feat: enable CIRA connection in console

addresses Add Support for CIRA
Fixes #665

Author: rsdmike

.gitignore

@@ -4,7 +4,10 @@
 # Config
 .env
 .DS_store
-*.pem
+#certs
+**/*.pem
+**/*.crt
+**/*.key
 **/*.yml
 **/*.yaml
 !config/config.yml
@@ -18,7 +21,7 @@ bin/
 *.db
 *.db-journal
 __debug_bin*
-
+*.app
 
 # Test binary, built with `go test -c`
 *.test

Dockerfile

@@ -15,10 +15,11 @@ FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66
 COPY --from=modules /go/pkg /go/pkg
 COPY . /app
 WORKDIR /app
+RUN go mod tidy
 RUN mkdir -p /app/tmp/
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
   go build -o /bin/app ./cmd/app
-
+RUN mkdir -p /.config/device-management-toolkit
 # Step 3: Final
 FROM scratch
 ENV TMPDIR=/tmp
@@ -27,4 +28,5 @@ COPY --from=builder /app/config /config
 COPY --from=builder /app/internal/app/migrations /migrations
 COPY --from=builder /bin/app /app
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /.config/device-management-toolkit /.config/device-management-toolkit
 CMD ["/app"]

cmd/app/main.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/device-management-toolkit/console/config"
 	"github.com/device-management-toolkit/console/internal/app"
+	"github.com/device-management-toolkit/console/internal/certificates"
 	"github.com/device-management-toolkit/console/internal/controller/openapi"
 	"github.com/device-management-toolkit/console/internal/usecase"
 	"github.com/device-management-toolkit/console/pkg/logger"
@@ -42,6 +43,16 @@ func main() {
 		log.Fatalf("App init error: %s", err)
 	}
 
+	root, privateKey, err := certificates.CheckAndLoadOrGenerateRootCertificate(true, cfg.CommonName, "US", "device-management-toolkit", true)
+	if err != nil {
+		log.Fatalf("Error loading or generating root certificate: %s", err)
+	}
+
+	_, _, err = certificates.CheckAndLoadOrGenerateWebServerCertificate(certificates.CertAndKeyType{Cert: root, Key: privateKey}, false, cfg.CommonName, "US", "device-management-toolkit", true)
+	if err != nil {
+		log.Fatalf("Error loading or generating web server certificate: %s", err)
+	}
+
 	handleEncryptionKey(cfg)
 
 	if os.Getenv("GIN_MODE") != "debug" {

config/config.go

@@ -3,6 +3,7 @@ package config
 import (
 	"errors"
 	"flag"
+	"net"
 	"os"
 	"path/filepath"
 	"time"
@@ -29,6 +30,7 @@ type (
 		Name                 string `env-required:"true" yaml:"name" env:"APP_NAME"`
 		Repo                 string `env-required:"true" yaml:"repo" env:"APP_REPO"`
 		Version              string `env-required:"true"`
+		CommonName           string `env-required:"true" yaml:"common_name" env:"APP_COMMON_NAME"`
 		EncryptionKey        string `yaml:"encryption_key" env:"APP_ENCRYPTION_KEY"`
 		AllowInsecureCiphers bool   `yaml:"allow_insecure_ciphers" env:"APP_ALLOW_INSECURE_CIPHERS"`
 	}
@@ -93,13 +95,36 @@ type (
 	}
 )
 
+// getPreferredIPAddress detects the most likely candidate IP address for this machine.
+// It prefers non-loopback IPv4 addresses and excludes link-local addresses.
+func getPreferredIPAddress() string {
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return "localhost"
+	}
+
+	for _, addr := range addrs {
+		if ipNet, ok := addr.(*net.IPNet); ok && !ipNet.IP.IsLoopback() {
+			if ipNet.IP.To4() != nil {
+				// Exclude link-local addresses (169.254.x.x)
+				if !ipNet.IP.IsLinkLocalUnicast() {
+					return ipNet.IP.String()
+				}
+			}
+		}
+	}
+
+	return "localhost"
+}
+
 // defaultConfig constructs the in-memory default configuration.
 func defaultConfig() *Config {
 	return &Config{
 		App: App{
 			Name:                 "console",
 			Repo:                 "device-management-toolkit/console",
 			Version:              "DEVELOPMENT",
+			CommonName:           getPreferredIPAddress(),
 			EncryptionKey:        "",
 			AllowInsecureCiphers: false,
 		},

docker-compose.yml

@@ -1,17 +1,17 @@
 services:
-  postgres:
-    container_name: postgres
-    image: postgres
-    networks:
-      - openamtnetwork1
-    volumes:
-      - pg-data:/var/lib/postgresql
-    environment:
-      POSTGRES_USER: "postgresadmin"
-      POSTGRES_PASSWORD: "admin123"
-      POSTGRES_DB: "rpsdb"
-    ports:
-      - 5432:5432
+  # postgres:
+  #   container_name: postgres
+  #   image: postgres
+  #   networks:
+  #     - openamtnetwork1
+  #   volumes:
+  #     - pg-data:/var/lib/postgresql/data
+  #   environment:
+  #     POSTGRES_USER: "postgresadmin"
+  #     POSTGRES_PASSWORD: "admin123"
+  #     POSTGRES_DB: "rpsdb"
+  #   ports:
+  #     - 5432:5432
   app:
     build: .
     container_name: app
@@ -25,12 +25,13 @@ services:
       HTTP_HOST: ""
       HTTP_TLS_ENABLED: "false"
       GIN_MODE: "debug"
-      DB_URL: "postgres://postgresadmin:admin123@postgres:5432/rpsdb"
+      #DB_URL: "postgres://postgresadmin:admin123@postgres:5432/rpsdb"
       AUTH_DISABLED: true
     ports:
       - 8181:8181
-    depends_on:
-      - postgres
+      - 4433:4433
+    # depends_on:
+    #   - postgres
   # integration:
   #   build:
   #     context: .

go.mod

@@ -4,7 +4,7 @@ go 1.24.2
 
 toolchain go1.24.9
 
-// replace github.com/device-management-toolkit/go-wsman-messages/v2 => ../go-wsman-messages
+replace github.com/device-management-toolkit/go-wsman-messages/v2 => ../go-wsman-messages
 
 require (
 	github.com/Masterminds/squirrel v1.5.4

internal/app/app.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/device-management-toolkit/console/config"
 	consolehttp "github.com/device-management-toolkit/console/internal/controller/http"
+	"github.com/device-management-toolkit/console/internal/controller/tcp/cira"
 	wsv1 "github.com/device-management-toolkit/console/internal/controller/ws/v1"
 	"github.com/device-management-toolkit/console/internal/usecase"
 	"github.com/device-management-toolkit/console/pkg/db"
@@ -76,6 +77,16 @@ func Run(cfg *config.Config) {
 	}
 
 	wsv1.RegisterRoutes(handler, log, usecases.Devices, upgrader)
+
+	// Use the same certificates that were generated in main.go
+	ciraCertFile := fmt.Sprintf("config/%s_cert.pem", cfg.CommonName)
+	ciraKeyFile := fmt.Sprintf("config/%s_key.pem", cfg.CommonName)
+
+	ciraServer, err := cira.NewServer(ciraCertFile, ciraKeyFile, usecases.Devices)
+	if err != nil {
+		log.Fatal("CIRA Server failed: %v", err)
+	}
+
 	// Configure TLS based on config
 	tlsEnabled := cfg.TLS.Enabled
 	certFile := cfg.TLS.CertFile
@@ -97,11 +108,17 @@ func Run(cfg *config.Config) {
 		log.Info("app - Run - signal: " + s.String())
 	case err = <-httpServer.Notify():
 		log.Error(fmt.Errorf("app - Run - httpServer.Notify: %w", err))
+	case ciraErr := <-ciraServer.Notify():
+		log.Error(fmt.Errorf("app - Run - ciraServer.Notify: %w", ciraErr))
 	}
 
 	// Shutdown
 	err = httpServer.Shutdown()
 	if err != nil {
 		log.Error(fmt.Errorf("app - Run - httpServer.Shutdown: %w", err))
 	}
+	err = ciraServer.Shutdown()
+	if err != nil {
+		log.Error(fmt.Errorf("app - Run - ciraServer.Shutdown: %w", err))
+	}
 }