Add manual, optionally-encrypted backup download (no auto-upload)
New POST /backup/download (admin-only) tars the whole jsondb directory (all servers/clients/users/settings) and streams it back as a file download. If a passphrase is given, the archive is encrypted first (AES-256-GCM, scrypt-derived key, backup/encrypt.go) - a small self-contained format, not gpg/OpenPGP-compatible, to avoid shelling out to an external binary or adding a PGP dependency. Deliberately does NOT upload anywhere automatically (e.g. to Nextcloud) - the archive only ever leaves the server as this one HTTP response to the requesting admin, who is responsible for storing it themselves. New "Download Backup" button + passphrase modal on the Global Settings page.
This commit is contained in:
sysops
@@ -0,0 +1,61 @@
|
||||
// Package backup builds a downloadable, optionally encrypted snapshot of
|
||||
// the jsondb directory (servers, clients, users, settings - everything
|
||||
// needed to restore this installation). It never transmits data anywhere
|
||||
// on its own; the archive is only ever returned to an authenticated admin
|
||||
// as an HTTP download, never uploaded automatically.
|
||||
package backup
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"bytes"
|
||||
"compress/gzip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
// BuildArchive tars+gzips every regular file under dbPath into memory,
|
||||
// preserving paths relative to dbPath so restoring means extracting into a
|
||||
// fresh, empty db directory.
|
||||
func BuildArchive(dbPath string) ([]byte, error) {
|
||||
var buf bytes.Buffer
|
||||
gzw := gzip.NewWriter(&buf)
|
||||
tw := tar.NewWriter(gzw)
|
||||
|
||||
err := filepath.Walk(dbPath, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if info.IsDir() {
|
||||
return nil
|
||||
}
|
||||
relPath, err := filepath.Rel(dbPath, path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
data, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
header := &tar.Header{
|
||||
Name: relPath,
|
||||
Mode: int64(info.Mode().Perm()),
|
||||
Size: int64(len(data)),
|
||||
ModTime: info.ModTime(),
|
||||
}
|
||||
if err := tw.WriteHeader(header); err != nil {
|
||||
return err
|
||||
}
|
||||
_, err = tw.Write(data)
|
||||
return err
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := tw.Close(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := gzw.Close(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return buf.Bytes(), nil
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
package backup
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"errors"
|
||||
"io"
|
||||
|
||||
"golang.org/x/crypto/scrypt"
|
||||
)
|
||||
|
||||
const (
|
||||
saltSize = 16
|
||||
keySize = 32 // AES-256
|
||||
)
|
||||
|
||||
// deriveKey turns a passphrase into a 32-byte AES key via scrypt, using the
|
||||
// given salt. scrypt (N=32768, r=8, p=1) is deliberately expensive to slow
|
||||
// down offline brute-force of a leaked archive.
|
||||
func deriveKey(passphrase string, salt []byte) ([]byte, error) {
|
||||
return scrypt.Key([]byte(passphrase), salt, 32768, 8, 1, keySize)
|
||||
}
|
||||
|
||||
// Encrypt symmetrically encrypts data with a passphrase using scrypt key
|
||||
// derivation + AES-256-GCM. Output layout: [16-byte salt][12-byte
|
||||
// nonce][GCM ciphertext+tag]. This is a small self-contained format
|
||||
// specific to this app - NOT OpenPGP/gpg-compatible - chosen to avoid
|
||||
// shelling out to an external gpg binary or adding a full PGP dependency.
|
||||
func Encrypt(plaintext []byte, passphrase string) ([]byte, error) {
|
||||
salt := make([]byte, saltSize)
|
||||
if _, err := io.ReadFull(rand.Reader, salt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
key, err := deriveKey(passphrase, salt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
nonce := make([]byte, gcm.NonceSize())
|
||||
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ciphertext := gcm.Seal(nil, nonce, plaintext, nil)
|
||||
|
||||
out := make([]byte, 0, saltSize+len(nonce)+len(ciphertext))
|
||||
out = append(out, salt...)
|
||||
out = append(out, nonce...)
|
||||
out = append(out, ciphertext...)
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// Decrypt reverses Encrypt, for manual restore/recovery.
|
||||
func Decrypt(data []byte, passphrase string) ([]byte, error) {
|
||||
if len(data) < saltSize {
|
||||
return nil, errors.New("backup: ciphertext too short")
|
||||
}
|
||||
salt := data[:saltSize]
|
||||
key, err := deriveKey(passphrase, salt)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
block, err := aes.NewCipher(key)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
nonceSize := gcm.NonceSize()
|
||||
if len(data) < saltSize+nonceSize {
|
||||
return nil, errors.New("backup: ciphertext too short")
|
||||
}
|
||||
nonce := data[saltSize : saltSize+nonceSize]
|
||||
ciphertext := data[saltSize+nonceSize:]
|
||||
return gcm.Open(nil, nonce, ciphertext, nil)
|
||||
}
|
||||
@@ -23,6 +23,7 @@ import (
|
||||
"golang.zx2c4.com/wireguard/wgctrl"
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"github.com/ngoduykhanh/wireguard-ui/backup"
|
||||
"github.com/ngoduykhanh/wireguard-ui/emailer"
|
||||
"github.com/ngoduykhanh/wireguard-ui/model"
|
||||
"github.com/ngoduykhanh/wireguard-ui/store"
|
||||
@@ -1587,6 +1588,42 @@ func GetHashesChanges(db store.IStore) echo.HandlerFunc {
|
||||
}
|
||||
}
|
||||
|
||||
// DownloadBackup handler builds a tar.gz snapshot of the entire jsondb
|
||||
// directory (all servers/clients/users/settings, everything needed to
|
||||
// restore this installation) and returns it as a file download. If a
|
||||
// non-empty "passphrase" is given in the JSON body, the archive is
|
||||
// encrypted (AES-256-GCM via backup.Encrypt) before being returned.
|
||||
// Admin-only. The archive is never transmitted anywhere automatically -
|
||||
// it only ever goes out as this one HTTP response to the requesting admin.
|
||||
func DownloadBackup(db store.IStore) echo.HandlerFunc {
|
||||
return func(c echo.Context) error {
|
||||
var payload struct {
|
||||
Passphrase string `json:"passphrase"`
|
||||
}
|
||||
// best-effort bind; an empty/absent body just means "no encryption"
|
||||
c.Bind(&payload)
|
||||
|
||||
archiveData, err := backup.BuildArchive(db.GetPath())
|
||||
if err != nil {
|
||||
log.Error("Cannot build backup archive: ", err)
|
||||
return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot build backup archive"})
|
||||
}
|
||||
|
||||
filename := fmt.Sprintf("wireguard-ui-multi-backup-%s.tar.gz", time.Now().UTC().Format("20060102-150405"))
|
||||
if payload.Passphrase != "" {
|
||||
archiveData, err = backup.Encrypt(archiveData, payload.Passphrase)
|
||||
if err != nil {
|
||||
log.Error("Cannot encrypt backup archive: ", err)
|
||||
return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot encrypt backup archive"})
|
||||
}
|
||||
filename += ".enc"
|
||||
}
|
||||
|
||||
c.Response().Header().Set(echo.HeaderContentDisposition, fmt.Sprintf("attachment; filename=%s", filename))
|
||||
return c.Blob(http.StatusOK, "application/octet-stream", archiveData)
|
||||
}
|
||||
}
|
||||
|
||||
// AboutPage handler
|
||||
func AboutPage() echo.HandlerFunc {
|
||||
return func(c echo.Context) error {
|
||||
|
||||
@@ -265,6 +265,7 @@ func main() {
|
||||
app.POST(util.BasePath+"/servers/:id/api/apply-wg-config", handler.ApplyServerConfig(db, tmplDir), handler.ValidSession, handler.ContentTypeJson, handler.RequireServerAccess(db))
|
||||
app.GET(util.BasePath+"/servers/:id/settings", handler.GetServerSettings(db), handler.ValidSession, handler.RequireServerAccess(db))
|
||||
app.POST(util.BasePath+"/servers/:id/settings", handler.SaveServerSettingsHandler(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin)
|
||||
app.POST(util.BasePath+"/backup/download", handler.DownloadBackup(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin)
|
||||
app.GET(util.BasePath+"/api/clients", handler.GetClients(db), handler.ValidSession)
|
||||
app.GET(util.BasePath+"/api/client/:id", handler.GetClient(db), handler.ValidSession)
|
||||
app.GET(util.BasePath+"/api/machine-ips", handler.MachineIPAddresses(), handler.ValidSession)
|
||||
|
||||
@@ -120,9 +120,57 @@ Global Settings
|
||||
</div>
|
||||
</div>
|
||||
<!-- /.row -->
|
||||
<div class="row">
|
||||
<div class="col-md-6">
|
||||
<div class="card card-warning">
|
||||
<div class="card-header">
|
||||
<h3 class="card-title">Backup</h3>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<p>Download a snapshot of the entire database (all servers, clients, users
|
||||
and settings, including private keys). Optionally encrypt it with a
|
||||
passphrase before it's downloaded - nothing is ever uploaded
|
||||
automatically, this only produces a file for you to store yourself.</p>
|
||||
<button type="button" class="btn btn-outline-warning" data-toggle="modal"
|
||||
data-target="#modal_download_backup">Download Backup</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<div class="modal fade" id="modal_download_backup">
|
||||
<div class="modal-dialog">
|
||||
<div class="modal-content">
|
||||
<div class="modal-header">
|
||||
<h4 class="modal-title">Download Backup</h4>
|
||||
<button type="button" class="close" data-dismiss="modal" aria-label="Close">
|
||||
<span aria-hidden="true">×</span>
|
||||
</button>
|
||||
</div>
|
||||
<div class="modal-body">
|
||||
<div class="form-group">
|
||||
<label for="_backup_passphrase" class="control-label">Encryption passphrase (optional)</label>
|
||||
<input type="password" class="form-control" id="_backup_passphrase"
|
||||
placeholder="Leave empty for an unencrypted archive">
|
||||
<small class="form-text text-muted">
|
||||
If set, the archive is encrypted with AES-256-GCM. Keep the passphrase
|
||||
somewhere safe - without it the backup cannot be restored.
|
||||
</small>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal-footer justify-content-between">
|
||||
<button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
|
||||
<button type="button" class="btn btn-success" id="btn_confirm_download_backup">Download</button>
|
||||
</div>
|
||||
</div>
|
||||
<!-- /.modal-content -->
|
||||
</div>
|
||||
<!-- /.modal-dialog -->
|
||||
</div>
|
||||
<!-- /.modal -->
|
||||
|
||||
<div class="modal fade" id="modal_endpoint_address_suggestion">
|
||||
<div class="modal-dialog">
|
||||
<div class="modal-content">
|
||||
@@ -280,5 +328,50 @@ Global Settings
|
||||
$("#modal_endpoint_address_suggestion").modal('hide');
|
||||
});
|
||||
});
|
||||
|
||||
// Download backup: fetch as a blob (can't be a plain form submit
|
||||
// since the app's CSRF middleware requires application/json), then
|
||||
// trigger a client-side download of the response.
|
||||
$(document).ready(function () {
|
||||
$("#btn_confirm_download_backup").click(function () {
|
||||
const passphrase = $("#_backup_passphrase").val();
|
||||
const btn = $(this);
|
||||
btn.prop('disabled', true).text('Preparing...');
|
||||
|
||||
fetch('{{.basePath}}/backup/download', {
|
||||
method: 'POST',
|
||||
headers: {'Content-Type': 'application/json'},
|
||||
body: JSON.stringify({passphrase: passphrase})
|
||||
}).then(function (resp) {
|
||||
if (!resp.ok) {
|
||||
return resp.json().then(function (body) {
|
||||
throw new Error(body.message || 'Backup failed');
|
||||
});
|
||||
}
|
||||
const disposition = resp.headers.get('Content-Disposition') || '';
|
||||
const match = disposition.match(/filename=([^;]+)/);
|
||||
const filename = match ? match[1].trim() : 'wireguard-ui-multi-backup.tar.gz';
|
||||
return resp.blob().then(function (blob) {
|
||||
return {blob: blob, filename: filename};
|
||||
});
|
||||
}).then(function (result) {
|
||||
const url = window.URL.createObjectURL(result.blob);
|
||||
const a = document.createElement('a');
|
||||
a.href = url;
|
||||
a.download = result.filename;
|
||||
document.body.appendChild(a);
|
||||
a.click();
|
||||
a.remove();
|
||||
window.URL.revokeObjectURL(url);
|
||||
$("#modal_download_backup").modal('hide');
|
||||
$("#_backup_passphrase").val('');
|
||||
toastr.success('Backup downloaded');
|
||||
}).catch(function (err) {
|
||||
toastr.error(err.message);
|
||||
}).finally(function () {
|
||||
btn.prop('disabled', false).text('Download');
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
{{end}}
|
||||
|
||||
Reference in New Issue
Block a user