feature: the router keeps its metrics in PostgreSQL, serves them for an OpenTelemetry Collector and pushes them over OTLP.

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -6,8 +6,10 @@ password OpenVPN checks, and a client certificate of the router CA with the user
 common name, which OpenVPN and IKEv2 accept. A Manager-only account is an account,
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
-neither the first nor the last name is given, and can sign in to the web service. Users exist
-whether or not a P2S system is enabled.
+neither the first nor the last name is given, and can sign in to the web service. A service
+account is a Manager-only account with the scope SERVICE_SCOPE in vpnRouterScope, which
+vpn-router-setup adds and keeps for the metrics service, as metrics.service_account names it; it
+cannot sign in to the web service. Users exist whether or not a P2S system is enabled.
 
 A group is a groupOfNames in ou=groups with a name, which follows the rules of user names, an
 optional description and at least one member; a group cannot be empty, so the last member
@@ -62,7 +64,9 @@ EMAIL_MAX = 254
 #: The keys of the person attributes and their LDAP attributes.
 PERSON = (('first_name', 'givenName'), ('last_name', 'sn'), ('email', 'mail'))
 #: The attributes read for a user.
-ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken']
+ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken', 'vpnRouterScope']
+#: The vpnRouterScope of a service account.
+SERVICE_SCOPE = 'service'
 #: The object classes of a VPN user and of a Manager-only account.
 VPN_USER_CLASSES = [b'inetOrgPerson']
 MANAGER_ONLY_CLASSES = [b'account', b'simpleSecurityObject', b'vpnRouterAccount']
@@ -183,6 +187,11 @@ def manager_only(attributes):
     return b'account' in (value.lower() for value in attributes.get('objectClass', []))
 
 
+def service(attributes):
+    """Whether the entry is a service account."""
+    return SERVICE_SCOPE.encode() in (value.lower() for value in attributes.get('vpnRouterScope', []))
+
+
 def summary(attributes):
     """A user as the answers show it; a person attribute the entry does not have is None."""
     name = attributes['uid'][0].decode()
@@ -190,6 +199,7 @@ def summary(attributes):
     user = {
         'name': name,
         'manager_only': manager_only(attributes),
+        'service': service(attributes),
         'enabled': lock != LOCKED,
         'locked': lock not in (None, LOCKED) and locked_since(lock) > time.time() - vpnrouter_ldap.LOCKOUT_SECONDS,
         'certificate': certificate(name)[0].is_file(),
@@ -213,12 +223,15 @@ def list_users(connection):
     return {'users': sorted((summary(attributes) for _, attributes in found), key=lambda user: user['name'])}
 
 
-def add(connection, name, password, values):
+def add(connection, name, password, values, service=False):
     """Add a user: a VPN user with its certificate when values gives all three person attributes, a Manager-only account
-    with at most the e-mail address when it gives neither name."""
+    with at most the e-mail address when it gives neither name, and, with service, which only vpn-router-setup uses, a
+    service account, with at most the e-mail address too."""
     check_name(name)
     details = person(values, required=False)
     vpn_user = 'givenName' in details or 'sn' in details
+    if service and vpn_user:
+        raise Failure('a service account has no first or last name', 2)
     if vpn_user and len(details) != len(PERSON):
         raise Failure('give first_name, last_name and email for a VPN user, or at most email for a Manager-only account', 2)
     check_password(password)
@@ -229,6 +242,8 @@ def add(connection, name, password, values):
     else:
         # simpleSecurityObject requires a userPassword; passwd_s sets the real one at once.
         record = {'objectClass': MANAGER_ONLY_CLASSES, 'uid': [name.encode()], 'userPassword': [b'{CRYPT}!']}
+        if service:
+            record['vpnRouterScope'] = [SERVICE_SCOPE.encode()]
     record.update({attribute: [value.encode()] for attribute, value in details.items()})
     try:
         connection.add_s(dn_of(name), ldap.modlist.addModlist(record))