Migrate to metal apiserver token file

.github/workflows/docker.yaml

@@ -28,12 +28,11 @@ jobs:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKER_REGISTRY_USER }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
-        if: ${{ github.event_name != 'pull_request' }}
 
       - name: Set up Go 1.26
         uses: actions/setup-go@v6
         with:
-          go-version: '1.26.x'
+          go-version: "1.26.x"
 
       - name: Lint
         uses: golangci/golangci-lint-action@v9
@@ -51,6 +50,6 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           sbom: true
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.tag }}

README.md

@@ -16,6 +16,13 @@ If the machine uuid is a valid machine, it will then use the provided private ke
 
 `metal-console` figures out in which partition the machine is located and then opens a tls socket connection to `metal-bmc` running on the management server in this partition. `metal-bmc` checks if the tls client certificate matches. If this is the case, it looks up the machine ipmi details from `metal-api` and starts a ipmi sol session to the machine.
 
+## Configuration
+
+The `metal-console` can be configured through environment variables. 
+Every configuration needs to be prefixed with `METAL_CONSOLE_`.
+
+All configuration options can be found in the implementation [internal/console/spec.go](./internal/console/spec.go).
+
 ## TODO
 
 - If a second console access starts to same machine, kill existing one

go.mod

@@ -5,7 +5,7 @@ go 1.26
 require (
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/kelseyhightower/envconfig v1.4.0
-	github.com/metal-stack/api v0.0.62
+	github.com/metal-stack/api v0.2.5
 	github.com/metal-stack/metal-lib v0.25.0
 	github.com/metal-stack/v v1.0.3
 	github.com/stretchr/testify v1.11.1
@@ -14,13 +14,13 @@ require (
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect
-	connectrpc.com/connect v1.19.2 // indirect
+	connectrpc.com/connect v1.20.0 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.19.0 // indirect
 	github.com/klauspost/connect-compress/v2 v2.1.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/minio/minlz v1.1.1 // indirect

go.sum

@@ -1,7 +1,7 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM=
-connectrpc.com/connect v1.19.2 h1:McQ83FGdzL+t60peksi0gXC7MQ/iLKgLduAnThbM0mo=
-connectrpc.com/connect v1.19.2/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
+connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
+connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -17,16 +17,16 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/connect-compress/v2 v2.1.1 h1:ycZNp4rWOZBodVE2Ls5AzK4aHkyK+GteEfzRZgKNs+c=
 github.com/klauspost/connect-compress/v2 v2.1.1/go.mod h1:9oilsPHJMzGKkjafSBk9J7iVo4mO+dw0G0KSdVpnlVE=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/metal-stack/api v0.0.62 h1:yXpRk/xRFB/L1e5MR1TKpL6B+azAYpd2QhnEAnZ12a4=
-github.com/metal-stack/api v0.0.62/go.mod h1:n8bd+Oi65Xf+3TUFwxyF79jt+1Aryt+M7quoqnyhxxY=
+github.com/metal-stack/api v0.2.5 h1:4w6nllK8GGCbQGp1//jgWTJF5Jm1W5F1MLQy/JSoRVM=
+github.com/metal-stack/api v0.2.5/go.mod h1:DEo89zN3hNMVbUGgotrWqFVMI3ECnX3WmFA0g4LCaB0=
 github.com/metal-stack/metal-lib v0.25.0 h1:ETGPFf0/GgAshCDtrWzm6tPlv3abRZjFnE+GHd1C/oY=
 github.com/metal-stack/metal-lib v0.25.0/go.mod h1:FWviUPM7oH1CnmCwkyLjWpd3yuzf6NnR97Xf45P2/Fk=
 github.com/metal-stack/v v1.0.3 h1:Sh2oBlnxrCUD+mVpzfC8HiqL045YWkxs0gpTvkjppqs=

internal/console/spec.go

@@ -1,13 +1,16 @@
 package console
 
+import "time"
+
 // Specification configures the application via environment.
 type Specification struct {
-	BindAddress            string `default:"localhost"`
-	MetalAPIServerURL      string `default:"http://localhost:8080" envconfig:"metal_apiserver_url"`
-	Port                   int    `default:"2222"`
-	Token                  string `default:"" envconfig:"token"`
-	PublicKey              string `default:"" split_words:"true"`
-	BmcReverseProxyAddress string `default:"" split_words:"true"`
+	BindAddress             string        `default:"localhost"`
+	MetalAPIServerURL       string        `default:"http://localhost:8080" envconfig:"metal_apiserver_url"`
+	Port                    int           `default:"2222"`
+	TokenFile               string        `default:"" envconfig:"token_file"`
+	TokenFileRereadDuration time.Duration `default:"1h" envconfig:"token_file_reread_duration"`
+	PublicKey               string        `default:"" split_words:"true"`
+	BmcReverseProxyAddress  string        `default:"" split_words:"true"`
 }
 
 func (s *Specification) DevMode() bool {

main.go

@@ -27,9 +27,9 @@ func main() {
 	}
 
 	client, err := apiclient.New(&apiclient.DialConfig{
-		BaseURL: spec.MetalAPIServerURL,
-		Token:   spec.Token,
-		// TODO enable token refresh
+		BaseURL:                 spec.MetalAPIServerURL,
+		TokenFile:               spec.TokenFile,
+		TokenFileRereadDuration: spec.TokenFileRereadDuration,
 	})
 	if err != nil {
 		log.Error("failed to create metal client", "error", err)