lyra
2064153cd3
Tests / test (pull_request) Successful in 1m10s
Brings preauth from 18/34 to 30/34 conformance (auth-gateway profile). The
remaining four checks all depend on files this branch cannot change (see below).
PHP toolchain (§1)
- require.php >=8.4 -> ^8.5, and pin config.platform to 8.5.0. The old
constraint also permitted PHP 9, which is not a promise we can keep.
composer.lock regenerated with --lock: content-hash + platform-overrides
only, zero dependency version movement.
- friendsofphp/php-cs-fixer * -> ^3.95. A wildcard meant CI was not
reproducible.
PHPStan (§2.2)
- vendor the shared phpstan.neon.dist (level 6) + a generated baseline.
187 errors are captured rather than fixed; the baseline should only shrink
from here.
- add phpstan/phpstan:^2.1 to require-dev.
Code style (§8.2)
- vendor the shared .php-cs-fixer.dist.php (@Symfony + @Symfony:risky +
declare_strict_types) and apply it: 59 of 67 files reformatted.
- Verified this is a formatting change, not a behaviour change: all 313 tests
pass after the reformat, all in_array() calls already passed strict=true,
and the remaining edits are @Symfony:risky idiom (yoda conditions, \count(),
self:: over the class name).
Repository layout (§4.4)
- docs/{Caddyfile,compose.yaml,example.env} -> docs/examples/, with
example.env becoming the conventional .env.example. This is the layout
GUIDING-LIGHT already cites preauth as doing correctly — it just needed
renaming.
- update the four readme.md references and a stale compose.yaml comment.
- docs/v1.1-plan.md references are left alone deliberately: it is a historical
plan recording what was done at the time, not live documentation.
Licence and security policy (§7)
- add LICENSE (uniform MIT, matching composer.json).
- add SECURITY.md describing the actual threat model: per-request
allow/intercept, no caching of the login flow, app-set security headers,
TOTP, and the fact that REMOTE_USER is trusted input.
Mobile accessibility (§3.3a)
- templates/base.html.twig: drop maximum-scale=1 and add viewport-fit=cover.
preauth was the one app already past the font-size precondition (controls
render at 21.6px = 0.9em x 24px), so removing the lock is safe here and
restores pinch-zoom for Android users.
Conformance tooling (§8.2)
- vendor .ci/conformance.sh and .ci/css-control-size.py so the check runs
from a checkout rather than fetching from the LAN-only private/ci.
- .editorconfig synced from the version that keeps the Caddyfile tab rule.
Not included (blocked by the .gitea/workflows pre-receive hook):
- ci-composer-audit, ci-composer-validate, ci-reusable-workflows.
Workflow files may only change via a trusted ref, so the caller files are
staged but not committed.
Also not included: dockerfile-nonroot (§6.4). Adding USER to an image with
VOLUME [/config, /data] changes volume ownership and needs an actual container
build/run to verify, so it goes in its own change.
78 lines
2.5 KiB
Caddyfile
78 lines
2.5 KiB
Caddyfile
# preauth example Caddyfile
|
|
|
|
# --- anti-caching guard for the login flow ---
|
|
# The login page, failed logins, redirects, and rate-limit pages must never
|
|
# be stored or replayed by a browser or intermediate cache. If they are,
|
|
# an aggressive cache (notably older Safari) can resurrect a stale pre-auth
|
|
# response — appearing to log a user back out after a refresh. preauth
|
|
# sends these headers itself; mirroring them here with `header_down` keeps
|
|
# the guarantee at the edge. Import this snippet inside every `forward_auth`
|
|
# block:
|
|
#
|
|
# forward_auth preauth { ...; import preauth_no_store }
|
|
#
|
|
# Note: 2xx auth responses are consumed by Caddy's forward_auth check and
|
|
# never reach the browser, and the protected service's own responses are
|
|
# not affected — so the cache headers of your services are left alone.
|
|
(preauth_no_store) {
|
|
header_down Cache-Control "no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0"
|
|
header_down Pragma "no-cache"
|
|
header_down Expires "0"
|
|
header_down Surrogate-Control "no-store"
|
|
header_down Vary "*"
|
|
}
|
|
|
|
# example of securing full service
|
|
# TODO replace domain and service name and port
|
|
service.example.com {
|
|
forward_auth preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
import preauth_no_store
|
|
}
|
|
reverse_proxy service-container:80
|
|
}
|
|
|
|
# you can choose to only restrict select paths
|
|
# or any other Caddy match criteria, if desired
|
|
# IE: https://protected.example.com/secure/
|
|
protected.example.com {
|
|
# note any request that does not start with "/secure/" is NOT protected
|
|
forward_auth /secure/* preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
import preauth_no_store
|
|
}
|
|
reverse_proxy protected-service:9000
|
|
}
|
|
|
|
# optionally, if you want to use a subdomain for central preauth
|
|
# set SUBDOMAIN_REDIRECT to true
|
|
# and AUTH_SUBDOMAIN to match the subdomain you use here
|
|
auth.example.com {
|
|
reverse_proxy preauth
|
|
}
|
|
|
|
# --- public rate-limited access (v1.1) ---
|
|
# Configure PUBLIC_PATHS env var to specify which paths are public.
|
|
# Example: PUBLIC_PATHS=/public/**
|
|
# Unauthenticated visitors to public paths are rate-limited separately
|
|
# from login attempts. Authenticated users bypass the public rate limiter.
|
|
#
|
|
# This example protects all of Gitea except /public/** which is
|
|
# publicly accessible but rate-limited (e.g., 100 req/min, 500 req/hr).
|
|
git.example.com {
|
|
forward_auth preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
import preauth_no_store
|
|
}
|
|
reverse_proxy gitea:3000
|
|
}
|
|
# In preauth's .env:
|
|
# PUBLIC_PATHS=/public/**
|
|
# PUBLIC_BURST_COUNT=100
|
|
# PUBLIC_BURST_TIME=60
|
|
# PUBLIC_UPPER_COUNT=500
|
|
# PUBLIC_UPPER_TIME=3600
|