cfn-vpn 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15da75354bf027cc2140fab12465e6cb9ff6090cd26eb11495ba63546a476eb0
-  data.tar.gz: b6058447275663117acc7b473960cb28bc524886e5d9771f944b6e835dc8b04c
+  metadata.gz: bb42ae1b12eb544e6d2d54276bb387efb5383c2037502a2ec155fd41ad522221
+  data.tar.gz: c3e774c1baf08c3ca0cdca6dc7b11014191f69eb183b63fddd6bbb56be522362
 SHA512:
-  metadata.gz: e61cef4dfc247340ebc639871d053dac6319ce8d658afb5551f3fe1901b533860a43b44ac036e2721478db013e81e3c4aa182adb1bf87cc96c10206b9670b2f9
-  data.tar.gz: 75c182953a0538329d57d669c73e5d7943bea388072b0ce0a010ac2dd4ba86f484978fe51164ef6a43e36a3f0809a0999c0493bac792c530783ef4cadc69667f
+  metadata.gz: b7c73bf1fcd82cb53a571f3bf60223b8eff89183a7afca82beead5b1ceb422370165b3a39c08c90ccf823a64bca8560babbda4210079a4a7a3c2122f0edf2a79
+  data.tar.gz: 5e944fa67a1fee92a5a42bb2f6ae5117a9907443cca284dde9a49e25899fd719adc5e5e96e3a45095090e16e0f615b72348ddac24798a3d4636019c849f15d13

data/.github/workflows/release-gem.yml

@@ -13,19 +13,22 @@ jobs:
     - name: Check out the repo
       uses: actions/checkout@v2
     
-    - name: Set up Ruby 2.6
+    - name: Set up Ruby 2.7
       uses: actions/setup-ruby@v1
       with:
-        ruby-version: 2.6.x
-
-    - name: Publish Gem to Github Packages Respository
+        ruby-version: 2.7.x
+    
+    - name: rspec
+      run: |
+        gem install rspec
+        rspec
+    
+    - name: build gem
       run: |
-        mkdir -p $HOME/.gem
-        touch $HOME/.gem/credentials
-        chmod 0600 $HOME/.gem/credentials
-        printf -- "---\n:github: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
         gem build cfn-vpn.gemspec
-        gem push --KEY github --host https://rubygems.pkg.github.com/${OWNER} *.gem
-      env:
-        GEM_HOST_API_KEY: "Bearer ${{secrets.GITHUB_TOKEN}}"
-        OWNER: ${{ github.repository_owner }}
+    
+    - name: Publish gem
+      uses: dawidd6/action-publish-gem@v1
+      with:
+        api_key: ${{secrets.RUBYGEMS_API_KEY}}
+        github_token: ${{secrets.GITHUB_TOKEN}}

data/cfn-vpn.gemspec

@@ -17,8 +17,6 @@ Gem::Specification.new do |spec|
   # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
   # to allow pushing to a single host or delete this section to allow pushing to any host.
   if spec.respond_to?(:metadata)
-    spec.metadata["allowed_push_host"] = 'https://rubygems.org'
-
     spec.metadata["homepage_uri"] = spec.homepage
     spec.metadata["source_code_uri"] = "https://github.com/base2services/aws-client-vpn"
   else

data/docs/getting-started.md

@@ -60,6 +60,17 @@ The following command and required option will launch a new federated based Clie
 cfn-vpn init [name] --server-cn [server certificate name] --subnet-ids [list of subets to associate with the vpn] --saml-arn [identity providor arn]
 ```
 
+The default authorization rule for the associated subets allows all. You can optionally change this by using the `--default-groups` flag to set groups on the default authorization rule. 
+
+```sh
+cfn-vpn init [name] --server-cn [server certificate name] --subnet-ids [list of subets to associate with the vpn] --saml-arn [identity providor arn] --default-groups [list of group ids]
+```
+
+## Subnet Associations and Authorisation
+
+AWS ClientVPN requires one or more subnets to be associated with the vpn. These subnets setup the default routes and by default cfn-vpn creates a allow all auth for the default routes.
+When using a federated ClientVPN you can modify the default auth to only allow specific groups by setting the groups in the `--default-groups` flag. This can also be modified later using the `modify` command.
+
 ## Additional Initialising Options
 
 ```
@@ -72,6 +83,7 @@ Options:
       [--easyrsa-local], [--no-easyrsa-local]  # run the easyrsa executable from your local rather than from docker
       [--bucket=BUCKET]                        # s3 bucket
       --subnet-ids=one two three               # subnet id to associate your vpn with
+      [--default-groups=one two three]         # groups to allow through the subnet associations when using federated auth
       [--cidr=CIDR]                            # cidr from which to assign client IP addresses
                                                # Default: 10.250.0.0/16
       [--dns-servers=one two three]            # DNS Servers to push to clients.

data/docs/routes.md

@@ -2,6 +2,8 @@
 
 Management of the VPN routes can be altered using the `routes` command or by using the `modify` command along with the yaml config file.
 
+**Note:** The default route via subnet association cannot be modified through this command. Use the `modify` command to alter the subnet associations.
+
 ## Routes Command
 
 ```

data/lib/cfnvpn/actions/init.rb

@@ -23,7 +23,7 @@ module CfnVpn::Actions
     class_option :bucket, desc: 's3 bucket'
 
     class_option :subnet_ids, required: true, type: :array, desc: 'subnet id to associate your vpn with'
-    class_option :default_groups, type: :array, desc: 'groups to allow through the subnet associations when using federated auth'
+    class_option :default_groups, default: [], type: :array, desc: 'groups to allow through the subnet associations when using federated auth'
     class_option :cidr, default: '10.250.0.0/16', desc: 'cidr from which to assign client IP addresses'
     class_option :dns_servers, default: [], type: :array, desc: 'DNS Servers to push to clients.'
     

data/lib/cfnvpn/version.rb

@@ -1,4 +1,4 @@
 module CfnVpn
-  VERSION = "1.1.0".freeze
+  VERSION = "1.1.1".freeze
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-vpn
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-02-03 00:00:00.000000000 Z
+date: 2021-02-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -262,7 +262,6 @@ homepage: https://github.com/base2services/aws-client-vpn
 licenses:
 - MIT
 metadata:
-  allowed_push_host: https://rubygems.org
   homepage_uri: https://github.com/base2services/aws-client-vpn
   source_code_uri: https://github.com/base2services/aws-client-vpn
 post_install_message: