big batch of updates adding various security features - manual TLS an…

…d Let's Encrypt support / rate-limiting / add-sync live toggling. Bunch of new documentation and some testing on AWS.

Dockerfile

@@ -11,5 +11,6 @@ WORKDIR /app
 COPY prod.toml /app/
 COPY xsyn-deploy /app/
 
-EXPOSE 8080
+EXPOSE 80
+EXPOSE 443
 ENTRYPOINT ["./xsyn-deploy"]

README.md

@@ -1,27 +1,52 @@
-# xSyn
+![xSyn Logo](https://raw.githubusercontent.com/ishani/xSyn/master/logo.jpg)
+
 Compact server implementing xBrowserSync API using Golang and BoltDB; supports API version 1.1.4 (Oct 2018)
 
-Easy to deploy via Docker, xSyn provides a lean server for privately hosting your own bookmarks sync store. As of writing, [xBrowserSync](https://www.xbrowsersync.org/) is available for Chrome, Firefox, Android and iOS. It's really good!
+Easy to deploy via Docker, xSyn provides a lean server for privately hosting your own bookmarks sync store. As of writing, [xBrowserSync](https://www.xbrowsersync.org/) is available for Chrome, Firefox, Android - It's really good!
 
-### Todo
+### Configuring
 
-* Actually check and reject a bundle of data that exceeds the advertised limits
-* Rate limiting
-* Tests
+xSyn pulls configuration from a TOML file during boot and allows environment variable overloads for all the values. Easy to setup and easy to tune.
+
+Check `prod.toml` for all available settings and override names.
+
+### Securing
+
+xSyn can be run unsecured, with TLS via provided keys or automatically secured via *Let's Encrypt*. 
 
-As it stands, xSyn works great for a private xBrowserSync server - I've been running with it for about a year - but bear in mind it doesn't have a lot of defence against people trying to flood or attack (yet)
+It is possible to run a special route that toggles the `Accepting New Syncs` value while running, so one can open/close the gates on a public server to limit users manually.
 
+Rate-limiting is enabled by default on all routes and is easily configurable.
+
+--
 
 ### DockerHub
-A recent build is available at [hdenholm/xsyn:latest](https://hub.docker.com/r/hdenholm/xsyn/)
 
-If running locally, ensure you map a volume to `/data` so that the BoltDB file persists.
+An up-to-date build is available at [hdenholm/xsyn:latest](https://hub.docker.com/r/hdenholm/xsyn/)
+
+Note that build dates are stamped into the published images, which you can view in the log on startup (with `release_mode` / `XS_SRV_RELEASE` set to false so you can see the Info logs)
 
 ### Azure
+
 I have a test instance running on Azure using their slightly restrictive Docker support for App Services. 
 
-In Application Settings, make sure `WEBSITES_ENABLE_APP_SERVICE_STORAGE` is enabled. With a default configuration file, add `WEBSITES_PORT` and set it to 8080. 
+In the portal, navigate to *Application Settings*, make sure `WEBSITES_ENABLE_APP_SERVICE_STORAGE` is enabled. With a default configuration file, add `WEBSITES_PORT` and set it to 80 - remember to update it if you set the `port` / `XS_SRV_PORT` config value.
+
+Because Azure doesn't let you manually configure volume mapping, we have to override the default file for the BoltDB. Set `XS_BOLT_FILE` to `/home/site/store.db` (or anything under the `/home/site` folder)
+
+Note that currently there is no way to use *Let's Encrypt* on Azure App Services as of writing as it requires more than one port to be exposed, and Azure doesn't allow this.
+
+### AWS
+
+xSyn works on ECS easily, including full *Let's Encrypt* support if you assign an EIP and map it to an owned domain.
+
+I have a simple example task template [over here](https://gist.github.com/ishani/06a99050500069319493facd31b6576e) - tested, but not a lot. Note this has LE enabled, so either disable that or set your own domain name up before you kick it off.
+
+
+--
+#### Todo
+
+* Tests
 
-Because Azure doesn't let you manually configure volume mapping, we have to override the default file for the BoltDB. Set `XS_BOLT_FILE` to `/home/site/store.db` (or anything under the /home/site folder)
+As it stands, xSyn works great for a private xBrowserSync server - I've been running with it for about a year - and I've poked it about on a few different platforms, but it really needs some actual tests and fuzzing done
 
-Check the `config.go` file for other envvars you can set to modify default behaviour.

config.go

@@ -30,8 +30,9 @@ import (
 )
 
 type tomlConfig struct {
-	Server tomlServer
-	Bolt   tomlBolt
+	Server   tomlServer
+	Bolt     tomlBolt
+	Security tomlSecurity
 }
 type tomlBolt struct {
 	StorageFile string `toml:"file" env:"XS_BOLT_FILE"`
@@ -44,6 +45,14 @@ type tomlServer struct {
 	Port           int32  `toml:"port" env:"XS_SRV_PORT"`
 	StatusRoute    string `toml:"status_route" env:"XS_SRV_STATUS"`
 }
+type tomlSecurity struct {
+	ReqPerSecond     float64 `toml:"max_requests_per_second" env:"XS_SEC_RPS"`
+	AcceptNewSyncs   bool    `toml:"accept_new_syncs" env:"XS_SEC_ACCEPT_NEW_SYNC"`
+	SyncToggleRoute  string  `toml:"sync_toggle_route" env:"XS_SEC_SYNCTOGGLE"`
+	TLSCert          string  `toml:"tls_cert" env:"XS_SEC_TLSCERT"`
+	UseLetsEncrypt   string  `toml:"lets_encrypt" env:"XS_SEC_LE"`
+	LetsEncryptCache string  `toml:"lets_encrypt_cache" env:"XS_SEC_LE_CACHE"`
+}
 
 // AppConfig is the config data parsed from disk
 var AppConfig tomlConfig
@@ -105,7 +114,7 @@ func checkOverrides(configData interface{}, cfgLog *zap.Logger) error {
 
 			overrideFromEnv := os.Getenv(envOverride)
 			if overrideFromEnv != "" {
-				cfgLog.Info("Overriding config",
+				cfgLog.Debug("Overriding config",
 					zap.String("key", envOverride),
 					zap.String("value", overrideFromEnv),
 				)
@@ -121,6 +130,13 @@ func checkOverrides(configData interface{}, cfgLog *zap.Logger) error {
 					}
 					field.Set(reflect.ValueOf(int32(ivalue)))
 
+				case reflect.Float64:
+					fvalue, err := strconv.ParseFloat(overrideFromEnv, 64)
+					if err != nil {
+						return err
+					}
+					field.Set(reflect.ValueOf(float64(fvalue)))
+
 				case reflect.Bool:
 					bvalue, err := strconv.ParseBool(overrideFromEnv)
 					if err != nil {

docker-build

@@ -1,6 +1,11 @@
 #!/bin/bash
 
-env GOOS=linux GOARCH=amd64 go build -o xsyn-deploy *.go
+# Define a timestamp function
+timestamp() {
+  date +"%Y-%m-%d_%H-%M-%S"
+}
+
+env GOOS=linux GOARCH=amd64 go build -ldflags "-X main.BuildStamp=$(timestamp)" -o xsyn-deploy *.go
 docker build -f Dockerfile -t hdenholm/xsyn:latest .
 
 docker tag xsyn:latest hdenholm/xsyn:latest