Refactor internals and expose websocket interface

.github/workflows/integration_test.yaml

@@ -0,0 +1,21 @@
+name: integration tests
+on:
+  - push
+  - pull_request
+  - workflow_dispatch
+jobs:
+  integration_tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Build remote-console binary for Dockerfile
+        run: |
+          go build -o remote-console ./cmd/remote-console
+      - name: Run integration tests
+        run: |
+          go test ./test -timeout 20m ./test

.github/workflows/lint.yaml

@@ -0,0 +1,23 @@
+name: golangci-lint
+on:
+  - pull_request
+
+permissions:
+  contents: read
+  # Optional: allow read access to pull requests. Use with `only-new-issues` option.
+  # pull-requests: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Go 1.26
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.26
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: latest

.github/workflows/unit_test.yaml

@@ -0,0 +1,19 @@
+name: unit tests
+on:
+  - push
+  - pull_request
+  - workflow_dispatch
+jobs:
+  unit_tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Run unit tests
+        run: |
+          # Exclude the integration tests
+          go test ./internal/...

Dockerfile

@@ -1,42 +1,22 @@
+# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+# Copyright © 2021-2022, 2025 Hewlett Packard Enterprise Development LP
 #
-# MIT License
-#
-# (C) Copyright 2021-2022, 2025 Hewlett Packard Enterprise Development LP
-#
-# Permission is hereby granted, free of charge, to any person obtaining a
-# copy of this software and associated documentation files (the "Software"),
-# to deal in the Software without restriction, including without limitation
-# the rights to use, copy, modify, merge, publish, distribute, sublicense,
-# and/or sell copies of the Software, and to permit persons to whom the
-# Software is furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
-# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
-# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-# OTHER DEALINGS IN THE SOFTWARE.
-#
+# SPDX-License-Identifier: MIT
+
 # Dockerfile for the console-data service
 
 ### goreleaser Stage ###
 ### Assume goreleaser has already compiled the binary and written it to ./remote-console
 
-FROM ubuntu:24.0 AS ubuntu-goreleaser
+FROM ubuntu:24.04 AS ubuntu-goreleaser
 
 RUN apt -y update
 RUN apt -y install conman less vim ssh jq tar procps inotify-tools
 
 COPY remote-console /app/
-COPY scripts/conman.conf /app/conman_base.conf
-COPY scripts/conman.conf /etc/conman.conf
-COPY scripts/ssh-key-console /usr/bin
-COPY scripts/ssh-pwd-console /usr/bin
-COPY scripts/ssh-pwd-mtn-console /usr/bin/
+COPY scripts/conman.conf.tmpl /app/conman.conf.tmpl
+COPY scripts/ssh-key-console /usr/bin/
+COPY scripts/ssh-pwd-console /usr/bin/
 COPY configs /app/configs
 
 RUN chown -Rv 65534:65534 /app /etc/conman.conf
@@ -92,25 +72,24 @@ RUN set -eux \
         bash \
         jq \
         inotify-tools \
+        logrotate \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy in the needed files
 COPY --from=builder /usr/local/bin/remote-console /app/
-COPY scripts/conman.conf /app/conman_base.conf
-COPY scripts/conman.conf /etc/conman.conf
+COPY scripts/conman.conf.tmpl /app/conman.conf.tmpl
 COPY scripts/ssh-key-console /usr/bin/
 COPY scripts/ssh-pwd-console /usr/bin/
-COPY scripts/ssh-pwd-mtn-console /usr/bin/
 COPY configs /app/configs
 
 # Aliases
 RUN echo 'alias ll="ls -l"' >> /root/.bashrc
 RUN echo 'alias vi="vim"' >> /root/.bashrc
-RUN chmod +775 /usr/bin/ssh-key-console /usr/bin/ssh-pwd-console /usr/bin/ssh-pwd-mtn-console
+RUN chmod +775 /usr/bin/ssh-key-console /usr/bin/ssh-pwd-console
 
 # Create log directories and set ownership to nobody (UID/GID 65534)
 RUN mkdir -p /var/log/conman/ /var/log/conman.old/ \
-    && chown -Rv 65534:65534 /app /etc/conman.conf /var/log/conman/ /var/log/conman.old/
+    && chown -Rv 65534:65534 /app /var/log/conman/ /var/log/conman.old/
 
 USER 65534:65534
 

cmd/remote-console/command.go

@@ -0,0 +1,52 @@
+// Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"context"
+	"log"
+	"strings"
+
+	"github.com/urfave/cli/v3"
+	"github.com/urfave/sflags"
+	"github.com/urfave/sflags/gen/gcli"
+)
+
+func ensureTrailingSlash(url string) string {
+	if url != "" && !strings.HasSuffix(url, "/") {
+		return url + "/"
+	}
+	return url
+}
+
+func command(config *remoteConsoleConfig) *cli.Command {
+
+	cmd := &cli.Command{
+		Name:        "remote-console",
+		Usage:       "access remote consoles",
+		Description: "OpenCHAMI remote console service",
+		Before: func(ctx context.Context, c *cli.Command) (context.Context, error) {
+			config.SmdURL = ensureTrailingSlash(config.SmdURL)
+
+			return ctx, validateConfig(config)
+		},
+		Action: func(context.Context, *cli.Command) error {
+			return runService(*config)
+		},
+	}
+
+	err := gcli.ParseToV3(config, &cmd.Flags, sflags.EnvPrefix("RCS_"))
+	if err != nil {
+		log.Fatalf("err: %v", err)
+	}
+
+	// Add log config separately, so we can flatten it
+	err = gcli.ParseToV3(&config.Log, &cmd.Flags, sflags.EnvPrefix("RCS_"))
+	if err != nil {
+		log.Fatalf("err: %v", err)
+	}
+
+	return cmd
+}

cmd/remote-console/config.go

@@ -0,0 +1,101 @@
+// Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/OpenCHAMI/remote-console/internal/conman"
+	"github.com/OpenCHAMI/remote-console/internal/creds"
+	"github.com/OpenCHAMI/remote-console/internal/logs"
+)
+
+type OAuth2Config struct {
+	ClientID     string   `desc:"OAuth2 client ID for SMD authentication"`
+	ClientSecret string   `desc:"OAuth2 client secret for SMD authentication"`
+	TokenURL     string   `desc:"OAuth2 token endpoint URL for SMD authentication"`
+	Scopes       []string `desc:"OAuth2 scopes for SMD authentication"`
+}
+
+type remoteConsoleConfig struct {
+	Log                  logs.LogConfig `flag:"-"`
+	Conman               conman.ConmanConfig
+	Creds                creds.CredsConfig
+	HttpListen           string `desc:"HTTP listen address"`
+	NewNodeLookup        int    `desc:"Interval in seconds to look for new nodes"`
+	CredsMonitorInterval int    `desc:"Interval in seconds to monitor credential updates"`
+	SmdURL               string `desc:"URL for the SMD service"`
+	JwksURL              string `desc:"JWKS URL for fetching public keys for JWT validation (optional)"`
+	JwksFetchInterval    int    `desc:"Interval in seconds to retry fetching JWKS on failure"`
+	Oauth2               OAuth2Config
+}
+
+func DefaultConfig() remoteConsoleConfig {
+	return remoteConsoleConfig{
+		Log:                  logs.DefaultLogConfig(),
+		Conman:               conman.DefaultConmanConfig(),
+		Creds:                creds.DefaultCredsConfig(),
+		HttpListen:           "0.0.0.0:26776",
+		NewNodeLookup:        120,
+		CredsMonitorInterval: 30,
+		SmdURL:               "http://cray-smd/",
+		JwksURL:              "",
+		JwksFetchInterval:    5,
+		// Note: Oauth2 vs OAuth2 so the sflags generate the correct flag name
+		Oauth2: OAuth2Config{},
+	}
+}
+
+func validateCredsConfig(config *remoteConsoleConfig) error {
+	credConfig := config.Creds
+
+	if credConfig.SecureStorageAdapter != "" {
+		_, err := creds.NewStorageAdapter(string(credConfig.SecureStorageAdapter))
+		if err != nil {
+			return fmt.Errorf("invalid secure storage adapter: %s, valid values are (vault or local)", credConfig.SecureStorageAdapter)
+		}
+
+		if credConfig.SecureStorageAdapter == creds.StorageAdapterLocal {
+			if credConfig.LocalStoreFilePath == "" {
+				return fmt.Errorf("a local storage path must be set when using the local secure storage adapter")
+			}
+
+			if credConfig.LocalStoreKey == "" {
+				return fmt.Errorf("a local storage key must be set when using the local secure storage adapter")
+			}
+		}
+	}
+
+	return nil
+}
+
+func validateConfig(config *remoteConsoleConfig) error {
+	if err := validateCredsConfig(config); err != nil {
+		return err
+	}
+
+	// Validate OAuth2 configuration - either all or nothing
+	oauth2 := config.Oauth2
+
+	oauth2Provided := []bool{
+		oauth2.ClientID != "",
+		oauth2.ClientSecret != "",
+		oauth2.TokenURL != "",
+		len(oauth2.Scopes) > 0,
+	}
+
+	// All
+	allProvided := !slices.Contains(oauth2Provided, false)
+
+	// Nothing
+	noneProvided := !slices.Contains(oauth2Provided, true)
+
+	if !allProvided && !noneProvided {
+		return fmt.Errorf("incomplete OAuth2 configuration: all fields (oauth2-client-id, oauth2-client-secret, oauth2-token-url and oauth2-scopes) must be provided")
+	}
+
+	return nil
+}