diff --git a/backend/src/main.rs b/backend/src/main.rs index 8e508db009..f1bc4c334d 100644 --- a/backend/src/main.rs +++ b/backend/src/main.rs @@ -42,15 +42,15 @@ use windmill_common::{ CRITICAL_ERROR_CHANNELS_SETTING, CUSTOM_TAGS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING, EMAIL_DOMAIN_SETTING, ENV_SETTINGS, EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING, - HUB_BASE_URL_SETTING, INDEXER_SETTING, INSTANCE_PYTHON_VERSION_SETTING, - JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, - LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING, - NO_DEFAULT_MAVEN_SETTING, NPM_CONFIG_REGISTRY_SETTING, NUGET_CONFIG_SETTING, OAUTH_SETTING, - OTEL_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, - POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING, - REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING, - RUBY_REPOS_SETTING, SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, SMTP_SETTING, TEAMS_SETTING, - TIMEOUT_WAIT_RESULT_SETTING, + HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INDEXER_SETTING, + INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING, + KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, + MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING, + NPM_CONFIG_REGISTRY_SETTING, NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING, + PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, + REQUEST_SIZE_LIMIT_SETTING, REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, + RETENTION_PERIOD_SECS_SETTING, RUBY_REPOS_SETTING, SAML_METADATA_SETTING, + SCIM_TOKEN_SETTING, SMTP_SETTING, TEAMS_SETTING, TIMEOUT_WAIT_RESULT_SETTING, }, scripts::ScriptLang, stats_oss::schedule_stats, @@ -95,10 +95,10 @@ use crate::monitor::{ reload_app_workspaced_route_setting, reload_base_url_setting, reload_bunfig_install_scopes_setting, reload_critical_alert_mute_ui_setting, reload_critical_error_channels_setting, reload_extra_pip_index_url_setting, - reload_hub_base_url_setting, reload_job_default_timeout_setting, reload_jwt_secret_setting, - reload_license_key, reload_npm_config_registry_setting, reload_pip_index_url_setting, - reload_retention_period_setting, reload_scim_token_setting, reload_smtp_config, - reload_worker_config, MonitorIteration, + reload_hub_api_secret_setting, reload_hub_base_url_setting, reload_job_default_timeout_setting, + reload_jwt_secret_setting, reload_license_key, reload_npm_config_registry_setting, + reload_pip_index_url_setting, reload_retention_period_setting, reload_scim_token_setting, + reload_smtp_config, reload_worker_config, MonitorIteration, }; #[cfg(feature = "parquet")] @@ -1071,6 +1071,9 @@ Windmill Community Edition {GIT_VERSION} RUBY_REPOS_SETTING => { reload_ruby_repos_setting(&conn).await }, + HUB_API_SECRET_SETTING => { + reload_hub_api_secret_setting(&conn).await + }, KEEP_JOB_DIR_SETTING => { load_keep_job_dir(&conn).await; }, diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs index b8a1d455e1..6d66d2ad66 100644 --- a/backend/src/monitor.rs +++ b/backend/src/monitor.rs @@ -50,10 +50,10 @@ use windmill_common::{ CRITICAL_ALERT_MUTE_UI_SETTING, CRITICAL_ERROR_CHANNELS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING, EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING, - HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING, - JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, - MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPM_CONFIG_REGISTRY_SETTING, NUGET_CONFIG_SETTING, - OTEL_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, + HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING, + JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, + LICENSE_KEY_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPM_CONFIG_REGISTRY_SETTING, + NUGET_CONFIG_SETTING, OTEL_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING, REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING, SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, TIMEOUT_WAIT_RESULT_SETTING, @@ -65,7 +65,7 @@ use windmill_common::{ server::load_smtp_config, tracing_init::JSON_FMT, users::truncate_token, - utils::{empty_as_none, now_from_db, rd_string, report_critical_error, Mode}, + utils::{empty_as_none, now_from_db, rd_string, report_critical_error, Mode, HUB_API_SECRET}, worker::{ load_env_vars, load_init_bash_from_env, load_periodic_bash_script_from_env, load_periodic_bash_script_interval_from_env, load_whitelist_env_vars_from_env, @@ -285,6 +285,8 @@ pub async fn initial_load( reload_smtp_config(db).await; } + reload_hub_api_secret_setting(&conn).await; + if server_mode { reload_retention_period_setting(&conn).await; reload_request_size(&conn).await; @@ -1185,6 +1187,16 @@ pub async fn reload_ruby_repos_setting(conn: &Connection) { .await; } +pub async fn reload_hub_api_secret_setting(conn: &Connection) { + reload_option_setting_with_tracing( + conn, + HUB_API_SECRET_SETTING, + "HUB_API_SECRET", + HUB_API_SECRET.clone(), + ) + .await; +} + pub async fn reload_retention_period_setting(conn: &Connection) { if let Err(e) = reload_setting( conn, diff --git a/backend/windmill-common/src/global_settings.rs b/backend/windmill-common/src/global_settings.rs index 443ee5dbb9..13be9ff02f 100644 --- a/backend/windmill-common/src/global_settings.rs +++ b/backend/windmill-common/src/global_settings.rs @@ -34,6 +34,7 @@ pub const EXPOSE_DEBUG_METRICS_SETTING: &str = "expose_debug_metrics"; pub const KEEP_JOB_DIR_SETTING: &str = "keep_job_dir"; pub const REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING: &str = "require_preexisting_user_for_oauth"; pub const OBJECT_STORE_CONFIG_SETTING: &str = "object_store_cache_config"; +pub const HUB_API_SECRET_SETTING: &str = "hub_api_secret"; pub const AUTOMATE_USERNAME_CREATION_SETTING: &str = "automate_username_creation"; pub const HUB_BASE_URL_SETTING: &str = "hub_base_url"; diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs index 58bad93e06..6dc1d76768 100644 --- a/backend/windmill-common/src/utils.rs +++ b/backend/windmill-common/src/utils.rs @@ -28,8 +28,10 @@ use sha2::{Digest, Sha256}; use sqlx::{Pool, Postgres}; use std::borrow::Cow; use std::fmt::Display; +use std::sync::Arc; use std::{fs::DirBuilder as SyncDirBuilder, str::FromStr}; use tokio::fs::DirBuilder as AsyncDirBuilder; +use tokio::sync::RwLock; use url::Url; pub const MAX_PER_PAGE: usize = 10000; @@ -134,6 +136,8 @@ lazy_static::lazy_static! { mode, } }; + + pub static ref HUB_API_SECRET: Arc>> = Arc::new(RwLock::new(None)); } lazy_static::lazy_static! { @@ -334,6 +338,10 @@ pub async fn http_get_from_hub( request = request.header("X-uid", uid); } + if let Some(hub_api_secret) = HUB_API_SECRET.read().await.clone() { + request = request.header("X-api-secret", hub_api_secret); + } + if let Some(query_params) = query_params { for (key, value) in query_params { request = request.query(&[(key, value)]); diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte index 95fb21b614..9bfb6ff33c 100644 --- a/frontend/src/lib/components/InstanceSetting.svelte +++ b/frontend/src/lib/components/InstanceSetting.svelte @@ -1067,12 +1067,7 @@ bind:value={$values[setting.key]} /> {:else if setting.fieldType == 'password'} - + {:else if setting.fieldType == 'boolean'}
= { { label: 'Private Hub base url', description: - 'Base URL of your private Hub instance, without trailing slash. Learn more', + 'Base URL of your Private Hub instance, without trailing slash. Learn more', placeholder: 'https://hub.company.com', key: 'hub_base_url', fieldType: 'text', @@ -226,6 +226,16 @@ export const settings: Record = { ee_only: '', requiresReloadOnChange: true }, + { + label: 'Private Hub API secret', + description: + 'If access to your Private Hub is restricted, you can set the hub API secret here. Learn more', + key: 'hub_api_secret', + fieldType: 'password', + storage: 'setting', + ee_only: '', + requiresReloadOnChange: true + }, { label: 'App workspace prefix', description: @@ -355,7 +365,7 @@ export const settings: Record = { label: 'PowerShell Repository PAT', description: 'Add private PowerShell repository Personal Access Token', key: 'powershell_repo_pat', - fieldType: 'text', + fieldType: 'password', storage: 'setting', ee_only: '' }