only allow admin access via unix socket

pkg/api/server.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"net"
 	"net/http"
+	"os"
 	"time"
 
 	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
@@ -25,6 +26,7 @@ type Server struct {
 	Data *types.ContextData
 
 	listen net.Listener
+	socket net.Listener
 }
 
 type notFoundHandler struct {
@@ -36,7 +38,7 @@ func (nf *notFoundHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // NewHTTPServer returns a new HTTPServer
-func NewServer(log logr.Logger, listen string) (*Server, error) {
+func NewServer(log logr.Logger, listen, socket string) (*Server, error) {
 	s := &Server{
 		mux:  mux.NewRouter(),
 		log:  log,
@@ -48,6 +50,13 @@ func NewServer(log logr.Logger, listen string) (*Server, error) {
 	}
 	s.listen = l
 
+	sock, err := unixListener(socket)
+	net.Listen("unix", socket)
+	if err != nil {
+		return nil, err
+	}
+	s.socket = sock
+
 	s.mux.NotFoundHandler = &notFoundHandler{s}
 	for _, v := range serverv1.Routes {
 		s.mux.HandleFunc(v.Path, s.contextWrapper(v.Handler)).Methods(v.Methods...)
@@ -55,6 +64,15 @@ func NewServer(log logr.Logger, listen string) (*Server, error) {
 	return s, nil
 }
 
+func unixListener(socket string) (sock net.Listener, err error) {
+	sock, err = net.Listen("unix", socket)
+	if err != nil {
+		return
+	}
+	err = os.Chmod(socket, 0660)
+	return
+}
+
 func (s *Server) Start(db *db.DB) {
 	s.srv = &http.Server{
 		Handler:      s.mux,
@@ -68,6 +86,12 @@ func (s *Server) Start(db *db.DB) {
 			s.log.Error(err, "")
 		}
 	}()
+	go func() {
+		err := s.srv.Serve(s.socket)
+		if err != nil && err != http.ErrServerClosed {
+			s.log.Error(err, "")
+		}
+	}()
 	return
 }