[Feat] Server Security (#1143)

* wip

* linting

* tsx

* code rabbit feedback

* warning banner

* Update resources/js/pages/security/index.tsx

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Author: RichardAnderson

app/Actions/Server/Security/CheckSecurityState.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Actions\Server\Security;
+
+use App\Jobs\Server\Security\DetectSecurityJob;
+use App\Models\Server;
+
+class CheckSecurityState
+{
+    public function check(Server $server): void
+    {
+        DetectSecurityJob::dispatch($server);
+    }
+}

app/Actions/Server/Security/ConfigureFail2ban.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Actions\Server\Security;
+
+use App\Jobs\Server\Security\ConfigureFail2banJob;
+use App\Models\Server;
+use App\Models\Service;
+use App\Services\Fail2ban\Fail2ban;
+use Illuminate\Support\Facades\Validator;
+
+class ConfigureFail2ban
+{
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function configure(Server $server, array $input): void
+    {
+        $service = $server->fail2ban();
+
+        if (! $service instanceof Service) {
+            return;
+        }
+
+        Validator::make($input, Fail2ban::jailValidationRules())->validate();
+
+        $service->type_data = [
+            'maxretry' => (int) ($input['maxretry'] ?? 5),
+            'findtime' => $input['findtime'] ?? '10m',
+            'bantime' => $input['bantime'] ?? '10m',
+            'ignoreip' => $input['ignoreip'] ?? '',
+        ];
+        $service->save();
+
+        dispatch(new ConfigureFail2banJob($service))->onQueue('ssh');
+    }
+}

app/Actions/Server/Security/ManageAutoUpdate.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Actions\Server\Security;
+
+use App\Models\Server;
+use Closure;
+use Cron\CronExpression;
+use Illuminate\Support\Facades\Validator;
+
+class ManageAutoUpdate
+{
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function update(Server $server, array $input): void
+    {
+        $this->validate($input);
+
+        $enabled = (bool) ($input['enabled'] ?? false);
+
+        $server->auto_update = $enabled;
+        $server->auto_update_schedule = $enabled ? $input['schedule'] : null;
+        $server->save();
+    }
+
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    private function validate(array $input): void
+    {
+        Validator::make($input, [
+            'enabled' => ['required', 'boolean'],
+            'schedule' => [
+                'nullable',
+                'required_if:enabled,true',
+                'string',
+                function (string $attribute, mixed $value, Closure $fail): void {
+                    if ($value && ! CronExpression::isValidExpression((string) $value)) {
+                        $fail('The schedule must be a valid cron expression.');
+                    }
+                },
+            ],
+        ])->validate();
+    }
+}

app/Actions/Server/Security/ManagePasswordAuth.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Actions\Server\Security;
+
+use App\Enums\SecurityControlStatus;
+use App\Jobs\Server\Security\ApplyPasswordAuthJob;
+use App\Models\Server;
+use Illuminate\Support\Facades\Validator;
+
+class ManagePasswordAuth
+{
+    /**
+     * @param  array<string, mixed>  $input
+     */
+    public function update(Server $server, array $input): void
+    {
+        Validator::make($input, [
+            'enabled' => ['required', 'boolean'],
+        ])->validate();
+
+        $enabled = (bool) $input['enabled'];
+
+        $server->refresh();
+        $security = $server->feature_data['security'] ?? [];
+        $security['password_authentication'] = array_merge($security['password_authentication'] ?? [], [
+            'enabled' => $enabled,
+            'status' => SecurityControlStatus::UPDATING->value,
+        ]);
+        $server->jsonUpdate('feature_data', 'security', $security);
+
+        dispatch(new ApplyPasswordAuthJob($server, $enabled))->onQueue('ssh');
+    }
+}

app/Actions/Server/Security/ManageRootLogin.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Actions\Server\Security;
+
+use App\Enums\SecurityControlStatus;
+use App\Jobs\Server\Security\ApplyRootLoginJob;
+use App\Models\Server;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
+
+class ManageRootLogin
+{
+    /**
+     * @param  array<string, mixed>  $input
+     *
+     * @throws ValidationException
+     */
+    public function update(Server $server, array $input): void
+    {
+        Validator::make($input, [
+            'enabled' => ['required', 'boolean'],
+        ])->validate();
+
+        $enabled = (bool) $input['enabled'];
+
+        if (! $enabled && $server->getSshUser() === 'root') {
+            throw ValidationException::withMessages([
+                'enabled' => 'Vito connects to this server as root. Switch to a non-root SSH user before disabling root login.',
+            ]);
+        }
+
+        $server->refresh();
+        $security = $server->feature_data['security'] ?? [];
+        $security['root_login'] = array_merge($security['root_login'] ?? [], [
+            'enabled' => $enabled,
+            'status' => SecurityControlStatus::UPDATING->value,
+        ]);
+        $server->jsonUpdate('feature_data', 'security', $security);
+
+        dispatch(new ApplyRootLoginJob($server, $enabled))->onQueue('ssh');
+    }
+}

app/Console/Commands/RunServerAutoUpdatesCommand.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Actions\Server\Update;
+use App\Enums\ServerStatus;
+use App\Models\Server;
+use Cron\CronExpression;
+use Illuminate\Console\Command;
+
+class RunServerAutoUpdatesCommand extends Command
+{
+    protected $signature = 'servers:auto-update';
+
+    protected $description = 'Dispatch package updates to servers whose auto-update schedule is due';
+
+    public function handle(): void
+    {
+        Server::query()
+            ->where('status', ServerStatus::READY)
+            ->where('auto_update', true)
+            ->whereNotNull('auto_update_schedule')
+            ->chunk(50, function ($servers): void {
+                /** @var Server $server */
+                foreach ($servers as $server) {
+                    if (! CronExpression::isValidExpression((string) $server->auto_update_schedule)) {
+                        continue;
+                    }
+
+                    if ((new CronExpression((string) $server->auto_update_schedule))->isDue(now(), config('app.timezone'))) {
+                        app(Update::class)->update($server);
+                    }
+                }
+            });
+    }
+}

app/Console/Kernel.php

@@ -21,6 +21,7 @@ protected function schedule(Schedule $schedule): void
         $schedule->command('metrics:get')->everyMinute();
         $schedule->command('servers:check')->everyFiveMinutes();
         $schedule->command('servers:check-updates')->dailyAt('02:00');
+        $schedule->command('servers:auto-update')->everyMinute()->withoutOverlapping();
         $schedule->command('domains:check-pending')->everyFiveMinutes();
         $schedule->command('ssl:renew-wildcards')->daily();
         $schedule->command('ssl:check-expiry')->daily();

app/Enums/SecurityControlStatus.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Enums;
+
+use App\Contracts\VitoEnum;
+
+enum SecurityControlStatus: string implements VitoEnum
+{
+    case DISABLED = 'disabled';
+    case UPDATING = 'updating';
+    case READY = 'ready';
+    case FAILED = 'failed';
+
+    public function getColor(): string
+    {
+        return match ($this) {
+            self::DISABLED => 'gray',
+            self::UPDATING => 'warning',
+            self::READY => 'success',
+            self::FAILED => 'danger',
+        };
+    }
+
+    public function getText(): string
+    {
+        return $this === self::READY ? 'active' : $this->value;
+    }
+}

app/Http/Controllers/ConsoleController.php

@@ -37,7 +37,7 @@ public function token(Server $server, Request $request): JsonResponse
         $this->validate($request, [
             'user' => [
                 'required',
-                Rule::in($server->getSshUsers()),
+                Rule::in($server->sshLoginUsers()),
             ],
         ]);