Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
ARG CHEN_BASE_IMAGE=jumpserver/chen-base:20261104_063401
ARG CHEN_BASE_IMAGE=jumpserver/chen-base:20261104_090447
FROM ${CHEN_BASE_IMAGE} AS stage-build
ARG TARGETARCH
ARG VERSION=dev
Expand Down
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ GO ?= go
VERSION ?= dev
PLATFORM ?= linux/$(shell $(GO) env GOARCH)
APT_MIRROR ?= https://deb.debian.org
BASE_VERSION ?= 20261104_063401
BASE_VERSION ?= 20261104_090447
CHEN_BASE_IMAGE ?= jumpserver/chen-base:$(BASE_VERSION)
CHEN_IMAGE ?= jumpserver/chen:$(VERSION)-ce
CHEN_EE_IMAGE ?= jumpserver/chen:$(VERSION)-ee
Expand Down
98 changes: 40 additions & 58 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,87 +1,69 @@
# Chen

Chen is JumpServer's database workspace. The backend is Go; the Luna frontend
uses Monaco. Queries, catalog browsing, completion and cancellation use HTTP,
with one SSE stream per session for execution and control updates. Wisp connects
the managed service to JumpServer authentication, permissions, command approval,
session control, audit and heartbeats.
Chen is JumpServer's database workspace. It provides SQL queries, schema browsing,
result editing and data import/export through the Luna frontend. The Go backend
integrates with JumpServer through Wisp for authentication, permissions and audit.

The workspace includes queries, inspection, draft-based grid editing, CSV import
and table/index DDL previews. Writes use the same JumpServer policy and audit
path. See [write workflows and limits](docs/writes.md).
## Build

## Run locally

Go 1.26.3 and a C compiler are required: PostgreSQL parsing uses `libpg_query`
through CGO. Node.js/pnpm are only needed when building Luna.
Use the Go version specified in [go.mod](go.mod) and a C compiler. PostgreSQL SQL
parsing requires CGO. Build the frontend separately in the Luna repository.

```sh
make build
make test vet
```

For managed mode, start Core and supply its bootstrap credential through your
private environment or a private Wisp configuration file. Never commit those
values. Existing Wisp registration is retained in `data/keys`.
To build and run the container image:

```sh
CORE_HOST=http://127.0.0.1:8080 ./start.sh managed
make image-ee VERSION=dev PLATFORM=linux/arm64
make run
```

`start.sh` builds Go and pinned Wisp v0.2.15. Managed mode listens on
`127.0.0.1:8082`; the HTTP API is under `/chen/api/v1/`. The startup script keeps
Wisp alive while Chen closes sessions and drains its audit outbox. Neither Java
nor Maven is part of the build or startup path.
Linux amd64 and arm64 builds include all supported database drivers, including
the pure Go Db2 driver.

## Run without Core
## Run with JumpServer

```sh
# In the adjacent Luna checkout:
pnpm install --frozen-lockfile
pnpm generate:chen
Start Core and configure the bootstrap credential through the environment or a
private Wisp configuration file, then run:

# In Chen:
mkdir -p data
cp conf/standalone_backends_example.yaml data/standalone_backends.yml
chmod 600 data/standalone_backends.yml
# Edit this private file with the database connection details.
make single BACKENDS=data/standalone_backends.yml WEB_DIR=../luna/.output/public
```sh
CORE_HOST=http://127.0.0.1:8080 ./start.sh managed
```

Open `http://127.0.0.1:8083/luna/chen/?selector=local-pg`, using a selector from
the configuration. Single mode does not contact Core or Wisp. Keep its listener
behind your intended access boundary; a selector is a routing name, not a secret.
See [single mode](docs/single.md).
Managed mode listens on `127.0.0.1:8082`. Keep registration keys in `data/keys`
and audit state in `data/go` persistent; container data is under `/opt/chen/data`.
The API is served at `/chen/api/v1/` with SSE streaming. Use `chen-go healthcheck`
for liveness and `chen-go readycheck` for readiness.

## Build and run images
## Run without JumpServer

The formal build is `Dockerfile-base` → `Dockerfile` → `Dockerfile-ee`.
The default image contains Go and Wisp and retains the existing JumpServer
`chen:8082` endpoint and `/opt/chen/data` volume.
Build Luna's standalone frontend using its declared Node.js and pnpm versions:

```sh
make image-ee VERSION=dev PLATFORM=linux/arm64
make run
# Or start in the background after providing Core configuration:
make dev-up
pnpm --dir ../luna install --frozen-lockfile
pnpm --dir ../luna generate:chen
mkdir -p data
cp conf/standalone_backends_example.yaml data/standalone_backends.yml
chmod 600 data/standalone_backends.yml
```

The standard image supports Linux amd64 and arm64, including Db2. Db2 uses
`github.com/go-db2/go-db2`, a pure Go DRDA driver pinned in `go.mod`. No IBM CLI,
Db2-specific build tag, native runtime or separate image variant is required.
Chen still needs CGO for PostgreSQL SQL parsing.
Edit the configuration with your database connection details, then start Chen:

See [build, release and integration acceptance](docs/build.md) and
[database compatibility](docs/database-compatibility.md) for limits and evidence.
```sh
make single BACKENDS=data/standalone_backends.yml WEB_DIR=../luna/.output/public
```

## Development and integration
Open `http://127.0.0.1:8083/luna/chen/?selector=local-pg`, using a selector from
the [configuration](conf/standalone_backends_example.yaml). Single mode has no
Core authentication; keep access limited to the intended users. The selector
identifies a connection and is not a password.

- [Go backend architecture and APIs](docs/go-v1.md)
- [JumpServer integration, approvals and validation boundaries](internal/jumpserver/README.md)
- [SQL analysis and completion](internal/sqlservice/README.md)
- [Build and integration acceptance](docs/build.md)
## Release packages

Luna is a separate repository. Build its corresponding revision into docker-web;
rebuilding Chen does not update the browser's static assets. The normal managed
route, single route, web application and Electron integration must all select
the same backend generation before consuming a one-use connection token.
`make package` extracts the built image into `build/chen-<version>-linux-<arch>.tar.gz`.
The archive includes binaries, configuration examples, licenses and this README.
On a matching Linux system, extract it and run `./start.sh managed`, or
`./start.sh single --backends /path/to/backends.yml --web-dir /path/to/luna`.
4 changes: 0 additions & 4 deletions cmd/chen-go/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -96,10 +96,6 @@ func parseOptions(args []string) (options, error) {

// Only the selected mode initializes its provider. Single mode never constructs
// a Wisp client or starts the managed audit/control background processes.
func configuredProvider(o options) (jumpserver.Provider, func(), error) {
return configuredProviderContext(context.Background(), o)
}

func configuredProviderContext(startupCtx context.Context, o options) (jumpserver.Provider, func(), error) {
if o.single {
config, err := standalone.Load(o.backends, standalone.LoadOptions{AllowInsecurePermissions: o.insecureBackends})
Expand Down
2 changes: 1 addition & 1 deletion cmd/chen-go/main_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ func TestSingleProviderDoesNotInitializeWisp(t *testing.T) {
if err := os.WriteFile(path, []byte(config), 0600); err != nil {
t.Fatal(err)
}
p, stop, err := configuredProvider(options{single: true, backends: path, state: dir, wisp: "intentionally-invalid-address", ca: "/does-not-exist.pem"})
p, stop, err := configuredProviderContext(context.Background(), options{single: true, backends: path, state: dir, wisp: "intentionally-invalid-address", ca: "/does-not-exist.pem"})
if err != nil {
t.Fatalf("single mode depended on Wisp configuration: %v", err)
}
Expand Down
2 changes: 1 addition & 1 deletion docker-compose.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ services:
context: .
dockerfile: Dockerfile
args:
CHEN_BASE_IMAGE: ${CHEN_BASE_IMAGE:-jumpserver/chen-base:20261104_063401}
CHEN_BASE_IMAGE: ${CHEN_BASE_IMAGE:-jumpserver/chen-base:20261104_090447}
VERSION: ${VERSION:-dev}
environment:
CORE_HOST: ${CORE_HOST:-http://host.docker.internal:8080}
Expand Down
Loading
Loading