HTTP Basic auth support

[metachris]

📝 Summary

Enables basic auth support for API requests.

The basic auth password is configurable through API and/or file. If set via API, the salted hash is stored in the file to persist across reboots.

Config-file updates:

[general]
# HTTP Basic Auth
basic_auth_secret_path = "basic-auth-secret.txt" # basic auth is supported if a path is provided
basic_auth_secret_salt = "D;%yL9TS:5PalS/d"      # use a random string for the salt

basic_auth_secret_path specifies the file to store the salted, hashed secret in. It's loaded (or created) on startup.

• if the file is not empty, API requests need to include a http basic auth password that matches that sha256 hash (user admin)
• if empty, no authentication is required for API requests until secret is configured through API or file. if /api/v1/set-basic-auth is called, it uses the payload as secret (immediately) and writes the hash of the secret it to the file (for reuse across restarts).
• if file does not exist, it is created (empty)

Only the salted SHA256 hash of the password is stored, both in the file as well as in memory.

The secret can be overwritten (updated) via API call, if the request provides the previous http basic auth secret.

Also added tests and updated the README.

---

✅ I have run these commands

• make lint
• make test
• go mod tidy

[MoeMahhouk]

an unrelated question but how is the system-api protected against DOS attacks here?
Can someone technically abuse the exposed API to send large amount of requests to make the instance slow and disrupt the execution of the other services on it?

[metachris]

an unrelated question but how is the system-api protected against DOS attacks here?

Good questions. Keep in mind, this API is not public! It's only available to the operator, who configures access on his cloud firewall and doesn't expose it publicly.