feat(api, web): enhance agent installation process with invited status and policy support
- Updated the agent enrollment process to include an 'invited' status, allowing for better tracking of agent states. - Implemented support for install links that can now include an `install_link_id`, facilitating the transition from invited to pending status upon enrollment. - Enhanced the MikroTik installation script to include the `EvofwInstallLinkId` for better tracking and management. - Added new API endpoints for fetching agent policies and serving MikroTik-specific installation scripts. - Improved the web UI to reflect the new agent statuses and provide copyable installation commands for agents. Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Denozordec
@@ -43,8 +43,13 @@ CLIENT_TOKEN="$(gen_token)"
|
||||
HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
|
||||
CP_URL="${EVOFW_CP_URL%/}"
|
||||
|
||||
ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","platform":"%s","token":"%s","client_version":"install.sh/1"}' \
|
||||
"$EVOFW_CLIENT_NAME" "$HOSTNAME" "$PLATFORM" "$CLIENT_TOKEN")
|
||||
if [[ -n "${EVOFW_INSTALL_LINK_ID:-}" ]]; then
|
||||
ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","platform":"%s","token":"%s","client_version":"install.sh/1","install_link_id":"%s"}' \
|
||||
"$EVOFW_CLIENT_NAME" "$HOSTNAME" "$PLATFORM" "$CLIENT_TOKEN" "$EVOFW_INSTALL_LINK_ID")
|
||||
else
|
||||
ENROLL_BODY=$(printf '{"name":"%s","hostname":"%s","platform":"%s","token":"%s","client_version":"install.sh/1"}' \
|
||||
"$EVOFW_CLIENT_NAME" "$HOSTNAME" "$PLATFORM" "$CLIENT_TOKEN")
|
||||
fi
|
||||
|
||||
ENROLL_TMP=$(mktemp)
|
||||
trap 'rm -f "$ENROLL_TMP"' EXIT
|
||||
|
||||
@@ -1,46 +1,84 @@
|
||||
# EvoFirewall MikroTik install (RouterOS 7+)
|
||||
# Usage: import after setting globals, or paste into terminal.
|
||||
# Required globals before import (or edit below):
|
||||
# :global EvofwCpUrl "https://fw.example.com"
|
||||
# :global EvofwSeed "YOUR_SEED"
|
||||
# :global EvofwName "mt-01"
|
||||
# EvoFirewall MikroTik install (RouterOS 7.21+)
|
||||
# Short-link sets EvofwCpUrl / EvofwSeed / EvofwName / EvofwInstallLinkId before body.
|
||||
# Legacy: set globals, then /import file-name=mikrotik-install.rsc
|
||||
#
|
||||
# Blacklist: drop EVOFW_DENY on input+forward
|
||||
# Whitelist: accept EVOFW_ALLOW + drop others on forward only (input stays open for Winbox/SSH)
|
||||
|
||||
:global EvofwCpUrl
|
||||
:global EvofwSeed
|
||||
:global EvofwName
|
||||
:global EvofwInstallLinkId
|
||||
|
||||
:if ([:typeof $EvofwCpUrl] = "nothing") do={ :error "EvofwCpUrl required" }
|
||||
:if ([:typeof $EvofwSeed] = "nothing") do={ :error "EvofwSeed required" }
|
||||
:if ([:typeof $EvofwName] = "nothing") do={ :set EvofwName [/system identity get name] }
|
||||
:if ([:typeof $EvofwCpUrl] = "nothing" || [:len $EvofwCpUrl] = 0) do={ :error "EvofwCpUrl required" }
|
||||
:if ([:typeof $EvofwSeed] = "nothing" || [:len $EvofwSeed] = 0) do={ :error "EvofwSeed required" }
|
||||
:if ([:typeof $EvofwName] = "nothing" || [:len $EvofwName] = 0) do={ :set EvofwName [/system identity get name] }
|
||||
|
||||
:local token ("evofw_" . [/certificate scep-server nonce generate])
|
||||
:if ([:len $token] < 20) do={
|
||||
:set token ("evofw_" . [:tostr [/system clock get time]] . [:tostr [/system resource get cpu-load]])
|
||||
:set token ("evofw_" . [:tostr [/system clock get time]] . [:tostr [/system resource get cpu-load]] . [:tostr [/system resource get free-memory]])
|
||||
}
|
||||
|
||||
:local body ("{\"name\":\"" . $EvofwName . "\",\"hostname\":\"" . [/system identity get name] . "\",\"platform\":\"mikrotik\",\"token\":\"" . $token . "\",\"client_version\":\"rsc/1\"}")
|
||||
:local body ("{\"name\":\"" . $EvofwName . "\",\"hostname\":\"" . [/system identity get name] . "\",\"platform\":\"mikrotik\",\"token\":\"" . $token . "\",\"client_version\":\"rsc/1\"")
|
||||
:if ([:typeof $EvofwInstallLinkId] != "nothing" && [:len $EvofwInstallLinkId] > 0) do={
|
||||
:set body ($body . ",\"install_link_id\":\"" . $EvofwInstallLinkId . "\"")
|
||||
}
|
||||
:set body ($body . "}")
|
||||
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/enroll") http-method=post http-header-field=("Content-Type: application/json,X-EvoFW-Seed: " . $EvofwSeed) http-data=$body keep-result=no
|
||||
:do {
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/enroll") http-method=post http-header-field=("Content-Type: application/json,X-EvoFW-Seed: " . $EvofwSeed) http-data=$body keep-result=no
|
||||
} on-error={
|
||||
:error "evofw: enroll failed — check EvofwCpUrl / EvofwSeed / connectivity"
|
||||
}
|
||||
|
||||
# Persist credentials for scheduler script
|
||||
/system script remove [find name="evofw-env"]
|
||||
/system script add name=evofw-env source=(" :global EvofwCpUrl \"" . $EvofwCpUrl . "\"; :global EvofwToken \"" . $token . "\" ")
|
||||
# Persist credentials
|
||||
:do { /system script remove [find name="evofw-env"] } on-error={}
|
||||
/system script add name=evofw-env policy=read,write,policy,test source=(" :global EvofwCpUrl \"" . $EvofwCpUrl . "\"; :global EvofwToken \"" . $token . "\" ")
|
||||
|
||||
/system script remove [find name="evofw-sync"]
|
||||
# Filter rules (idempotent by comment)
|
||||
:do { /ip firewall filter remove [find comment~"^evofw-"] } on-error={}
|
||||
|
||||
/ip firewall filter add chain=input action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-input disabled=no
|
||||
/ip firewall filter add chain=forward action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-forward disabled=no
|
||||
/ip firewall filter add chain=forward action=accept src-address-list=EVOFW_ALLOW comment=evofw-wl-accept-forward disabled=yes
|
||||
/ip firewall filter add chain=forward action=drop comment=evofw-wl-drop-forward disabled=yes
|
||||
|
||||
# Sync: fetch policy.rsc → import address-lists + toggle mode
|
||||
:do { /system script remove [find name="evofw-sync"] } on-error={}
|
||||
/system script add name=evofw-sync policy=read,write,policy,test source={
|
||||
:global EvofwCpUrl
|
||||
:global EvofwToken
|
||||
:if ([:typeof $EvofwCpUrl] = "nothing" || [:typeof $EvofwToken] = "nothing") do={ /system script run evofw-env }
|
||||
:local tmp [/file get [find name="evofw-policy.json"] name]
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/policy") http-header-field=("Authorization: Bearer " . $EvofwToken) dst-path=evofw-policy.json
|
||||
# Address-lists: EVOFW_DENY / EVOFW_ALLOW — operator should map filter rules once:
|
||||
# /ip firewall filter add chain=input src-address-list=EVOFW_DENY action=drop comment=evofw
|
||||
# whitelist: policy drop + accept EVOFW_ALLOW
|
||||
:log info "evofw: policy fetched — apply address-lists via controller export or manual parse"
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/heartbeat") http-method=post http-header-field=("Authorization: Bearer " . $EvofwToken . ",Content-Type: application/json") http-data="{\"source\":\"mikrotik\"}" keep-result=no
|
||||
:if ([:typeof $EvofwCpUrl] = "nothing" || [:typeof $EvofwToken] = "nothing") do={
|
||||
/system script run evofw-env
|
||||
}
|
||||
:if ([:typeof $EvofwCpUrl] = "nothing" || [:typeof $EvofwToken] = "nothing") do={
|
||||
:log error "evofw: missing EvofwCpUrl/EvofwToken"
|
||||
:error "evofw env missing"
|
||||
}
|
||||
:do {
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/policy.rsc") http-header-field=("Authorization: Bearer " . $EvofwToken) dst-path=evofw-policy.rsc
|
||||
/import file-name=evofw-policy.rsc
|
||||
} on-error={
|
||||
:log warning "evofw: policy sync failed (pending approval or network)"
|
||||
}
|
||||
:local denyCnt [:len [/ip firewall address-list find list=EVOFW_DENY]]
|
||||
:local allowCnt [:len [/ip firewall address-list find list=EVOFW_ALLOW]]
|
||||
:local cnt ($denyCnt + $allowCnt)
|
||||
:local report ("{\"status\":\"ok\",\"prefix_count\":" . $cnt . ",\"kernel_method\":\"address-list\",\"source\":\"mikrotik\"}")
|
||||
:do {
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/apply-report") http-method=post http-header-field=("Authorization: Bearer " . $EvofwToken . ",Content-Type: application/json") http-data=$report keep-result=no
|
||||
} on-error={}
|
||||
:do {
|
||||
/tool fetch url=($EvofwCpUrl . "/v1/agent/heartbeat") http-method=post http-header-field=("Authorization: Bearer " . $EvofwToken . ",Content-Type: application/json") http-data="{\"source\":\"mikrotik\"}" keep-result=no
|
||||
} on-error={}
|
||||
:log info ("evofw: sync done deny=" . $denyCnt . " allow=" . $allowCnt)
|
||||
}
|
||||
|
||||
/system scheduler remove [find name="evofw-sync"]
|
||||
/system scheduler add name=evofw-sync interval=1m on-event=evofw-sync
|
||||
:do { /system scheduler remove [find name="evofw-sync"] } on-error={}
|
||||
/system scheduler add name=evofw-sync interval=1m on-event=evofw-sync policy=read,write,policy,test
|
||||
|
||||
:put ("EvoFirewall enrolled as " . $EvofwName . " — approve in UI, ensure filter rules for EVOFW_* lists")
|
||||
:do { /system script run evofw-sync } on-error={
|
||||
:log info "evofw: initial sync skipped (approve agent in UI)"
|
||||
}
|
||||
|
||||
:put ("EvoFirewall enrolled as " . $EvofwName . " — approve in UI; scheduler evofw-sync every 1m")
|
||||
|
||||
Reference in New Issue
Block a user