Merge pull request #2 from Fokir/feat/nginx-http2-tls12

feat: HTTP/2 + optional TLS 1.2-only to mitigate new RKN blocking

Author: Fokir

cmd/server/main.go

@@ -20,6 +20,7 @@ import (
 	"github.com/sokol/system-control/internal/network_nodes"
 	"github.com/sokol/system-control/internal/nftables"
 	"github.com/sokol/system-control/internal/nginx"
+	"github.com/sokol/system-control/internal/settings"
 	"github.com/sokol/system-control/internal/traffic"
 	"github.com/sokol/system-control/internal/wireguard"
 )
@@ -56,6 +57,7 @@ func main() {
 	natRepo := nftables.NewRepository(db)
 	nodesRepo := network_nodes.NewRepository(db)
 	nginxRepo := nginx.NewRepository(db)
+	settingsRepo := settings.NewRepository(db)
 	auditRepo := audit.NewRepository(db)
 	trafficRepo := traffic.NewRepository(db)
 	wgRepo := wireguard.NewRepository(db)
@@ -66,7 +68,9 @@ func main() {
 	natSvc := nftables.NewService(natRepo, natEngine)
 	nodesMonitor := network_nodes.NewMonitor(nodesRepo, 30*time.Second)
 	nodesSvc := network_nodes.NewService(nodesRepo, nodesMonitor)
-	nginxSvc := nginx.NewService(nginxRepo, cfg.NginxSitesDir, cfg.Port)
+	settingsSvc := settings.NewService(settingsRepo)
+	nginxSvc := nginx.NewService(nginxRepo, cfg.NginxSitesDir, cfg.Port, settingsSvc)
+	settingsSvc.SetChangeListener(nginxSvc)
 	auditSvc := audit.NewService(auditRepo)
 	trafficSvc := traffic.NewService(trafficRepo, nodesRepo)
 	wgEngine := wireguard.NewEngine()
@@ -114,6 +118,7 @@ func main() {
 	nodesHandler := network_nodes.NewHandler(nodesSvc)
 	nginxHandler := nginx.NewHandler(nginxSvc)
 	nginxAuthHandler := nginx.NewAuthHandler(nginxRepo)
+	settingsHandler := settings.NewHandler(settingsSvc)
 	auditHandler := audit.NewHandler(auditSvc)
 	trafficHandler := traffic.NewHandler(trafficSvc)
 	wgHandler := wireguard.NewHandler(wgSvc)
@@ -140,6 +145,7 @@ func main() {
 			r.Mount("/nat-groups", natHandler.Routes())
 			r.Mount("/network-nodes", nodesHandler.Routes())
 			r.Mount("/nginx-domains", nginxHandler.Routes())
+			r.Mount("/settings", settingsHandler.Routes())
 			r.Mount("/audit-logs", auditHandler.Routes())
 			r.Mount("/traffic", trafficHandler.Routes())
 			r.Mount("/wireguard", wgHandler.Routes())

internal/database/migrations/007_settings.sql

@@ -0,0 +1,6 @@
+-- Global key/value settings store
+CREATE TABLE IF NOT EXISTS settings (
+    key        TEXT PRIMARY KEY,
+    value      TEXT NOT NULL,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);

internal/nginx/service.go

@@ -15,14 +15,20 @@ import (
 	"github.com/sokol/system-control/internal/pkg/validate"
 )
 
+// SettingsProvider supplies global settings the nginx config depends on.
+type SettingsProvider interface {
+	ForceTLS12() bool
+}
+
 type Service struct {
 	repo        *Repository
 	sitesDir    string
 	backendPort int
+	settings    SettingsProvider
 }
 
-func NewService(repo *Repository, sitesDir string, backendPort int) *Service {
-	return &Service{repo: repo, sitesDir: sitesDir, backendPort: backendPort}
+func NewService(repo *Repository, sitesDir string, backendPort int, settings SettingsProvider) *Service {
+	return &Service{repo: repo, sitesDir: sitesDir, backendPort: backendPort, settings: settings}
 }
 
 func (s *Service) GetAll() ([]Domain, error) {
@@ -384,18 +390,23 @@ func (s *Service) configPath(domain string) string {
 	return filepath.Join(s.sitesDir, fmt.Sprintf("sc_%s.conf", domain))
 }
 
-func (s *Service) writeAndReload(domain *Domain) error {
+// writeConfig renders and writes the nginx config for a domain and validates
+// it with `nginx -t`, rolling back on test failure (restoring the previous
+// config if one existed, otherwise removing the brand-new file). It does NOT
+// reload nginx — callers reload once they have written all configs.
+func (s *Service) writeConfig(domain *Domain) error {
 	if runtime.GOOS != "linux" {
 		slog.Warn("nginx config write skipped on non-Linux", "domain", domain.Domain)
 		return nil
 	}
 
-	content, err := renderConfig(domain, s.backendPort)
+	content, err := renderConfig(domain, s.backendPort, s.settings.ForceTLS12())
 	if err != nil {
 		return fmt.Errorf("render config: %w", err)
 	}
 
 	path := s.configPath(domain.Domain)
+	prev, prevErr := os.ReadFile(path) // prevErr != nil => no prior config existed
 	if err := os.WriteFile(path, content, 0644); err != nil {
 		return fmt.Errorf("write config file: %w", err)
 	}
@@ -404,15 +415,74 @@ func (s *Service) writeAndReload(domain *Domain) error {
 	cmd := exec.Command("nginx", "-t")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		// Rollback: remove bad config
-		os.Remove(path)
+		// Roll back: restore the previous working config if one existed,
+		// otherwise remove the brand-new (bad) file. Prevents a failed
+		// rebuild from taking an already-online domain offline.
+		if prevErr == nil {
+			if wErr := os.WriteFile(path, prev, 0644); wErr != nil {
+				slog.Error("failed to restore previous nginx config after failed test", "error", wErr, "domain", domain.Domain)
+			}
+		} else {
+			os.Remove(path)
+		}
 		return fmt.Errorf("nginx config test failed: %s: %w", string(output), err)
 	}
 
+	return nil
+}
+
+func (s *Service) writeAndReload(domain *Domain) error {
+	if err := s.writeConfig(domain); err != nil {
+		return err
+	}
 	s.reloadNginx()
 	return nil
 }
 
+// rebuildTargets returns the domains whose nginx config depends on global
+// SSL settings: enabled domains that have SSL. Non-SSL domains are skipped
+// because ForceTLS12 / http2 only affect the SSL server block.
+func rebuildTargets(domains []Domain) []*Domain {
+	var targets []*Domain
+	for i := range domains {
+		d := &domains[i]
+		if d.Enabled && d.SSLEnabled {
+			targets = append(targets, d)
+		}
+	}
+	return targets
+}
+
+// RebuildAll re-renders and reloads nginx configs for all SSL-enabled domains.
+// Used when a global setting (e.g. force TLS 1.2) changes. It reloads nginx once
+// after writing all configs rather than per domain.
+func (s *Service) RebuildAll() error {
+	if runtime.GOOS != "linux" {
+		return nil
+	}
+	domains, err := s.repo.GetAll()
+	if err != nil {
+		return fmt.Errorf("get domains: %w", err)
+	}
+	written := 0
+	for _, d := range rebuildTargets(domains) {
+		if err := s.writeConfig(d); err != nil {
+			slog.Error("failed to rebuild nginx config", "error", err, "domain", d.Domain)
+			continue
+		}
+		written++
+	}
+	if written > 0 {
+		s.reloadNginx()
+	}
+	return nil
+}
+
+// OnSettingsChanged implements settings.ChangeListener: rebuild all configs.
+func (s *Service) OnSettingsChanged() error {
+	return s.RebuildAll()
+}
+
 func (s *Service) removeConfig(domain string) {
 	os.Remove(s.configPath(domain))
 }

internal/nginx/service_test.go

@@ -7,6 +7,10 @@ import (
 	"github.com/sokol/system-control/internal/database"
 )
 
+type stubSettings struct{ forceTLS12 bool }
+
+func (s stubSettings) ForceTLS12() bool { return s.forceTLS12 }
+
 func setupNginxTest(t *testing.T) *Service {
 	t.Helper()
 	dbPath := filepath.Join(t.TempDir(), "test.db")
@@ -18,7 +22,7 @@ func setupNginxTest(t *testing.T) *Service {
 
 	sitesDir := t.TempDir()
 	repo := NewRepository(db)
-	return NewService(repo, sitesDir, 8080)
+	return NewService(repo, sitesDir, 8080, stubSettings{})
 }
 
 // mustCreate creates a domain, ignoring nginx config errors (expected in test env without root).
@@ -31,6 +35,22 @@ func mustCreate(t *testing.T, svc *Service, req CreateDomainRequest) *Domain {
 	return domain
 }
 
+func TestRebuildTargets(t *testing.T) {
+	domains := []Domain{
+		{Domain: "enabled-ssl.example.com", Enabled: true, SSLEnabled: true},
+		{Domain: "enabled-nossl.example.com", Enabled: true, SSLEnabled: false},
+		{Domain: "disabled-ssl.example.com", Enabled: false, SSLEnabled: true},
+	}
+
+	targets := rebuildTargets(domains)
+	if len(targets) != 1 {
+		t.Fatalf("expected 1 target, got %d", len(targets))
+	}
+	if targets[0].Domain != "enabled-ssl.example.com" {
+		t.Errorf("expected 'enabled-ssl.example.com', got %q", targets[0].Domain)
+	}
+}
+
 func TestCreateDomain_Success(t *testing.T) {
 	svc := setupNginxTest(t)
 

internal/nginx/template.go

@@ -74,12 +74,21 @@ server {
 }
 
 server {
-    listen 443 ssl;
+    listen 443 ssl http2;
     server_name {{.Domain}};
 
     ssl_certificate /etc/letsencrypt/live/{{.Domain}}/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/{{.Domain}}/privkey.pem;
+{{- if .ForceTLS12}}
+    ssl_protocols TLSv1.2;
+    ssl_prefer_server_ciphers off;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+    ssl_session_tickets off;
+{{- else}}
     include /etc/letsencrypt/options-ssl-nginx.conf;
+{{- end}}
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 {{template "locations" .}}
 }
@@ -106,9 +115,10 @@ type configData struct {
 	HasAuth           bool
 	BackendPort       int
 	SSLEnabled        bool
+	ForceTLS12        bool
 }
 
-func renderConfig(d *Domain, backendPort int) ([]byte, error) {
+func renderConfig(d *Domain, backendPort int, forceTLS12 bool) ([]byte, error) {
 	scheme := d.UpstreamScheme
 	if scheme == "" {
 		scheme = "http"
@@ -122,6 +132,7 @@ func renderConfig(d *Domain, backendPort int) ([]byte, error) {
 		HasAuth:           d.AuthEnabled,
 		BackendPort:       backendPort,
 		SSLEnabled:        d.SSLEnabled,
+		ForceTLS12:        forceTLS12,
 	}
 	var buf bytes.Buffer
 	if err := confTmpl.Execute(&buf, data); err != nil {

internal/nginx/template_test.go

@@ -0,0 +1,50 @@
+package nginx
+
+import (
+	"strings"
+	"testing"
+)
+
+func sslDomain() *Domain {
+	return &Domain{
+		Domain:         "example.com",
+		UpstreamIP:     "10.0.0.1",
+		UpstreamPort:   8080,
+		UpstreamScheme: "http",
+		SSLEnabled:     true,
+	}
+}
+
+func TestRenderConfig_HTTP2AlwaysEnabled(t *testing.T) {
+	out, err := renderConfig(sslDomain(), 8080, false)
+	if err != nil {
+		t.Fatalf("renderConfig: %v", err)
+	}
+	if !strings.Contains(string(out), "listen 443 ssl http2;") {
+		t.Errorf("expected 'listen 443 ssl http2;' in SSL config, got:\n%s", out)
+	}
+}
+
+func TestRenderConfig_ForceTLS12(t *testing.T) {
+	out, err := renderConfig(sslDomain(), 8080, true)
+	if err != nil {
+		t.Fatalf("renderConfig: %v", err)
+	}
+	s := string(out)
+	if !strings.Contains(s, "ssl_protocols TLSv1.2;") {
+		t.Errorf("expected 'ssl_protocols TLSv1.2;' when ForceTLS12, got:\n%s", s)
+	}
+	if strings.Contains(s, "options-ssl-nginx.conf") {
+		t.Errorf("expected certbot include ABSENT when ForceTLS12, got:\n%s", s)
+	}
+}
+
+func TestRenderConfig_DefaultUsesCertbotInclude(t *testing.T) {
+	out, err := renderConfig(sslDomain(), 8080, false)
+	if err != nil {
+		t.Fatalf("renderConfig: %v", err)
+	}
+	if !strings.Contains(string(out), "options-ssl-nginx.conf") {
+		t.Errorf("expected certbot include when not ForceTLS12, got:\n%s", out)
+	}
+}

internal/settings/handler.go

@@ -0,0 +1,44 @@
+package settings
+
+import (
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/sokol/system-control/internal/pkg/httputil"
+)
+
+type Handler struct {
+	svc *Service
+}
+
+func NewHandler(svc *Service) *Handler {
+	return &Handler{svc: svc}
+}
+
+func (h *Handler) Routes() chi.Router {
+	r := chi.NewRouter()
+	r.Get("/", h.get)
+	r.Put("/", h.update)
+	return r
+}
+
+type settingsDTO struct {
+	ForceTLS12 bool `json:"forceTls12"`
+}
+
+func (h *Handler) get(w http.ResponseWriter, r *http.Request) {
+	httputil.JSON(w, http.StatusOK, settingsDTO{ForceTLS12: h.svc.ForceTLS12()})
+}
+
+func (h *Handler) update(w http.ResponseWriter, r *http.Request) {
+	var req settingsDTO
+	if err := httputil.Decode(r, &req); err != nil {
+		httputil.Error(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if err := h.svc.SetForceTLS12(req.ForceTLS12); err != nil {
+		httputil.Error(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	httputil.JSON(w, http.StatusOK, settingsDTO{ForceTLS12: req.ForceTLS12})
+}

internal/settings/repository.go

@@ -0,0 +1,34 @@
+package settings
+
+import "database/sql"
+
+type Repository struct {
+	db *sql.DB
+}
+
+func NewRepository(db *sql.DB) *Repository {
+	return &Repository{db: db}
+}
+
+// Get returns the value for key, or empty string if the key does not exist.
+func (r *Repository) Get(key string) (string, error) {
+	var value string
+	err := r.db.QueryRow("SELECT value FROM settings WHERE key = ?", key).Scan(&value)
+	if err == sql.ErrNoRows {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	return value, nil
+}
+
+// Set inserts or updates the value for key.
+func (r *Repository) Set(key, value string) error {
+	_, err := r.db.Exec(
+		`INSERT INTO settings (key, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)
+			ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = CURRENT_TIMESTAMP`,
+		key, value,
+	)
+	return err
+}