Scaffold tomswallapi control-plane service

2026-07-19 13:31:14 +10:00
commit 6de48552fb
19 changed files with 1021 additions and 0 deletions
@@ -0,0 +1,90 @@
+// Package database provides the Postgres connection pool and schema migrations
+// for tomswallapi.
+package database
+
+import (
+	"context"
+	"embed"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+//go:embed migrations/*.sql
+var migrationsFS embed.FS
+
+// DB wraps a pgx connection pool.
+type DB struct {
+	Pool *pgxpool.Pool
+}
+
+// New opens a connection pool and verifies connectivity.
+func New(ctx context.Context, dsn string) (*DB, error) {
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		return nil, fmt.Errorf("creating pool: %w", err)
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("pinging database: %w", err)
+	}
+	return &DB{Pool: pool}, nil
+}
+
+// Close releases the pool.
+func (db *DB) Close() { db.Pool.Close() }
+
+// Migrate applies any pending embedded SQL migrations in lexical order. Each
+// migration file is recorded in schema_migrations and applied at most once.
+func (db *DB) Migrate(ctx context.Context) error {
+	if _, err := db.Pool.Exec(ctx, `
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version    TEXT PRIMARY KEY,
+			applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+		)`); err != nil {
+		return fmt.Errorf("creating schema_migrations: %w", err)
+	}
+
+	entries, err := migrationsFS.ReadDir("migrations")
+	if err != nil {
+		return fmt.Errorf("reading migrations: %w", err)
+	}
+	var files []string
+	for _, e := range entries {
+		if !e.IsDir() && strings.HasSuffix(e.Name(), ".sql") {
+			files = append(files, e.Name())
+		}
+	}
+	sort.Strings(files)
+
+	for _, name := range files {
+		var exists bool
+		if err := db.Pool.QueryRow(ctx,
+			`SELECT EXISTS(SELECT 1 FROM schema_migrations WHERE version = $1)`, name,
+		).Scan(&exists); err != nil {
+			return fmt.Errorf("checking migration %s: %w", name, err)
+		}
+		if exists {
+			continue
+		}
+
+		body, err := migrationsFS.ReadFile("migrations/" + name)
+		if err != nil {
+			return fmt.Errorf("reading migration %s: %w", name, err)
+		}
+
+		if err := pgx.BeginFunc(ctx, db.Pool, func(tx pgx.Tx) error {
+			if _, err := tx.Exec(ctx, string(body)); err != nil {
+				return fmt.Errorf("applying %s: %w", name, err)
+			}
+			_, err := tx.Exec(ctx, `INSERT INTO schema_migrations (version) VALUES ($1)`, name)
+			return err
+		}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
@@ -0,0 +1,95 @@
+-- Initial tomswallapi schema: fleet-global objects + per-device layer.
+-- See DESIGN.md (tomswall repo) for the model this implements.
+
+-- Global settings: a single row of fleet-wide defaults.
+CREATE TABLE settings (
+    id             BOOLEAN PRIMARY KEY DEFAULT true CHECK (id),  -- singleton
+    address_family TEXT    NOT NULL DEFAULT 'inet',
+    log_level      TEXT    NOT NULL DEFAULT 'info',
+    ip_forwarding  BOOLEAN NOT NULL DEFAULT true,
+    table_name     TEXT    NOT NULL DEFAULT 'tomswall',
+    default_resolver JSONB NOT NULL DEFAULT '[]'::jsonb  -- ["10.0.0.53"] or "system"
+);
+INSERT INTO settings (id) VALUES (true);
+
+-- Routing domains. enforce_on_routers toggles defense-in-depth vs transparent transit.
+CREATE TABLE fabrics (
+    name               TEXT PRIMARY KEY,
+    enforce_on_routers BOOLEAN NOT NULL DEFAULT false,
+    description        TEXT NOT NULL DEFAULT ''
+);
+
+-- Fleet-global zones. subnets is a list of CIDRs. parent gives subzone nesting.
+CREATE TABLE zones (
+    name    TEXT PRIMARY KEY,
+    type    TEXT NOT NULL DEFAULT 'ip',        -- ip | ip6 | firewall
+    subnets JSONB NOT NULL DEFAULT '[]'::jsonb,
+    parent  TEXT REFERENCES zones(name) ON DELETE RESTRICT
+);
+
+-- Address groups materialize nftables named sets. type drives population source.
+CREATE TABLE address_groups (
+    name         TEXT PRIMARY KEY,
+    type         TEXT NOT NULL CHECK (type IN ('static', 'dns', 'asn')),
+    members      JSONB NOT NULL DEFAULT '[]'::jsonb,  -- static: CIDRs; dns: FQDNs; asn: ASN numbers
+    refresh      TEXT NOT NULL DEFAULT '',            -- asn: cache TTL (e.g. 24h); dns: honor_ttl
+    description  TEXT NOT NULL DEFAULT ''
+);
+
+-- Reusable port+proto combos.
+CREATE TABLE portgroups (
+    name  TEXT PRIMARY KEY,
+    proto TEXT NOT NULL,
+    ports JSONB NOT NULL DEFAULT '[]'::jsonb
+);
+
+-- Default zone-to-zone policies. priority orders evaluation (first match wins).
+CREATE TABLE policies (
+    id       BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    priority INT NOT NULL DEFAULT 0,
+    source   TEXT NOT NULL,
+    dest     TEXT NOT NULL,
+    action   TEXT NOT NULL,
+    log      TEXT NOT NULL DEFAULT ''
+);
+
+-- Fleet-global intents. source/dest use the shorewall-style element list
+-- (bare zone, or zone:+ipset / zone:&fqdn). Stored as JSONB element arrays.
+CREATE TABLE rules (
+    id        BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    priority  INT NOT NULL DEFAULT 0,
+    action    TEXT NOT NULL,
+    source    JSONB NOT NULL DEFAULT '[]'::jsonb,  -- ["loc", "net:+asn_cloudflare"]
+    dest      JSONB NOT NULL DEFAULT '[]'::jsonb,
+    proto     TEXT NOT NULL DEFAULT '',
+    portgroup TEXT REFERENCES portgroups(name) ON DELETE RESTRICT,
+    ports     JSONB NOT NULL DEFAULT '[]'::jsonb,
+    log       TEXT NOT NULL DEFAULT '',
+    comment   TEXT NOT NULL DEFAULT ''
+);
+
+-- Devices in the fleet.
+CREATE TABLE devices (
+    name     TEXT PRIMARY KEY,
+    class    TEXT NOT NULL CHECK (class IN ('router', 'firewall')),
+    fabric   TEXT REFERENCES fabrics(name) ON DELETE SET NULL,
+    resolver JSONB NOT NULL DEFAULT '[]'::jsonb,   -- per-device DNS resolver override
+    settings JSONB NOT NULL DEFAULT '{}'::jsonb,   -- per-device settings overrides
+    reported_generation BIGINT NOT NULL DEFAULT 0, -- last generation the agent applied
+    last_seen TIMESTAMPTZ
+);
+
+-- The per-device zone->interface binding table (the only host-specific object).
+CREATE TABLE bindings (
+    device     TEXT NOT NULL REFERENCES devices(name) ON DELETE CASCADE,
+    zone       TEXT NOT NULL REFERENCES zones(name) ON DELETE CASCADE,
+    interfaces JSONB NOT NULL DEFAULT '[]'::jsonb,  -- ["eth1"] or ["bond0.40"]
+    PRIMARY KEY (device, zone)
+);
+
+-- Monotonic generation counter bumped on any config-affecting change.
+CREATE TABLE generation (
+    id      BOOLEAN PRIMARY KEY DEFAULT true CHECK (id),  -- singleton
+    current BIGINT NOT NULL DEFAULT 1
+);
+INSERT INTO generation (id) VALUES (true);