migration wizard

crates/defguard/src/main.rs

@@ -16,7 +16,7 @@ use defguard_common::{
 };
 use defguard_core::{
     auth::failed_login::FailedLoginMap,
-    db::AppEvent,
+    db::{AppEvent, models::wizard_flags::WizardFlags},
     enterprise::{
         activity_log_stream::activity_log_stream_manager::run_activity_log_stream_manager,
         license::{License, run_periodic_license_check, set_cached_license},
@@ -33,7 +33,7 @@ use defguard_event_router::{RouterReceiverSet, run_event_router};
 use defguard_gateway_manager::{GatewayManager, GatewayTxSet};
 use defguard_proxy_manager::{ProxyManager, ProxyTxSet};
 use defguard_session_manager::{events::SessionManagerEvent, run_session_manager};
-use defguard_setup::setup::run_setup_web_server;
+use defguard_setup::{migration::run_migration_web_server, setup::run_setup_web_server};
 use defguard_vpn_stats_purge::run_periodic_stats_purge;
 use secrecy::ExposeSecret;
 use tokio::sync::{
@@ -94,27 +94,49 @@ async fn main() -> Result<(), anyhow::Error> {
         info!("Using HMAC OpenID signing key");
     }
 
+    let wizard_flags = WizardFlags::init(&pool).await?;
+    let mut ini_server_config = true;
+
     // initialize default settings
     Settings::init_defaults(&pool).await?;
     // initialize global settings struct
     initialize_current_settings(&pool).await?;
+    Settings::ensure_secret_key(&pool, &config).await?;
     let mut settings = Settings::get_current_settings();
 
-    if !settings.initial_setup_completed {
+    if wizard_flags.initial_wizard_in_progress && !wizard_flags.initial_wizard_completed {
         if let Err(err) =
             run_setup_web_server(pool.clone(), config.http_bind_address, config.http_port).await
         {
             anyhow::bail!("Setup web server exited with error: {err}");
         }
+        settings = Settings::get_current_settings();
+    } else if wizard_flags.migration_wizard_in_progress && !wizard_flags.migration_wizard_completed
+    {
+        settings.update_from_config(&pool, &config).await?;
+
+        config.initialize_post_settings();
+        SERVER_CONFIG
+            .set(config.clone())
+            .expect("Failed to initialize server config.");
+
+        ini_server_config = false;
 
+        if let Err(err) =
+            run_migration_web_server(pool.clone(), config.http_bind_address, config.http_port).await
+        {
+            anyhow::bail!("Migration web server exited with error: {err}");
+        }
         settings = Settings::get_current_settings();
     }
 
-    config.initialize_post_settings();
+    if ini_server_config {
+        config.initialize_post_settings();
 
-    SERVER_CONFIG
-        .set(config.clone())
-        .expect("Failed to initialize server config.");
+        SERVER_CONFIG
+            .set(config.clone())
+            .expect("Failed to initialize server config.");
+    }
 
     // create event channels for services
     let (api_event_tx, api_event_rx) = unbounded_channel::<ApiEvent>();
@@ -141,7 +163,7 @@ async fn main() -> Result<(), anyhow::Error> {
         anyhow::bail!("CA certificate or key were not found in settings, despite completing setup.")
     }
 
-    // read grpc TLS cert and key
+    // read grpc TLS cert and key from legacy config values
     let grpc_cert = config
         .grpc_cert
         .as_ref()
@@ -172,11 +194,13 @@ async fn main() -> Result<(), anyhow::Error> {
     }
 
     let (proxy_control_tx, proxy_control_rx) = channel::<ProxyControlMessage>(100);
+    let proxy_secret_key = settings.secret_key_required()?.to_string();
     let proxy_manager = ProxyManager::new(
         pool.clone(),
         ProxyTxSet::new(gateway_tx.clone(), bidi_event_tx.clone()),
         Arc::clone(&incompatible_components),
         proxy_control_rx,
+        proxy_secret_key,
     );
 
     let mut gateway_manager = GatewayManager::new(
@@ -208,9 +232,9 @@ async fn main() -> Result<(), anyhow::Error> {
         ) => error!("Web server returned early: {res:?}"),
         res = run_periodic_stats_purge(
             pool.clone(),
-            config.stats_purge_frequency.into(),
-            config.stats_purge_threshold.into()
-        ), if !config.disable_stats_purge =>
+            settings.stats_purge_frequency(),
+            settings.stats_purge_threshold()
+        ), if !settings.disable_stats_purge =>
             error!("Periodic stats purge task returned early: {res:?}"),
         res = run_periodic_license_check(&pool) =>
             error!("Periodic license check task returned early: {res:?}"),