mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-11-04 03:24:24 -05:00
micbar
4e7ebd4f8c
chi's ClientIPFrom* header middlewares trust the header from anyone who can
reach us. Pick the middleware per request instead: headers are only read
when the peer is a trusted proxy, everyone else gets their network address.
- PROXY_TRUSTED_PROXIES, defaults to loopback and private ranges
- PROXY_CLIENT_IP_HEADER, defaults to X-Forwarded-For, e.g. CF-Connecting-IP
- drop the strategy setting and xff_trusted_hops
- pass the client address to the services in X-Forwarded-For instead of
X-Client-Ip, reva reads it e.g. for OCM
- same check in collaboration, traefik routes to it directly
- OC_TRUSTED_PROXIES and OC_CLIENT_IP_HEADER set both services
- the other services only drop RealIP, none of them reads the address
Taken from #3864 and https://github.com/opencloud-eu/opencloud/pull/3464#issuecomment-6494799883
# Conflicts:
# services/proxy/README.md
62 lines
1.8 KiB
Go
62 lines
1.8 KiB
Go
package http
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/go-chi/chi/v5/middleware"
|
|
"github.com/opencloud-eu/opencloud/pkg/cors"
|
|
opencloudmiddleware "github.com/opencloud-eu/opencloud/pkg/middleware"
|
|
"github.com/opencloud-eu/opencloud/pkg/service/http"
|
|
"github.com/opencloud-eu/opencloud/pkg/version"
|
|
svc "github.com/opencloud-eu/opencloud/services/thumbnails/pkg/service/http/v0"
|
|
"go-micro.dev/v4"
|
|
)
|
|
|
|
// Server initializes the http service and server.
|
|
func Server(opts ...Option) (http.Service, error) {
|
|
options := newOptions(opts...)
|
|
|
|
service, err := http.NewService(
|
|
http.TLSConfig(options.Config.HTTP.TLS),
|
|
http.Logger(options.Logger),
|
|
http.Name(options.Config.Service.Name),
|
|
http.Version(version.GetString()),
|
|
http.Namespace(options.Config.HTTP.Namespace),
|
|
http.Address(options.Config.HTTP.Addr),
|
|
http.Context(options.Context),
|
|
http.TraceProvider(options.TraceProvider),
|
|
)
|
|
if err != nil {
|
|
options.Logger.Error().
|
|
Err(err).
|
|
Msg("Error initializing http service")
|
|
return http.Service{}, fmt.Errorf("could not initialize http service: %w", err)
|
|
}
|
|
|
|
handle := svc.NewService(
|
|
svc.Logger(options.Logger),
|
|
svc.Config(options.Config),
|
|
svc.Middleware(
|
|
middleware.RequestID,
|
|
opencloudmiddleware.Cors(
|
|
cors.Logger(options.Logger),
|
|
cors.AllowedOrigins(options.Config.HTTP.CORS.AllowedOrigins),
|
|
cors.AllowedMethods(options.Config.HTTP.CORS.AllowedMethods),
|
|
cors.AllowedHeaders(options.Config.HTTP.CORS.AllowedHeaders),
|
|
cors.AllowCredentials(options.Config.HTTP.CORS.AllowCredentials),
|
|
),
|
|
opencloudmiddleware.Version(
|
|
options.Config.Service.Name,
|
|
version.GetString(),
|
|
),
|
|
opencloudmiddleware.Logger(options.Logger),
|
|
),
|
|
)
|
|
|
|
if err := micro.RegisterHandler(service.Server(), handle); err != nil {
|
|
return http.Service{}, err
|
|
}
|
|
|
|
return service, nil
|
|
}
|