feat: saved SSH hosts per user, the way in sealed with AES-GCM under a server key kept beside the database

internal/server/db.go

@@ -11,7 +11,8 @@ import (
 
 // DB wraps the SQLite connection and all queries used by the server.
 type DB struct {
-	sql *sql.DB
+	sql  *sql.DB
+	path string // the file; the key of saved secrets sits beside it
 }
 
 // OpenDB opens (creating if needed) the SQLite database at path and runs
@@ -30,7 +31,7 @@ func OpenDB(path string) (*DB, error) {
 	if err := sdb.Ping(); err != nil {
 		return nil, err
 	}
-	db := &DB{sql: sdb}
+	db := &DB{sql: sdb, path: path}
 	if err := db.migrate(); err != nil {
 		return nil, err
 	}
@@ -122,6 +123,11 @@ CREATE TABLE IF NOT EXISTS forward_rules (
 		`ALTER TABLE admins ADD COLUMN pin_hash TEXT NOT NULL DEFAULT ''`,
 		`ALTER TABLE admins ADD COLUMN role TEXT NOT NULL DEFAULT 'admin'`,
 		`ALTER TABLE admins ADD COLUMN pw_locked INTEGER NOT NULL DEFAULT 0`,
+		`CREATE TABLE IF NOT EXISTS ssh_hosts (
+		    id INTEGER PRIMARY KEY AUTOINCREMENT,
+		    admin_id INTEGER NOT NULL REFERENCES admins(id) ON DELETE CASCADE,
+		    label TEXT NOT NULL, host TEXT NOT NULL, port INTEGER NOT NULL, user TEXT NOT NULL,
+		    auth TEXT NOT NULL, secret TEXT NOT NULL)`,
 		`CREATE TABLE IF NOT EXISTS admin_agents (
 		    admin_id INTEGER NOT NULL REFERENCES admins(id) ON DELETE CASCADE,
 		    agent_id TEXT NOT NULL,