micbar
4e7ebd4f8c
chi's ClientIPFrom* header middlewares trust the header from anyone who can
reach us. Pick the middleware per request instead: headers are only read
when the peer is a trusted proxy, everyone else gets their network address.
- PROXY_TRUSTED_PROXIES, defaults to loopback and private ranges
- PROXY_CLIENT_IP_HEADER, defaults to X-Forwarded-For, e.g. CF-Connecting-IP
- drop the strategy setting and xff_trusted_hops
- pass the client address to the services in X-Forwarded-For instead of
X-Client-Ip, reva reads it e.g. for OCM
- same check in collaboration, traefik routes to it directly
- OC_TRUSTED_PROXIES and OC_CLIENT_IP_HEADER set both services
- the other services only drop RealIP, none of them reads the address
Taken from #3864 and https://github.com/opencloud-eu/opencloud/pull/3464#issuecomment-6494799883
# Conflicts:
# services/proxy/README.md
Server Backend
Tip
For general information about OpenCloud and how to install please visit OpenCloud on Github and OpenCloud GmbH.
This is the main repository of the OpenCloud server. It contains the golang codebase for the backend services.
Getting Involved
The OpenCloud server is released under Apache 2.0. The project is thrilled to receive contributions in all forms. Start hacking now, there are many ways to get involved such as:
- Reporting issues or bugs
- Requesting features
- Writing documentation
- Writing code or extend our tests
- Reviewing code
- Helping others in the community
Every contribution is meaningful and appreciated! Please refer to our Contribution Guidelines if you want to get started.
Build OpenCloud
To build the backend, follow these instructions:
Generate the assets needed by e.g., the web UI and the builtin IDP
make generate
Then compile the opencloud binary
make -C opencloud build
That will produce the binary opencloud/bin/opencloud. It can be started as a local test instance right away with a two step command:
opencloud/bin/opencloud init && opencloud/bin/opencloud server
This creates a server configuration (by default in $HOME/.opencloud) and starts the server.
For more setup- and installation options consult the Development Documentation.
Technology
Important information for contributors about the technology in use.
Authentication
The OpenCloud backend authenticates users via OpenID Connect using either an external IdP like Keycloak or the embedded LibreGraph Connect identity provider.
Database
The OpenCloud backend does not use a database. It stores all data in the filesystem. By default, the root directory of the backend is $HOME/.opencloud/.
Security
If you find a security-related issue, please contact security@opencloud.eu immediately.