            </pre>
+        </dd>
     </dl>
 
 </body>