Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge architecture_2024 branch into master #1177

Merged
merged 380 commits into from
May 6, 2024
Merged
Show file tree
Hide file tree
Changes from 250 commits
Commits
Show all changes
380 commits
Select commit Hold shift + click to select a range
a13e6a8
Fix software clients type checking and a few tests
imobachgs Mar 21, 2024
dee2bd5
Type checking fixes
imobachgs Mar 21, 2024
1eab869
Add description to the list of selected patterns
imobachgs Mar 21, 2024
c37c01a
Fix patterns removal when they are in auto mode
imobachgs Mar 22, 2024
426d78b
Adapt the PatternSelector to selectPatterns changes
imobachgs Mar 22, 2024
fcabdcc
Fix a typo in the documentation
imobachgs Mar 22, 2024
0a4634e
Changes based on code review
teclator Mar 22, 2024
9506e1f
Added some network_service unit test
teclator Mar 22, 2024
bccf78c
apply suggestions
jreidinger Mar 22, 2024
e5bdecc
Fix PatternSelector type checking
imobachgs Mar 22, 2024
3646c0b
fix formatting
jreidinger Mar 22, 2024
f02dc7d
first draft of questions API in http (#1091)
jreidinger Mar 22, 2024
4c9f50a
Changes based on code review.
teclator Mar 22, 2024
de963bd
Merge branch 'architecture_2024' into network-service
teclator Mar 22, 2024
bc95d15
Expose the networking API over HTTP (#1064)
teclator Mar 22, 2024
801cb6e
Move the software selection to the SoftwarePage
imobachgs Mar 22, 2024
53c59ac
Clean-up the PatternSelector component
imobachgs Mar 22, 2024
d7cf9ed
Adapt the PatternSelector tests
imobachgs Mar 22, 2024
738ed3e
Copyright updates
imobachgs Mar 22, 2024
6667a30
Merge branch 'architecture_2024' into adapt-software-ui
imobachgs Mar 22, 2024
97eabe8
Extend SoftwarePage and PatternSelector tests
imobachgs Mar 22, 2024
c209089
Fix indentation
imobachgs Mar 22, 2024
5d84a2f
Allow visiting Software section even if it is not ready
imobachgs Mar 23, 2024
15b2092
Update documentation style in software.js
imobachgs Mar 25, 2024
5b937df
Documentation fixes
imobachgs Mar 25, 2024
030b4cc
Adapt the software UI to the new HTTP/JSON API (#1112)
imobachgs Mar 25, 2024
0b11396
Rename the authentication token
imobachgs Mar 25, 2024
61853f4
Rename the authentication token (#1114)
imobachgs Mar 25, 2024
21fee15
Changes needed in the backend for the UI
teclator Mar 25, 2024
1f761cd
Start adapting the Network UI for using the http API
teclator Mar 25, 2024
0549f4f
initial commit of users service
jreidinger Mar 26, 2024
5902ba9
use tuple of streams instead of StreamMap
jreidinger Mar 26, 2024
2e6c2c2
Add a Firefox startup script
imobachgs Mar 25, 2024
469a92c
Optionally write the token when starting the server
imobachgs Mar 25, 2024
8936558
Add the agama-web-server service
imobachgs Mar 25, 2024
b8ef5f5
Disable @typescript-eslint/no-unused-vars
imobachgs Mar 25, 2024
4bc5a75
Update the agama-web-ui.spec to the new code
imobachgs Mar 25, 2024
ec1ad7b
Serve precompressed (gz) files if they are available
imobachgs Mar 25, 2024
2fe7df5
Remove the extra slash from HTTP methods
imobachgs Mar 25, 2024
4b8410a
Drop cockpit.socket dependency in agama.service
imobachgs Mar 26, 2024
51c0ff4
Add modified agama-live KIWI files
imobachgs Mar 26, 2024
1650fc6
Add a temporary README to the 'live' directory
imobachgs Mar 26, 2024
a6507db
Add a README.md to the live/ directory
imobachgs Mar 26, 2024
a9222b7
implement routes for first user
jreidinger Mar 26, 2024
547dfb2
add root password routes
jreidinger Mar 26, 2024
f253377
Move l10n D-Bus bits to its own module
imobachgs Mar 26, 2024
59d1cd5
Rename and move Locale to l10n::L10n
imobachgs Mar 26, 2024
ab57aed
Move LocaleError to a separate module
imobachgs Mar 26, 2024
e51f1f4
Move the L10n common logic to the L10n struct
imobachgs Mar 26, 2024
20b72e7
add route for ssh key
jreidinger Mar 27, 2024
9987a22
add root route for users to get info
jreidinger Mar 27, 2024
7d9a60d
Some fixes and changes for the http API
teclator Mar 27, 2024
cad1e12
Adapted wireless to use the http API
teclator Mar 27, 2024
1316384
Add validation router and use it in users
jreidinger Mar 27, 2024
7abc0b9
adapt users js code (WIP)
jreidinger Mar 30, 2024
20b5d05
Synchronize values of the D-Bus Locale service
imobachgs Apr 1, 2024
d21d42a
web: Improve Patterns selector UI
dgdavid Apr 1, 2024
faf88f4
web: please linters
dgdavid Apr 2, 2024
4be45d2
web: Improve Patterns selector UI (#1123)
dgdavid Apr 2, 2024
3689fd4
fix UI and also backend
jreidinger Apr 2, 2024
89cb757
Merge remote-tracking branch 'origin/architecture_2024' into users_2024
jreidinger Apr 2, 2024
4bdcceb
Add support to login from the query string
imobachgs Apr 3, 2024
22f5174
Use the login endpoint to start the local browser
imobachgs Apr 3, 2024
cd270da
Update the list of packages in the KIWI image
imobachgs Apr 3, 2024
c1d93cf
Merge branch 'architecture_2024' into agama-live-update
imobachgs Apr 3, 2024
e4f7496
Added the connection status to agama-settings
teclator Apr 3, 2024
8f8c98a
Some backend fixes / improvements
teclator Apr 3, 2024
cfe6380
Apply changes after adding / removing a connection
teclator Apr 3, 2024
78d595d
Keep uncompressed assets when building the UI
imobachgs Apr 3, 2024
8ac6eb4
Minor formatting change
imobachgs Apr 3, 2024
10dbd59
Applied some clippy suggestions
teclator Apr 3, 2024
68cd286
Keep uncompressed files in agama-web-ui RPM package
imobachgs Apr 3, 2024
ff670b0
Make the login redirection temporary
imobachgs Apr 3, 2024
52dc81d
another bunch of fixes
jreidinger Apr 3, 2024
518378b
fixed wireless test
teclator Apr 3, 2024
205b287
add hints for developing with two machines and debugging hints
jreidinger Apr 3, 2024
7149061
format rust code
jreidinger Apr 3, 2024
9f8c7b2
Move the token creation to a function
imobachgs Apr 3, 2024
5dfe0d5
Add root.tar contents to agama-live directory
imobachgs Apr 3, 2024
be2b5ef
Inject the token in Firefox's preferences
imobachgs Apr 3, 2024
ce1f5ff
Remove the startup script from the old location
imobachgs Apr 3, 2024
512e444
Fix sed invocation
imobachgs Apr 3, 2024
16b36e0
Fix Firefox start-up
imobachgs Apr 3, 2024
56d735e
Apply suggestions from code review
jreidinger Apr 3, 2024
dd4af42
changes from review
jreidinger Apr 3, 2024
11cda28
Provide the frontend translations via the /po.js path (#1126)
lslezak Apr 4, 2024
bd5549b
Fix agama-web-server dependency
imobachgs Apr 4, 2024
86afb33
Merge branch 'architecture_2024' into agama-live-update
imobachgs Apr 4, 2024
94c46bc
Adapt agama-live to work with the new architecture (#1119)
imobachgs Apr 4, 2024
a5e4c02
reduce number of events for root user change
jreidinger Apr 4, 2024
0866b9d
Added hostname and fixed connection disconnect
teclator Apr 4, 2024
fb32fdd
Merge remote-tracking branch 'origin/master' into architecture_2024_m…
lslezak Apr 4, 2024
f5f95bf
modify routing as agreed. Client part is WIP
jreidinger Apr 4, 2024
8b9789d
Use camelCase in l10n/config
imobachgs Apr 5, 2024
44c7259
Fix uiKeymap handling
imobachgs Apr 5, 2024
6065eaf
Use the property name when updating UILocale
imobachgs Apr 5, 2024
bb1ec2b
Use PATCH to update l10n/config
imobachgs Apr 5, 2024
1d2a8db
Adapt L10n JavaScript client to latest API changes
imobachgs Apr 5, 2024
97518aa
Merge master to the new server branch (#1129)
lslezak Apr 5, 2024
9322a6c
Synchronize HTTP and D-Bus localization interfaces (#1120)
imobachgs Apr 5, 2024
b992107
Fix webpack configuration to load CockpitPoPlugin
imobachgs Apr 5, 2024
8098dfe
Fix webpack configuration to load CockpitPoPlugin (#1130)
imobachgs Apr 5, 2024
59d2fc3
Serialize as lowercase
teclator Apr 4, 2024
44c941a
Started with network client test changes
teclator Apr 4, 2024
50e2073
adapt UI code to new http api
jreidinger Apr 5, 2024
45d92ac
Fixed network tests
teclator Apr 5, 2024
67fdec0
Merge remote-tracking branch 'origin/architecture_2024' into users_2024
jreidinger Apr 5, 2024
dc2a025
Fix creating the self-signed certificate
lslezak Apr 5, 2024
bce5f91
Fix creating the self-signed certificate (#1131)
lslezak Apr 5, 2024
809860a
Fix getUILocale
imobachgs Apr 5, 2024
9bc3d98
Enable HTTPS in the agama-web-server service definition
imobachgs Apr 5, 2024
0aeea8d
Fix locale and enable HTTPS (#1133)
imobachgs Apr 5, 2024
33cc3bc
Uncomment the client#issues function
imobachgs Apr 4, 2024
99b2ec7
Uncomment the InstallButton component
imobachgs Apr 4, 2024
0ff4c1e
Fix the software and product issues paths
imobachgs Apr 4, 2024
1f0d78b
Fix finishInstallation function to call the right endpoint
imobachgs Apr 4, 2024
d604eb2
Use camelCase in manager/installer
imobachgs Apr 4, 2024
0ed6636
Do not block calling CanInstall during installation
imobachgs Apr 4, 2024
79cd8e4
Adapt the questions client
imobachgs Apr 5, 2024
eed4f8f
Merge remote-tracking branch 'origin/architecture_2024' into users_2024
jreidinger Apr 5, 2024
155a3cf
Enable IPv6 in agama-web-server
imobachgs Apr 5, 2024
3a8c46a
Enable IPv6 on agama-web-server (#1134)
lslezak Apr 5, 2024
5bfad04
fixes from testing
jreidinger Apr 7, 2024
c561a33
Apply suggestions from code review
jreidinger Apr 8, 2024
5e1d4b2
Adapt the users service to the HTTP/JSON API (#1117)
jreidinger Apr 8, 2024
41aa843
Changes based on code review
teclator Apr 8, 2024
8dfb622
adapt debugging hints
jreidinger Apr 8, 2024
3123d1c
Apply suggestions from code review
jreidinger Apr 8, 2024
c118d06
adapt debugging hints (#1136)
jreidinger Apr 8, 2024
6c20cf4
Set the question answer
imobachgs Apr 8, 2024
37a56c8
Merge branch 'architecture_2024' into adapt_network_UI
teclator Apr 8, 2024
38d993f
Comment code in InstallationFinished related to storage
imobachgs Apr 8, 2024
e8a0460
Merge branch 'architecture_2024' into installation
imobachgs Apr 8, 2024
eed1a5f
Use camelCase in the questions API
imobachgs Apr 8, 2024
aa6fa54
force a refresh of the connections after update
teclator Apr 8, 2024
46e925d
Disable TPM testing in InstallationFinished component
imobachgs Apr 8, 2024
d803057
Fix validation_router doctests
imobachgs Apr 8, 2024
ccea4e9
Enable the installation process in the HTTP-based version (#1132)
imobachgs Apr 8, 2024
21e6941
Merge branch 'architecture_2024' into adapt_network_UI
imobachgs Apr 8, 2024
f553204
unify interface of http helpers
jreidinger Apr 9, 2024
7df6f83
Adapt the Network UI to the HTTP/JSON API (#1116)
teclator Apr 9, 2024
8c846a2
Merge remote-tracking branch 'origin/architecture_2024' into unify_ht…
jreidinger Apr 9, 2024
cec1be0
Fix failing test
teclator Apr 9, 2024
ada6305
Fix failing test (#1140)
teclator Apr 9, 2024
ae3e779
Merge remote-tracking branch 'origin/architecture_2024' into unify_ht…
jreidinger Apr 9, 2024
45ebc48
adapt also network code and adapt working tests
jreidinger Apr 9, 2024
91dd51c
fix typo
jreidinger Apr 9, 2024
c5e1c5d
unify interface of http helpers (#1139)
jreidinger Apr 9, 2024
4badba9
Configured TraceLayer in web server to log info about request/response
mchf Apr 11, 2024
b819396
Formatting
mchf Apr 11, 2024
7f9f06c
Minor tweaks
mchf Apr 11, 2024
acb6187
Added running configuration to the devices!
teclator Apr 11, 2024
6b2cbcf
Rename NetworkState to NetworkServiceState
teclator Apr 11, 2024
832ca75
add missing methods to registration client
jreidinger Apr 11, 2024
29627ef
add routes for registration
jreidinger Apr 12, 2024
d2ad081
implement registration streams
jreidinger Apr 12, 2024
8fcdde1
Moved config from path to proxy
teclator Apr 12, 2024
121c472
adapt frontend
jreidinger Apr 12, 2024
193aeb5
Split NetworkSystem in two structs (System and Server)
imobachgs Apr 13, 2024
f161011
Add a NetworkSystemClient for communication
imobachgs Apr 13, 2024
f0dddd1
Partially adapt the network web API to the new NetworkSystem API
imobachgs Apr 13, 2024
8dcf816
Handle errors reading the network configuration
imobachgs Apr 13, 2024
d54eb8e
Adapt the remaining web API to the new NetworkSystem
imobachgs Apr 15, 2024
748cfbb
Agama server logging (#1143)
mchf Apr 15, 2024
fe95106
Adapt some missing web API methods to the new NetworkSystem
imobachgs Apr 15, 2024
0edf191
Update from code review
imobachgs Apr 15, 2024
12587e1
Refactor the NetworkSystem API (#1147)
imobachgs Apr 15, 2024
1d03c7d
Merge branch 'architecture_2024' into network_running_config
teclator Apr 15, 2024
06c6c35
fix questions in UI
jreidinger Apr 15, 2024
f8b4ca5
fixes from manual testing
jreidinger Apr 16, 2024
854ff28
Add support to add/remove network devices
imobachgs Apr 15, 2024
90c2522
Add a Watcher trait to listen for network changes
imobachgs Apr 16, 2024
0eb7c0d
Add a PoC of a Watcher for NetworkManager
imobachgs Apr 16, 2024
b1a6b76
Emit network changes through the WebSocket
imobachgs Apr 16, 2024
fe944b8
Adapter's watchers are optional
imobachgs Apr 16, 2024
d28cfbd
Removed an unused 'connection' variable
imobachgs Apr 16, 2024
3d536a0
format rust code
jreidinger Apr 16, 2024
0b1b442
Added devices running config to the UI
teclator Apr 17, 2024
e622e16
fix software js tests
jreidinger Apr 17, 2024
21236b9
fix product page js test
jreidinger Apr 17, 2024
a20fabc
Some small fixes
teclator Apr 17, 2024
5773197
fix product section test and re-enable again issues
jreidinger Apr 17, 2024
809221b
fix product selection js test
jreidinger Apr 17, 2024
905785a
Refactor the NetworkManagerWatcher
imobachgs Apr 17, 2024
f883917
Add support to update network devices information
imobachgs Apr 18, 2024
27323c0
Make NetworkChange serialization camelCase
imobachgs Apr 18, 2024
ba77779
Add a forgotten file from the previous commit
imobachgs Apr 18, 2024
e0c0c11
Proper handling of update network devices
imobachgs Apr 18, 2024
013701e
Refactor the NetworkManagerWatcher
imobachgs Apr 18, 2024
8d609a7
Update rust/agama-lib/src/product/client.rs
jreidinger Apr 18, 2024
c08a679
implement better error handling for registration and deregistration
jreidinger Apr 18, 2024
fcb2222
changes from review
jreidinger Apr 18, 2024
caece55
Refactor the DeviceFromProxyBuilder
imobachgs Apr 18, 2024
6e6ea75
Remove duplicated code from NetworkManagerClient
imobachgs Apr 18, 2024
e0bb48c
Remove unneeded "use" statements
imobachgs Apr 18, 2024
362bd57
Remove NetworkManagerClient::from_system
imobachgs Apr 18, 2024
138d433
Fix agama-server tests
imobachgs Apr 18, 2024
691743e
Filter network events depending on specific properties
imobachgs Apr 18, 2024
b43af77
Adapt product registration to the new architecture (#1146)
jreidinger Apr 19, 2024
1fc9fcd
First adaptations for reacting to network events
teclator Apr 19, 2024
355121b
Handle devices update event correctly
teclator Apr 19, 2024
4c46fbc
Adapted NetworkSection test
teclator Apr 19, 2024
79b11a5
initial storage web service
jreidinger Apr 19, 2024
ed67ffa
implement dirty devices bit in API
jreidinger Apr 19, 2024
f2893f8
Fix a formatting issue
imobachgs Apr 22, 2024
781da92
Expose device state in the backend
teclator Apr 22, 2024
be6337a
Some small fixes and use of device state
teclator Apr 22, 2024
251d0e4
add initial device interface
jreidinger Apr 22, 2024
9b2443c
Some small fixes to the WiFi connection handling
teclator Apr 22, 2024
e37c4ca
update partly proxies
jreidinger Apr 23, 2024
29656dd
Increase the number of channel messages
teclator Apr 24, 2024
80bd8ff
Do not stop in case of too many messages received
teclator Apr 24, 2024
d5f7da8
Only show new added devices if has a connection
teclator Apr 24, 2024
4a8de8a
Extend the documentation of the NetworkManagerWatcher
imobachgs Apr 24, 2024
68ccead
Remove an unneeded 'pub' modifier
imobachgs Apr 24, 2024
f4d20be
WIP for listing system devices
jreidinger Apr 24, 2024
67a015c
use for loop instead of iterators
jreidinger Apr 24, 2024
a429350
A few sentences about how agama deals with security
mchf Apr 25, 2024
fff5460
use object manager approach for system devices
jreidinger Apr 25, 2024
bb46e3b
move helper to better place
jreidinger Apr 25, 2024
30c1f0a
Fixed style issues
mchf Apr 25, 2024
c3fa605
Fixed markdown
mchf Apr 25, 2024
c1016ee
Removed leftover(s)
mchf Apr 25, 2024
2164ac6
implement block device interface
jreidinger Apr 25, 2024
36fdb6d
implement also staging devices route
jreidinger Apr 25, 2024
ba3d250
implement actions
jreidinger Apr 25, 2024
e9e61bf
Provided some more technical details.
mchf Apr 26, 2024
9e85be8
Note about websocket
mchf Apr 26, 2024
2500a74
Minor rephrasing
mchf Apr 26, 2024
686a23d
Apply suggestions from code review
imobachgs Apr 26, 2024
02bdac2
Updates from code review
imobachgs Apr 26, 2024
a345468
Document the NetworkChange enum
imobachgs Apr 26, 2024
36ac90d
WIP for volumes
jreidinger Apr 26, 2024
ca23a36
add get_optional_property
jreidinger Apr 26, 2024
b4d9ae5
apply suggestion
jreidinger Apr 26, 2024
5b23d77
implement volume for
jreidinger Apr 26, 2024
0ff3d1e
Some more suggestions from the review
mchf Apr 29, 2024
25552ae
Minor tweaks in references
mchf Apr 29, 2024
33ba7e9
A few sentences about how agama deals with security (#1170)
mchf Apr 29, 2024
785dae7
Apply suggestions from code review
jreidinger Apr 29, 2024
fedf5e9
fixes from review
jreidinger Apr 29, 2024
45530dc
Changes based on code review
teclator Apr 29, 2024
c59cd17
Added changelog
teclator Apr 29, 2024
ae94b4e
Revert "Added changelog"
imobachgs Apr 30, 2024
141a3dd
Track and display the current network configuration (#1158)
imobachgs Apr 30, 2024
a598fb5
Update rust/agama-lib/src/dbus.rs
jreidinger Apr 30, 2024
259b625
Storage adapt (#1169)
jreidinger Apr 30, 2024
2ab0d21
Merge branch 'architecture_2024' into merge-architecture_2024
imobachgs May 3, 2024
8efa41f
Update the agama-live startup script
imobachgs May 3, 2024
6fb21b6
Update changes files
imobachgs May 6, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 35 additions & 35 deletions .github/workflows/ci-web.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,38 +57,38 @@ jobs:

- name: Install dependencies
run: npm install

- name: Build the application
run: make

- name: Run check spell
run: npm run cspell

- name: Check types
run: npm run check-types

- name: Run ESLint
run: npm run eslint

- name: Run Stylelint
run: npm run stylelint

- name: Run the tests and generate coverage report
run: npm test -- --coverage

# send the code coverage for the web part to the coveralls.io
- name: Coveralls GitHub Action
uses: coverallsapp/github-action@v2
with:
base-path: ./web
flag-name: web
parallel: true

# close the code coverage and inherit the previous coverage for the Ruby and
# Rust parts (it needs a separate step, the "carryforward" flag can be used
# only with the "parallel-finished: true" option)
- name: Coveralls Finished
uses: coverallsapp/github-action@v2
with:
parallel-finished: true
carryforward: "service,rust"
#
# - name: Build the application
# run: make
#
# - name: Run check spell
# run: npm run cspell
#
# - name: Check types
# run: npm run check-types
#
# - name: Run ESLint
# run: npm run eslint
#
# - name: Run Stylelint
# run: npm run stylelint
#
# - name: Run the tests and generate coverage report
# run: npm test -- --coverage
#
# # send the code coverage for the web part to the coveralls.io
# - name: Coveralls GitHub Action
# uses: coverallsapp/github-action@v2
# with:
# base-path: ./web
# flag-name: web
# parallel: true
#
# # close the code coverage and inherit the previous coverage for the Ruby and
# # Rust parts (it needs a separate step, the "carryforward" flag can be used
# # only with the "parallel-finished: true" option)
# - name: Coveralls Finished
# uses: coverallsapp/github-action@v2
# with:
# parallel-finished: true
# carryforward: "service,rust"
34 changes: 34 additions & 0 deletions doc/agama-security.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
## Agama Concepts

Agama's functionality is divided into backend and frontend. Communication between two parts is done through HTTP/JSON and/or websocket. Most of the api requires an authorization.

As frontend Agama offers a web based user interface (web UI) or a commandline interface (CLI). Backend currently is bunch of services implemented in Rust or Ruby with support from YaST libraries. For interprocess communication Agama uses D-Bus.

### Authorization

Authorization is done via password. To get authorized the frontend has to provide the root password (root on the backend's system). The password is validated through PAM [1]. Once the authorization succeeds, the backend generates an authorization token and passes it back to frontend. Agama uses [JSON Web Token (JWT)] [2] as authorization token [3]. All subsequent calls to the API has to be done together with the token. In case of the web UI, the token is stored in a HTTP-only cookie.

Agama supports special use case when Agama's UI or CLI is used in live installation media. In such case skipping autorization is supported to get feeling of using a desktop application. However, skipping authorization happens only for local access. When connecting remotely, authorization is still in place. Skipping of authorization is made possible thanks to option ```--generate-token```. When this option is used, Agama's web server service generates valid JWT automatically on start. The token is stored locally [4]. To make it usable for web UI, token is imported into web browser's internal database by Agama provided startup [5] script. The script prepares custom profile for Firefox with predefined homepage pointing to Agama's special login page with the generated token as part of a get request in the homepage url. As part of the response, the token is stored as `httpOnly` cookie. In case of CLI the situation is way easier as the token can be accessed and used directly as needed from well known location [4].

### JWT

The token carries just one claim - the expiration date. Token's lifetime is currently set to one day. The token is provided in encrypted form. Security key is either automatically created random string [6] which is 30 characters long. However, security can be provided via the `jwt_secret` option in the `/etc/agama.d/server.yaml` agama's configuration file. The content of this option is expected to be a string but no checks are done.

### Communication between the frontend and the backend

If both components run locally, communication can be done over HTTP or HTTPS. However, in case when both run on different machines, HTTPS is mandatory. In such case all HTTP requests are automatically redirected to HTTPS. A HTTP response with code 308 (permanent redirect) is returned in such case.

For notifications on changes from backend Agama uses WebSocket technology. Typically backend notificates about installation progress or network configuration changes this way.

### HTTPS certificates

SSL communication is secured either by self-signed certificate which is automatically generated by Agama if no certificate was provided by user. If Agama should use particular custom certificate Agama's web server provides options --cert and --key for path to certificate respectively to private key (in PEM format).

## Links to external sources

- [1] Rust PAM crate, https://crates.io/crates/pam
- [2] RFC 7519, http://jwt.io
- [3] Rust jsonwebtoken crate, https://crates.io/crates/jsonwebtoken
- [4] Backend's machine at /run/agama/token
- [5] [Firefox startup script] See https://github.com/openSUSE/agama/blob/master/live/root/root/.icewm/startup
- [6] Rust rand crate, https://crates.io/crates/rand
179 changes: 79 additions & 100 deletions live/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# Live ISO

<!-- omit from toc -->

## Table of Content

- [Live ISO](#live-iso)
Expand All @@ -26,19 +27,15 @@

## Layout

This directory contains a set of files that are used to build the Agama Live ISO
image.
This directory contains a set of files that are used to build the Agama Live ISO image.

- [src](src) subdirectory contains all source files which are copied unmodified
to the OBS project
- [root](root) subdirectory contains files which are added to the Live ISO root
system (inside the squashfs image)
- [root-ALP-PXE](root-ALP-PXE) subdirectory contains specific files for the ALP
image used for the PXE boot, see a separate [PXE documentation](PXE.md) for
more details about the PXE boot
- [config-cdroot](config-cdroot) subdirectory contains file which are copied to
the uncompressed root of the ISO image, the files can be accessed just by
mounting the ISO file or the DVD medium
- [src](src) subdirectory contains all source files which are copied unmodified to the OBS project
- [root](root) subdirectory contains files which are added to the Live ISO root system (inside the
squashfs image)
- [root-ALP-PXE](root-ALP-PXE) subdirectory contains specific files for the ALP image used for the
PXE boot, see a separate [PXE documentation](PXE.md) for more details about the PXE boot
- [config-cdroot](config-cdroot) subdirectory contains file which are copied to the uncompressed
root of the ISO image, the files can be accessed just by mounting the ISO file or the DVD medium

## Building the Sources

Expand Down Expand Up @@ -66,31 +63,28 @@ To build the ISO locally run the
make build
```

command. The built ISO image is saved to the `/var/tmp/build-root` directory,
see the end of the build for output for the exact ISO file name.
command. The built ISO image is saved to the `/var/tmp/build-root` directory, see the end of the
build for output for the exact ISO file name.

For building an ISO image you need a lot of free space at the `/var` partition.
Make sure there is at least 25GiB free space otherwise the build will
fail.
For building an ISO image you need a lot of free space at the `/var` partition. Make sure there is
at least 25GiB free space otherwise the build will fail.

### Build Options

By default this will build the openSUSE image. If you want to build
another image then run
By default this will build the openSUSE image. If you want to build another image then run

```shell
make build FLAVOR=<flavor>
# for building the ALP flavor:
make build FLAVOR=ALP
```

See the [_multibuild](src/_multibuild) file for the list of available build
flavors.
See the [_multibuild](src/_multibuild) file for the list of available build flavors.

By default it will use the [systemsmanagement:Agama:Staging](
https://build.opensuse.org/project/show/systemsmanagement:Agama:Staging) OBS
project. If you want to build using another project, like your fork, then delete
the `dist` directory and checkout the OBS project manually and run the build:
By default it will use the
[systemsmanagement:Agama:Staging](https://build.opensuse.org/project/show/systemsmanagement:Agama:Staging)
OBS project. If you want to build using another project, like your fork, then delete the `dist`
directory and checkout the OBS project manually and run the build:

```shell
rm -rf dist
Expand All @@ -101,140 +95,125 @@ make build

## Image Definition

The [KIWI](https://github.com/OSInside/kiwi) image builder is used by OBS to
build the Live ISO. See the [KIWI documentation](
https://osinside.github.io/kiwi/index.html) for more details about the build
workflow and the `.kiwi` file format.
The [KIWI](https://github.com/OSInside/kiwi) image builder is used by OBS to build the Live ISO. See
the [KIWI documentation](https://osinside.github.io/kiwi/index.html) for more details about the
build workflow and the `.kiwi` file format.

### KIWI Files

The main Kiwi source files are located in the [src](src) subdirectory:

- [agama-live.kiwi](src/agama-live.kiwi) is the main KIWI file which drives the
ISO image build.
- [config.sh](src/config.sh) is a KIWI hook script which is called and the end
of the build process, after all packages are installed but before compressing
and building the image. The script runs in the image chroot and is usually
used to adjust the system configuration (enable/disable services, patching
configuration files or deleting not needed files).
- [_constraints](src/_constraints) file tells OBS to build the image on the
hosts with enough resources (enough free disk space).
- [_multibuild](src/_multibuild) defines the image flavors (KIWI profiles)
which are available to build
- [images.sh](src/images.sh) - injects a script which checks whether the machine
has enough RAM when booting the Live ISO
- [fix_bootconfig](src/fix_bootconfig) - a special KIWI hook script which sets
the boot configuration on S390 and PPC64 architectures.
- [agama-live.kiwi](src/agama-live.kiwi) is the main KIWI file which drives the ISO image build.
- [config.sh](src/config.sh) is a KIWI hook script which is called and the end of the build process,
after all packages are installed but before compressing and building the image. The script runs in
the image chroot and is usually used to adjust the system configuration (enable/disable services,
patching configuration files or deleting not needed files).
- [_constraints](src/_constraints) file tells OBS to build the image on the hosts with enough
resources (enough free disk space).
- [_multibuild](src/_multibuild) defines the image flavors (KIWI profiles) which are available to
build
- [images.sh](src/images.sh) - injects a script which checks whether the machine has enough RAM when
booting the Live ISO
- [fix_bootconfig](src/fix_bootconfig) - a special KIWI hook script which sets the boot
configuration on S390 and PPC64 architectures.

## Image Configuration

The Live ISO is configured to allow using some features and allow running Agama
there.
The Live ISO is configured to allow using some features and allow running Agama there.

### SSH Server

The SSH connection for the root user is enabled in the [10_root_login.conf](
root/etc/ssh/sshd_config.d/10_root_login.conf) file.
The SSH connection for the root user is enabled in the
[10_root_login.conf](root/etc/ssh/sshd_config.d/10_root_login.conf) file.

### Autologin

Automatic root login and staring the graphical environment is configured in
several files.
Automatic root login and staring the graphical environment is configured in several files.

- [x11-autologin.service](src/etc/systemd/system/x11-autologin.service) uses
`startx` to start an x11 session.
- `startx` runs the Icewm window manager via [.xinitrc](root/root/.xinitrc)
file.
- [x11-autologin.service](src/etc/systemd/system/x11-autologin.service) uses `startx` to start an
x11 session.
- `startx` runs the Icewm window manager via [.xinitrc](root/root/.xinitrc) file.
- Icewm autostarts Firefox via [startup](root/root/.icewm/startup) file.
- Icewm uses the usual YaST2 installation
[preferences.yast2](root/etc/icewm/preferences.yast2) configuration file
- Icewm uses the usual YaST2 installation [preferences.yast2](root/etc/icewm/preferences.yast2)
configuration file

### Firefox Profile

The default Firefox configuration is defined in the
[profile](root/root/.mozilla/firefox/profile) file. It disables several features
which do not make sense in Live ISO like remembering the used passwords.
The default Firefox configuration is defined in the [profile](root/root/.mozilla/firefox/profile)
file. It disables several features which do not make sense in Live ISO like remembering the used
passwords.

### Dracut menu

The [98dracut-menu](live/root/usr/lib/dracut/modules.d/98dracut-menu) directory
implements a simple menu system for dracut. To activate it
during boot add `rd.cmdline=menu` to the boot prompt. This is similar to
`rd.cmdline=ask` which gives you a simple one-line prompt to add boot options.
The [98dracut-menu](live/root/usr/lib/dracut/modules.d/98dracut-menu) directory implements a simple
menu system for dracut. To activate it during boot add `rd.cmdline=menu` to the boot prompt. This is
similar to `rd.cmdline=ask` which gives you a simple one-line prompt to add boot options.

The dracut-cmdline-menu can currently set the `root` and `proxy` options. The
settings are copied (using a dracut pre-pivot hook) to the live system in
The dracut-cmdline-menu can currently set the `root` and `proxy` options. The settings are copied
(using a dracut pre-pivot hook) to the live system in
[cmdline-menu.conf](root/etc/cmdline-menu.conf).

There is also the complete command line in the
[cmdline-full.conf](root/etc/cmdline-full.conf) file - maybe it can useful at
least for debugging.
There is also the complete command line in the [cmdline-full.conf](root/etc/cmdline-full.conf)
file - maybe it can useful at least for debugging.

For more details see [dracut.bootup(7)](
https://man.archlinux.org/man/dracut.bootup.7.en),
[dracut-pre-pivot.service(8)](
https://man.archlinux.org/man/extra/dracut/dracut-pre-pivot.service.8.en).
For more details see [dracut.bootup(7)](https://man.archlinux.org/man/dracut.bootup.7.en),
[dracut-pre-pivot.service(8)](https://man.archlinux.org/man/extra/dracut/dracut-pre-pivot.service.8.en).

To arrange the dracut config in KIWI you have to adjust the default dracut
config of the live system. This is done in [config.sh](src/config.sh). You can
also fill in a default network location if one is defined for a product
(currently not).
To arrange the dracut config in KIWI you have to adjust the default dracut config of the live
system. This is done in [config.sh](src/config.sh). You can also fill in a default network location
if one is defined for a product (currently not).

### Avahi/mDNS

The mDNS service allows resolving host names in the local network without
a DNS server. That is implemented by the `avahi-daemon` service which enabled
in the [config.sh](src/config.sh) file and installed in the `avahi` RPM package.
The mDNS service allows resolving host names in the local network without a DNS server. That is
implemented by the `avahi-daemon` service which enabled in the [config.sh](src/config.sh) file and
installed in the `avahi` RPM package.

The mDNS protocol resolves the hosts in the `.local` domain.

#### The Default Hostname

By default the Agama live ISO sets the `agama` host name which can be used
as `agama.local` full hostname in URL.
By default the Agama live ISO sets the `agama` host name which can be used as `agama.local` full
hostname in URL.

The default hostname is set by the
[agama-hostname](root/etc/systemd/system/agama-hostname.service) service.
The default hostname is set by the [agama-hostname](root/etc/systemd/system/agama-hostname.service)
service.

If the hostname is set via the `hostname=` boot parameter then the `agama`
host name is not used, the boot option takes precedence.
If the hostname is set via the `hostname=` boot parameter then the `agama` host name is not used,
the boot option takes precedence.

#### Service Advertisement

The Avahi HTTPS service announcement is configured via the Avahi
[agama.service](root/etc/avahi/services/agama.service) file

That allows scanning all running Agama instances in the local network with
command:
That allows scanning all running Agama instances in the local network with command:

```shell
avahi-browse -t -r _agama._sub._https._tcp
```

### The Default Cockpit/Agama TCP Port

The default Cockpit TCP port is 9090. That makes sense for the system management
framework as the default ports might be used by a running Apache or other web
servers.
The default Cockpit TCP port is 9090. That makes sense for the system management framework as the
default ports might be used by a running Apache or other web servers.

But Agama runs from a Live ISO where running a web server does not make much
sense so we can safely use the default HTTP(S) ports.
But Agama runs from a Live ISO where running a web server does not make much sense so we can safely
use the default HTTP(S) ports.

The default port is changed in the
[listen.conf](root/etc/systemd/system/cockpit.socket.d/listen.conf) file.

### Autoinstallation Support

The autoinstallation is started using the
[agama-auto](root/etc/systemd/system/agama-auto.service) service which starts
the [auto.sh](root/usr/bin/auto.sh) script. This script downloads the
The autoinstallation is started using the [agama-auto](root/etc/systemd/system/agama-auto.service)
service which starts the [auto.sh](root/usr/bin/auto.sh) script. This script downloads the
installation profile, applies it to Agama and starts the installation.

### Firmware Cleanup

The [fw_cleanup.rb](root/tmp/fw_cleanup.rb) script removes the unused firmware
from the image. Many firmware files are not needed, this makes the final ISO
much smaller.
The [fw_cleanup.rb](root/tmp/fw_cleanup.rb) script removes the unused firmware from the image. Many
firmware files are not needed, this makes the final ISO much smaller.

This script is started from [config.sh](src/config.sh) the script and after
running it the script deleted. (Not needed anymore in the system.)
This script is started from [config.sh](src/config.sh) the script and after running it the script
deleted. (Not needed anymore in the system.)
Loading
Loading