Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/nodered/files/config.json

@@ -0,0 +1,3 @@
+{
+  "token": "${secret:api-token}"
+}

modules/nodered/files/mqtt.env

@@ -0,0 +1,4 @@
+MESH_NODERED_URL=http://127.0.0.1:${port:1880}
+MESH_NODERED_CONFIG_FILE=${dir:mesh-state}/config.json
+MESH_PROVISIONS_DIR=${dir:state}
+MESH_WRITTEN_DIR=${dir:written}

modules/nodered/files/settings.js

@@ -0,0 +1,48 @@
+// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change
+// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and
+// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user
+// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+const ADMIN_PASSWORD = "${secret:admin}";
+const API_TOKEN = "${secret:api-token}";
+const ADMIN = { username: "admin", permissions: "*" };
+
+const settings = JSON.parse(fs.readFileSync(path.join(__dirname, "settings.json"), "utf8"));
+// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the
+// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the
+// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.
+if (settings.timeZone) process.env.TZ = settings.timeZone;
+delete settings.timeZone;
+delete settings.endpoints;
+delete settings.mqtt;
+delete settings.topics;
+
+function same(a, b) {
+  const x = crypto.createHash("sha256").update(String(a)).digest();
+  const y = crypto.createHash("sha256").update(String(b)).digest();
+  return crypto.timingSafeEqual(x, y);
+}
+
+// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its
+// settings held, so the password people already use keeps working.
+function passwordMatches(given) {
+  if (/^\$2[aby]\$\d\d\$/.test(ADMIN_PASSWORD)) return require("bcryptjs").compare(String(given), ADMIN_PASSWORD);
+  return Promise.resolve(same(given, ADMIN_PASSWORD));
+}
+
+module.exports = Object.assign(settings, {
+  uiPort: 1880,
+  adminAuth: {
+    type: "credentials",
+    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),
+    authenticate: (username, password) =>
+      username === ADMIN.username
+        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))
+        : Promise.resolve(null),
+    // The module's own tools call the admin API with this bearer token.
+    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: "mesh", permissions: "*" } : null),
+  },
+});

modules/nodered/files/settings.json

@@ -0,0 +1,14 @@
+{
+  "flowFile": "flows.json",
+  "flowFilePretty": true,
+  "diagnostics": { "enabled": true, "ui": true },
+  "runtimeState": { "enabled": false, "ui": false },
+  "logging": { "console": { "level": "info", "metrics": false, "audit": false } },
+  "exportGlobalContextKeys": false,
+  "externalModules": {},
+  "editorTheme": { "projects": { "enabled": false } },
+  "functionExternalModules": true,
+  "debugMaxLength": 1000,
+  "mqttReconnectTime": 15000,
+  "serialReconnectTime": 15000
+}

modules/nodered/module.json

@@ -36,6 +36,108 @@
       }
     ]
   },
+  "config": {
+    "flow-file": {
+      "type": "string",
+      "description": "Node-RED's flowFile setting: the file in the user directory the flows are kept in.",
+      "trusted": true,
+      "default": "flows.json"
+    },
+    "flow-file-pretty": {
+      "type": "boolean",
+      "description": "Node-RED's flowFilePretty setting: whether the flows file is written indented.",
+      "trusted": true,
+      "default": true
+    },
+    "diagnostics": {
+      "type": "object",
+      "description": "Node-RED's diagnostics setting: whether its diagnostics report is on, and shown in the editor.",
+      "trusted": true,
+      "default": {
+        "enabled": true,
+        "ui": true
+      }
+    },
+    "runtime-state": {
+      "type": "object",
+      "description": "Node-RED's runtimeState setting: whether flows may be started and stopped from the editor.",
+      "trusted": true,
+      "default": {
+        "enabled": false,
+        "ui": false
+      }
+    },
+    "logging": {
+      "type": "object",
+      "description": "Node-RED's logging setting: the console log's level, and whether metrics and audit events are logged.",
+      "trusted": true,
+      "default": {
+        "console": {
+          "level": "info",
+          "metrics": false,
+          "audit": false
+        }
+      }
+    },
+    "export-global-context-keys": {
+      "type": "boolean",
+      "description": "Node-RED's exportGlobalContextKeys setting: whether a function node may list the global context's keys.",
+      "trusted": true,
+      "default": false
+    },
+    "external-modules": {
+      "type": "object",
+      "description": "Node-RED's externalModules setting: which modules the editor may install, and from where.",
+      "trusted": true,
+      "default": {}
+    },
+    "editor-theme": {
+      "type": "object",
+      "description": "Node-RED's editorTheme setting: the editor's look and features, projects among them.",
+      "trusted": true,
+      "default": {
+        "projects": {
+          "enabled": false
+        }
+      }
+    },
+    "function-external-modules": {
+      "type": "boolean",
+      "description": "Node-RED's functionExternalModules setting: whether a function node may load modules of its own.",
+      "trusted": true,
+      "default": true
+    },
+    "debug-max-length": {
+      "type": "number",
+      "description": "Node-RED's debugMaxLength setting: the most characters a debug message shows, a count.",
+      "trusted": true,
+      "default": 1000
+    },
+    "mqtt-reconnect-time": {
+      "type": "number",
+      "description": "Node-RED's mqttReconnectTime setting: how long an MQTT node waits before reconnecting, in milliseconds.",
+      "trusted": true,
+      "default": 15000
+    },
+    "serial-reconnect-time": {
+      "type": "number",
+      "description": "Node-RED's serialReconnectTime setting: how long a serial node waits before reconnecting, in milliseconds.",
+      "trusted": true,
+      "default": 15000
+    },
+    "mqtt": {
+      "type": "object",
+      "description": "The broker nodes the module's MQTT step keeps pointed at the mesh's broker, as {\"brokers\": [their ids]}; empty, none.",
+      "trusted": true,
+      "default": {}
+    },
+    "time-zone": {
+      "type": "string",
+      "description": "The time zone the flows schedule and format in, an IANA name such as Europe/Brussels; unset, the container's UTC.",
+      "trusted": true,
+      "default": ""
+    }
+  },
   "resources": [
     {
       "id": "mesh-state",
@@ -66,7 +168,7 @@
       "path": "${dir:state}/settings.js",
       "mode": "0600",
       "owner": "1000:1000",
-      "content": "// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change\n// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and\n// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user\n// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.\nconst fs = require(\"fs\");\nconst path = require(\"path\");\nconst crypto = require(\"crypto\");\n\nconst ADMIN_PASSWORD = \"${secret:admin}\";\nconst API_TOKEN = \"${secret:api-token}\";\nconst ADMIN = { username: \"admin\", permissions: \"*\" };\n\nconst settings = JSON.parse(fs.readFileSync(path.join(__dirname, \"settings.json\"), \"utf8\"));\n// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the\n// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the\n// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.\nif (settings.timeZone) process.env.TZ = settings.timeZone;\ndelete settings.timeZone;\ndelete settings.endpoints;\ndelete settings.mqtt;\ndelete settings.topics;\n\nfunction same(a, b) {\n  const x = crypto.createHash(\"sha256\").update(String(a)).digest();\n  const y = crypto.createHash(\"sha256\").update(String(b)).digest();\n  return crypto.timingSafeEqual(x, y);\n}\n\n// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its\n// settings held, so the password people already use keeps working.\nfunction passwordMatches(given) {\n  if (/^\\$2[aby]\\$\\d\\d\\$/.test(ADMIN_PASSWORD)) return require(\"bcryptjs\").compare(String(given), ADMIN_PASSWORD);\n  return Promise.resolve(same(given, ADMIN_PASSWORD));\n}\n\nmodule.exports = Object.assign(settings, {\n  uiPort: 1880,\n  adminAuth: {\n    type: \"credentials\",\n    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),\n    authenticate: (username, password) =>\n      username === ADMIN.username\n        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))\n        : Promise.resolve(null),\n    // The module's own tools call the admin API with this bearer token.\n    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: \"mesh\", permissions: \"*\" } : null),\n  },\n});\n"
+      "template": "files/settings.js"
     },
     {
       "id": "settings",
@@ -75,7 +177,8 @@
       "mode": "0600",
       "owner": "1000:1000",
       "merge": "json",
-      "content": "{\n  \"flowFile\": \"flows.json\",\n  \"flowFilePretty\": true,\n  \"diagnostics\": { \"enabled\": true, \"ui\": true },\n  \"runtimeState\": { \"enabled\": false, \"ui\": false },\n  \"logging\": { \"console\": { \"level\": \"info\", \"metrics\": false, \"audit\": false } },\n  \"exportGlobalContextKeys\": false,\n  \"externalModules\": {},\n  \"editorTheme\": { \"projects\": { \"enabled\": false } },\n  \"functionExternalModules\": true,\n  \"debugMaxLength\": 1000,\n  \"mqttReconnectTime\": 15000,\n  \"serialReconnectTime\": 15000\n}\n"
+      "takes-config": [{"key": "flow-file", "as": "flowFile"}, {"key": "flow-file-pretty", "as": "flowFilePretty"}, "diagnostics", {"key": "runtime-state", "as": "runtimeState"}, "logging", {"key": "export-global-context-keys", "as": "exportGlobalContextKeys"}, {"key": "external-modules", "as": "externalModules"}, {"key": "editor-theme", "as": "editorTheme"}, {"key": "function-external-modules", "as": "functionExternalModules"}, {"key": "debug-max-length", "as": "debugMaxLength"}, {"key": "mqtt-reconnect-time", "as": "mqttReconnectTime"}, {"key": "serial-reconnect-time", "as": "serialReconnectTime"}, "mqtt", {"key": "time-zone", "as": "timeZone"}],
+      "template": "files/settings.json"
     },
     {
       "id": "server",
@@ -110,14 +213,14 @@
       "type": "file",
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
-      "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
+      "template": "files/config.json"
     },
     {
       "id": "mqtt-env",
       "type": "file",
       "path": "${dir:state}/mqtt.env",
       "mode": "0600",
-      "content": "MESH_NODERED_URL=http://127.0.0.1:${port:1880}\nMESH_NODERED_CONFIG_FILE=${dir:mesh-state}/config.json\nMESH_PROVISIONS_DIR=${dir:state}\nMESH_WRITTEN_DIR=${dir:written}\n"
+      "template": "files/mqtt.env"
     },
     {
       "id": "mqtt",
@@ -179,6 +282,11 @@
           "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
           "MESH_NODERED_CONFIG_FILE": "${dir:mesh-state}/config.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   }