-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.go
145 lines (126 loc) · 4.28 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
package main
import (
"bytes"
"fmt"
"io/ioutil"
"net/http"
"net/http/httputil"
"os"
"strings"
"time"
"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/aws/signer/v4"
"github.com/prometheus/client_golang/prometheus/promhttp"
auth "github.com/skuid/go-middlewares/authn/google"
"github.com/skuid/spec"
"github.com/skuid/spec/lifecycle"
_ "github.com/skuid/spec/metrics"
"github.com/skuid/spec/middlewares"
flag "github.com/spf13/pflag"
"github.com/spf13/viper"
"go.uber.org/zap"
)
func init() {
l, err := spec.NewStandardLogger()
if err != nil {
fmt.Println(err.Error())
os.Exit(1)
}
zap.ReplaceGlobals(l)
err = os.Setenv("AWS_SDK_LOAD_CONFIG", "true")
if err != nil {
zap.L().Fatal(err.Error())
}
}
func main() {
flag.String("role-arn", "", "The AWS Role ARN to use")
flag.String("mfa-serial", "", "The serial number of the MFA device.")
flag.String("domain", "", "The elasticsearch domain to proxy")
flag.Int("port", 3000, "Listening port for proxy")
flag.String("region", "us-west-2", "AWS region for credentials")
flag.Bool("auth-enable", false, "enable Google OIDC authentication")
flag.String("auth-email-domain", "", "allowed user domains")
flag.Int("metrics-port", 3001, "management endpoint port")
flag.Parse()
viper.BindPFlags(flag.CommandLine)
viper.SetEnvPrefix("esproxy")
viper.AutomaticEnv()
viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
zap.L().Info("Connected to Elasticsearch",
zap.String("domain", viper.GetString("domain")),
zap.String("es_host", fmt.Sprintf("http://127.0.0.1:%d", viper.GetInt("port"))),
zap.String("kibana_host", fmt.Sprintf("http://127.0.0.1:%d/_plugin/kibana/", viper.GetInt("port"))),
)
sess, err := session.NewSession(&aws.Config{CredentialsChainVerboseErrors: aws.Bool(true)})
if err != nil {
zap.L().Error("Error creating AWS session", zap.Error(err))
return
}
var creds *credentials.Credentials
if len(viper.GetString("role-arn")) > 0 && len(viper.GetString("mfa-serial")) > 0 {
creds = stscreds.NewCredentials(sess, viper.GetString("role-arn"), func(p *stscreds.AssumeRoleProvider) {
p.SerialNumber = aws.String(viper.GetString("mfa-serial"))
p.TokenProvider = stscreds.StdinTokenProvider
})
} else {
creds = sess.Config.Credentials
if _, err := creds.Get(); err != nil {
zap.L().Error("Failed to load credentials", zap.Error(err))
return
}
}
director := func(req *http.Request) {
req.URL.Scheme = "https"
req.Host = viper.GetString("domain")
req.URL.Host = viper.GetString("domain")
req.Header.Set("Connection", "close")
// delete x-forwarded-for since the request
// signing doesn't like it
req.Header.Del("X-Forwarded-For")
t := time.Now()
req.Header.Set("Date", t.Format(time.RFC3339))
signer := v4.NewSigner(creds)
var bodyData []byte
if req.Body != nil {
bodyData, err = ioutil.ReadAll(req.Body)
if err != nil {
zap.L().Error(err.Error(), zap.String("method", req.Method), zap.String("path", req.URL.Path))
return
}
}
if _, err := signer.Sign(req, bytes.NewReader(bodyData), "es", viper.GetString("region"), t); err != nil {
zap.L().Error("Error signing request", zap.Error(err))
return
}
}
proxy := &httputil.ReverseProxy{Director: director}
mux := http.NewServeMux()
var mwares []middlewares.Middleware
if viper.GetBool("auth-enable") {
authorizer := auth.New(
auth.WithAuthorizedDomains(viper.GetString("auth-email-domain")),
)
mwares = append(mwares, authorizer.Authorize())
}
mux.Handle("/", middlewares.Apply(
proxy,
mwares...,
))
hostPort := fmt.Sprintf(":%d", viper.GetInt("port"))
server := &http.Server{Addr: hostPort, Handler: mux}
lifecycle.ShutdownOnTerm(server)
go func() {
internalMux := http.NewServeMux()
internalMux.Handle("/metrics", promhttp.Handler())
internalMux.HandleFunc("/live", lifecycle.LivenessHandler)
internalMux.HandleFunc("/ready", lifecycle.ReadinessHandler)
zap.L().Info("starting es-proxy metrics server", zap.Int("port", viper.GetInt("metrics-port")))
http.ListenAndServe(fmt.Sprintf(":%d", viper.GetInt("metrics-port")), internalMux)
}()
if err := server.ListenAndServe(); err != http.ErrServerClosed {
zap.L().Fatal(err.Error())
}
}