automatic API access for default admin (#357)

deploy/helm/README.md

@@ -28,7 +28,7 @@ The [Values](#values) section lists the parameters that can be configured during
 ## Values
 
 | Key                              | Type       | Default                        | Description                                                                                                                                                                                                                                                     |
-|-----|------|---------|-------------|
+|----------------------------------|------------|--------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | nameOverride                     | string     | `""`                           | Partially override resource names (adds suffix)                                                                                                                                                                                                                 |
 | fullnameOverride                 | string     | `""`                           | Fully override resource names                                                                                                                                                                                                                                   |
 | extraDeploy                      | list       | `[]`                           | Array of extra objects to deploy with the release                                                                                                                                                                                                               |

docs/documentation/configuration/examples.md

@@ -6,6 +6,7 @@ Below are some sample YAML configurations demonstrating how to override some def
 core:
   admin_user: test@example.com
   admin_password: password
+  admin_api_token: super-s3cr3t-api-token-or-a-UUID
   import_existing: false
   create_default_peer: true
   self_provisioning_allowed: true

docs/documentation/configuration/overview.md

@@ -111,6 +111,10 @@ More advanced options are found in the subsequent `Advanced` section.
 - **Default:** `wgportal`
 - **Description:** The administrator password. The default password of `wgportal` should be changed immediately.
 
+### `admin_api_token`
+- **Default:** *(empty)*
+- **Description:** An API token for the admin user. If a token is provided, the REST API can be accessed using this token. If empty, the API is initially disabled for the admin user.
+
 ### `editable_keys`
 - **Default:** `true`
 - **Description:** Allow editing of WireGuard key-pairs directly in the UI.

internal/app/app.go

@@ -127,7 +127,7 @@ func (a *App) createDefaultUser(ctx context.Context) error {
 	}
 
 	now := time.Now()
-	admin, err := a.CreateUser(ctx, &domain.User{
+	defaultAdmin := &domain.User{
 		BaseModel: domain.BaseModel{
 			CreatedBy: domain.CtxSystemAdminId,
 			UpdatedBy: domain.CtxSystemAdminId,
@@ -150,7 +150,16 @@ func (a *App) createDefaultUser(ctx context.Context) error {
 		Locked:          nil,
 		LockedReason:    "",
 		LinkedPeerCount: 0,
-	})
+	}
+	if a.Config.Core.AdminApiToken != "" {
+		if len(a.Config.Core.AdminApiToken) < 18 {
+			logrus.Warnf("[SECURITY WARNING] admin API token is too short, should be at least 18 characters long")
+		}
+		defaultAdmin.ApiToken = a.Config.Core.AdminApiToken
+		defaultAdmin.ApiTokenCreated = &now
+	}
+
+	admin, err := a.CreateUser(ctx, defaultAdmin)
 	if err != nil {
 		return err
 	}

internal/config/config.go

@@ -16,6 +16,7 @@ type Config struct {
 		// AdminUser defines the default administrator account that will be created
 		AdminUser     string `yaml:"admin_user"`
 		AdminPassword string `yaml:"admin_password"`
+		AdminApiToken string `yaml:"admin_api_token"` // if set, the API access is enabled automatically
 
 		EditableKeys                bool `yaml:"editable_keys"`
 		CreateDefaultPeer           bool `yaml:"create_default_peer"`
@@ -94,6 +95,7 @@ func defaultConfig() *Config {
 
 	cfg.Core.AdminUser = "admin@wgportal.local"
 	cfg.Core.AdminPassword = "wgportal"
+	cfg.Core.AdminApiToken = "" // by default, the API access is disabled
 	cfg.Core.ImportExisting = true
 	cfg.Core.RestoreState = true
 	cfg.Core.CreateDefaultPeer = false