diff --git a/Dockerfile b/Dockerfile index fa2819a..4f601d9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,24 +2,12 @@ FROM golang:1.24-alpine AS builder WORKDIR /app -# Install dependencies for builder including sqlc RUN apk add --no-cache git make bash curl -# Install sqlc -# RUN curl -L https://github.com/sqlc-dev/sqlc/releases/download/v1.29.0/sqlc_1.29.0_linux_amd64.tar.gz | tar -xz -C /usr/local/bin - COPY go.mod go.sum ./ RUN sed -i '/^tool github.com\/evilmartians\/lefthook/d' go.mod RUN go mod download -# Copy source files needed for sqlc generation -# COPY sqlc.yaml ./sqlc.yaml -# COPY db/ ./db/ - -# Generate sqlc code -# RUN sqlc generate - -# Copy remaining source files (excluding db/ since it's already copied) COPY cmd/ ./cmd/ COPY internal/ ./internal/ COPY api/ ./api/ @@ -27,35 +15,13 @@ COPY docs/ ./docs/ COPY templates/ ./templates/ COPY go.mod go.sum ./ -# Initial build of the application RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o guac cmd/guac/main.go -# Final stage for running the application -FROM alpine:3.20 - -# Install Go, bash, ca-certificates, and openssl. -# Go and bash are needed for Tilt's live_update run steps if they compile/run scripts. -RUN apk --no-cache add ca-certificates openssl go bash - +FROM gcr.io/distroless/static:nonroot WORKDIR /app - -# Copy the built binary from the builder stage. -COPY --from=builder /app/guac /app/guac -# Copy templates (if your application uses them from filesystem at runtime) -COPY --from=builder /app/templates /app/templates - -# Create and copy certificates as before -RUN mkdir -p /app/certs -# COPY --from=builder /app/certs/ /app/certs/ # This line might not be needed if certs are always generated -RUN echo "Generating self-signed certificates..." && \ - openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout /app/certs/private.key \ - -out /app/certs/certificate.crt \ - -subj "/C=US/ST=California/L=San Francisco/O=My Company/CN=mydomain.com" - -ENV CERT_PATH=/app/certs/certificate.crt -ENV CERT_KEY_PATH=/app/certs/private.key -ENV GUACD_ADDRESS=guacd:4822 - +COPY --from=builder --chown=nonroot:nonroot /app/guac /app/guac +COPY --from=builder --chown=nonroot:nonroot /app/templates /app/templates +ENV GUACD_ADDRESS=guacd:4822 EXPOSE 4567 +USER nonroot:nonroot CMD ["/app/guac"] diff --git a/Dockerfile.tilt b/Dockerfile.tilt index d37052c..57a69b1 100644 --- a/Dockerfile.tilt +++ b/Dockerfile.tilt @@ -1,27 +1,8 @@ -FROM alpine:3.20 - -# Install runtime dependencies only -RUN apk --no-cache add ca-certificates openssl bash - +FROM gcr.io/distroless/static:debug-nonroot WORKDIR /app - -# Copy pre-compiled binary from local build -COPY .tilt/guac /app/guac -RUN chmod +x /app/guac - -# Copy templates -COPY templates/ /app/templates/ - -# Generate self-signed certificates -RUN mkdir -p /app/certs && \ - openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ - -keyout /app/certs/private.key \ - -out /app/certs/certificate.crt \ - -subj "/C=US/ST=California/L=San Francisco/O=My Company/CN=mydomain.com" - -ENV CERT_PATH=/app/certs/certificate.crt -ENV CERT_KEY_PATH=/app/certs/private.key +COPY --chmod=755 --chown=nonroot:nonroot .tilt/guac /app/guac +COPY --chown=nonroot:nonroot templates/ /app/templates/ ENV GUACD_ADDRESS=guacd:4822 - EXPOSE 4567 +USER nonroot:nonroot CMD ["/app/guac"] diff --git a/Makefile b/Makefile index 6e989f1..5a6f689 100644 --- a/Makefile +++ b/Makefile @@ -1,25 +1,5 @@ all: run -# check if the certs directory exists and .key and .crt files exist -ifneq ("$(wildcard certs)","") - ifneq ("$(wildcard certs/private.key)","") - ifneq ("$(wildcard certs/certificate.crt)","") - CERTS_EXIST := true - endif - endif -endif -# if certs exist, set the cert path and key path -ifeq ($(CERTS_EXIST), true) - CERT_PATH := "$(shell pwd)/certs/certificate.crt" - CERT_KEY_PATH := "$(shell pwd)/certs/private.key" -else - CERT_PATH := "$(shell pwd)/certs/certificate.crt" - CERT_KEY_PATH := "$(shell pwd)/certs/private.key" - bash ./certs/generate.sh -endif - - - # Install dependencies deps: go mod tidy @@ -52,9 +32,8 @@ lint: # run the server run: deps @echo "Running server..." - @echo "Using certs from $(CERT_PATH) and $(CERT_KEY_PATH)" @echo "Starting server..." - CERT_PATH=./certs/certificate.crt CERT_KEY_PATH=./certs/private.key go run cmd/guac/main.go + go run cmd/guac/main.go run_frontend: @echo "Running frontend..." diff --git a/deployments/manifest.yml b/deployments/manifest.yml index 270cddd..afb5569 100644 --- a/deployments/manifest.yml +++ b/deployments/manifest.yml @@ -255,7 +255,7 @@ spec: serviceAccountName: browser-sandbox-sa containers: - name: api - image: ghcr.io/browsersec/kubebrowse:sha-09dfa1f + image: ghcr.io/browsersec/kubebrowse:sha-09dfa1f imagePullPolicy: IfNotPresent ports: - containerPort: 4567 @@ -397,7 +397,6 @@ roleRef: name: pod-manager apiGroup: rbac.authorization.k8s.io --- - # --- # Cron Job to cleanup idle sessions # apiVersion: batch/v1 @@ -490,11 +489,11 @@ spec: cpu: "200m" env: - name: VITE_GUAC_CLIENT_URL - value: "https://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567" + value: "http://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567" - name: GUAC_CLIENT_URL - value: "https://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567" + value: "http://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567" - name: CADDY_GUAC_CLIENT_URL - value: "https://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567" + value: "http://browser-sandbox-api.browser-sandbox.svc.cluster.local:4567" --- # Frontend Service apiVersion: v1 @@ -509,7 +508,7 @@ spec: ports: - port: 80 targetPort: 80 - # nodePort: 30007 + # nodePort: 30007 selector: app: "browser-sandbox-frontend" --- @@ -527,4 +526,4 @@ spec: - name: rdp port: 3389 targetPort: rdp # Matches the named port "rdp" (3389) in the pod spec ---- \ No newline at end of file +--- diff --git a/frontend/.env.example b/frontend/.env.example new file mode 100644 index 0000000..51884f4 --- /dev/null +++ b/frontend/.env.example @@ -0,0 +1,2 @@ +# Backend origin for local development (no TLS) +VITE_API_BASE_URL=http://localhost:4567 diff --git a/frontend/Caddyfile b/frontend/Caddyfile index 883dbcc..cb109a8 100644 --- a/frontend/Caddyfile +++ b/frontend/Caddyfile @@ -17,10 +17,6 @@ # Authentication endpoints - proxy to backend API handle /auth/* { reverse_proxy {$CADDY_GUAC_CLIENT_URL} { - transport http { - tls - tls_insecure_skip_verify - } header_up Host {http.reverse_proxy.upstream.hostport} header_up Connection {header.Connection} header_up Upgrade {header.Upgrade} @@ -34,10 +30,6 @@ # Session management endpoints handle /sessions/* { reverse_proxy {$CADDY_GUAC_CLIENT_URL} { - transport http { - tls - tls_insecure_skip_verify - } header_up Host {http.reverse_proxy.upstream.hostport} header_up Connection {header.Connection} header_up Upgrade {header.Upgrade} @@ -51,10 +43,6 @@ # API v1 endpoints handle /api/v1/* { reverse_proxy {$CADDY_GUAC_CLIENT_URL} { - transport http { - tls - tls_insecure_skip_verify - } header_up Host {http.reverse_proxy.upstream.hostport} header_up Connection {header.Connection} header_up Upgrade {header.Upgrade} @@ -68,10 +56,6 @@ # Tunnel endpoints handle /tunnel* { reverse_proxy {$CADDY_GUAC_CLIENT_URL} { - transport http { - tls - tls_insecure_skip_verify - } header_up Host {http.reverse_proxy.upstream.hostport} header_up Connection {header.Connection} header_up Upgrade {header.Upgrade} @@ -85,10 +69,6 @@ # WebSocket tunnel endpoints handle /websocket-tunnel* { reverse_proxy {$CADDY_GUAC_CLIENT_URL} { - transport http { - tls - tls_insecure_skip_verify - } header_up Host {http.reverse_proxy.upstream.hostport} header_up Connection {header.Connection} header_up Upgrade {header.Upgrade} diff --git a/frontend/index.html b/frontend/index.html index 0c589ec..47d9e28 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -4,7 +4,7 @@ -
{sessionState.error}
-