Omar SobhandClaude Opus 4.8
7332d69f8a
Security hardening: - The gateway no longer sends arbitrary shell to nodes. The WSS exec op is replaced by a typed `verify` op the daemon runs itself (fixed host+docker check); future container ops are typed too. cm-api NodeHub.verify() + the daemon's handle_command only dispatches vetted ops. BYO Tailscale: - migrations/0019_workspace_tailscale.sql + cm-db fleet_tailscale repo (store the user's Tailscale API key + tailnet, server-side only). - cm-api routes/tailscale.rs: POST/GET/DELETE /api/fleet/tailscale + GET /api/fleet/tailscale/devices (proxies api.tailscale.com device list). - Daemon: --tailscale-authkey → `tailscale up --authkey … --ssh` (enables Tailscale SSH for keyless user access); else `tailscale set --ssh=true`. Reports its tailscale IP (already). UI: - Fleet overview gains a Tailscale section: connect (key+tailnet) + live tailnet device status (online/last-seen/IP/os). Node cards show a copyable Tailscale SSH target (ssh <ip>). Remaining: P2 — RemoteDriver + placement (run agents on nodes) and the in-UI remote terminal (PTY proxied over the WSS channel). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
11 lines
546 B
SQL
11 lines
546 B
SQL
-- Bring-your-own Tailscale: a workspace connects its own tailnet so we can read
|
|
-- fleet network metrics (the Tailscale device list) via their API key. The key
|
|
-- is only ever used server-side for outbound calls to api.tailscale.com.
|
|
-- TODO: move api_key into the cm-secrets broker store (like `connections`).
|
|
CREATE TABLE workspace_tailscale (
|
|
workspace_id UUID PRIMARY KEY REFERENCES workspaces (id) ON DELETE CASCADE,
|
|
api_key TEXT NOT NULL,
|
|
tailnet TEXT NOT NULL,
|
|
connected_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|