Skip to content

Commit f173431

Browse files
lunnylunny
committed
refactor reverseproxy setting
1 parent 3f9e360 commit f173431

File tree

12 files changed

+104
-50
lines changed

12 files changed

+104
-50
lines changed

‎modules/setting/reverseproxy.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Copyright 2024 The Gitea Authors. All rights reserved.
2+
// SPDX-License-Identifier: MIT
3+
4+
package setting
5+
6+
var ReverseProxyAuth = struct {
7+
Enabled bool
8+
EnableReverseProxyAuthAPI bool
9+
EnableReverseProxyAutoRegister bool
10+
EnableReverseProxyEmail bool
11+
EnableReverseProxyFullName bool
12+
ReverseProxyAuthUser string
13+
ReverseProxyAuthEmail string
14+
ReverseProxyAuthFullName string
15+
ReverseProxyLimit int
16+
ReverseProxyTrustedProxies []string
17+
}{}
18+
19+
func loadReverseProxyAuthFrom(rootCfg ConfigProvider) error {
20+
serviceSec := rootCfg.Section("service")
21+
22+
ReverseProxyAuth.Enabled = serviceSec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION").MustBool()
23+
ReverseProxyAuth.EnableReverseProxyAuthAPI = serviceSec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION_API").MustBool()
24+
ReverseProxyAuth.EnableReverseProxyAutoRegister = serviceSec.Key("ENABLE_REVERSE_PROXY_AUTO_REGISTRATION").MustBool()
25+
ReverseProxyAuth.EnableReverseProxyEmail = serviceSec.Key("ENABLE_REVERSE_PROXY_EMAIL").MustBool()
26+
ReverseProxyAuth.EnableReverseProxyFullName = serviceSec.Key("ENABLE_REVERSE_PROXY_FULL_NAME").MustBool()
27+
28+
securitySec := rootCfg.Section("security")
29+
ReverseProxyAuth.ReverseProxyAuthUser = securitySec.Key("REVERSE_PROXY_AUTHENTICATION_USER").MustString("X-WEBAUTH-USER")
30+
ReverseProxyAuth.ReverseProxyAuthEmail = securitySec.Key("REVERSE_PROXY_AUTHENTICATION_EMAIL").MustString("X-WEBAUTH-EMAIL")
31+
ReverseProxyAuth.ReverseProxyAuthFullName = securitySec.Key("REVERSE_PROXY_AUTHENTICATION_FULL_NAME").MustString("X-WEBAUTH-FULLNAME")
32+
33+
ReverseProxyAuth.ReverseProxyLimit = securitySec.Key("REVERSE_PROXY_LIMIT").MustInt(1)
34+
ReverseProxyAuth.ReverseProxyTrustedProxies = securitySec.Key("REVERSE_PROXY_TRUSTED_PROXIES").Strings(",")
35+
if len(ReverseProxyAuth.ReverseProxyTrustedProxies) == 0 {
36+
ReverseProxyAuth.ReverseProxyTrustedProxies = []string{"127.0.0.0/8", "::1/128"}
37+
}
38+
39+
return nil
40+
}

‎modules/setting/security.go‎

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,12 @@ import (
1515

1616
var (
1717
// Security settings
18-
InstallLock bool
19-
SecretKey string
20-
InternalToken string // internal access token
21-
LogInRememberDays int
22-
CookieRememberName string
23-
ReverseProxyAuthUser string
24-
ReverseProxyAuthEmail string
25-
ReverseProxyAuthFullName string
26-
ReverseProxyLimit int
27-
ReverseProxyTrustedProxies []string
18+
InstallLock bool
19+
SecretKey string
20+
InternalToken string // internal access token
21+
LogInRememberDays int
22+
CookieRememberName string
23+
2824
MinPasswordLength int
2925
ImportLocalPaths bool
3026
DisableGitHooks bool
@@ -114,16 +110,6 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
114110

115111
CookieRememberName = sec.Key("COOKIE_REMEMBER_NAME").MustString("gitea_incredible")
116112

117-
ReverseProxyAuthUser = sec.Key("REVERSE_PROXY_AUTHENTICATION_USER").MustString("X-WEBAUTH-USER")
118-
ReverseProxyAuthEmail = sec.Key("REVERSE_PROXY_AUTHENTICATION_EMAIL").MustString("X-WEBAUTH-EMAIL")
119-
ReverseProxyAuthFullName = sec.Key("REVERSE_PROXY_AUTHENTICATION_FULL_NAME").MustString("X-WEBAUTH-FULLNAME")
120-
121-
ReverseProxyLimit = sec.Key("REVERSE_PROXY_LIMIT").MustInt(1)
122-
ReverseProxyTrustedProxies = sec.Key("REVERSE_PROXY_TRUSTED_PROXIES").Strings(",")
123-
if len(ReverseProxyTrustedProxies) == 0 {
124-
ReverseProxyTrustedProxies = []string{"127.0.0.0/8", "::1/128"}
125-
}
126-
127113
MinPasswordLength = sec.Key("MIN_PASSWORD_LENGTH").MustInt(8)
128114
ImportLocalPaths = sec.Key("IMPORT_LOCAL_PATHS").MustBool(false)
129115
DisableGitHooks = sec.Key("DISABLE_GIT_HOOKS").MustBool(true)

‎modules/setting/service.go‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,6 @@ var Service = struct {
4545
RequireSignInView bool
4646
EnableNotifyMail bool
4747
EnableBasicAuth bool
48-
EnableReverseProxyAuth bool
49-
EnableReverseProxyAuthAPI bool
50-
EnableReverseProxyAutoRegister bool
51-
EnableReverseProxyEmail bool
52-
EnableReverseProxyFullName bool
5348
EnableCaptcha bool
5449
RequireCaptchaForLogin bool
5550
RequireExternalRegistrationCaptcha bool
@@ -157,11 +152,7 @@ func loadServiceFrom(rootCfg ConfigProvider) {
157152
Service.ShowMilestonesDashboardPage = sec.Key("SHOW_MILESTONES_DASHBOARD_PAGE").MustBool(true)
158153
Service.RequireSignInView = sec.Key("REQUIRE_SIGNIN_VIEW").MustBool()
159154
Service.EnableBasicAuth = sec.Key("ENABLE_BASIC_AUTHENTICATION").MustBool(true)
160-
Service.EnableReverseProxyAuth = sec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION").MustBool()
161-
Service.EnableReverseProxyAuthAPI = sec.Key("ENABLE_REVERSE_PROXY_AUTHENTICATION_API").MustBool()
162-
Service.EnableReverseProxyAutoRegister = sec.Key("ENABLE_REVERSE_PROXY_AUTO_REGISTRATION").MustBool()
163-
Service.EnableReverseProxyEmail = sec.Key("ENABLE_REVERSE_PROXY_EMAIL").MustBool()
164-
Service.EnableReverseProxyFullName = sec.Key("ENABLE_REVERSE_PROXY_FULL_NAME").MustBool()
155+
165156
Service.EnableCaptcha = sec.Key("ENABLE_CAPTCHA").MustBool(false)
166157
Service.RequireCaptchaForLogin = sec.Key("REQUIRE_CAPTCHA_FOR_LOGIN").MustBool(false)
167158
Service.RequireExternalRegistrationCaptcha = sec.Key("REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA").MustBool(Service.EnableCaptcha)

‎modules/setting/setting.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ func LoadSettings() {
203203

204204
loadDBSetting(CfgProvider)
205205
loadServiceFrom(CfgProvider)
206+
loadReverseProxyAuthFrom(CfgProvider)
206207
loadOAuth2ClientFrom(CfgProvider)
207208
loadCacheFrom(CfgProvider)
208209
loadSessionFrom(CfgProvider)
@@ -223,6 +224,7 @@ func LoadSettings() {
223224
func LoadSettingsForInstall() {
224225
loadDBSetting(CfgProvider)
225226
loadServiceFrom(CfgProvider)
227+
loadReverseProxyAuthFrom(CfgProvider)
226228
loadMailerFrom(CfgProvider)
227229
}
228230

‎options/locale/locale_en-US.ini‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3194,7 +3194,16 @@ config.repo_root_path = Repository Root Path
31943194
config.lfs_root_path = LFS Root Path
31953195
config.log_file_root_path = Log Path
31963196
config.script_type = Script Type
3197-
config.reverse_auth_user = Reverse Authentication User
3197+
config.reverse_proxy_auth_config = Reverse Proxy Authentication Configuration
3198+
config.reverse_proxy_auth_user = Authentication User
3199+
config.reverse_proxy_auth_email = Authentication Email
3200+
config.reverse_proxy_auth_fullname = Authentication Fullname
3201+
config.reverse_proxy_auth_limit = Authentication Limit
3202+
config.reverse_proxy_auth_trusted_proxies = Authentication Trusted Proxies
3203+
config.reverse_proxy_auth_enable_api = Enable Authentication API
3204+
config.reverse_proxy_auth_enable_autoregister = Enable Authentication Auto Register
3205+
config.reverse_proxy_auth_enable_email = Enable Authentication Email
3206+
config.reverse_proxy_auth_enable_fullname = Enable Authentication Fullname
31983207
31993208
config.ssh_config = SSH Configuration
32003209
config.ssh_enabled = Enabled

‎routers/api/packages/api.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {
7575
}
7676

7777
func verifyAuth(r *web.Router, authMethods []auth.Method) {
78-
if setting.Service.EnableReverseProxyAuth {
78+
if setting.ReverseProxyAuth.Enabled {
7979
authMethods = append(authMethods, &auth.ReverseProxy{})
8080
}
8181
authGroup := auth.NewGroup(authMethods...)

‎routers/api/v1/api.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ func reqExploreSignIn() func(ctx *context.APIContext) {
331331

332332
func reqBasicOrRevProxyAuth() func(ctx *context.APIContext) {
333333
return func(ctx *context.APIContext) {
334-
if ctx.IsSigned && setting.Service.EnableReverseProxyAuthAPI && ctx.Data["AuthedMethod"].(string) == auth.ReverseProxyMethodName {
334+
if ctx.IsSigned && setting.ReverseProxyAuth.EnableReverseProxyAuthAPI && ctx.Data["AuthedMethod"].(string) == auth.ReverseProxyMethodName {
335335
return
336336
}
337337
if !ctx.IsBasicAuth {
@@ -700,7 +700,7 @@ func buildAuthGroup() *auth.Group {
700700
&auth.HTTPSign{},
701701
&auth.Basic{}, // FIXME: this should be removed once we don't allow basic auth in API
702702
)
703-
if setting.Service.EnableReverseProxyAuthAPI {
703+
if setting.ReverseProxyAuth.EnableReverseProxyAuthAPI {
704704
group.Add(&auth.ReverseProxy{})
705705
}
706706

‎routers/common/middleware.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,11 @@ func ProtocolMiddlewares() (handlers []any) {
6060
})
6161
})
6262

63-
if setting.ReverseProxyLimit > 0 {
63+
if setting.ReverseProxyAuth.ReverseProxyLimit > 0 {
6464
opt := proxy.NewForwardedHeadersOptions().
65-
WithForwardLimit(setting.ReverseProxyLimit).
65+
WithForwardLimit(setting.ReverseProxyAuth.ReverseProxyLimit).
6666
ClearTrustedProxies()
67-
for _, n := range setting.ReverseProxyTrustedProxies {
67+
for _, n := range setting.ReverseProxyAuth.ReverseProxyTrustedProxies {
6868
if !strings.Contains(n, "/") {
6969
opt.AddTrustedProxy(n)
7070
} else {

‎routers/web/admin/config.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -136,9 +136,8 @@ func Config(ctx *context.Context) {
136136
ctx.Data["CustomRootPath"] = setting.CustomPath
137137
ctx.Data["LogRootPath"] = setting.Log.RootPath
138138
ctx.Data["ScriptType"] = setting.ScriptType
139-
ctx.Data["ReverseProxyAuthUser"] = setting.ReverseProxyAuthUser
140-
ctx.Data["ReverseProxyAuthEmail"] = setting.ReverseProxyAuthEmail
141139

140+
ctx.Data["ReverseProxyAuth"] = setting.ReverseProxyAuth
142141
ctx.Data["SSH"] = setting.SSH
143142
ctx.Data["LFS"] = setting.LFS
144143

‎routers/web/web.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ func buildAuthGroup() *auth_service.Group {
102102
group.Add(&auth_service.OAuth2{}) // FIXME: this should be removed and only applied in download and oauth related routers
103103
group.Add(&auth_service.Basic{}) // FIXME: this should be removed and only applied in download and git/lfs routers
104104

105-
if setting.Service.EnableReverseProxyAuth {
105+
if setting.ReverseProxyAuth.Enabled {
106106
group.Add(&auth_service.ReverseProxy{}) // reverseproxy should before Session, otherwise the header will be ignored if user has login
107107
}
108108
group.Add(&auth_service.Session{})

0 commit comments

Comments
 (0)