arcodange-org/webapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allow both duckdns.org and .fr domains
All checks were successful
Docker Build / build-and-push-image (push) Successful in 2m13s
Details

Browse Source
This commit is contained in:
Gabriel Radureau
2025-12-18 08:27:49 +01:00
parent 1d3db54909
commit c1a0b1f134
3 changed files with 39 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
chart/templates/config.yaml
View File

@@ -4,7 +4,7 @@ metadata:
name: {{ include "webapp.name" . }}-config name: {{ include "webapp.name" . }}-config
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
data: data:
OAUTH_ALLOWED_HOST: webapp.arcodange.duckdns.org OAUTH_ALLOWED_HOSTS: webapp.arcodange.duckdns.org,webapp.arcodange.fr
OAUTH_DEVICE_CODE_ALLOWED_IPS: 86.238.234.54, # OAUTH_DEVICE_CODE_ALLOWED_IPS: 86.238.234.54,
DATABASE_URL: postgres://pgbouncer_auth:pgbouncer_auth@pgbouncer.tools/postgres?sslmode=disable DATABASE_URL: postgres://pgbouncer_auth:pgbouncer_auth@pgbouncer.tools/postgres?sslmode=disable
# DATABASE_URL: postgres://username:password@localhost/dbname?sslmode=disable # DATABASE_URL: postgres://username:password@localhost/dbname?sslmode=disable

25
chart/templates/localIngress.yaml Normal file
View File

@@ -0,0 +1,25 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
argocd.argoproj.io/tracking-id: webapp:networking.k8s.io/Ingress:webapp/webapp
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.middlewares: localIp@file
traefik.ingress.kubernetes.io/router.tls: 'true'
traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.duckdns.org
traefik.ingress.kubernetes.io/router.tls.domains.0.sans: webapp.arcodange.duckdns.org
name: webapp-local
namespace: webapp
spec:
rules:
- host: webapp.arcodange.duckdns.org
http:
paths:
- backend:
service:
name: webapp
port:
number: 8080
path: /
pathType: Prefix

19
main.go
View File

@@ -21,8 +21,11 @@ import (
var ( var (
db *sql.DB // Global database connection db *sql.DB // Global database connection
c = cache.New(5*time.Minute, 10*time.Minute) c = cache.New(5*time.Minute, 10*time.Minute)
oauthAllowedHost = os.Getenv("OAUTH_ALLOWED_HOST") // URL authorized for device code oauthAllowedHosts = strings.Split(os.Getenv("OAUTH_ALLOWED_HOSTS"), ",") // authorized HOSTS for device code
oauthDeviceCodeAllowedIPs = strings.Split(os.Getenv("OAUTH_DEVICE_CODE_ALLOWED_IPS"), ",") // IPS autorisées pour /retrieve oauthDeviceCodeAllowedIPs = strings.Split(os.Getenv("OAUTH_DEVICE_CODE_ALLOWED_IPS"), ",") // IPS autorisées pour /retrieve
_, localNetwork, _ = net.ParseCIDR("192.168.0.0/16")
_, localNetworkIPV6, _ = net.ParseCIDR("2a01:cb04:dff:cf00::/56")
_, k3sNetwork, _ = net.ParseCIDR("10.42.0.0/16")
) )
// dbConnection initializes the database connection. // dbConnection initializes the database connection.
@@ -103,7 +106,7 @@ func indexHandler(w http.ResponseWriter, r *http.Request) {
</body> </body>
</html> </html>
` `
fmt.Fprintf(w, tmpl) fmt.Fprint(w, tmpl)
} }
// selectHandler handles HTTP requests and executes a SQL query. // selectHandler handles HTTP requests and executes a SQL query.
@@ -151,7 +154,7 @@ func oauth2_callback(w http.ResponseWriter, r *http.Request) {
// Vérifier le référent (ou origine) // Vérifier le référent (ou origine)
hostHeader := strings.Trim(r.Header.Get("X-Forwarded-Host"), "[]") hostHeader := strings.Trim(r.Header.Get("X-Forwarded-Host"), "[]")
if oauthAllowedHost != "" && hostHeader != oauthAllowedHost { if len(oauthAllowedHosts) > 0 && !slices.Contains(oauthAllowedHosts, hostHeader) {
fmt.Fprintln(os.Stderr, "X-Forwarded-Host: "+hostHeader) fmt.Fprintln(os.Stderr, "X-Forwarded-Host: "+hostHeader)
fmt.Fprintln(os.Stderr, "received headers") fmt.Fprintln(os.Stderr, "received headers")
for key, value := range r.Header { for key, value := range r.Header {
@@ -283,11 +286,13 @@ func oauth2_callback(w http.ResponseWriter, r *http.Request) {
func retrieveHandler(w http.ResponseWriter, r *http.Request) { func retrieveHandler(w http.ResponseWriter, r *http.Request) {
// Récupérer l'IP de l'utilisateur // Récupérer l'IP de l'utilisateur
userIP, _, err := net.SplitHostPort(r.RemoteAddr) userIP, _, err := net.SplitHostPort(r.RemoteAddr)
userIPforwarded := r.Header.Get("X-Forwarded-For") userIPforwarded := net.ParseIP(r.Header.Get("X-Forwarded-For"))
if err != nil || if err != nil ||
!slices.Contains(oauthDeviceCodeAllowedIPs, userIP) && !slices.Contains(oauthDeviceCodeAllowedIPs, userIPforwarded.String()) &&
!slices.Contains(oauthDeviceCodeAllowedIPs, userIPforwarded) { !localNetwork.Contains(userIPforwarded) &&
fmt.Fprintln(os.Stderr, "denied userIP: "+userIP+" forwarded: "+userIPforwarded) !localNetworkIPV6.Contains(userIPforwarded) &&
!k3sNetwork.Contains(userIPforwarded) {
fmt.Fprintln(os.Stderr, "denied userIP: "+userIP+" forwarded: "+userIPforwarded.String())
fmt.Fprintf(os.Stderr, "alowed ips: %+v", oauthDeviceCodeAllowedIPs) fmt.Fprintf(os.Stderr, "alowed ips: %+v", oauthDeviceCodeAllowedIPs)
// Parcourir tous les headers // Parcourir tous les headers
for name, values := range r.Header { for name, values := range r.Header {