unkin-agent
51243d8145
The traefik gateway terminates TLS for ghp.unkin.net and forwards cleartext to the ghp Service port 80 -> container :8080. But :8080 was GHP_SERVER_HTTP_LISTEN, ghp's http->https 308 REDIRECT listener, so ghp bounced every request back to https, which the gateway forwarded to :8080 again: an infinite ghp.unkin.net -> ghp.unkin.net 308 loop. Per ghp source (internal/server/server.go Run/serveTLS/servePlain, redirect.go), the app is served on either GHP_SERVER_LISTEN (plain, full handler incl. mgmt UI + API) OR GHP_SERVER_HTTPS_LISTEN (own TLS) - it is strictly either/or: any non-empty https_listen sets hasTLS and runs serveTLS, in which GHP_SERVER_LISTEN is ignored and http_listen only ever redirects. To serve cleartext on :8080 behind the TLS-terminating gateway, ghp must run in plain mode: - configmap: drop GHP_SERVER_HTTPS_LISTEN + GHP_SERVER_HTTP_LISTEN; set GHP_SERVER_LISTEN ":8080" so :8080 SERVES the app; add GHP_SERVER_TRUST_PROXY_HEADERS so ghp trusts the gateway's X-Forwarded-*/Forwarded for scheme/host. - deployment + vmservicescrape: the metrics server only wraps TLS when hasTLS is true, so in plain mode it is cleartext - switch the /metrics probes and the scrape from HTTPS/https to HTTP/http. Service, HTTPRoute and Gateway are unchanged.
35 lines
1.6 KiB
YAML
35 lines
1.6 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: ghp-env
|
|
namespace: ghp
|
|
data:
|
|
GHP_DATABASE_DRIVER: postgres
|
|
# ghp runs in plain-HTTP reverse-proxy mode: the traefik gateway terminates TLS
|
|
# for ghp.unkin.net and forwards cleartext to container :8080, where ghp SERVES
|
|
# the full app (mgmt UI + API) via GHP_SERVER_LISTEN.
|
|
#
|
|
# Do NOT set GHP_SERVER_HTTPS_LISTEN here. Any non-empty https_listen flips ghp
|
|
# into TLS-only mode (server.go Run(): hasTLS -> serveTLS): the app is served on
|
|
# :8443 and http_listen becomes a 308 http->https REDIRECT listener, while
|
|
# GHP_SERVER_LISTEN is ignored entirely. The gateway forwarding cleartext into
|
|
# that redirect listener on :8080 was the ghp.unkin.net -> ghp.unkin.net 308 loop.
|
|
#
|
|
# nonroot cannot bind <1024; listen high and remap in the Service.
|
|
GHP_SERVER_LISTEN: ":8080"
|
|
# Behind the TLS-terminating gateway: trust its X-Forwarded-* / Forwarded headers
|
|
# for scheme/host when generating absolute URLs (GHP_SERVER_BASE_URL is also set).
|
|
GHP_SERVER_TRUST_PROXY_HEADERS: "true"
|
|
GHP_METRICS_LISTEN: ":9136"
|
|
GHP_METRICS_ENABLED: "true"
|
|
GHP_SERVER_BASE_URL: https://ghp.unkin.net
|
|
GHP_SERVER_MANAGEMENT_HOST: ghp.unkin.net
|
|
# private_key key from the ghp-github-app Secret, mounted as a file.
|
|
GHP_GITHUB_PRIVATE_KEY_FILE: /etc/ghp/github-app/private_key
|
|
# cert-manager Certificate ghp-tls, mounted from the ghp-tls Secret.
|
|
GHP_TLS_CERT_FILE: /etc/ghp/tls/tls.crt
|
|
GHP_TLS_KEY_FILE: /etc/ghp/tls/tls.key
|
|
# PLACEHOLDER: set to Ben's GitHub username before ghp will admit an admin.
|
|
GHP_ADMINS: "neoloc"
|