mirror of
https://github.com/nextcloud/all-in-one.git
synced 2026-09-21 10:40:21 +00:00
Simon L.
4aea53cb2d
The `/api/auth/login` and `/api/auth/getlogin` endpoints are already blocked for the nextcloud container. However containers that reach the mastercontainer via the host use the gateway ip of the `nextcloud-aio` network as source address, so requests from them were not caught by the existing matcher. The gateway ip is now read in start.sh and exported as DOCKER_NETWORK_GATEWAY so that it can be used via `remote_ip` in both Caddyfiles. Note that this needs a second matcher block instead of an additional line in the existing one because matchers of different types inside one named matcher are AND'ed together, which would never match. Also `remote_host` only resolves host names, hence the built-in `remote_ip` matcher is used for the ip. If the `nextcloud-aio` network does not exist yet - it only gets created by the php code once the containers get started for the first time - the value falls back to localhost, which is a no-op for the matcher, and the actual gateway ip gets applied on the next restart of the mastercontainer. Signed-off-by: Simon L. <szaimen@e.mail.de>
54 lines
1.3 KiB
Caddyfile
54 lines
1.3 KiB
Caddyfile
{
|
|
admin off
|
|
|
|
# auto_https will be handled manually in acme.Caddyfile
|
|
auto_https disable_redirects
|
|
|
|
storage file_system {
|
|
root /mnt/docker-aio-config/caddy-internal/
|
|
}
|
|
|
|
log {
|
|
level ERROR
|
|
# We need to exclude the remote-host plugin from logging as it would spam the logs
|
|
# See https://github.com/nextcloud/all-in-one/pull/7006#issuecomment-4003238239
|
|
exclude http.matchers.remote_host
|
|
}
|
|
|
|
servers {
|
|
# Only h1 is allowed as we prevent `ERR_NETWORK_CHANGED` from happening
|
|
protocols h1
|
|
}
|
|
|
|
skip_install_trust
|
|
}
|
|
|
|
https://:8080 {
|
|
import headers.Caddyfile
|
|
|
|
@denied-host {
|
|
path /api/auth/login /api/auth/getlogin
|
|
remote_host nextcloud-aio-nextcloud
|
|
}
|
|
abort @denied-host
|
|
|
|
# The gateway ip of the nextcloud-aio network is used as source address by containers
|
|
# that reach the mastercontainer via the host, so it needs to be blocked as well.
|
|
# The variable gets set in start.sh and falls back to localhost if the network
|
|
# does not exist yet. In that case it gets applied on the next container restart.
|
|
@denied-gateway {
|
|
path /api/auth/login /api/auth/getlogin
|
|
remote_ip {$DOCKER_NETWORK_GATEWAY}
|
|
}
|
|
abort @denied-gateway
|
|
|
|
root * /var/www/docker-aio/php/public
|
|
php_fastcgi unix//run/php.sock
|
|
file_server
|
|
|
|
tls {
|
|
on_demand
|
|
issuer internal
|
|
}
|
|
}
|