0 Fork 0

mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-11-09 05:52:52 -05:00

Files

T

micbar 4e7ebd4f8c fix: only trust forwarding headers from trusted reverse proxies

chi's ClientIPFrom* header middlewares trust the header from anyone who can
  reach us. Pick the middleware per request instead: headers are only read
  when the peer is a trusted proxy, everyone else gets their network address.

  - PROXY_TRUSTED_PROXIES, defaults to loopback and private ranges
  - PROXY_CLIENT_IP_HEADER, defaults to X-Forwarded-For, e.g. CF-Connecting-IP
  - drop the strategy setting and xff_trusted_hops
  - pass the client address to the services in X-Forwarded-For instead of
    X-Client-Ip, reva reads it e.g. for OCM
  - same check in collaboration, traefik routes to it directly
  - OC_TRUSTED_PROXIES and OC_CLIENT_IP_HEADER set both services
  - the other services only drop RealIP, none of them reads the address

  Taken from #3864 and https://github.com/opencloud-eu/opencloud/pull/3464#issuecomment-6494799883

# Conflicts:
#	services/proxy/README.md

2026-10-30 15:15:22 +01:00

config

rename folder extensions -> services

2022-06-27 14:05:36 +02:00

pkg

fix: only trust forwarding headers from trusted reverse proxies

2026-10-30 15:15:22 +01:00

Makefile

Makefile: remove unneeded recursion.mk

2025-04-22 16:57:17 +02:00

README.md

Rebrand ocs

2025-01-17 08:41:26 +01:00

README.md

OCS Service

The ocs service (open collaboration services) serves one purpose: it has an endpoint for signing keys which the web frontend accesses when uploading data.

Signing-Keys Endpoint

The ocs service contains an endpoint /cloud/user/signing-key on which a user can GET a signing key. Note, this functionality might be deprecated or moved in the future.

Signing-Keys Store

To authenticate presigned URLs the proxy service needs to read the signing keys from a store that is populated by the ocs service. Possible stores that can be configured via OCS_PRESIGNEDURL_SIGNING_KEYS_STORE are:

nats-js-kv: Stores data using key-value-store feature of nats jetstream
redis-sentinel: Stores data in a configured Redis Sentinel cluster.
opencloudstoreservice: Stores data in the legacy OpenCloud store service. Requires setting OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES to eu.opencloud.api.store.

The memory store cannot be used as it does not share the memory from the ocs service signing key memory store, even in a single process.

Make sure to configure the same store in the proxy service.

Store specific notes:

When using redis-sentinel, the Redis master to use is configured via e.g. OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES in the form of <sentinel-host>:<sentinel-port>/<redis-master> like 10.10.0.200:26379/mymaster.
When using nats-js-kv it is recommended to set PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES to the same value as OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES. That way the proxy uses the same nats instance as the ocs service.
When using opencloudstoreservice the OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES must be set to the service name eu.opencloud.api.store. It does not support TTL and stores the presigning keys indefinitely. Also, the store service needs to be started.