Ephemeral instances for ssh and web

.gitignore

@@ -27,5 +27,3 @@ vite.config.ts.timestamp-*
 uploads/
 ctf/
 khi_web_logs/
-docs/superpowers/
-.superpowers/

Dockerfile

@@ -1,28 +1,35 @@
+FROM oven/bun:1 AS build
+
+WORKDIR /app
+COPY drizzle/ ./drizzle
+COPY src/ ./src
+COPY static/ ./static
+COPY drizzle.config.ts bun.lock package.json svelte.config.js tsconfig.json vite.config.ts .
+
+RUN bun install --frozen-lockfile && \
+    BETTER_AUTH_URL=http://placeholder \
+    BETTER_AUTH_SECRET=placeholder \
+    bun run build
+
 FROM nginx:latest
-RUN apt-get update && apt-get install -y supervisor nodejs npm net-tools && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y supervisor net-tools && rm -rf /var/lib/apt/lists/*
+COPY --from=build /usr/local/bin/bun /usr/local/bin/bun
 
 # prepare necessary directories
 RUN mkdir -p /app
 
 # replace nginx config file
 COPY khi.conf /etc/nginx/conf.d/default.conf
 
-# move the svelte app into the container and build it
 WORKDIR /app
-COPY drizzle/ ./drizzle
-COPY src/ ./src
-COPY static/ ./static
-COPY drizzle.config.ts package-lock.json package.json svelte.config.js tsconfig.json vite.config.ts .
-
-RUN npm install . && \
-    BETTER_AUTH_URL=http://placeholder \
-    BETTER_AUTH_SECRET=placeholder \
-    npm run build
+COPY --from=build /app/build ./build
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./package.json
 
 # copy the automation config for running nginx and the web-app
 COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
 
 # prep entry script and execute it
 COPY entrypoint.sh /root/entrypoint.sh
 RUN chmod +x /root/entrypoint.sh
-CMD ["/root/entrypoint.sh"]
+CMD ["/root/entrypoint.sh"]

README.md

@@ -68,8 +68,8 @@ UPLOADS_DIR=
 
 Running the svelte application
 ```console
-npm install .
-npm run dev -- --open
+bun install
+bun run dev -- --open
 ```
 
 If you'd prefer running the compose locally

docker-compose.yml

@@ -51,6 +51,66 @@ services:
       # handler does not need to be on the same network as the database
       - handler_net
 
+  docker-socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    container_name: docker_socket_proxy_khi
+    restart: unless-stopped
+    environment:
+      CONTAINERS: 1
+      POST: 1
+      IMAGES: 1
+      NETWORKS: 1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - docker_proxy_net
+
+  ssh-orchestrator:
+    container_name: ssh_orchestrator_khi
+    restart: unless-stopped
+    build:
+      context: .
+      dockerfile: ./ssh-orchestrator/Dockerfile
+    environment:
+      DOCKER_PROXY_HOST: docker-socket-proxy
+      DOCKER_PROXY_PORT: 2375
+      SSH_MIN_PORT: ${SSH_MIN_PORT}
+      SSH_MAX_PORT: ${SSH_MAX_PORT}
+      WEB_MIN_PORT: ${WEB_MIN_PORT}
+      WEB_MAX_PORT: ${WEB_MAX_PORT}
+      SSH_INSTANCE_MINUTES: ${SSH_INSTANCE_MINUTES:-45}
+      SSH_INSTANCE_CPU_NANOS: ${SSH_INSTANCE_CPU_NANOS:-1000000000}
+      SSH_INSTANCE_MEM_BYTES: ${SSH_INSTANCE_MEM_BYTES:-268435456}
+      SSH_INSTANCE_PIDS_LIMIT: ${SSH_INSTANCE_PIDS_LIMIT:-128}
+      WEB_INSTANCE_CPU_NANOS: ${WEB_INSTANCE_CPU_NANOS:-1000000000}
+      WEB_INSTANCE_MEM_BYTES: ${WEB_INSTANCE_MEM_BYTES:-268435456}
+      WEB_INSTANCE_PIDS_LIMIT: ${WEB_INSTANCE_PIDS_LIMIT:-128}
+      SSH_IMAGE_REGISTRY: ${SSH_IMAGE_REGISTRY:-}
+      SSH_REGISTRY_USER: ${SSH_REGISTRY_USER:-}
+      SSH_REGISTRY_PASSWORD: ${SSH_REGISTRY_PASSWORD:-}
+      SSH_IMAGE_PREFIX: ${SSH_IMAGE_PREFIX:-khi-ssh/}
+      WEB_IMAGE_PREFIX: ${WEB_IMAGE_PREFIX:-khi-web/}
+    networks:
+      - ssh_orch_net
+      - docker_proxy_net
+
+  migrate:
+    container_name: migrate_khi
+    build:
+      context: .
+      dockerfile: ./migrate/Dockerfile
+    environment:
+      PG_HOST: postgres
+      PG_PORT: 5432
+      PG_USER: ${PG_ADMIN_USER}
+      PG_PASSWORD: ${PG_ADMIN_PASSWORD}
+      PG_DATABASE: ${PG_DATABASE}
+    networks:
+      - app_internal
+    depends_on:
+      postgres:
+        condition: service_healthy
+
   app:
     container_name: web_khi
     restart: unless-stopped
@@ -85,6 +145,10 @@ services:
       BIN_UPLOADS_DIR: /app/ctf
       CHALLENGE_HOST: ${CHALLENGE_HOST:-ctf.hacksu.com}
       TESTING_READ: "C++ is the Best Language, the very best."
+
+      SSH_IMAGE_REGISTRY: ${SSH_IMAGE_REGISTRY:-}
+      SSH_REGISTRY_USER: ${SSH_REGISTRY_USER:-}
+      SSH_REGISTRY_PASSWORD: ${SSH_REGISTRY_PASSWORD:-}
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.khi.rule=Host(`ctf.hacksu.com`)"
@@ -101,9 +165,12 @@ services:
     networks:
       - app_internal
       - handler_net
+      - ssh_orch_net
     depends_on:
       postgres:
         condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
 
 volumes:
   khi_psql_data:
@@ -113,4 +180,6 @@ volumes:
 
 networks:
   app_internal:
-  handler_net:
+  handler_net:
+  docker_proxy_net:
+  ssh_orch_net:

drizzle.config.ts

@@ -1,10 +1,5 @@
 import { defineConfig } from "drizzle-kit";
 
-console.log(process.env.PG_HOST!);
-console.log(process.env.PG_USER!);
-console.log(process.env.PG_PASSWORD!);
-console.log(process.env.PG_DATABASE!);
-
 export default defineConfig({
   schema: "./src/lib/database/auth-schema.ts",
   out: "./drizzle",
@@ -14,6 +9,7 @@ export default defineConfig({
     port: Number(process.env.PG_PORT!),
     user: process.env.PG_USER!,
     password: process.env.PG_PASSWORD!,
-    database: process.env.PG_DATABASE!
+    database: process.env.PG_DATABASE!,
+    ssl: false
   }
 });

drizzle/0001_seed_event_config.sql

@@ -0,0 +1,2 @@
+-- Custom SQL migration file, put your code below! --
+INSERT INTO event_config (name, event_start, event_length, site_active) VALUES ('config', NOW(), 7, false) ON CONFLICT (name) DO NOTHING;

drizzle/0002_dazzling_paper_doll.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "instance_sessions" ADD COLUMN "challenge_id" integer;--> statement-breakpoint
+ALTER TABLE "instance_sessions" ADD CONSTRAINT "instance_sessions_challenge_id_challenges_id_fk" FOREIGN KEY ("challenge_id") REFERENCES "public"."challenges"("id") ON DELETE no action ON UPDATE no action;

drizzle/0003_next_kulan_gath.sql

@@ -0,0 +1,12 @@
+CREATE TABLE "ssh_instance_sessions" (
+	"uid" text PRIMARY KEY NOT NULL,
+	"challenge_id" integer NOT NULL,
+	"container_id" text NOT NULL,
+	"port" integer NOT NULL,
+	"password" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "ssh_instance_sessions" ADD CONSTRAINT "ssh_instance_sessions_uid_user_id_fk" FOREIGN KEY ("uid") REFERENCES "public"."user"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "ssh_instance_sessions" ADD CONSTRAINT "ssh_instance_sessions_challenge_id_challenges_id_fk" FOREIGN KEY ("challenge_id") REFERENCES "public"."challenges"("id") ON DELETE no action ON UPDATE no action;

drizzle/0004_cooing_kabuki.sql

@@ -0,0 +1 @@
+ALTER TABLE "challenges" ADD COLUMN "image_ref" text;

drizzle/0005_sleepy_celestials.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "web_instances" (
+	"challenge_id" integer PRIMARY KEY NOT NULL,
+	"container_id" text NOT NULL,
+	"port" integer NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "challenges" ADD COLUMN "web_image_ref" text;--> statement-breakpoint
+ALTER TABLE "web_instances" ADD CONSTRAINT "web_instances_challenge_id_challenges_id_fk" FOREIGN KEY ("challenge_id") REFERENCES "public"."challenges"("id") ON DELETE no action ON UPDATE no action;