gw: add admin API token authentication

The admin server has historically relied on network isolation alone:
`construct()` does no caller checks, so anyone reachable on the admin
port (default `0.0.0.0:8001` inside the deployment container) can call
any admin RPC or load the dashboard. Combined with the dashboard's
visibility into cluster state, this is an obvious hardening target.

Add an opt-in shared-secret check, modelled on KMS `ensure_admin` but
using the plain token in config (no hash) so the value can be injected
via dstack encrypted env without round-tripping a SHA-256 step.

- `AdminConfig.admin_token` (empty = no auth, with a startup WARN so
  existing deployments keep their current behaviour).
- New `admin_auth::AdminAuthFairing` attached to the admin Rocket
  instance. Accepts the token via `X-Admin-Token`, `Authorization:
  Bearer <token>`, or `?token=...` (for the browser dashboard).
  Constant-time compare via `subtle::ConstantTimeEq`. Rejected
  requests are rewritten to a sentinel URI that returns HTTP 401, so
  all currently-mounted routes (prpc + dashboard) are covered without
  per-route guards.
- Thread `ADMIN_TOKEN` through `dstack-app` entrypoint + compose so
  encrypted-env values land in `gateway.toml`.
- Update `bootstrap-cluster.sh` to send `X-Admin-Token` when
  `ADMIN_TOKEN` is set.

Author: kvinwang

Cargo.lock

@@ -192,6 +192,7 @@ rustls-webpki = "0.103.10"
 schnorrkel = "0.11.4"
 sha2 = { version = "0.10.8", default-features = false }
 sha3 = "0.10.8"
+subtle = "2"
 blake2 = "0.10.6"
 tokio-rustls = { version = "0.26.2", features = ["ring"] }
 x25519-dalek = { version = "2.0.1", features = ["static_secrets"] }

Cargo.toml

@@ -62,6 +62,7 @@ uuid = { workspace = true, features = ["v4"] }
 rmp-serde.workspace = true
 or-panic.workspace = true
 base64.workspace = true
+subtle.workspace = true
 
 [target.'cfg(unix)'.dependencies]
 nix = { workspace = true, features = ["resource"] }

gateway/Cargo.toml

@@ -14,17 +14,25 @@
 # Load .env if present
 if [ -f ".env" ]; then
   set -a
+  # shellcheck source=/dev/null
   source .env
   set +a
 fi
 
 ADMIN_ADDR="${1:-${GATEWAY_ADMIN_RPC_ADDR:-127.0.0.1:9203}}"
 
+# When admin auth is enabled, ADMIN_TOKEN must be set so curl can present
+# X-Admin-Token. Empty token = legacy unauthenticated mode.
+AUTH_HEADER=()
+if [ -n "$ADMIN_TOKEN" ]; then
+  AUTH_HEADER=(-H "X-Admin-Token: $ADMIN_TOKEN")
+fi
+
 echo "Waiting for gateway admin API at $ADMIN_ADDR..."
 max_retries=60
 retry=0
 while [ $retry -lt $max_retries ]; do
-  if curl -sf "http://$ADMIN_ADDR/prpc/Status" >/dev/null 2>&1; then
+  if curl -sf "${AUTH_HEADER[@]}" "http://$ADMIN_ADDR/prpc/Status" >/dev/null 2>&1; then
     break
   fi
   retry=$((retry + 1))
@@ -47,19 +55,19 @@ else
 fi
 
 echo "Setting certbot config (ACME URL: $ACME_URL)..."
-curl -sf -X POST "http://$ADMIN_ADDR/prpc/SetCertbotConfig" \
+curl -sf -X POST "${AUTH_HEADER[@]}" "http://$ADMIN_ADDR/prpc/SetCertbotConfig" \
   -H "Content-Type: application/json" \
   -d '{"acme_url":"'"$ACME_URL"'","renew_interval_secs":3600,"renew_before_expiration_secs":864000,"renew_timeout_secs":300}' >/dev/null \
   && echo "  Certbot config set" || echo "  WARN: failed to set certbot config"
 
 # Create DNS credential if CF_API_TOKEN is provided and no credentials exist yet
 if [ -n "$CF_API_TOKEN" ]; then
-  existing=$(curl -sf "http://$ADMIN_ADDR/prpc/ListDnsCredentials" 2>/dev/null)
+  existing=$(curl -sf "${AUTH_HEADER[@]}" "http://$ADMIN_ADDR/prpc/ListDnsCredentials" 2>/dev/null)
   cred_count=$(echo "$existing" | jq -r '.credentials | length' 2>/dev/null || echo "0")
 
   if [ "$cred_count" = "0" ]; then
     echo "Creating default DNS credential..."
-    curl -sf -X POST "http://$ADMIN_ADDR/prpc/CreateDnsCredential" \
+    curl -sf -X POST "${AUTH_HEADER[@]}" "http://$ADMIN_ADDR/prpc/CreateDnsCredential" \
       -H "Content-Type: application/json" \
       -d '{"name":"cloudflare","provider_type":"cloudflare","cf_api_token":"'"$CF_API_TOKEN"'","set_as_default":true}' >/dev/null \
       && echo "  DNS credential created" || echo "  WARN: failed to create DNS credential"
@@ -72,12 +80,12 @@ fi
 
 # Add ZT-Domain if SRV_DOMAIN is provided and domain doesn't exist yet
 if [ -n "$SRV_DOMAIN" ]; then
-  existing=$(curl -sf "http://$ADMIN_ADDR/prpc/ListZtDomains" 2>/dev/null)
+  existing=$(curl -sf "${AUTH_HEADER[@]}" "http://$ADMIN_ADDR/prpc/ListZtDomains" 2>/dev/null)
   has_domain=$(echo "$existing" | jq -r '.domains[]? | select(.domain=="'"$SRV_DOMAIN"'") | .domain' 2>/dev/null)
 
   if [ -z "$has_domain" ]; then
     echo "Adding ZT-Domain: $SRV_DOMAIN..."
-    curl -sf -X POST "http://$ADMIN_ADDR/prpc/AddZtDomain" \
+    curl -sf -X POST "${AUTH_HEADER[@]}" "http://$ADMIN_ADDR/prpc/AddZtDomain" \
       -H "Content-Type: application/json" \
       -d '{"domain":"'"$SRV_DOMAIN"'","port":443,"priority":100}' >/dev/null \
       && echo "  ZT-Domain added" || echo "  WARN: failed to add ZT-Domain"

gateway/dstack-app/bootstrap-cluster.sh

@@ -36,6 +36,7 @@ validate_env "$NODE_ID"
 validate_env "$WG_IP"
 validate_env "$WG_RESERVED_NET"
 validate_env "$WG_CLIENT_RANGE"
+validate_env "$ADMIN_TOKEN"
 
 # Validate $NODE_ID, must be a number
 if [[ ! "$NODE_ID" =~ ^[0-9]+$ ]]; then
@@ -89,6 +90,7 @@ sync_connections_interval = "${SYNC_CONNECTIONS_INTERVAL:-30s}"
 enabled = true
 address = "${ADMIN_LISTEN_ADDR:-0.0.0.0}"
 port = ${ADMIN_LISTEN_PORT:-8001}
+admin_token = "${ADMIN_TOKEN}"
 
 [core.wg]
 public_key = "$PUBLIC_KEY"

gateway/dstack-app/builder/entrypoint.sh

@@ -41,6 +41,7 @@ services:
       - TIMEOUT_TOTAL=${TIMEOUT_TOTAL:-5h}
       - ADMIN_LISTEN_ADDR=${ADMIN_LISTEN_ADDR:-0.0.0.0}
       - ADMIN_LISTEN_PORT=${ADMIN_LISTEN_PORT:-8001}
+      - ADMIN_TOKEN=${ADMIN_TOKEN:-}
       - INBOUND_PP_ENABLED=${INBOUND_PP_ENABLED:-false}
       - TIMEOUT_PP_HEADER=${TIMEOUT_PP_HEADER:-5s}
       - PORT_POLICY_FETCH_TIMEOUT=${PORT_POLICY_FETCH_TIMEOUT:-10s}

gateway/dstack-app/docker-compose.yaml

@@ -24,6 +24,10 @@ timeout = "5s"
 [core.admin]
 enabled = false
 address = "127.0.0.1:8011"
+# Shared secret required by every admin endpoint (RPC + dashboard) when
+# non-empty. Clients send it via the `X-Admin-Token` header (or `?token=...`
+# for the dashboard / browser links). Empty disables auth.
+admin_token = ""
 
 [core.debug]
 insecure_enable_debug_rpc = false