3993b7552f
All checks were successful
secrets-guard / encrypted (pull_request) Successful in 4s
PR build (required check) / changes (pull_request) Successful in 6s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 1s
Sync infra to hosts / sync-beta (push) Has been skipped
Sync infra to hosts / sync-prod (push) Has been skipped
Sync infra to hosts / sync-centralis (push) Has been skipped
Sync infra to hosts / sync-dev (push) Successful in 6s
secrets-guard / encrypted (push) Successful in 4s
shell-lint / shellcheck (push) Successful in 6s
Every OAuth redirect URI the backend builds is currently http://, whatever scheme the user actually arrived with. There are two Caddy hops in front of the app: the host Caddy terminates TLS and sets X-Forwarded-Proto: https, then proxies to 127.0.0.1:8137 over plain HTTP; the stack LB is the second hop. Caddy preserves an incoming X-Forwarded-* header only when the immediate peer is a trusted proxy, and trusted_proxies was never set here -- so the LB overwrote the header with the scheme of the connection it had just received, which is http. accounts/oauth.py:_redirect_uri builds the callback from x-forwarded-proto, and that URI must match what is registered in the provider's console. Measured on vps2, same request to each hop: direct to web, XFP=https -> https://thermograph.org/api/v2/... through the LB, XFP=https -> http://thermograph.org/api/v2/... through the PATCHED LB -> https://thermograph.org/api/v2/... through the PATCHED LB, no XFP-> http://thermograph.org/api/v2/... The last line is the point of using trusted_proxies rather than hardcoding `header_up X-Forwarded-Proto https`: the LB still reports the truth when nothing in front of it claims otherwise. private_ranges covers 127.0.0.1/8 and the Docker bridge ranges, which is where the host Caddy reaches this container from. The LB binds loopback only, precisely so it cannot be reached un-fronted, so the only party that can set these headers is the host Caddy -- trusting the local peer widens nothing. Applied to beta's LB too. Beta is where a provider change gets tested before it reaches thermograph.org, so it needs the same behaviour or the test is not a test.
45 lines
1.6 KiB
Text
45 lines
1.6 KiB
Text
# Beta's loopback LB bridge config — the beta counterpart of ./Caddyfile.
|
|
#
|
|
# Two differences from prod's, both load-bearing:
|
|
#
|
|
# 1. It proxies to beta-web / beta-frontend, not web / frontend. Beta's Swarm
|
|
# services carry that prefix so their short DNS names cannot collide with
|
|
# prod's on the shared overlay (see thermograph-beta-stack.yml).
|
|
# 2. deploy-stack.sh publishes this container on 127.0.0.1:8237 and :8180,
|
|
# not 8137/8180 — prod's LB already owns 8137/8080 on this host. The
|
|
# LISTEN ports below stay 8137/8080: those are inside the container, and
|
|
# the host mapping is what differs. Keeping the container ports identical
|
|
# to prod's means the two configs differ only in the upstream names.
|
|
#
|
|
# The host Caddy on vps2 terminates TLS for beta.thermograph.org and proxies to
|
|
# 127.0.0.1:8237 / :8180 — see deploy/Caddyfile.
|
|
|
|
{
|
|
auto_https off
|
|
admin off
|
|
|
|
# Same reason as ./Caddyfile — see the long note there. Without it this second
|
|
# Caddy hop overwrites the host Caddy's X-Forwarded-Proto: https with http,
|
|
# and every OAuth redirect URI the backend builds comes out non-HTTPS, which
|
|
# Google rejects outright for a web client.
|
|
#
|
|
# Beta needs it as much as prod does, and arguably first: beta is where an
|
|
# OAuth provider change gets tested before it reaches thermograph.org.
|
|
servers {
|
|
trusted_proxies static private_ranges
|
|
}
|
|
}
|
|
|
|
:8137 {
|
|
reverse_proxy beta-web:8137 {
|
|
# Fail fast to the client if the VIP has no healthy task; Swarm's own
|
|
# task healthchecks handle ejecting dead replicas from the VIP.
|
|
lb_try_duration 5s
|
|
}
|
|
}
|
|
|
|
:8080 {
|
|
reverse_proxy beta-frontend:8080 {
|
|
lb_try_duration 5s
|
|
}
|
|
}
|