Skip to content

Commit e94c512

Browse files
authored
Proxy protocol (#408)
* bugs: postfix, enable proxy protocol for internal requests This binds postscreen on port 20025 with proxy protocol support. It will allow for us to send proxy protocol headers from haproxy so that the remote address is correctly considered. * add proxy protocol support to loadbalancers
1 parent 27a2335 commit e94c512

File tree

8 files changed

+164
-8
lines changed

8 files changed

+164
-8
lines changed

Vagrantfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ SERVERS = [
1111
"docs",
1212
"downloads",
1313
"hg",
14-
{:name => "loadbalancer", :ports => [20000, 20001, 20002, 20003, 20004, 20005, 20010]},
14+
{:name => "loadbalancer", :ports => [20000, 20001, 20002, 20003, 20004, 20005, 20010, 20011]},
1515
"mail",
1616
"moin",
1717
"planet",

pillar/base/firewall/bugs.sls

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,7 @@ firewall:
99
port: 25
1010
frontend-bugs:
1111
port: 9000:9002
12-
source: *psf_internal_network
12+
source: *psf_internal_network
13+
postscreen:
14+
port: 20025
15+
source: *psf_internal_network

pillar/base/firewall/loadbalancer.sls

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ firewall:
88
http_0:
99
port: 20000
1010

11-
http_1:
12-
port: 20001
13-
1411
http_2:
1512
port: 20002
1613

@@ -29,6 +26,12 @@ firewall:
2926
http_map:
3027
port: 20010
3128

29+
http_proxy:
30+
port: 20001
31+
32+
http_proxy_map:
33+
port: 20011
34+
3235
"hg.python.org:ssh":
3336
port: 20100
3437

pillar/base/haproxy.sls

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,8 @@ haproxy:
171171
roundup-{{ service }}:
172172
bind: :{{ port }} {% if ssl %} ssl crt /etc/ssl/private/bugs.python.org.pem {% endif %}
173173
service: roundup-{{ service }}
174+
accept_proxy: True
175+
send_proxy: True
174176
extra:
175177
- timeout client 30m
176178
- timeout server 30m

salt/bugs/config/postfix/main.cf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,6 @@ virtual_alias_domains = {% for tracker, config in pillar["bugs"]["trackers"].ite
5050
virtual_alias_maps = hash:/etc/postfix/virtual
5151

5252
smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/reject_recipients
53+
54+
postscreen_upstream_proxy_protocol = haproxy
55+
postscreen_upstream_proxy_timeout = 5s

salt/bugs/config/postfix/master.cf

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
#
2+
# Postfix master process configuration file. For details on the format
3+
# of the file, see the master(5) manual page (command: "man 5 master" or
4+
# on-line: http://www.postfix.org/master.5.html).
5+
#
6+
# Do not forget to execute "postfix reload" after editing this file.
7+
#
8+
# ==========================================================================
9+
# service type private unpriv chroot wakeup maxproc command + args
10+
# (yes) (yes) (no) (never) (100)
11+
# ==========================================================================
12+
smtp inet n - y - - smtpd
13+
20025 inet n - y - 1 postscreen
14+
#smtp inet n - y - 1 postscreen
15+
smtpd pass - - y - - smtpd
16+
#dnsblog unix - - y - 0 dnsblog
17+
#tlsproxy unix - - y - 0 tlsproxy
18+
# Choose one: enable submission for loopback clients only, or for any client.
19+
#127.0.0.1:submission inet n - y - - smtpd
20+
#submission inet n - y - - smtpd
21+
# -o syslog_name=postfix/submission
22+
# -o smtpd_tls_security_level=encrypt
23+
# -o smtpd_sasl_auth_enable=yes
24+
# -o smtpd_tls_auth_only=yes
25+
# -o smtpd_reject_unlisted_recipient=no
26+
# -o smtpd_client_restrictions=$mua_client_restrictions
27+
# -o smtpd_helo_restrictions=$mua_helo_restrictions
28+
# -o smtpd_sender_restrictions=$mua_sender_restrictions
29+
# -o smtpd_recipient_restrictions=
30+
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
31+
# -o milter_macro_daemon_name=ORIGINATING
32+
# Choose one: enable smtps for loopback clients only, or for any client.
33+
#127.0.0.1:smtps inet n - y - - smtpd
34+
#smtps inet n - y - - smtpd
35+
# -o syslog_name=postfix/smtps
36+
# -o smtpd_tls_wrappermode=yes
37+
# -o smtpd_sasl_auth_enable=yes
38+
# -o smtpd_reject_unlisted_recipient=no
39+
# -o smtpd_client_restrictions=$mua_client_restrictions
40+
# -o smtpd_helo_restrictions=$mua_helo_restrictions
41+
# -o smtpd_sender_restrictions=$mua_sender_restrictions
42+
# -o smtpd_recipient_restrictions=
43+
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
44+
# -o milter_macro_daemon_name=ORIGINATING
45+
#628 inet n - y - - qmqpd
46+
pickup unix n - y 60 1 pickup
47+
cleanup unix n - y - 0 cleanup
48+
qmgr unix n - n 300 1 qmgr
49+
#qmgr unix n - n 300 1 oqmgr
50+
tlsmgr unix - - y 1000? 1 tlsmgr
51+
rewrite unix - - y - - trivial-rewrite
52+
bounce unix - - y - 0 bounce
53+
defer unix - - y - 0 bounce
54+
trace unix - - y - 0 bounce
55+
verify unix - - y - 1 verify
56+
flush unix n - y 1000? 0 flush
57+
proxymap unix - - n - - proxymap
58+
proxywrite unix - - n - 1 proxymap
59+
smtp unix - - y - - smtp
60+
relay unix - - y - - smtp
61+
-o syslog_name=postfix/$service_name
62+
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
63+
showq unix n - y - - showq
64+
error unix - - y - - error
65+
retry unix - - y - - error
66+
discard unix - - y - - discard
67+
local unix - n n - - local
68+
virtual unix - n n - - virtual
69+
lmtp unix - - y - - lmtp
70+
anvil unix - - y - 1 anvil
71+
scache unix - - y - 1 scache
72+
postlog unix-dgram n - n - 1 postlogd
73+
#
74+
# ====================================================================
75+
# Interfaces to non-Postfix software. Be sure to examine the manual
76+
# pages of the non-Postfix software to find out what options it wants.
77+
#
78+
# Many of the following services use the Postfix pipe(8) delivery
79+
# agent. See the pipe(8) man page for information about ${recipient}
80+
# and other message envelope options.
81+
# ====================================================================
82+
#
83+
# maildrop. See the Postfix MAILDROP_README file for details.
84+
# Also specify in main.cf: maildrop_destination_recipient_limit=1
85+
#
86+
maildrop unix - n n - - pipe
87+
flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
88+
#
89+
# ====================================================================
90+
#
91+
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
92+
#
93+
# Specify in cyrus.conf:
94+
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
95+
#
96+
# Specify in main.cf one or more of the following:
97+
# mailbox_transport = lmtp:inet:localhost
98+
# virtual_transport = lmtp:inet:localhost
99+
#
100+
# ====================================================================
101+
#
102+
# Cyrus 2.1.5 (Amos Gouaux)
103+
# Also specify in main.cf: cyrus_destination_recipient_limit=1
104+
#
105+
#cyrus unix - n n - - pipe
106+
# flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
107+
#
108+
# ====================================================================
109+
# Old example of delivery via Cyrus.
110+
#
111+
#old-cyrus unix - n n - - pipe
112+
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
113+
#
114+
# ====================================================================
115+
#
116+
# See the Postfix UUCP_README file for configuration details.
117+
#
118+
uucp unix - n n - - pipe
119+
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
120+
#
121+
# Other external delivery methods.
122+
#
123+
ifmail unix - n n - - pipe
124+
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
125+
bsmtp unix - n n - - pipe
126+
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
127+
scalemail-backend unix - n n - 2 pipe
128+
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
129+
mailman unix - n n - - pipe
130+
flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}

salt/bugs/init.sls

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,17 @@ tracker-nginx-extras:
165165
- pkg: roundup-deps
166166
- cmd: lego_bootstrap
167167
168+
/etc/postfix/master.cf:
169+
file.managed:
170+
- source: salt://bugs/config/postfix/master.cf
171+
- user: root
172+
- group: root
173+
- mode: "0644"
174+
- template: jinja
175+
- require:
176+
- pkg: roundup-deps
177+
- cmd: lego_bootstrap
178+
168179
/etc/postfix/virtual:
169180
file.managed:
170181
- source: salt://bugs/config/postfix/virtual
@@ -203,15 +214,17 @@ postfix:
203214
- reload: True
204215
- require:
205216
- file: /etc/postfix/main.cf
217+
- file: /etc/postfix/master.cf
206218
- file: /etc/postfix/virtual
207219
- file: /etc/postfix/reject_recipients
208220
- watch_any:
209221
- file: /etc/postfix/main.cf
222+
- file: /etc/postfix/master.cf
210223
- file: /etc/postfix/virtual
211224
- file: /etc/postfix/reject_recipients
212225
213226
{# We can extend this for smtps/submission later #}
214-
{% for (port, service) in [(25, "smtp")] %}
227+
{% for (port, service) in [(20025, "smtp")] %}
215228
/etc/consul.d/roundup-{{ service }}.json:
216229
file.managed:
217230
- source: salt://consul/etc/service.jinja

salt/haproxy/config/haproxy.cfg.jinja

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ listen tls:
8989
bind 0.0.0.0:443 ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
9090
bind :::443 ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
9191
bind :20010 ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
92+
bind :20011 accept-proxy ssl alpn h2,http/1.1 crt star.python.org.pem crt star.pypa.io.pem crt star.pyfound.org.pem crt speed.pypy.org.pem crt www.pycon.org.pem crt jython.org.pem crt salt-public.psf.io.pem crt planetpython.org.pem crt bugs.python.org.pem
9293

9394
mode http
9495

@@ -106,6 +107,7 @@ listen tls:
106107

107108
frontend main
108109
bind :20000
110+
bind :20001 accept-proxy
109111
bind 0.0.0.0:80
110112
bind :::80
111113
bind 127.0.0.1:19001 # This is our TLS socket.
@@ -236,7 +238,7 @@ backend {{ service }}
236238

237239
{% for name, config in haproxy.listens.items() -%}
238240
listen {{ name }}
239-
bind {{ config.bind }}
241+
bind {{ config.bind }}{% if config.get("accept_proxy", False) %} accept-proxy{% endif %}
240242

241243
mode tcp
242244
option tcplog
@@ -247,7 +249,7 @@ listen {{ name }}
247249
{% endfor %}
248250

249251
{{ "{{" }}range service "{{ config.service }}@{{ pillar.dc }}"}}
250-
{% raw %}server {{.Node}} {{.Address}}:{{.Port}} check{{end}}{% endraw %}
252+
{% raw %}server {{.Node}} {{.Address}}:{{.Port}} check{{end}}{% endraw %}{% if config.get("send_proxy", False) %} send-proxy{% endif %}
251253

252254
{% endfor %}
253255

0 commit comments

Comments
 (0)