lyra
5563999525
Sync GitHub / sync (push) Successful in 8s
Add PublicAccessListener (priority 84) that allows rate-limited unauthenticated access to configured public paths. Authenticated users bypass this listener entirely via AcceptListener/AllowListener. New components: - PublicPathMatcher service with wildcard path matching (* and **) and optional host-prefix scoping - PublicAccessListener applying per-IP rate limiting to public paths - Separate public_limiter compound rate limiter (burst + sustained) - publicRateLimitCache pool (APCu in prod, array in tests) New env vars: - PUBLIC_PATHS (comma-separated path patterns, empty = disabled) - PUBLIC_BURST_COUNT/PUBLIC_BURST_TIME (default 100/60s) - PUBLIC_UPPER_COUNT/PUBLIC_UPPER_TIME (default 500/3600s) Tests: 52 new tests (29 unit for PublicPathMatcher, 12 unit for PublicAccessListener, 11 functional for PublicAccessFlowTest). Total: 293 tests, 605 assertions, all passing. PHP CS Fixer: 0 of 63 files need fixing. Documentation: README, CHANGELOG, ROADMAP, Caddyfile, example.env all updated with public access configuration and examples.
51 lines
1.4 KiB
Caddyfile
51 lines
1.4 KiB
Caddyfile
# example of securing full service
|
|
# TODO replace domain and service name and port
|
|
service.example.com {
|
|
forward_auth preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
}
|
|
reverse_proxy service-container:80
|
|
}
|
|
|
|
# you can choose to only restrict select paths
|
|
# or any other Caddy match criteria, if desired
|
|
# IE: https://protected.example.com/secure/
|
|
protected.example.com {
|
|
# note any request that does not start with "/secure/" is NOT protected
|
|
forward_auth /secure/* preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
}
|
|
reverse_proxy protected-service:9000
|
|
}
|
|
|
|
# optionally, if you want to use a subdomain for central preauth
|
|
# set SUBDOMAIN_REDIRECT to true
|
|
# and AUTH_SUBDOMAIN to match the subdomain you use here
|
|
auth.example.com {
|
|
reverse_proxy preauth
|
|
}
|
|
|
|
# --- public rate-limited access (v1.1) ---
|
|
# Configure PUBLIC_PATHS env var to specify which paths are public.
|
|
# Example: PUBLIC_PATHS=/public/**
|
|
# Unauthenticated visitors to public paths are rate-limited separately
|
|
# from login attempts. Authenticated users bypass the public rate limiter.
|
|
#
|
|
# This example protects all of Gitea except /public/** which is
|
|
# publicly accessible but rate-limited (e.g., 100 req/min, 500 req/hr).
|
|
git.example.com {
|
|
forward_auth preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
}
|
|
reverse_proxy gitea:3000
|
|
}
|
|
# In preauth's .env:
|
|
# PUBLIC_PATHS=/public/**
|
|
# PUBLIC_BURST_COUNT=100
|
|
# PUBLIC_BURST_TIME=60
|
|
# PUBLIC_UPPER_COUNT=500
|
|
# PUBLIC_UPPER_TIME=3600
|