diff --git a/.env.prod.sample b/.env.prod.sample new file mode 100644 index 0000000..e269297 --- /dev/null +++ b/.env.prod.sample @@ -0,0 +1,46 @@ +HOST=localhost +PORT=3000 +BASE_URL=https://example.com +SECRET_KEY=YOU_SHOULD_CHANGE_THIS +BACKEND_URL=http://backend:3000 + +MONGO_ROOT_PASSWORD=adminpassword +MONGO_USER=commander +MONGO_PASS=commander +MONGO_DB=linux-odyssey + +# Admin user credentials for analytics +ADMIN_USERNAME=admin +ADMIN_PASSWORD=admin + +# Optional +# CONTAINER_EXPIRY=60 # 60 minutes +# SESSION_MAX_AGE=168 # 7 days +# TRUSTED_PROXIES=1.2.3.4 +# valid configurations see isIP & isIPRange in https://github.com/validatorjs/validator.js?tab=readme-ov-file#validators + +# GOOGLE_CLIENT_ID= +# GOOGLE_CLIENT_SECRET= +# GITHUB_CLIENT_ID= +# GITHUB_CLIENT_SECRET= +# SURVEY_URL= +# BUG_REPORT_URL= +# DOCKER_NETWORK= + +# SURVEY_URL= +# BUG_REPORT_URL= + +# Docker related config +# DOCKER_NETWORK=host +# QUEST_IMAGE=linuxodyssey/quest-base +# DOCKER_PREFIX=linuxodyssey/quest- + +# To mount quest folder from host into container, for development purpose +# MOUNT_QUEST=true + +# LOG_PATH= + +# Testing, create a user with the following credentials, disable rate limiting +# TESTING=true +# TESTING_USERNAME=alex +# TESTING_PASSWORD=Alex1234 \ No newline at end of file diff --git a/.env.sample b/.env.sample index a389a42..06be919 100644 --- a/.env.sample +++ b/.env.sample @@ -1,11 +1,11 @@ HOST=localhost PORT=3000 BASE_URL=http://localhost:5173 -BACKEND_URL=http://localhost:3000 MONGO_URL=mongodb://localhost:27017/odyssey-test SECRET_KEY=sample-secret # Optional +# BACKEND_URL=http://host.docker.internal:3000 # CONTAINER_EXPIRY=60 # 60 minutes # SESSION_MAX_AGE=168 # 7 days # TRUSTED_PROXIES=1.2.3.4 diff --git a/.gitignore b/.gitignore index 4032a9b..eeb5072 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ +config + # Logs logs *.log @@ -85,6 +87,7 @@ built .env.test.local .env.production.local .env.local +.env.prod # parcel-bundler cache (https://parceljs.org/) .cache diff --git a/README.md b/README.md index 2873065..e2f8ac1 100644 --- a/README.md +++ b/README.md @@ -11,9 +11,10 @@ ## Known Issues -- The player's terminal doesn't work correctly on Mac OS and Windows for now. Please use Linux or Virtual Machines. You can track [this issue](https://github.com/linux-odyssey/linux-odyssey/issues/165) for updates. - MongoDB requires x86 architecture to run for v5+ versions. You can track [this issue](https://github.com/linux-odyssey/linux-odyssey/issues/166) for updates. +Windows user please refer to [docs/windows-setup.md](docs/windows-setup.md) for setup instructions. + ## Installation git clone https://github.com/lancatlin/linux-odyssey.git @@ -34,6 +35,16 @@ 6. **utils**: other utility code shared between packages 7. **game (in the future)**: core logic of game playing, will be extracted from server +## Configuration + +The configuration is stored in the `.env` file. You can copy from the sample file. + + cp .env.sample .env + +The backend will use a SSH key pair to login to the player's container. The private key is on the host, and the public key is copied to the player's container. + +The key pair is stored in `./config/ssh_key` and `./config/ssh_key.pub`. If it doesn't exist, the backend will generate a new pair and store them. + ## Docker Setup ### Docker compose files explaination @@ -58,14 +69,18 @@ This will start the db. it will automatically restarts by Docker. Building quest images: + docker compose build base yarn build:quests ### Build Quest Images in Details -In each quest folder, there is a `game.yml` file, which is the quest definition. And a optional `Dockerfile` can overwrite the base image. If you want to include additional files, put them in a `home` folder. The files in `home` will **not** be copied to the image automatically, you have to copy them in the `Dockerfile`. +In each quest folder, there is a `game.yml` file, which is the quest definition. + +If you want to include additional files, put them in a `home` folder. The files in `home` will be copied to the user's home on container creation automatically. quests/ ├── Dockerfile # Base image + ├── entrypoint.sh # Entrypoint for the container ├── discover │ └── game.yml ├── helloworld @@ -81,17 +96,22 @@ In each quest folder, there is a `game.yml` file, which is the quest definition. └── home └── ancient_scroll.txt +An optional `Dockerfile` can overwrite the base image. You can use this to install additional dependencies or modify the environment. + +Customized `entrypoint.sh` for each quest is not yet supported. + To build all quests: yarn build:quests The base image is built with docker-compose, so you can use `docker compose build base` to rebuild it. Once you rebuild the base image, you have to rebuild all quests. -### Mounting Host Directory +### Optional: Mounting Host Directory To improve the development experience, we can mount the host directory to the container in the pattern: /path/to/linux-odyssey/quests/${quest_id}/home:/home/commander + /path/to/linux-odyssey/packages/container:/usr/local/lib/container You can edit the files on your host, and the changes will be reflected in the container. This is disabled by default. To enable it, you can set the following environment variables: @@ -121,6 +141,10 @@ The default username and password is `alex` and `Alex1234`. ## Testing +Unit tests: + + yarn test:unit + Run Cypress locally, using the current development containers: docker compose up -d @@ -145,7 +169,14 @@ Run Cypress in container, create brand-new containers along with it: # Server side docker compose -f docker-compose.prod.yml pull + yarn build:quests docker compose -f docker-compose.prod.yml up -d +### Necessary Configuration + To enable social login, you should have OAuth client token in a `.env` file: You can copy from `.env.sample` + +**YOU MUST CHANGE THE SECRET_KEY** in `.env` file. + + SECRET_KEY=your-secret-key diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 23685b7..1495d9e 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -29,15 +29,25 @@ services: volumes: - /var/run/docker.sock:/var/run/docker.sock - ./logs:/app/logs + - ./config:/app/config + - ./quests:/app/quests:ro env_file: - .env + - .env.prod environment: - - MONGO_URL=mongodb://${MONGO_USER}:${MONGO_PASSWORD}@db:27017/${MONGO_DB} + - MONGO_URL=mongodb://${MONGO_USER}:${MONGO_PASS}@db:27017/${MONGO_DB} - DOCKER_NETWORK=linux-odyssey-players - SECRET_KEY=${SECRET_KEY} - TRUSTED_PROXIES=${TRUSTED_PROXIES} - BACKEND_URL=http://backend:3000 - BASE_URL=${BASE_URL} + - HOST_PROJECT_ROOT=${PWD} + - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID} + - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET} + - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID} + - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET} + - SURVEY_URL=${SURVEY_URL} + - BUG_REPORT_URL=${BUG_REPORT_URL} analytics: image: linuxodyssey/analytics @@ -52,8 +62,11 @@ services: - internal ports: - '3001:3001' + env_file: + - .env + - .env.prod environment: - - MONGO_URL=mongodb://${MONGO_USER}:${MONGO_PASSWORD}@db:27017/${MONGO_DB} + - MONGO_URL=mongodb://${MONGO_USER}:${MONGO_PASS}@db:27017/${MONGO_DB} - ADMIN_USERNAME=${ADMIN_USERNAME} - ADMIN_PASSWORD=${ADMIN_PASSWORD} @@ -72,14 +85,8 @@ services: - MONGO_INITDB_ROOT_USERNAME=admin - MONGO_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD} - MONGO_USER=${MONGO_USER} - - MONGO_PASS=${MONGO_PASSWORD} + - MONGO_PASS=${MONGO_PASS} - MONGO_DB=${MONGO_DB} - - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID} - - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET} - - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID} - - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET} - - SURVEY_URL=${SURVEY_URL} - - BUG_REPORT_URL=${BUG_REPORT_URL} base: image: linuxodyssey/quest-base diff --git a/docker-compose.yml b/docker-compose.yml index f7065bd..702c4df 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,12 +12,17 @@ services: base: image: linuxodyssey/quest-base + networks: + - players build: context: . dockerfile: ./quests/Dockerfile + extra_hosts: + - 'host.docker.internal:host-gateway' networks: internal: players: name: linux-odyssey-players - internal: true + internal: false + external: true diff --git a/docker-scripts.sh b/docker-scripts.sh index 2c14551..f1931d9 100755 --- a/docker-scripts.sh +++ b/docker-scripts.sh @@ -32,15 +32,16 @@ down() { dump() { # Define service name and dump directory name SERVICE_NAME="db" + COMPOSE_FILE="docker-compose.prod.yml" DUMP_NAME="mongodump-$(date --iso).archive" - CONTAINER_ID=$(docker compose ps -q $SERVICE_NAME) + CONTAINER_ID=$(docker compose -f $COMPOSE_FILE ps -q $SERVICE_NAME) # Fetch credentials from Docker environment variables - MONGO_URL=$(docker compose exec -T backend printenv MONGO_URL) + MONGO_URL=$(docker compose -f $COMPOSE_FILE exec -T backend printenv MONGO_URL) echo mongo uri: $MONGO_URL # Dump MongoDB data using credentials - docker compose exec -T $SERVICE_NAME sh -c "mongodump --gzip --archive=/tmp/$DUMP_NAME -d odyssey-test" && + docker compose -f $COMPOSE_FILE exec -T $SERVICE_NAME sh -c "mongodump --gzip --archive=/tmp/$DUMP_NAME --uri=$MONGO_URL" && # Copy the dump from the container to the host # Note: You will need to know the exact container name for this step diff --git a/docs/windows-setup.md b/docs/windows-setup.md new file mode 100644 index 0000000..7479d42 --- /dev/null +++ b/docs/windows-setup.md @@ -0,0 +1,141 @@ +# Windows Environment Setup + +## Install WSL and Ubuntu + +Please refer to the Official [Setup WSL](https://learn.microsoft.com/en-us/windows/wsl/setup/environment) on Microsoft's website. + +Run the following command in PowerShell as Administrator: + + wsl --install + +Then restart the computer. After restarting, you can open Ubuntu terminal by searching "Ubuntu" in Start menu. You will be prompted to create a new user account. Once you have done that, you can continue with the following steps. + +## Setup Environment (In Ubuntu terminal) + +1. Update and upgrade + + ``` + sudo apt-get update + sudo apt-get upgrade + ``` + +1. Install Git + + ``` + sudo apt-get install git + ``` + +1. Install Node.js (Version 20.x) + + ``` + curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - + sudo apt-get install nodejs + sudo apt install build-essential + sudo npm install -g yarn + ``` + +## Install Docker + +(Refer to [get.docker.com](https://get.docker.com/)) + +To install the latest stable versions of Docker CLI, Docker Engine, and their +dependencies: + +1. Download the script + + ``` + curl -fsSL https://get.docker.com -o install-docker.sh + ``` + +1. verify the script's content + + ``` + cat install-docker.sh + ``` + +1. run the script with --dry-run to verify the steps it executes + + ``` + sh install-docker.sh --dry-run + ``` + +**NOTE: the script will recommend you to use Docker Desktop instead, but we need to use Docker inside WSL for the backend to work.** Just ignore it and wait for the installation to finish. + +1. run the script either as root, or using sudo to perform the installation. + + ``` + sudo sh install-docker.sh + ``` + +1. Verify the installation + + ``` + docker --version + ``` + +1. Add your user to the docker group + + ``` + sudo usermod -aG docker $USER + ``` + + **NOTE: You need to create a new WSL terminal to apply the changes.** + +1. Verify the installation + + ``` + docker ps + ``` + This should return something like: + + CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES + +## Run the Project (In Ubuntu terminal) + +1. Clone the repository + + ``` + git clone https://github.com/lancatlin/linux-odyssey.git + cd linux-odyssey + ``` + + Optional: To open the project in VSCode, run the following command inside the project folder: + + ``` + code . + ``` + +1. Install dependencies + + ``` + yarn install + ``` + It is ok if there are some warnings and `gyp: ERR` errors, just verify there is `done` at the end. + +1. Copy the environment variables + + ``` + cp .env.sample .env + ``` + +1. Docker setup + + ``` + docker compose pull + docker compose build + docker compose up -d db + ``` + + + + +1. Run the project + + ``` + yarn build + yarn dev + ``` + + + +Enjoy! \ No newline at end of file diff --git a/quests/.includes/sshd_config b/quests/.includes/sshd_config new file mode 100644 index 0000000..0cf7758 --- /dev/null +++ b/quests/.includes/sshd_config @@ -0,0 +1,121 @@ +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +AuthorizedKeysFile /etc/ssh/authorized_keys/%u + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* NODE_PATH ZDOTDIR API_ENDPOINT TOKEN + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/quests/Dockerfile b/quests/Dockerfile index 8044c7f..99bfbab 100644 --- a/quests/Dockerfile +++ b/quests/Dockerfile @@ -1,26 +1,32 @@ -FROM alpine:3.18 +FROM debian:bookworm-slim LABEL maintainer="wancat@wancat.cc" -RUN apk add --no-cache \ +RUN apt-get update && apt-get install -y \ vim \ zsh \ - nodejs \ - yarn + curl \ + openssh-server + + +RUN curl -fsSL https://deb.nodesource.com/setup_20.x -o nodesource_setup.sh +RUN bash nodesource_setup.sh +RUN apt-get install -y nodejs +RUN npm install -g yarn +RUN node -v && yarn -v WORKDIR /usr/local/lib/container - COPY ./packages/container/package.json ./yarn.lock ./ RUN yarn install --modules-folder /usr/src/node_modules ENV NODE_PATH=/usr/src/node_modules COPY ./packages/container /usr/local/lib/container COPY ./quests/.includes/zshrc /etc/zsh/zshrc +RUN rm -f /etc/motd /etc/issue /etc/issue.net /etc/update-motd.d/* +RUN rm -rf /etc/skel && mkdir -p /etc/skel +RUN mkdir -p /etc/ssh/authorized_keys && chmod 755 /etc/ssh/authorized_keys +COPY ./quests/.includes/sshd_config /etc/ssh/sshd_config +COPY ./quests/entrypoint.sh /entrypoint.sh -ENV USERNAME=commander +EXPOSE 22 -RUN adduser --disabled-password --gecos '' --shell /bin/zsh ${USERNAME} - -USER ${USERNAME} - -WORKDIR /home/${USERNAME} -CMD [ "/bin/zsh" ] +ENTRYPOINT ["/bin/sh", "/entrypoint.sh"] diff --git a/quests/checkpoint-01/Dockerfile b/quests/checkpoint-01/Dockerfile deleted file mode 100644 index 2a8e341..0000000 --- a/quests/checkpoint-01/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} \ No newline at end of file diff --git a/quests/checkpoint-02/Dockerfile b/quests/checkpoint-02/Dockerfile deleted file mode 100644 index 2a8e341..0000000 --- a/quests/checkpoint-02/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} \ No newline at end of file diff --git a/quests/checkpoint-03/Dockerfile b/quests/checkpoint-03/Dockerfile deleted file mode 100644 index 377fb37..0000000 --- a/quests/checkpoint-03/Dockerfile +++ /dev/null @@ -1,7 +0,0 @@ -FROM linuxodyssey/quest-base - -USER root -COPY home . -RUN chown -R ${USERNAME}:${USERNAME} . - -USER ${USERNAME} \ No newline at end of file diff --git a/quests/copy/Dockerfile b/quests/copy/Dockerfile deleted file mode 100644 index 2a8e341..0000000 --- a/quests/copy/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} \ No newline at end of file diff --git a/quests/entrypoint.sh b/quests/entrypoint.sh new file mode 100644 index 0000000..7951103 --- /dev/null +++ b/quests/entrypoint.sh @@ -0,0 +1,21 @@ +#!/bin/sh + +USERNAME=commander + +echo "Initializing container for $USERNAME" + +if ! id -u ${USERNAME} >/dev/null 2>&1; then + echo "Adding user $USERNAME" + adduser --disabled-password --gecos '' --shell /bin/zsh ${USERNAME} && \ + find / -name ".gitkeep" -type f -exec rm -f {} + + + echo "Adding public key for $USERNAME" + echo "Public key: $PUB_KEY" + PUB_KEY_PATH=/etc/ssh/authorized_keys/${USERNAME} + echo $PUB_KEY > ${PUB_KEY_PATH} + chmod 644 ${PUB_KEY_PATH} +fi + +mkdir -p /run/sshd +echo "Starting SSH server" +/usr/sbin/sshd -D -e diff --git a/quests/execute/Dockerfile b/quests/execute/Dockerfile deleted file mode 100644 index 54f88a1..0000000 --- a/quests/execute/Dockerfile +++ /dev/null @@ -1,6 +0,0 @@ -FROM linuxodyssey/quest-base - -USER root -COPY home ${HOME} - -USER commander \ No newline at end of file diff --git a/quests/explore/Dockerfile b/quests/explore/Dockerfile deleted file mode 100644 index 2a8e341..0000000 --- a/quests/explore/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} \ No newline at end of file diff --git a/quests/helloworld/Dockerfile b/quests/helloworld/Dockerfile deleted file mode 100644 index 1811d6e..0000000 --- a/quests/helloworld/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} diff --git a/quests/move/Dockerfile b/quests/move/Dockerfile deleted file mode 100644 index 79a8660..0000000 --- a/quests/move/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY --chown=${USERNAME} home ${HOME} \ No newline at end of file diff --git a/quests/path/Dockerfile b/quests/path/Dockerfile deleted file mode 100644 index 2a8e341..0000000 --- a/quests/path/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} \ No newline at end of file diff --git a/quests/read/Dockerfile b/quests/read/Dockerfile deleted file mode 100644 index 2a8e341..0000000 --- a/quests/read/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} \ No newline at end of file diff --git a/quests/remove/Dockerfile b/quests/remove/Dockerfile deleted file mode 100644 index 3e36542..0000000 --- a/quests/remove/Dockerfile +++ /dev/null @@ -1,4 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY --chown=${USERNAME} home ${HOME} -RUN mkdir empty \ No newline at end of file diff --git a/quests/remove/home/empty/.gitkeep b/quests/remove/home/empty/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/quests/tab/Dockerfile b/quests/tab/Dockerfile deleted file mode 100644 index 1811d6e..0000000 --- a/quests/tab/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM linuxodyssey/quest-base - -COPY home ${HOME} diff --git a/server/package.json b/server/package.json index 44b869f..432f5dd 100644 --- a/server/package.json +++ b/server/package.json @@ -40,6 +40,7 @@ "passport-jwt": "^4.0.1", "passport-local": "^1.0.0", "socket.io": "^4.7.1", + "ssh2": "^1.16.0", "swagger-ui-express": "^5.0.0", "validator": "^13.11.0", "winston": "^3.11.0", @@ -61,6 +62,7 @@ "@types/passport-local": "^1.0.38", "@types/passport-oauth2": "^1.4.15", "@types/source-map-support": "^0", + "@types/ssh2": "^1.15.1", "@types/swagger-ui-express": "^4.1.6", "@types/validator": "^13.11.9", "concurrently": "^8.2.2", diff --git a/server/src/api/socket.ts b/server/src/api/socket.ts index 5395370..2483851 100644 --- a/server/src/api/socket.ts +++ b/server/src/api/socket.ts @@ -1,8 +1,9 @@ import { Server } from 'socket.io' import type { Socket } from 'socket.io' +import { Duplex } from 'stream' import validator from 'validator' import type { Server as HttpServer } from 'http' -import { Session } from '@linux-odyssey/models' +import { ISession, Session } from '@linux-odyssey/models' import { getAndStartContainer, attachContainer } from '../containers/docker.js' import SessionMiddleware from '../middleware/session.js' import { genJWT } from '../utils/auth.js' @@ -77,30 +78,34 @@ async function connectContainer(socket: Socket, next: (err?: Error) => void) { stream, } next() - } catch { - next(new Error('Failed to start container.')) + } catch (err) { + logger.error(err) + next(new Error('Failed to connect to container.')) } } function onConnect(socket: Socket) { - const { session, stream } = socket.data.context - stream.socket.on('data', (chunk: Buffer) => { + const { session, stream } = socket.data.context as { + session: ISession + stream: Duplex + } + stream.on('data', (chunk: Buffer) => { socket.emit('terminal', chunk.toString()) }) socket.on('terminal', function incoming(message) { - stream.socket.write(message) + stream.write(message) }) const socketCallback = (event: string, ...data: any[]) => { socket.emit(event, ...data) } - listenToSession(session.id, socketCallback) + listenToSession(session._id.toString(), socketCallback) socket.on('disconnect', () => { - stream.socket.write('exit\n') - removeFromSession(session.id, socketCallback) + stream.write('exit\n') + removeFromSession(session._id.toString(), socketCallback) stream.destroy() }) } diff --git a/server/src/config.ts b/server/src/config.ts index 63af4dd..3f316a8 100644 --- a/server/src/config.ts +++ b/server/src/config.ts @@ -3,6 +3,7 @@ import dotenv from 'dotenv' import { fileURLToPath } from 'node:url' import path from 'path' import { get } from './utils/env.js' +import { loadOrCreateKeyPair } from './utils/crypto.js' // Import dotenv and load ../.env dotenv.config({ path: '../.env' }) @@ -31,17 +32,25 @@ function getUrl(key: string): string { function createConfig() { const isProduction = process.env.NODE_ENV === 'production' - const host = get('HOST', 'localhost') + const host = get('HOST', '0.0.0.0') const port = Number(get('PORT', 3000)) const baseUrl = get('BASE_URL', `http://${host}:${port}`) + const backendUrl = get('BACKEND_URL', `http://host.docker.internal:${port}`) const url = new URL(baseUrl) + const projectRoot = getProjectRoot() + const keypairPath = get( + 'KEYPAIR_PATH', + path.join(projectRoot, 'config', 'ssh_key') + ) + const keypair = loadOrCreateKeyPair(keypairPath) + return { host, port, baseUrl, domain: url.hostname, protocol: url.protocol, - backendUrl: get('BACKEND_URL', baseUrl), + backendUrl, db: get('MONGO_URL', 'mongodb://localhost:27017/odyssey-test'), secret: get('SECRET_KEY', ''), isProduction: process.env.NODE_ENV === 'production', @@ -60,17 +69,20 @@ function createConfig() { surveyUrl: getUrl('SURVEY_URL'), bugReportUrl: getUrl('BUG_REPORT_URL'), + projectRoot, + docker: { - network: get('DOCKER_NETWORK', 'host'), + network: get('DOCKER_NETWORK', 'linux-odyssey-players'), defaultImage: get('QUEST_IMAGE', 'linuxodyssey/quest-base'), imagePrefix: get('DOCKER_PREFIX', 'linuxodyssey/quest-'), mountQuest: process.env.MOUNT_QUEST === 'true', + hostProjectRoot: get('HOST_PROJECT_ROOT', projectRoot), + keypairPath, + keypair, }, - projectRoot: getProjectRoot(), - log: { - path: get('LOG_PATH', path.join(getProjectRoot(), 'logs')), + path: get('LOG_PATH', path.join(projectRoot, 'logs')), }, testing: { enabled: !isProduction && process.env.TESTING === 'true', diff --git a/server/src/containers/docker.ts b/server/src/containers/docker.ts index 77d5efe..03d4183 100644 --- a/server/src/containers/docker.ts +++ b/server/src/containers/docker.ts @@ -1,41 +1,77 @@ +import fs from 'fs/promises' +import { Duplex } from 'stream' import Docker from 'dockerode' import config, { getQuestImage } from '../config.js' import logger from '../utils/logger.js' +import { connectToSSH } from './ssh.js' const engine = new Docker() -const containerOptions = { - AttachStdin: true, - AttachStdout: true, - AttachStderr: true, - Tty: true, - OpenStdin: true, - StdinOnce: false, +const newContainerOptions = ( + name: string, + imageId: string, + options: { + binds?: string[] + } = {} +): Docker.ContainerCreateOptions => ({ + name, + Image: getQuestImage(imageId), HostConfig: { NetworkMode: config.docker.network, + Binds: options.binds, + ExtraHosts: ['host.docker.internal:host-gateway'], }, -} as Docker.ContainerCreateOptions + ExposedPorts: { + '22/tcp': {}, + }, + Env: [`PUB_KEY=${config.docker.keypair.publicKey}`], +}) -export function createContainer( +export async function createContainer( name: string, + questId: string, imageId: string ): Promise { - const option = { - ...containerOptions, - name, - Image: getQuestImage(imageId), + let binds: string[] = [] + if (await questHomeExists(questId)) { + logger.info('Mounting quest home', questId) + binds.push( + `${config.docker.hostProjectRoot}/quests/${questId}/home:/etc/skel:ro` + ) } - if (!config.isProduction && config.docker.mountQuest && imageId !== 'base') { - logger.info('Mounting quest folder', imageId) - option.HostConfig!.Binds = [ - `${config.projectRoot}/quests/${imageId}/home:/home/commander`, - `${config.projectRoot}/packages/container:/usr/local/lib/container`, + logger.info('Mounting quest folder', questId) + binds = [ + `${config.docker.hostProjectRoot}/quests/${questId}/home:/home/commander`, + `${config.docker.hostProjectRoot}/packages/container:/usr/local/lib/container`, ] } + const option = newContainerOptions(name, imageId, { binds }) + await createNetworkIfNotExists(config.docker.network) return engine.createContainer(option) } +async function createNetworkIfNotExists(network: string) { + const dockerNetworks = await engine.listNetworks({ + filters: { + name: [network], + }, + }) + if (dockerNetworks.length === 0) { + logger.log('Creating player network', network) + await engine.createNetwork({ Name: network }) + } +} + +async function questHomeExists(imageId: string) { + try { + const stat = await fs.stat(`${config.projectRoot}/quests/${imageId}/home`) + return stat.isDirectory() + } catch { + return false + } +} + export async function getAndStartContainer( id: string ): Promise { @@ -53,26 +89,25 @@ export async function getAndStartContainer( export async function attachContainer( container: Docker.Container, { token }: { token: string } -) { - const exec = await container.exec({ - AttachStdin: true, - AttachStdout: true, - AttachStderr: true, - Cmd: ['/bin/zsh'], - Tty: true, - Env: [ - `TOKEN=${token}`, - `API_ENDPOINT=${config.backendUrl}`, - 'ZDOTDIR=/etc/zsh', - ], - }) +): Promise { + const containerIp = (await container.inspect()).NetworkSettings.Networks[ + config.docker.network + ].IPAddress - const execOutput = await exec.start({ - Detach: false, - Tty: true, - }) - - return execOutput + for (let i = 0; i < 10; i++) { + try { + // eslint-disable-next-line no-await-in-loop + const stream = await connectToSSH(containerIp, { token }) + return stream + } catch (err) { + logger.error('Failed to connect to SSH', err) + // eslint-disable-next-line no-await-in-loop + await new Promise((resolve) => { + setTimeout(resolve, 1000) + }) + } + } + throw new Error('Failed to connect to SSH') } export async function deleteContainer(id: string) { diff --git a/server/src/containers/ssh.ts b/server/src/containers/ssh.ts new file mode 100644 index 0000000..4eb54b9 --- /dev/null +++ b/server/src/containers/ssh.ts @@ -0,0 +1,45 @@ +import { Client } from 'ssh2' +import { Duplex } from 'stream' +import config from '../config.js' + +export async function connectToSSH( + containerIp: string, + { token }: { token: string } +): Promise { + const conn = new Client() + + return new Promise((resolve, reject) => { + conn + .on('ready', () => { + conn.shell( + { + env: { + TOKEN: token, + API_ENDPOINT: config.backendUrl, + ZDOTDIR: '/etc/zsh', + NODE_PATH: '/usr/src/node_modules', + }, + }, + (err, stream) => { + if (err) { + reject(err) + } + stream.on('close', () => { + conn.end() + }) + resolve(stream) + } + ) + }) + .on('error', (err) => { + reject(err) + }) + .connect({ + host: containerIp, + port: 22, + username: 'commander', + privateKey: config.docker.keypair.privateKey, + timeout: 5000, + }) + }) +} diff --git a/server/src/index.ts b/server/src/index.ts index 3ed074d..22916d8 100644 --- a/server/src/index.ts +++ b/server/src/index.ts @@ -72,7 +72,7 @@ async function main() { app.use('/api/v1', apiRouter) app.use(errorHandler) - server.listen(config.port, config.host, () => { + server.listen(config.port, '0.0.0.0', () => { logger.info(`Server listening at ${config.baseUrl}`) }) } diff --git a/server/src/models/sessionManager.ts b/server/src/models/sessionManager.ts index 798732c..2489704 100644 --- a/server/src/models/sessionManager.ts +++ b/server/src/models/sessionManager.ts @@ -43,6 +43,7 @@ export async function createNewSession( const container = await createContainer( `quest-${quest.id}-${user.username}-${Date.now()}`, + quest.id, quest.image ) diff --git a/server/src/utils/crypto.ts b/server/src/utils/crypto.ts new file mode 100644 index 0000000..7f6ed0f --- /dev/null +++ b/server/src/utils/crypto.ts @@ -0,0 +1,39 @@ +import fs from 'fs' +import path from 'path' +import ssh2 from 'ssh2' + +const { + utils: { generateKeyPairSync }, +} = ssh2 + +type KeyPair = { + privateKey: string + publicKey: string +} + +export function loadOrCreateKeyPair(privateKeyPath: string): KeyPair { + const publicKeyPath = `${privateKeyPath}.pub` + if (fs.existsSync(privateKeyPath) && fs.existsSync(publicKeyPath)) { + const privateKey = fs.readFileSync(privateKeyPath, 'utf8') + const publicKey = fs.readFileSync(publicKeyPath, 'utf8') + return { privateKey, publicKey } + } + const dir = path.dirname(privateKeyPath) + if (!fs.existsSync(dir)) { + fs.mkdirSync(dir, { recursive: true }) + } + const keyPair = generateKeyPair() + fs.writeFileSync(privateKeyPath, keyPair.privateKey, { + mode: 0o600, + }) + fs.writeFileSync(publicKeyPath, keyPair.publicKey, { + mode: 0o600, + }) + return keyPair +} + +export function generateKeyPair(): KeyPair { + const { private: privateKey, public: publicKey } = + generateKeyPairSync('ed25519') + return { privateKey, publicKey } +} diff --git a/server/tests/utils/crypto.test.ts b/server/tests/utils/crypto.test.ts new file mode 100644 index 0000000..4c4b17f --- /dev/null +++ b/server/tests/utils/crypto.test.ts @@ -0,0 +1,9 @@ +import { generateKeyPair } from '../../src/utils/crypto' + +describe('generateKeyPair', () => { + it('should generate a key pair', () => { + const keyPair = generateKeyPair() + expect(keyPair).toHaveProperty('privateKey') + expect(keyPair).toHaveProperty('publicKey') + }) +}) diff --git a/yarn.lock b/yarn.lock index 0c92a44..78ca72a 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2067,6 +2067,13 @@ dependencies: "@types/node" "^18.11.18" +"@types/ssh2@^1.15.1": + version "1.15.1" + resolved "https://registry.yarnpkg.com/@types/ssh2/-/ssh2-1.15.1.tgz#4db4b6864abca09eb299fe5354fa591add412223" + integrity sha512-ZIbEqKAsi5gj35y4P4vkJYly642wIbY6PqoN0xiyQGshKUGXR9WQjF/iF9mXBQ8uBKy3ezfsCkcoHKhd0BzuDA== + dependencies: + "@types/node" "^18.11.18" + "@types/stack-utils@^2.0.0": version "2.0.3" resolved "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz" @@ -3579,6 +3586,14 @@ cors@~2.8.5: object-assign "^4" vary "^1" +cpu-features@~0.0.10: + version "0.0.10" + resolved "https://registry.yarnpkg.com/cpu-features/-/cpu-features-0.0.10.tgz#9aae536db2710c7254d7ed67cb3cbc7d29ad79c5" + integrity sha512-9IkYqtX3YHPCzoVg1Py+o9057a3i0fp7S530UWokCSaFVTc7CwXPRiOjRjBQQ18ZCNafx78YfnG+HALxtVmOGA== + dependencies: + buildcheck "~0.0.6" + nan "^2.19.0" + cpu-features@~0.0.9: version "0.0.9" resolved "https://registry.npmjs.org/cpu-features/-/cpu-features-0.0.9.tgz" @@ -6823,6 +6838,11 @@ nan@^2.17.0, nan@^2.18.0: resolved "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz" integrity sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w== +nan@^2.19.0, nan@^2.20.0: + version "2.21.0" + resolved "https://registry.yarnpkg.com/nan/-/nan-2.21.0.tgz#203ab765a02e6676c8cb92e1cad9503e7976d55b" + integrity sha512-MCpOGmdWvAOMi4RWnpxS5G24l7dVMtdSHtV87I3ltjaLdFOTO74HVJ+DfYiAXjxGKsYR/UCmm1rBwhMN7KqS1A== + nanoid@^3.3.7: version "3.3.7" resolved "https://registry.npmjs.org/nanoid/-/nanoid-3.3.7.tgz" @@ -8584,6 +8604,17 @@ ssh2@^1.11.0: cpu-features "~0.0.9" nan "^2.18.0" +ssh2@^1.16.0: + version "1.16.0" + resolved "https://registry.yarnpkg.com/ssh2/-/ssh2-1.16.0.tgz#79221d40cbf4d03d07fe881149de0a9de928c9f0" + integrity sha512-r1X4KsBGedJqo7h8F5c4Ybpcr5RjyP+aWIG007uBPRjmdQWfEiVLzSK71Zji1B9sKxwaCvD8y8cwSkYrlLiRRg== + dependencies: + asn1 "^0.2.6" + bcrypt-pbkdf "^1.0.2" + optionalDependencies: + cpu-features "~0.0.10" + nan "^2.20.0" + sshpk@^1.14.1, sshpk@^1.7.0: version "1.18.0" resolved "https://registry.npmjs.org/sshpk/-/sshpk-1.18.0.tgz" @@ -8631,7 +8662,7 @@ string-length@^4.0.1: char-regex "^1.0.2" strip-ansi "^6.0.0" -"string-width-cjs@npm:string-width@^4.2.0", "string-width@^1.0.2 || 2 || 3 || 4", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3: +"string-width-cjs@npm:string-width@^4.2.0": version "4.2.3" resolved "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz" integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g== @@ -8649,6 +8680,15 @@ string-width@^1.0.1: is-fullwidth-code-point "^1.0.0" strip-ansi "^3.0.0" +"string-width@^1.0.2 || 2 || 3 || 4", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3: + version "4.2.3" + resolved "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz" + integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g== + dependencies: + emoji-regex "^8.0.0" + is-fullwidth-code-point "^3.0.0" + strip-ansi "^6.0.1" + string-width@^5.0.1, string-width@^5.1.2: version "5.1.2" resolved "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz" @@ -8709,7 +8749,7 @@ stringstream@~0.0.4: resolved "https://registry.yarnpkg.com/stringstream/-/stringstream-0.0.6.tgz#7880225b0d4ad10e30927d167a1d6f2fd3b33a72" integrity sha512-87GEBAkegbBcweToUrdzf3eLhWNg06FJTebl4BVJz/JgWy8CvEr9dRtX5qWphiynMSQlxxi+QqN0z5T32SLlhA== -"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1: +"strip-ansi-cjs@npm:strip-ansi@^6.0.1": version "6.0.1" resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz" integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A== @@ -8723,6 +8763,13 @@ strip-ansi@^3.0.0, strip-ansi@^3.0.1, strip-ansi@~3.0.1: dependencies: ansi-regex "^2.0.0" +strip-ansi@^6.0.0, strip-ansi@^6.0.1: + version "6.0.1" + resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz" + integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A== + dependencies: + ansi-regex "^5.0.1" + strip-ansi@^7.0.1: version "7.1.0" resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz" @@ -9575,7 +9622,7 @@ wordwrap@^1.0.0: resolved "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz" integrity sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q== -"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0: +"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0": version "7.0.0" resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz" integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q== @@ -9593,6 +9640,15 @@ wrap-ansi@^6.2.0: string-width "^4.1.0" strip-ansi "^6.0.0" +wrap-ansi@^7.0.0: + version "7.0.0" + resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz" + integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q== + dependencies: + ansi-styles "^4.0.0" + string-width "^4.1.0" + strip-ansi "^6.0.0" + wrap-ansi@^8.1.0: version "8.1.0" resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz"