mirror of
https://github.com/taylanbakircioglu/haproxy-openmanager.git
synced 2026-09-16 15:45:11 +00:00
bd6a31cb0d
Adds opt-in TOTP-based Multi-Factor Authentication that is fully
backwards compatible with existing logins. Operators choose to enable
MFA per account; nothing changes for users who do not opt in.
Highlights
==========
* RFC 6238 TOTP (6 digits, 30s period, SHA1) with ±30s skew tolerance,
compatible with Microsoft / Google Authenticator, Authy, Duo, 1Password.
* Per-step replay protection (`mfa_last_used_totp_step`) so a captured
code cannot be reused inside the same window.
* Fernet-encrypted TOTP secrets at rest, key resolution via
`MFA_ENCRYPTION_KEY` env (HKDF-derived from `SECRET_KEY` as fallback).
* 10 single-use, bcrypt-hashed backup codes per user, formatted
`XXXX-YYYY` from a confusion-free alphabet (no 0/O/1/I/L).
* Two-step login flow: `POST /api/auth/login` returns `mfa_required`
+ `mfa_token`, then `POST /api/auth/login/mfa-verify` accepts a TOTP
code OR a backup code. JWT is minted only after MFA succeeds.
* Self-service: users enable / disable MFA from their own row in the
Users page; admins reset (single user or bulk) but never enable on
behalf of someone else (matches AWS IAM / GitHub / Google Workspace).
* Bulk emergency reset CLI: `scripts/admin-mfa-reset-all.sh`.
Security hardening
==================
* Atomic transactions with `SELECT … FOR UPDATE` on `mfa_pending_logins`
and `users` rows so concurrent verify / enroll calls cannot race.
* `/api/mfa/enroll/start` refuses re-enrollment when MFA is already on
(prevents silent secret rotation via a stolen JWT).
* Pydantic `ValidationError` messages are sanitized before reaching the
audit log so request bodies (TOTP / backup codes in flight) never
appear in plaintext.
* Slowapi rate limits are per-USER, not per-IP, with a trusted-proxy
XFF strategy so a single ingress address cannot exhaust the bucket
for thousands of operators (`MFA_TRUSTED_PROXY_CIDRS`,
`MFA_RATE_LIMIT_*` env-overridable).
* Login query now scopes to `is_active = TRUE` so a soft-deleted row
with the same username can no longer occlude the active user
(also closes a small account-enumeration side channel).
Database
========
Additive migrations (idempotent `ADD COLUMN IF NOT EXISTS`,
`CREATE TABLE IF NOT EXISTS`):
- users: mfa_enabled, mfa_method, mfa_secret_encrypted,
mfa_enrolled_at, mfa_last_used_at, mfa_last_used_totp_step
- mfa_backup_codes (user_id ON DELETE CASCADE)
- mfa_pending_logins (user_id ON DELETE CASCADE, challenge_token,
attempts, expires_at)
- mfa_pending_enrollments (user_id ON DELETE CASCADE)
Frontend
========
* Login page becomes a 3-phase state machine
(credentials → MFA → submitting); legacy single-step login is
preserved for users who haven't enrolled.
* New MFAEnrollModal (3-step wizard: QR + secret → verify → backup
codes) using `qrcode.react`.
* Users page shows MFA column + per-row enable/disable/reset actions.
Admins viewing other users with MFA off see a non-actionable info
icon explaining that only the user themselves can enable MFA.
Deployment
==========
* `MFA_ENCRYPTION_KEY` is added to `k8s/manifests/03-secrets.yaml` as
a placeholder; `SECRET_KEY` is also placeholder-ized so both are
injected by the existing pipeline pattern (sed-replace + apply).
* No new build-time env vars are required for the frontend. The SPA
uses `window.location.host` for `/api/*` and is routed by the
existing nginx ingress configuration.
* `frontend/.dockerignore` ensures host `.env*` files cannot bleed
into the production bundle.
Tests
=====
* New unit suites:
- `test_mfa_service.py` (TOTP, encryption, backup codes)
- `test_mfa_backwards_compat.py` (regression — non-MFA flow unchanged)
- `test_mfa_rate_limits.py` (env override + dataclass immutability)
- `test_mfa_rate_limit_key.py` (JWT key, trusted-proxy XFF, fallbacks)
* All existing 1000+ unit tests continue to pass.
Documentation
=============
* README MFA section (overview, day-to-day operations, emergency
reset CLI, env variables, rate-limit tuning).
* `scripts/README.md` documents the bulk reset script.
Issue: #18
163 lines
4.4 KiB
YAML
163 lines
4.4 KiB
YAML
services:
|
|
# PostgreSQL Database
|
|
postgres:
|
|
image: postgres:15-alpine
|
|
container_name: haproxy-openmanager-db
|
|
environment:
|
|
POSTGRES_DB: haproxy_openmanager
|
|
POSTGRES_USER: haproxy_user
|
|
POSTGRES_PASSWORD: haproxy_pass
|
|
PGDATA: /var/lib/postgresql/data/pgdata
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
ports:
|
|
- "5432:5432"
|
|
networks:
|
|
- haproxy-network
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U haproxy_user -d haproxy_openmanager"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
# Redis Cache
|
|
redis:
|
|
image: redis:7-alpine
|
|
container_name: haproxy-openmanager-redis
|
|
command: redis-server --maxmemory 2gb --maxmemory-policy volatile-lru --save ""
|
|
ports:
|
|
- "6379:6379"
|
|
networks:
|
|
- haproxy-network
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 5
|
|
|
|
# Backend API - pulls from Docker Hub by default
|
|
# To build locally instead, uncomment the build section and run: docker compose build backend
|
|
backend:
|
|
image: taylanbakircioglu/haproxy-openmanager-backend:latest
|
|
# build:
|
|
# context: ./backend
|
|
# dockerfile: Dockerfile
|
|
container_name: haproxy-openmanager-backend
|
|
environment:
|
|
- DATABASE_URL=postgresql://haproxy_user:haproxy_pass@postgres:5432/haproxy_openmanager
|
|
- REDIS_URL=redis://redis:6379
|
|
- SECRET_KEY=your-secret-key-change-this-in-production
|
|
- DEBUG=False
|
|
- LOG_LEVEL=INFO
|
|
- PUBLIC_URL=http://localhost:8080
|
|
- MANAGEMENT_BASE_URL=http://localhost:8080
|
|
volumes:
|
|
- haproxy_configs:/etc/haproxy
|
|
expose:
|
|
- "8000"
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
redis:
|
|
condition: service_healthy
|
|
networks:
|
|
- haproxy-network
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health')"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
# Frontend React App - pulls from Docker Hub by default
|
|
# To build locally instead, uncomment the build section and run: docker compose build frontend
|
|
#
|
|
# NOTE: REACT_APP_* env vars are BUILD-time only for Create-React-App. The
|
|
# runtime container (serve -s build) does NOT consume them. The frontend
|
|
# uses same-origin (window.location) for /api/* and is routed by the nginx
|
|
# service below to the backend container. No env vars are required here.
|
|
frontend:
|
|
image: taylanbakircioglu/haproxy-openmanager-frontend:latest
|
|
# build:
|
|
# context: ./frontend
|
|
# dockerfile: Dockerfile
|
|
container_name: haproxy-openmanager-frontend
|
|
expose:
|
|
- "3000"
|
|
depends_on:
|
|
- backend
|
|
networks:
|
|
- haproxy-network
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
# Nginx Reverse Proxy
|
|
nginx:
|
|
image: nginx:alpine
|
|
container_name: haproxy-openmanager-nginx
|
|
volumes:
|
|
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
|
ports:
|
|
- "8080:8080"
|
|
depends_on:
|
|
- frontend
|
|
- backend
|
|
networks:
|
|
- haproxy-network
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
# HAProxy Instance (for testing)
|
|
haproxy:
|
|
image: haproxy:2.8-alpine
|
|
container_name: haproxy-instance
|
|
volumes:
|
|
- ./haproxy/haproxy-simple.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
|
|
ports:
|
|
- "80:80"
|
|
- "8404:8404"
|
|
networks:
|
|
- haproxy-network
|
|
|
|
# Remote HAProxy Instance 1 (Production)
|
|
haproxy-remote1:
|
|
image: haproxy:2.8-alpine
|
|
container_name: haproxy-remote1
|
|
volumes:
|
|
- ./haproxy/haproxy-simple.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
|
|
ports:
|
|
- "8001:80"
|
|
- "8405:8404"
|
|
networks:
|
|
- haproxy-network
|
|
environment:
|
|
- HAPROXY_ENV=production
|
|
|
|
# Remote HAProxy Instance 2 (Staging)
|
|
haproxy-remote2:
|
|
image: haproxy:2.8-alpine
|
|
container_name: haproxy-remote2
|
|
volumes:
|
|
- ./haproxy/haproxy-simple.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
|
|
ports:
|
|
- "8002:80"
|
|
- "8406:8404"
|
|
networks:
|
|
- haproxy-network
|
|
environment:
|
|
- HAPROXY_ENV=staging
|
|
|
|
volumes:
|
|
postgres_data:
|
|
haproxy_configs:
|
|
|
|
networks:
|
|
haproxy-network:
|
|
driver: bridge
|