Code Monkey home page Code Monkey logo

ingress's Introduction

CI workflow GitHub release Semantic Release License

NGINX Ingress proxy for DNS3L

docker pull ghcr.io/dns3l/ingress

Configuration

variable note default
ENVIRONMENT production or other deployments
DNS3L_FQDN published DNS3L FQDN localhost
DNS3L_APP_URL nuxt endpoint http://web:3000
DNS3L_AUTH_URL dex endpoint https://auth:5554/auth
DNS3L_DAEMON_URL dns3ld endpoint http://dns3ld:8880/api
DNS3L_API_TIMEOUT dns3ld read timeout 6m
DNS3L_AUTH_TIMEOUT dex/auth read timeout 2m
CERT_URL bootstrap certificate for FQDN ${DNS3L_DAEMON_URL}/ca/les/crt/${DNS3L_FQDN}
CLIENT_ID auth client ID dns3l-api
CLIENT_SECRET auth client secret random
DNS3L_USER user to feed the cert certbot
DNS3L_PASS user password random

If CERT_URL doesn't exist a selfsigned is created instead.

Mount a custom nginx config to /etc/nginx.conf if environment based template seems not sufficient.

Multihomed

If you need to provide multiple URL for DNS3L stack, there is the issue that Dex always publishes a single issuer URL to the client.

In that case you can spawn multiple Dex instances that share the same config expect the issuer URL

# dex instance 1
issuer: https://dns3l.example.com/auth

# dex instance 2
issuer: https://foo.example.com/auth

# dex instance 3
issuer: https://bar.example.com/auth

and set DNS3L_FQDN to dns3l.example.com foo.example.com bar.example.com. Space separated. The first name is the certificate name by convention. Make sure the following names are included as SAN.

Or you mount a custom nginx config with the following tweaks.

  map $host $auth {
    dns3l.example.com https://auth1:5554/auth;
    foo.example.com https://auth2:5554/auth;
    bar.example.com https://auth3:5554/auth;
    default https://auth:5554/auth;
  }
  server {
    server_name dns3l.example.com foo.example.com bar.example.com;
  }

ingress's People

Contributors

iaean avatar semantic-release-bot avatar

Watchers

Leonhard Nobach avatar  avatar

Forkers

iaean

ingress's Issues

Add CORS injection to config template

To support workaround for dns3l/dns3l-core#56

    # DNS3L daemon
    location /api {
      # ...

      # Inject CORS (preflight) handling...
      # Strip Access-Control-Allow-Origin et al. from source response
      # proxy_hide_header Access-Control-...;
      if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
        # Custom headers and headers various browsers *should* be OK with but aren't
        add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header "Access-Control-Allow-Credentials" 'true';
        add_header 'Access-Control-Max-Age' 86400;
        add_header 'Content-Type' 'text/plain; charset=utf-8';
        add_header 'Content-Length' 0;
        return 204;
      }
      add_header 'Access-Control-Allow-Origin' '*' always;
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
      add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
      add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
    }

Support auth in multihomed deployments

Auth subsystem actually doesn't work in multi homed environments. Because dex is publishing a single issuer URL only.

nginx needs new config to proxy /auth based on name to multiple dex backends that share the same config expect the issuer URL.

Seems related to dns3l/dns3l-core#19

Ingress LDAP LB

Seems Dex LDAP backend is not supporting failover.

Therefore we provide an LDAP L4 LB ingress config that can be utilized by Dex config.

Configurable upstream read timeout(s)

Sometimes there are backends with slow response. We should be able to configure the upstream read timeout.

An example where Dex is to late because it's auth backend is responding slow:

dns3l-ingress  | 2023/01/27 18:00:25 [error] 55#55: *98 upstream timed out (110: Operation timed out) while reading response header from upstream, client: 10.1.2.3, server: dns3l.example.com, request: "POST /auth/token HTTP/2.0", upstream: https://172.18.0.3:5554/auth/token, host: "dns3l.example.com"
dns3l-ingress  | 10.1.2.3 - "POST /auth/token HTTP/2.0" 504 160 "-" "curl/7.79.1" 60.075 60.074 .

Unable to self update the certificate

The ingress should poll the backend daily and installs a (re)new(ed) cert once it is there.
This is realized as a dcron cronjob /etc/periodic/daily/nginx-renew.

PID   USER     TIME  COMMAND
    1 root      0:00 nginx: master process nginx -g daemon off;
   52 root      0:17 crond -L/dev/null

This cronjob is never triggered from a vanilla deployment. A manual trigger works like a charm.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.