Add admin dashboard at / with bearer-token overview API

cmd/tunneld/main.go

@@ -18,6 +18,10 @@ import (
 	"gitea.tzgyn.dev/TZGyn/tunnel/internal/server"
 )
 
+// version is shown on the admin dashboard; override with
+// -ldflags "-X main.version=<v>".
+var version = "dev"
+
 func envOr(key, fallback string) string {
 	if value := os.Getenv(key); value != "" {
 		return value
@@ -44,6 +48,7 @@ func main() {
 	httpMode := flag.String("http-mode", envOr("HTTP_MODE", "serve"), `"serve" runs the whole app on plain HTTP, "redirect" 301s to the domain`)
 	dataPath := flag.String("data", envOr("TUNNELD_DATA", dataDefault), "tunnel store file (created 0600)")
 	caFile := flag.String("ca-file", envOr("LOCAL_CA_FILE", ""), "write the local CA certificate here for clients to trust")
+	adminToken := flag.String("admin-token", envOr("ADMIN_TOKEN", ""), "bearer token for the admin dashboard at / and /api/admin/overview; empty disables the admin API")
 	flag.Parse()
 
 	if *caFile == "" {
@@ -70,7 +75,19 @@ func main() {
 	}
 
 	hub := server.NewHub(store)
-	api := &server.API{Store: store, Hub: hub, Domain: *domain}
+	api := &server.API{
+		Store:      store,
+		Hub:        hub,
+		Domain:     *domain,
+		AdminToken: *adminToken,
+		StartedAt:  time.Now(),
+		Version:    version,
+	}
+	if *adminToken == "" {
+		log.Printf("admin dashboard: disabled (set ADMIN_TOKEN to enable it at /)")
+	} else {
+		log.Printf("admin dashboard: enabled at /")
+	}
 
 	// Public TLS listener: SNI routing, with API terminations handed to the
 	// shared HTTP server.