Add S3 webresource handler

Change-type: minor

config.ts

@@ -1,5 +1,6 @@
 import type { ConfigLoader } from '@balena/pinejs';
 import * as balenaModel from './src/balena';
+import { getFileUploadHandler } from './src/fileupload-handler';
 
 export = {
 	models: [balenaModel],
@@ -25,4 +26,5 @@ export = {
 			],
 		},
 	],
+	webResourceHandler: getFileUploadHandler(),
 } as ConfigLoader.Config;

config/confd/conf.d/cloudront-pk.pem.toml

@@ -0,0 +1,7 @@
+[template]
+src = "cloudfront-pk.pem.tmpl"
+dest = "/etc/ssl/private/cloudfront-pk.pem"
+keys = [
+  "WEBRESOURCES_CLOUDFRONT_PRIVATEKEY",
+]
+mode = "0400"

config/confd/conf.d/env.toml

@@ -53,5 +53,13 @@ keys = [
 	"VPN_PORT",
 	"VPN_SERVICE_API_KEY",
 	"VPN_GUEST_API_KEY",
-	"VPN_CONNECT_PROXY_PORT"
+	"VPN_CONNECT_PROXY_PORT",
+	"WEBRESOURCES_S3_ACCESS_KEY",
+	"WEBRESOURCES_S3_SECRET_KEY",
+	"WEBRESOURCES_S3_REGION",
+	"WEBRESOURCES_S3_HOST",
+	"WEBRESOURCES_S3_BUCKET",
+	"WEBRESOURCES_S3_MAX_FILESIZE",
+	"WEBRESOURCES_CLOUDFRONT_PUBLICKEY",
+	"WEBRESOURCES_CLOUDFRONT_HOST"
 ]

config/confd/templates/cloudfront-pk.pem.tmpl

@@ -0,0 +1 @@
+{{base64Decode (getenv "WEBRESOURCES_CLOUDFRONT_PRIVATEKEY" "")}}

config/confd/templates/env.tmpl

@@ -79,3 +79,11 @@ VPN_SERVICE_API_KEY={{getenv "VPN_SERVICE_API_KEY"}}
 {{if getenv "VPN_GUEST_API_KEY"}}VPN_GUEST_API_KEY={{getenv "VPN_GUEST_API_KEY"}}{{end}}
 {{if getenv "AUTH_RESINOS_REGISTRY_CODE"}}AUTH_RESINOS_REGISTRY_CODE={{getenv "AUTH_RESINOS_REGISTRY_CODE"}}{{end}}
 {{if getenv "BROTLI_COMPRESSION_QUALITY"}}BROTLI_COMPRESSION_QUALITY={{getenv "BROTLI_COMPRESSION_QUALITY"}}{{end}}
+{{if getenv "WEBRESOURCES_S3_ACCESS_KEY"}}WEBRESOURCES_S3_ACCESS_KEY={{getenv "WEBRESOURCES_S3_ACCESS_KEY"}}{{end}}
+{{if getenv "WEBRESOURCES_S3_SECRET_KEY"}}WEBRESOURCES_S3_SECRET_KEY={{getenv "WEBRESOURCES_S3_SECRET_KEY"}}{{end}}
+{{if getenv "WEBRESOURCES_S3_REGION"}}WEBRESOURCES_S3_REGION={{getenv "WEBRESOURCES_S3_REGION"}}{{end}}
+{{if getenv "WEBRESOURCES_S3_HOST"}}WEBRESOURCES_S3_HOST={{getenv "WEBRESOURCES_S3_HOST"}}{{end}}
+{{if getenv "WEBRESOURCES_S3_BUCKET"}}WEBRESOURCES_S3_BUCKET={{getenv "WEBRESOURCES_S3_BUCKET"}}{{end}}
+{{if getenv "WEBRESOURCES_S3_MAX_FILESIZE"}}WEBRESOURCES_S3_MAX_FILESIZE={{getenv "WEBRESOURCES_S3_MAX_FILESIZE"}}{{end}}
+{{if getenv "WEBRESOURCES_CLOUDFRONT_PUBLICKEY"}}WEBRESOURCES_CLOUDFRONT_PUBLICKEY={{getenv "WEBRESOURCES_CLOUDFRONT_PUBLICKEY"}}{{end}}
+{{if getenv "WEBRESOURCES_CLOUDFRONT_HOST"}}WEBRESOURCES_CLOUDFRONT_HOST={{getenv "WEBRESOURCES_CLOUDFRONT_HOST"}}{{end}}

package.json

@@ -38,6 +38,7 @@
     "@balena/es-version": "^1.0.2",
     "@balena/node-metrics-gatherer": "^6.0.3",
     "@balena/pinejs": "^15.3.0",
+    "@balena/pinejs-webresource-cloudfront": "^0.0.3",
     "@sentry/node": "^7.49.0",
     "@types/basic-auth": "^1.1.3",
     "@types/bluebird": "^3.5.38",

src/fileupload-handler.ts

@@ -0,0 +1,85 @@
+import { webResourceHandler } from '@balena/pinejs';
+import {
+	CloudFrontHandler,
+	CloudFrontHandlerProps,
+} from '@balena/pinejs-webresource-cloudfront';
+import {
+	WEBRESOURCES_S3_ACCESS_KEY,
+	WEBRESOURCES_S3_SECRET_KEY,
+	WEBRESOURCES_S3_REGION,
+	WEBRESOURCES_S3_HOST,
+	WEBRESOURCES_S3_BUCKET,
+	WEBRESOURCES_S3_MAX_FILESIZE,
+	WEBRESOURCES_CLOUDFRONT_PRIVATEKEY,
+	WEBRESOURCES_CLOUDFRONT_PUBLICKEY,
+	WEBRESOURCES_CLOUDFRONT_HOST,
+} from './lib/config';
+
+const getS3Config = (): webResourceHandler.S3HandlerProps | undefined => {
+	if (
+		WEBRESOURCES_S3_ACCESS_KEY != null &&
+		WEBRESOURCES_S3_SECRET_KEY != null &&
+		WEBRESOURCES_S3_REGION != null &&
+		WEBRESOURCES_S3_HOST != null &&
+		WEBRESOURCES_S3_BUCKET != null
+	) {
+		return {
+			accessKey: WEBRESOURCES_S3_ACCESS_KEY,
+			secretKey: WEBRESOURCES_S3_SECRET_KEY,
+			region: WEBRESOURCES_S3_REGION,
+			endpoint: WEBRESOURCES_S3_HOST,
+			bucket: WEBRESOURCES_S3_BUCKET,
+			maxSize: WEBRESOURCES_S3_MAX_FILESIZE,
+		};
+	}
+};
+
+const getCloudfrontConfig = (): CloudFrontHandlerProps | undefined => {
+	const s3Config = getS3Config();
+	if (
+		s3Config != null &&
+		WEBRESOURCES_CLOUDFRONT_PRIVATEKEY != null &&
+		WEBRESOURCES_CLOUDFRONT_PUBLICKEY != null &&
+		WEBRESOURCES_CLOUDFRONT_HOST != null
+	) {
+		return {
+			cfPublicKeyId: WEBRESOURCES_CLOUDFRONT_PUBLICKEY,
+			cfSecretKey: WEBRESOURCES_CLOUDFRONT_PRIVATEKEY,
+			cfDistributionDomain: WEBRESOURCES_CLOUDFRONT_HOST,
+			...s3Config,
+		};
+	}
+};
+
+let handler: webResourceHandler.WebResourceHandler | undefined;
+export const getFileUploadHandler = () => {
+	if (handler == null) {
+		const cfConfig = getCloudfrontConfig();
+		if (cfConfig != null) {
+			handler = new CloudFrontHandler(cfConfig);
+			console.log('Successfully initialised webresource CloudFront handler.');
+			console.log({
+				region: cfConfig.region,
+				endpoint: cfConfig.endpoint,
+				bucket: cfConfig.bucket,
+				cFhost: cfConfig.cfDistributionDomain,
+			});
+			return handler;
+		}
+
+		const s3Config = getS3Config();
+		if (s3Config != null) {
+			handler = new webResourceHandler.S3Handler(s3Config);
+			console.log('Successfully initialised webresource S3 handler.');
+			console.log({
+				region: s3Config.region,
+				endpoint: s3Config.endpoint,
+				bucket: s3Config.bucket,
+			});
+			return handler;
+		}
+
+		console.log('No webresource handler loaded.');
+	}
+	return handler;
+};

src/lib/config.ts

@@ -415,6 +415,29 @@ export const IGNORE_FROZEN_DEVICE_PERMISSIONS = boolVar(
 	false,
 );
 
+export const WEBRESOURCES_S3_HOST = optionalVar('WEBRESOURCES_S3_HOST');
+export const WEBRESOURCES_S3_REGION = optionalVar('WEBRESOURCES_S3_REGION');
+export const WEBRESOURCES_S3_ACCESS_KEY = optionalVar(
+	'WEBRESOURCES_S3_ACCESS_KEY',
+);
+export const WEBRESOURCES_S3_SECRET_KEY = optionalVar(
+	'WEBRESOURCES_S3_SECRET_KEY',
+);
+export const WEBRESOURCES_S3_BUCKET = optionalVar('WEBRESOURCES_S3_BUCKET');
+export const WEBRESOURCES_S3_MAX_FILESIZE = intVar(
+	'WEBRESOURCES_S3_MAX_FILESIZE',
+	10000000,
+);
+export const WEBRESOURCES_CLOUDFRONT_PRIVATEKEY = optionalVar(
+	'WEBRESOURCES_CLOUDFRONT_PRIVATEKEY',
+);
+export const WEBRESOURCES_CLOUDFRONT_PUBLICKEY = optionalVar(
+	'WEBRESOURCES_CLOUDFRONT_PUBLICKEY',
+);
+export const WEBRESOURCES_CLOUDFRONT_HOST = optionalVar(
+	'WEBRESOURCES_CLOUDFRONT_HOST',
+);
+
 /**
  * Splits an env var in the format of `${username}:${password}`
  * into a RedisAuth object. Auth is optional, so this can return