Skip to content

Commit 4b13a8e

Browse files
ArtisKruminsArtisKrumins
authored
Merge pull request #511 from wunderio/release/2026-01-06
Release 2026-01-06
2 parents d784f03 + ac4f4c8 commit 4b13a8e

File tree

5 files changed

+59
-47
lines changed

5 files changed

+59
-47
lines changed

‎drupal/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: drupal
3-
version: 1.28.1
3+
version: 1.28.2
44
dependencies:
55
- name: mariadb
66
version: 7.5.x

‎drupal/templates/_helpers.tpl‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -538,6 +538,7 @@ if [[ "$(drush status --fields=bootstrap)" = *'Successful'* ]] ; then
538538
--exclude="{{ $folderPattern }}" \
539539
{{ end -}}
540540
--delete --delete-excluded \
541+
--ignore-missing-args \
541542
/app/reference-data/{{ $index }}
542543
{{ end -}}
543544
{{- end }}
@@ -619,11 +620,11 @@ if [ "${REF_DATA_COPY_FILES:-}" == "true" ]; then
619620
if [ -d "/app/reference-data/{{ $index }}" ] && [ -n "$(ls /app/reference-data/{{ $index }})" ]; then
620621
echo "Importing {{ $index }} files"
621622
# skip subfolders
622-
rsync -r --delete --temp-dir=/tmp/ --filter "- */" "/app/reference-data/{{ $index }}/" "{{ $mount.mountPath }}" &
623+
rsync -r --delete --ignore-missing-args --temp-dir=/tmp/ --filter "- */" "/app/reference-data/{{ $index }}/" "{{ $mount.mountPath }}" &
623624
# run rsync for each subfolder
624625
for f in /app/reference-data/{{ $index }}/*/; do
625626
subfolder="$(realpath -s $f)"
626-
rsync -r --delete --temp-dir=/tmp/ "${subfolder}" "{{ $mount.mountPath }}" &
627+
rsync -r --delete --ignore-missing-args --temp-dir=/tmp/ "${subfolder}" "{{ $mount.mountPath }}" &
627628
done
628629
fi
629630
{{ end -}}

‎drupal/templates/varnish-configmap-vcl.yaml‎

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -304,10 +304,29 @@ data:
304304
return(pipe);
305305
}
306306
307+
# Match upstream allowlist to supply headers containing real ip
308+
if (client.ip ~ upstream_proxy && req.http.X-Envoy-External-Address) {
309+
set req.http.X-Forwarded-For = req.http.X-Envoy-External-Address;
310+
set req.http.X-Real-IP = req.http.X-Envoy-External-Address;
311+
}
312+
elseif (client.ip ~ upstream_proxy && req.http.X-Forwarded-For) {
313+
set req.http.X-Real-IP = req.http.X-Forwarded-For;
314+
}
315+
elseif (client.ip ~ upstream_proxy && req.http.X-Real-IP) {
316+
set req.http.X-Forwarded-For = req.http.X-Real-IP;
317+
}
318+
else {
319+
set req.http.X-Forwarded-For = client.ip;
320+
set req.http.X-Real-IP = client.ip;
321+
}
322+
323+
# Use first ip from X-Real-IP as parsed ip
324+
set req.http.X-Parsed-IP = regsub(req.http.X-Real-IP, "[, ].*$", "");
325+
307326
# Only allow BAN requests from IP addressees in the 'internal' ACL.
308327
if (req.method == "BAN") {
309328
# Admin port is only exposed to internal network
310-
if (!client.ip ~ purge) {
329+
if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
311330
return (synth(403, "Not allowed."));
312331
}
313332
@@ -331,7 +350,7 @@ data:
331350
# Only allow URIBAN requests from IP addressees in the 'internal' ACL.
332351
if (req.method == "URIBAN") {
333352
# Admin port is only exposed to internal network
334-
if (!client.ip ~ purge) {
353+
if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
335354
return (synth(403, "Not allowed."));
336355
}
337356
@@ -348,24 +367,6 @@ data:
348367
return (synth(200, "Ban added."));
349368
}
350369
351-
# Match upstream allowlist to supply headers containing real ip
352-
if (client.ip ~ upstream_proxy && req.http.X-Envoy-External-Address) {
353-
set req.http.X-Forwarded-For = req.http.X-Envoy-External-Address;
354-
set req.http.X-Real-IP = req.http.X-Envoy-External-Address;
355-
}
356-
elseif (client.ip ~ upstream_proxy && req.http.X-Forwarded-For) {
357-
set req.http.X-Forwarded-For = req.http.X-Forwarded-For;
358-
set req.http.X-Real-IP = req.http.X-Forwarded-For;
359-
}
360-
elseif (client.ip ~ upstream_proxy && req.http.X-Real-IP) {
361-
set req.http.X-Forwarded-For = req.http.X-Real-IP;
362-
set req.http.X-Real-IP = req.http.X-Real-IP;
363-
}
364-
else {
365-
set req.http.X-Forwarded-For = client.ip;
366-
set req.http.X-Real-IP = client.ip;
367-
}
368-
369370
# Only deal with "normal" types
370371
if (req.method != "GET"
371372
&& req.method != "HEAD"
@@ -434,7 +435,7 @@ data:
434435
return (synth( 403, "Forbidden"));
435436
}
436437
437-
if (req.http.Authorization || client.ip ~ internal) {
438+
if (req.http.Authorization || ( std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal && std.ip(req.http.X-Parsed-IP, "0.0.0.0") !~ upstream_proxy )) {
438439
# Not cacheable by default
439440
return (pass);
440441
}
@@ -460,7 +461,7 @@ data:
460461
}
461462
462463
# Do not allow public access to cron.php , update.php or install.php.
463-
if (req.url ~ "^(?:/core)?/(?:cron|install|update)\.php$" && !client.ip ~ internal) {
464+
if (req.url ~ "^(?:/core)?/(?:cron|install|update)\.php$" && (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy)) {
464465
# Have Varnish throw the error directly.
465466
return (synth( 404, "Page not found."));
466467
}

‎frontend/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: frontend
3-
version: 1.25.0
3+
version: 1.25.1
44
dependencies:
55
- name: mariadb
66
version: 7.10.x

‎frontend/templates/varnish-configmap-vcl.yaml‎

Lines changed: 31 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,15 @@ data:
2424
{{- end }}
2525
}
2626
27+
# Define the purge network access.
28+
# These are used below to allow cache purging via BAN.
29+
acl purge {
30+
"127.0.0.1";
31+
{{- range .Values.nginx.noauthips }}
32+
{{ . | quote }};
33+
{{- end }}
34+
}
35+
2736
# List of upstream proxies we trust to set X-Forwarded-For correctly.
2837
acl upstream_proxy {
2938
{{- if kindIs "string" .Values.nginx.realipfrom }}
@@ -56,10 +65,29 @@ data:
5665
return (synth(400));
5766
}
5867
68+
# Match upstream allowlist to supply headers containing real ip
69+
if (client.ip ~ upstream_proxy && req.http.X-Envoy-External-Address) {
70+
set req.http.X-Forwarded-For = req.http.X-Envoy-External-Address;
71+
set req.http.X-Real-IP = req.http.X-Envoy-External-Address;
72+
}
73+
elseif (client.ip ~ upstream_proxy && req.http.X-Forwarded-For) {
74+
set req.http.X-Real-IP = req.http.X-Forwarded-For;
75+
}
76+
elseif (client.ip ~ upstream_proxy && req.http.X-Real-IP) {
77+
set req.http.X-Forwarded-For = req.http.X-Real-IP;
78+
}
79+
else {
80+
set req.http.X-Forwarded-For = client.ip;
81+
set req.http.X-Real-IP = client.ip;
82+
}
83+
84+
# Use first ip from X-Real-IP as parsed ip
85+
set req.http.X-Parsed-IP = regsub(req.http.X-Real-IP, "[, ].*$", "");
86+
5987
# Only allow BAN requests from IP addressees in the 'internal' ACL.
6088
if (req.method == "BAN") {
6189
# Admin port is only exposed to internal network
62-
if (!client.ip ~ internal) {
90+
if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
6391
return (synth(403, "Not allowed."));
6492
}
6593
@@ -79,7 +107,7 @@ data:
79107
# Only allow URIBAN requests from IP addressees in the 'internal' ACL.
80108
if (req.method == "URIBAN") {
81109
# Admin port is only exposed to internal network
82-
if (!client.ip ~ internal) {
110+
if (!std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ purge || std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ upstream_proxy ) {
83111
return (synth(403, "Not allowed."));
84112
}
85113
@@ -95,24 +123,6 @@ data:
95123
return (synth(200, "Ban added."));
96124
}
97125
98-
# Match upstream allowlist to supply headers containing real ip
99-
if (client.ip ~ upstream_proxy && req.http.X-Envoy-External-Address) {
100-
set req.http.X-Forwarded-For = req.http.X-Envoy-External-Address;
101-
set req.http.X-Real-IP = req.http.X-Envoy-External-Address;
102-
}
103-
elseif (client.ip ~ upstream_proxy && req.http.X-Forwarded-For) {
104-
set req.http.X-Forwarded-For = req.http.X-Forwarded-For;
105-
set req.http.X-Real-IP = req.http.X-Forwarded-For;
106-
}
107-
elseif (client.ip ~ upstream_proxy && req.http.X-Real-IP) {
108-
set req.http.X-Forwarded-For = req.http.X-Real-IP;
109-
set req.http.X-Real-IP = req.http.X-Real-IP;
110-
}
111-
else {
112-
set req.http.X-Forwarded-For = client.ip;
113-
set req.http.X-Real-IP = client.ip;
114-
}
115-
116126
# Check request methods
117127
if (req.method == "PRI") {
118128
# This will never happen in properly formed traffic.
@@ -135,7 +145,7 @@ data:
135145
}
136146
137147
# Do not cache requests with Authorization header
138-
if (req.http.Authorization || client.ip ~ internal) {
148+
if (req.http.Authorization || ( std.ip(req.http.X-Parsed-IP, "0.0.0.0") ~ internal && std.ip(req.http.X-Parsed-IP, "0.0.0.0") !~ upstream_proxy )) {
139149
return (pass);
140150
}
141151

0 commit comments

Comments
 (0)