only allow admin access via unix socket

pkg/api/client/client.go

@@ -11,6 +11,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httputil"
+	"net/url"
 	"os"
 	"strings"
 	"time"
@@ -19,6 +20,8 @@ import (
 type Client struct {
 	endpoint    string
 	httpClient  *http.Client
+	dialer      *net.Dialer
+	dialerFunc  func(ctx context.Context, network, addr string) (net.Conn, error)
 	debugWriter io.Writer
 	//insecure    bool
 }
@@ -31,6 +34,22 @@ type ClientOption func(*Client)
 
 func WithEndpoint(endpoint string) ClientOption {
 	return func(client *Client) {
+		u, err := url.Parse(endpoint)
+		if err != nil {
+			return
+		}
+		client.dialer = &net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}
+		if u.Scheme == "unix" {
+			client.dialerFunc = func(ctx context.Context, network, addr string) (net.Conn, error) {
+				return client.dialer.DialContext(ctx, "unix", u.Path)
+			}
+			client.endpoint = "http://unix"
+			return
+		}
+		client.dialerFunc = client.dialer.DialContext
 		client.endpoint = strings.TrimRight(endpoint, "/")
 	}
 }
@@ -104,10 +123,7 @@ func NewClient(options ...ClientOption) *Client {
 				return http.ErrUseLastResponse
 			},
 			Transport: &http.Transport{
-				DialContext: (&net.Dialer{
-					Timeout:   30 * time.Second,
-					KeepAlive: 30 * time.Second,
-				}).DialContext,
+				DialContext: client.dialerFunc,
 				//ForceAttemptHTTP2:     true,
 				MaxIdleConns:    100,
 				IdleConnTimeout: 90 * time.Second,