Add SSH key pair management tasks

Add generate_ssh_key, get_ssh_key, and revoke_ssh_key task types to
enable direct SSH access to an Edgebox instance. The generate task
creates an ED25519 key pair, installs the public key in authorized_keys,
and stores both keys plus the fingerprint in the option table. The
revoke task removes the key pair from disk, purges it from
authorized_keys, and clears the stored options.

.github/workflows/go.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v5
       with:
         go-version: '1.20.2'
     - name: Check out code

CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+## [1.3.2] - 08-12-2024
+
+* Fix to Browser Dev feature:
+    * Checking browser dev url when internet_accessible was checking the incorrect path. This is now fixed.
+
+## [1.3.1] - 08-12-2024
+
+* Fixes to Browser Dev feature:
+    * Now edgeboxctl also fetches or generates the browser dev environment url and saves it into an option both when starting, and every time the browser dev status is fetched.
+
+## [1.3.0] - 05-12-2024
+
+* Added Edgebox Browser Development Environment Feature Support
+    * Added tasks for handling browser development environment into tasks.go
+    * Added executable tasks to ExecuteTask and scheduled ones to ExecuteSchedules
+* Other bug fixes and improvements.
+
+### Missing Past Releases
+
+Release notes for past versions are not available in this file. Please refer to the [GitHub releases](https://hithub.com/edgebox-iot/edgeboxctl/releases) for more information. Feel free to contribute to this file by adding missing release notes.
+

Makefile

@@ -67,7 +67,7 @@ run:
 install:
 	@echo "📦 Installing edgeboxctl service (${RELEASE}) for ${GOOS} (${GOARCH})\n"
 	
-	@echo "🚧 Stopping edgeboxctl service if it is running"
+	@echo "�🚧 Stopping edgeboxctl service if it is running"
 	sudo systemctl stop edgeboxctl || true
 
 	@echo "\n🗑️ Removing old edgeboxctl binary and service"

README.md

@@ -59,10 +59,12 @@ To get a local copy up and running follow these simple steps.
 If you're running for development purposes, a docker container suffices, so make sure you have:
 
 * docker
-* docker compose
+* docker compose (docker-compose-v2 package)
 
 Check the following links for more info on [Docker](https://www.docker.com/) and [Docker Compose](https://docs.docker.com/compose/).
 
+**Note:** If you don't have `docker compose` available, install it with: `sudo apt-get install docker-compose-v2`
+
 Aditionally, `edgeboxctl` needs the following bash commands available wherever it runs:
 
 * `arm-linux-gnueabi-gcc` (`sudo apt-get install gcc-arm*`)
@@ -79,10 +81,10 @@ Aditionally, `edgeboxctl` needs the following bash commands available wherever i
 ```sh
 git clone https://github.com/edgebox-iot/edgeboxctl.git
 ```
-2. Run Docker-Compose
+2. Run Docker Compose
-```sh
+
-docker-compose up
 ```
+docker compose up
 
 
 

internal/edgeapps/edgeapps.go

@@ -489,7 +489,7 @@ func GetEdgeAppServices(ID string) []EdgeAppService {
 		// Check if the service is actually running
 		if shouldBeRunning {
 			cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "exec", "-T", serviceID, "echo", "'Service Check'"}
-			cmdResult := utils.Exec(wsPath, "docker-compose", cmdArgs)
+			cmdResult := utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 			if cmdResult != "" {
 				isRunning = true
 			}
@@ -511,7 +511,7 @@ func RunEdgeApp(ID string) EdgeAppStatus {
 	for _, service := range services {
 
 		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "start", service.ID}
-		utils.Exec(wsPath, "docker-compose", cmdArgs)
+		utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 	}
 
 	// Wait for it to settle up before continuing...
@@ -529,7 +529,7 @@ func StopEdgeApp(ID string) EdgeAppStatus {
 	for _, service := range services {
 
 		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "stop", service.ID}
-		utils.Exec(wsPath, "docker-compose", cmdArgs)
+		utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 	}
 
 	// Wait for it to settle up before continuing...

internal/tasks/tasks.go

@@ -18,6 +18,8 @@ import (
 	"github.com/edgebox-iot/edgeboxctl/internal/system"
 	"github.com/edgebox-iot/edgeboxctl/internal/utils"
 
+	"github.com/joho/godotenv"
+
 	_ "github.com/go-sql-driver/mysql" // Mysql Driver
 	_ "github.com/mattn/go-sqlite3"    // SQlite Driver
 )
@@ -295,6 +297,21 @@ func ExecuteTask(task Task) Task {
 			taskResult := taskStopShell()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
 
+		case "generate_ssh_key":
+			log.Println("Generating SSH Key...")
+			taskResult := taskGenerateSshKey()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "get_ssh_key":
+			log.Println("Getting SSH Key...")
+			taskResult := taskGetSshKey()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "revoke_ssh_key":
+			log.Println("Revoking SSH Key...")
+			taskResult := taskRevokeSshKey()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
 		case "activate_browser_dev":
 			log.Println("Activating Browser Dev Environment")
 			taskResult := taskActivateBrowserDev()
@@ -531,6 +548,8 @@ func ExecuteSchedules(tick int) {
 		log.Println("Fetching Browser Dev Environment Information")
 		taskGetBrowserDevPassword()
 		taskGetBrowserDevStatus()
+
+		taskCheckSystemUpdates()
 		
 		ip := taskGetSystemIP()
 		log.Println("System IP is: " + ip)
@@ -560,9 +579,7 @@ func ExecuteSchedules(tick int) {
 		taskStartWs()
 		log.Println(taskGetEdgeApps())
 		taskUpdateSystemLoggerServices()
-		taskRecoverFromUpdate()
+		taskRecoverFromUpdate()		
-		taskCheckSystemUpdates()
-		
 	}
 
 	if tick%5 == 0 {
@@ -571,6 +588,10 @@ func ExecuteSchedules(tick int) {
 		log.Println(taskGetStorageDevices())
 	}
 
+	if tick%15 == 0 {
+		taskGetBrowserDevStatus()
+	}
+
 	if tick%30 == 0 {
 		// Executing every 30 ticks
 		log.Println(taskGetEdgeApps())
@@ -1150,7 +1171,10 @@ func taskGetBrowserDevStatus() string {
 	if browserDevStatus == "active" {
 		fmt.Println("Browser Dev Environment is running")
 		utils.WriteOption("BROWSERDEV_STATUS", "running")
+		taskGetBrowserDevUrl()
+
 		return "{\"status\": \"running\"}"
+
 	} else {
 		fmt.Println("Browser Dev Environment is not running")
 		utils.WriteOption("BROWSERDEV_STATUS", "not_running")
@@ -1158,6 +1182,24 @@ func taskGetBrowserDevStatus() string {
 	}
 }
 
+func taskGetBrowserDevUrl() string {
+	url := ""
+	myEdgeAppServiceEnv, err := godotenv.Read(utils.GetPath(utils.BrowserDevPath) + "myedgeapp.env")
+	if err != nil {
+		log.Println("No myedge.app environment file found. Status is Network-Only")
+		url = "http://dev." + system.GetHostname() + ".local"
+	} else {
+		if myEdgeAppServiceEnv["INTERNET_URL"] != "" {
+			url = "https://" + myEdgeAppServiceEnv["INTERNET_URL"]
+		}
+	}
+
+	fmt.Println("Browser Dev Url: " + url)
+
+	utils.WriteOption("BROWSERDEV_URL", url)
+	return url
+}
+
 func taskActivateBrowserDev() string {
 	fmt.Println("Executing taskActivateBrowserDev")
 	wsPath := utils.GetPath(utils.WsPath)
@@ -1170,6 +1212,10 @@ func taskActivateBrowserDev() string {
 	system.StartWs()
 	// Write control option for API
 	utils.WriteOption("BROWSERDEV_STATUS", "running")
+
+	// Write and refresh the dev environment password option
+	taskGetBrowserDevPassword()
+
 	return "{\"status\": \"ok\"}"
 }
 
@@ -1189,15 +1235,14 @@ func taskDeactivateBrowserDev() string {
 
 func taskGetBrowserDevPassword() string {
 	fmt.Println("Executing taskGetBrowserDevPassword")
-	password := utils.ReadOption("BROWSERDEV_PASSWORD")
+
-	if password == "" {
+	password, err := system.FetchBrowserDevPasswordFromFile()
-		password, err := system.FetchBrowserDevPasswordFromFile()
+	if err == nil {
-		if err == nil {
+		utils.WriteOption("BROWSERDEV_PASSWORD", password)
-			utils.WriteOption("BROWSERDEV_PASSWORD", password)
+	} else {
-		} else {
+		fmt.Println("Error fetching browser dev password from file: " + err.Error())
-			fmt.Println("Error fetching browser dev password from file: " + err.Error())
-		}
 	}
+
 	return password
 }
 
@@ -1555,3 +1600,118 @@ func taskStartWs() {
 	fmt.Println("Executing taskStartWs")
 	system.StartWs()
 }
+
+func taskGenerateSshKey() string {
+	fmt.Println("Executing taskGenerateSshKey")
+
+	keyPath := "/root/.ssh/id_ed25519"
+	pubKeyPath := keyPath + ".pub"
+
+	// Check if key already exists
+	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+		fmt.Println("SSH key not found, generating new ED25519 key pair...")
+		utils.Exec("/", "ssh-keygen", []string{"-t", "ed25519", "-f", keyPath, "-N", "", "-q"})
+	} else {
+		fmt.Println("SSH key already exists at " + keyPath)
+	}
+
+	// Read public key
+	pubKeyBytes, err := os.ReadFile(pubKeyPath)
+	if err != nil {
+		fmt.Println("Error reading public key: " + err.Error())
+		return "{\"status\": \"error\", \"message\": \"" + err.Error() + "\"}"
+	}
+	pubKey := string(pubKeyBytes)
+
+	// Read private key
+	privKeyBytes, err := os.ReadFile(keyPath)
+	if err != nil {
+		fmt.Println("Error reading private key: " + err.Error())
+		return "{\"status\": \"error\", \"message\": \"" + err.Error() + "\"}"
+	}
+	privKey := string(privKeyBytes)
+
+	// Also add public key to authorized_keys for root
+	utils.Exec("/", "sh", []string{"-c", "mkdir -p /root/.ssh && chmod 700 /root/.ssh"})
+	authorizedFile := "/root/.ssh/authorized_keys"
+	authorizedBytes, _ := os.ReadFile(authorizedFile)
+	authorizedContent := string(authorizedBytes)
+
+	// Only add if not already present
+	if !strings.Contains(authorizedContent, strings.TrimSpace(pubKey)) {
+		f, err := os.OpenFile(authorizedFile, os.O_APPEND|os.O_WRONLY, 0600)
+		if err == nil {
+			defer f.Close()
+			f.WriteString("\n" + pubKey)
+			fmt.Println("Added SSH public key to authorized_keys")
+		}
+	}
+
+	// Store in options for the API to read
+	utils.WriteOption("SSH_PUBLIC_KEY", strings.TrimSpace(pubKey))
+	utils.WriteOption("SSH_PRIVATE_KEY", privKey)
+	utils.WriteOption("SSH_KEY_FINGERPRINT", strings.TrimSpace(utils.Exec("/", "ssh-keygen", []string{"-lf", pubKeyPath, "-E", "sha256"})))
+
+	fmt.Println("SSH key stored in options")
+
+	return "{\"status\": \"ok\", \"public_key\": \"" + strings.TrimSpace(pubKey) + "\"}"
+}
+
+func taskGetSshKey() string {
+	fmt.Println("Executing taskGetSshKey")
+
+	pubKey := utils.ReadOption("SSH_PUBLIC_KEY")
+	fingerprint := utils.ReadOption("SSH_KEY_FINGERPRINT")
+
+	if pubKey == "" {
+		// Try to read from filesystem directly
+		return taskGenerateSshKey()
+	}
+
+	return "{\"status\": \"ok\", \"public_key\": \"" + pubKey + "\", \"fingerprint\": \"" + fingerprint + "\"}"
+}
+
+func taskRevokeSshKey() string {
+	fmt.Println("Executing taskRevokeSshKey")
+
+	keyPath := "/root/.ssh/id_ed25519"
+	pubKeyPath := keyPath + ".pub"
+
+	// Read current public key before deletion
+	var pubKeyForRemoval string
+	if bytes, err := os.ReadFile(pubKeyPath); err == nil {
+		pubKeyForRemoval = strings.TrimSpace(string(bytes))
+	}
+
+	// Remove SSH key pair from filesystem
+	if err := os.Remove(keyPath); err != nil {
+		fmt.Println("Warning: could not remove private key: " + err.Error())
+	}
+	if err := os.Remove(pubKeyPath); err != nil {
+		fmt.Println("Warning: could not remove public key: " + err.Error())
+	}
+
+	// Remove the public key from authorized_keys if present
+	if pubKeyForRemoval != "" {
+		authorizedFile := "/root/.ssh/authorized_keys"
+		if bytes, err := os.ReadFile(authorizedFile); err == nil {
+			lines := strings.Split(string(bytes), "\n")
+			newLines := []string{}
+			for _, line := range lines {
+				if strings.TrimSpace(line) != pubKeyForRemoval {
+					newLines = append(newLines, line)
+				}
+			}
+			_ = os.WriteFile(authorizedFile, []byte(strings.Join(newLines, "\n")), 0600)
+		}
+	}
+
+	// Remove SSH options from DB
+	utils.WriteOption("SSH_PUBLIC_KEY", "")
+	utils.WriteOption("SSH_PRIVATE_KEY", "")
+	utils.WriteOption("SSH_KEY_FINGERPRINT", "")
+
+	fmt.Println("SSH key pair revoked")
+
+	return "{\"status\": \"ok\", \"message\": \"SSH key pair revoked\"}"
+}

internal/utils/utils.go

@@ -111,6 +111,7 @@ const ApiPath string = "apiPath"
 const EdgeAppsPath string = "edgeAppsPath"
 const EdgeAppsBackupPath string = "edgeAppsBackupPath"
 const WsPath string = "wsPath"
+const BrowserDevPath string = "browserDevPath"
 const LoggerPath string = "loggerPath"
 const BrowserDevPasswordFileLocation string = "browserDevPasswordFileLocation"
 const BrowserDevProxyPath string = "browserDevProxyPath"
@@ -176,6 +177,14 @@ func GetPath(pathKey string) string {
 			targetPath = "/home/system/components/ws/"
 		}
 
+	case BrowserDevPath:
+
+		if env["BROWSERDEV_PATH"] != "" {
+			targetPath = env["BROWSERDEV_PATH"]
+		} else {
+			targetPath = "/home/system/components/dev/"
+		}
+
 	case LoggerPath:
 		if env["LOGGER_PATH"] != "" {
 			targetPath = env["LOGGER_PATH"]