feat(ssh_locker): implement ssh locker helper scripts and configuration for Duo API integration

terraform/modules/apps/ssh_locker_web/config.tf

@@ -0,0 +1,14 @@
+locals {
+  config = {
+    "clientId" : var.duo_client_id
+    "clientSecret" : var.duo_client_secret
+    "apiHost" : var.duo_api_host
+    "redirectUri" : var.redirect_uri
+    "accessToken" : var.access_token
+    "socketPath" : "/app/socket"
+    "tlsCert" : var.tls_enabled ? "/etc/ssl/certs/private/tls.crt" : ""
+    "tlsKey" : var.tls_enabled ? "/etc/ssl/certs/private/tls.key" : ""
+  }
+  config_json     = jsonencode(local.config)
+  config_checksum = sha256(local.config_json)
+}

terraform/modules/apps/ssh_locker_web/main.tf

@@ -0,0 +1,191 @@
+resource "kubernetes_namespace" "ssh_locker_web" {
+  metadata {
+    name = "ssh-locker-web"
+  }
+}
+
+resource "kubernetes_secret" "ssh_locker_web" {
+  metadata {
+    name      = "ssh-locker-web-config"
+    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
+  }
+  data = {
+    "config.json" = local.config_json
+  }
+  type = "Opaque"
+}
+
+resource "kubernetes_service_account" "ssh_locker_web" {
+  metadata {
+    name      = "ssh-locker-web"
+    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_manifest" "internal_cert" {
+  count = var.tls_enabled ? 1 : 0
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "internal-cert"
+      namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
+    }
+    spec = {
+      secretName = "internal-cert"
+      issuerRef = {
+        name = var.issuer
+        kind = "ClusterIssuer"
+      }
+      commonName = "backend.ssh-locker-web.svc.cluster.local"
+      dnsNames   = ["backend.ssh-locker-web.svc.cluster.local"]
+    }
+  }
+}
+resource "kubernetes_deployment" "ssh_locker_web" {
+  metadata {
+    name      = "backend"
+    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
+    labels = {
+      app = "backend"
+    }
+    annotations = {
+      "config/checksum" = local.config_checksum
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "backend"
+      }
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "backend"
+        }
+      }
+
+      spec {
+        security_context {
+          run_as_user     = var.user_id
+          run_as_group    = var.group_id
+          fs_group        = var.group_id
+          run_as_non_root = true
+        }
+        container {
+          name  = "backend"
+          image = "a13labs/ssh_locker_web:latest"
+
+          security_context {
+            allow_privilege_escalation = false
+          }
+
+          port {
+            container_port = var.tls_enabled ? 8443 : 8080
+            name           = var.tls_enabled ? "https" : "http"
+          }
+
+          readiness_probe {
+            tcp_socket {
+              port = var.tls_enabled ? 8443 : 8080
+            }
+          }
+
+          liveness_probe {
+            tcp_socket {
+              port = var.tls_enabled ? 8443 : 8080
+            }
+          }
+
+          volume_mount {
+            name       = "config-volume"
+            mount_path = "/app/config.json"
+            sub_path   = "config.json"
+            read_only  = true
+          }
+
+          volume_mount {
+            name       = "socket-volume"
+            mount_path = "/app/socket"
+          }
+
+          dynamic "volume_mount" {
+            for_each = var.tls_enabled ? [1] : []
+            content {
+              name       = "internal-cert"
+              mount_path = "/etc/ssl/certs/private"
+              read_only  = true
+            }
+
+          }
+        }
+
+        volume {
+          name = "config-volume"
+          secret {
+            secret_name = kubernetes_secret.ssh_locker_web.metadata[0].name
+            items {
+              key  = "config.json"
+              path = "config.json"
+            }
+          }
+        }
+
+        volume {
+          name = "socket-volume"
+          host_path {
+            path = var.socket_path
+          }
+        }
+
+        dynamic "volume" {
+          for_each = var.tls_enabled ? [1] : []
+          content {
+            name = "internal-cert"
+            secret {
+              secret_name = "internal-cert"
+              items {
+                key  = "tls.crt"
+                path = "tls.crt"
+              }
+              items {
+                key  = "tls.key"
+                path = "tls.key"
+              }
+            }
+          }
+        }
+
+        service_account_name = kubernetes_service_account.ssh_locker_web.metadata[0].name
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "backend" {
+  metadata {
+    name      = "backend"
+    namespace = kubernetes_namespace.ssh_locker_web.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "backend"
+    }
+
+    port {
+      name        = var.tls_enabled ? "https" : "http"
+      port        = var.tls_enabled ? 443 : 80
+      target_port = var.tls_enabled ? 8443 : 8080
+    }
+
+    type = "ClusterIP"
+  }
+}

terraform/modules/apps/ssh_locker_web/outputs.tf

@@ -0,0 +1,7 @@
+output "namespace" {
+  value = kubernetes_namespace.ssh_locker_web.metadata[0].name
+}
+
+output "app_name" {
+  value = "ssh_locker_web"
+}

terraform/modules/apps/ssh_locker_web/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~>2.18"
+    }
+  }
+}

terraform/modules/apps/ssh_locker_web/variables.tf

@@ -0,0 +1,55 @@
+variable "duo_client_id" {
+  description = "Duo client ID"
+  type        = string
+  sensitive   = true
+}
+
+variable "duo_client_secret" {
+  description = "Duo client secret"
+  type        = string
+  sensitive   = true
+}
+
+variable "duo_api_host" {
+  description = "Duo API host"
+  type        = string
+}
+
+variable "redirect_uri" {
+  description = "Redirect URI for Duo authentication"
+  type        = string
+}
+
+variable "access_token" {
+  description = "Access token for Duo API"
+  type        = string
+  sensitive   = true
+}
+
+variable "socket_path" {
+  description = "Socket path for Duo API"
+  type        = string
+}
+
+variable "user_id" {
+  description = "User for running the pod"
+  type        = number
+  default     = 1000
+}
+
+variable "group_id" {
+  description = "Group for running the pod"
+  type        = number
+  default     = 1000
+}
+
+variable "issuer" {
+  description = "The issuer for the certificate"
+  type        = string
+  default     = "internal-ca"
+}
+variable "tls_enabled" {
+  description = "Enable TLS for the SFTPGo server"
+  type        = bool
+  default     = true
+}