1// Package cli implements the CLI adapter for Gordon.
2package cli
3
4import (
5 "context"
6 "fmt"
7 "path/filepath"
8 "strings"
9
10 "github.com/bnema/zerowrap"
11 "github.com/spf13/viper"
12
13 "github.com/bnema/gordon/internal/adapters/out/domainsecrets"
14 "github.com/bnema/gordon/internal/app"
15 "github.com/bnema/gordon/internal/boundaries/in"
16 "github.com/bnema/gordon/internal/boundaries/out"
17 "github.com/bnema/gordon/internal/domain"
18 "github.com/bnema/gordon/internal/usecase/config"
19 secretsSvc "github.com/bnema/gordon/internal/usecase/secrets"
20)
21
22// LocalServices provides direct access to local services for CLI operations.
23type LocalServices struct {
24 configSvc in.ConfigService
25 secretSvc in.SecretService
26 dataDir string
27 tlsEnabled bool
28}
29
30// GetConfigService returns the config service.
31func (l *LocalServices) GetConfigService() in.ConfigService {
32 return l.configSvc
33}
34
35// GetSecretService returns the secret service.
36func (l *LocalServices) GetSecretService() in.SecretService {
37 return l.secretSvc
38}
39
40// GetDataDir returns the data directory.
41func (l *LocalServices) GetDataDir() string {
42 return l.dataDir
43}
44
45// HasInternalTLS reports whether a TLS-capable entrypoint enables the internal CA.
46func (l *LocalServices) HasInternalTLS() bool {
47 return l.tlsEnabled
48}
49
50// GetLocalServices creates local services for CLI operations.
51// It loads the config and initializes services without starting the server.
52func GetLocalServices(configPath string) (*LocalServices, error) {
53 // Set up viper with defaults
54 v := viper.New()
55 v.SetDefault("server.port", 8088)
56 v.SetDefault("server.registry_port", 5000)
57 v.SetDefault("server.data_dir", app.DefaultDataDir())
58
59 // Configure viper with config file paths
60 app.ConfigureViper(v, configPath)
61
62 // Read config file
63 if err := v.ReadInConfig(); err != nil {
64 if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
65 return nil, fmt.Errorf("failed to read config file: %w", err)
66 }
67 // Config file not found is OK for some operations
68 }
69
70 log := zerowrap.New(cliLogConfig)
71
72 // Create config service (without event bus for CLI operations)
73 configSvc := config.NewService(v, nil)
74 ctx := context.Background()
75 if err := configSvc.Load(ctx); err != nil {
76 return nil, fmt.Errorf("failed to load configuration: %w", err)
77 }
78
79 // Determine data directory and env directory
80 dataDir := v.GetString("server.data_dir")
81 if dataDir == "" {
82 dataDir = app.DefaultDataDir()
83 }
84
85 envDir := v.GetString("env.dir")
86 if envDir == "" {
87 envDir = filepath.Join(dataDir, "env")
88 }
89
90 // Create domain secret store using configured backend (pass or file-based)
91 domainSecretStore, err := createLocalDomainSecretStore(v, envDir, log)
92 if err != nil {
93 return nil, fmt.Errorf("failed to create domain secret store: %w", err)
94 }
95 secretSvc := secretsSvc.NewService(domainSecretStore, log, nil)
96
97 return &LocalServices{
98 configSvc: configSvc,
99 secretSvc: secretSvc,
100 dataDir: dataDir,
101 tlsEnabled: hasLocalTLSCapableEntrypoint(v),
102 }, nil
103}
104
105func hasLocalTLSCapableEntrypoint(v *viper.Viper) bool {
106 for _, rawEntryPoint := range v.GetStringMap("entrypoints") {
107 entryPoint, ok := rawEntryPoint.(map[string]any)
108 if !ok {
109 continue
110 }
111 switch strings.TrimSpace(fmt.Sprint(entryPoint["protocol"])) {
112 case "smart_tcp", "tls_mux":
113 return true
114 }
115 }
116 return false
117}
118
119func createLocalDomainSecretStore(v *viper.Viper, envDir string, log zerowrap.Logger) (out.DomainSecretStore, error) {
120 backend := resolveLocalSecretsBackend(v)
121 switch backend {
122 case domain.SecretsBackendPass:
123 return domainsecrets.NewPassStore(log)
124 case domain.SecretsBackendSops:
125 return nil, fmt.Errorf("sops backend not yet supported for domain secrets")
126 default:
127 return domainsecrets.NewFileStore(envDir, log)
128 }
129}
130
131func resolveLocalSecretsBackend(v *viper.Viper) domain.SecretsBackend {
132 backend := strings.TrimSpace(v.GetString("auth.secrets_backend"))
133 if backend == "" {
134 // Legacy key support for older configs.
135 backend = strings.TrimSpace(v.GetString("secrets.backend"))
136 }
137
138 switch backend {
139 case "pass":
140 return domain.SecretsBackendPass
141 case "sops":
142 return domain.SecretsBackendSops
143 case "unsafe", "":
144 return domain.SecretsBackendUnsafe
145 default:
146 log := zerowrap.Default()
147 log.Warn().Str("backend", backend).Msg("unrecognized secrets backend, falling back to unsafe")
148 return domain.SecretsBackendUnsafe
149 }
150}