From 9125e7659616ab5252490d46aef84fcc89bdfd64 Mon Sep 17 00:00:00 2001 From: Stavros Date: Thu, 17 Sep 2026 17:45:30 +0300 Subject: [PATCH] feat: init proxy yaml configs --- integration/docker-compose.yaml.tmpl | 34 +++++ integration/suite/proxies/caddy.yaml.tmpl | 33 +++++ integration/suite/proxies/envoy.yaml.tmpl | 137 ++++++++++++++++++++ integration/suite/proxies/nginx.yaml.tmpl | 79 +++++++++++ integration/suite/proxies/proxies.go | 27 ++++ integration/suite/proxies/traefik.yaml.tmpl | 68 ++++++++++ 6 files changed, 378 insertions(+) create mode 100644 integration/docker-compose.yaml.tmpl create mode 100644 integration/suite/proxies/caddy.yaml.tmpl create mode 100644 integration/suite/proxies/envoy.yaml.tmpl create mode 100644 integration/suite/proxies/nginx.yaml.tmpl create mode 100644 integration/suite/proxies/proxies.go create mode 100644 integration/suite/proxies/traefik.yaml.tmpl diff --git a/integration/docker-compose.yaml.tmpl b/integration/docker-compose.yaml.tmpl new file mode 100644 index 00000000..707ec93f --- /dev/null +++ b/integration/docker-compose.yaml.tmpl @@ -0,0 +1,34 @@ +services: +{{ if eq .Proxy "caddy" }} + {{ template "caddy" . }} +{{ else if eq .Proxy "traefik" }} + {{ template "traefik" . }} +{{ else if eq .Proxy "nginx" }} + {{ template "nginx" . }} +{{ else if eq .Proxy "envoy" }} + {{ template "envoy" . }} +{{ else }} + {{ template "traefik" . }} +{{ end }} + + whoami: + image: traefik/whoami:v1.12.0 + pull_policy: missing + + tinyauth: + {{ if .Build }} + build: + context: ../ + dockerfile: Dockerfile + args: + - VERSION=e2e + - BUILD_TAGS=nomsgpack + - LDFLAGS=-s -w + {{ else }} + image: ghcr.io/tinyauthapp/tinyauth:{{ .Version }} + {{ end }} + pull_policy: missing + command: ["--configfile", "/config.yaml"] + volumes: + - ./tinyauth.config.yaml:/config.yaml:ro + diff --git a/integration/suite/proxies/caddy.yaml.tmpl b/integration/suite/proxies/caddy.yaml.tmpl new file mode 100644 index 00000000..045f1e78 --- /dev/null +++ b/integration/suite/proxies/caddy.yaml.tmpl @@ -0,0 +1,33 @@ +{{ define "caddy" }} +caddy: + image: caddy:2.11.4 + pull_policy: missing + ports: + - {{ .Proxy.Port }}:80 + configs: + - source: caddy_caddyfile + target: /etc/caddy/Caddyfile + mode: 0664 +{{ end }} + +{{ define "caddy_config" }} +caddy_caddyfile: + content: | + { + auto_https off + } + + {{ if .Services.Whoami.Enabled }} + http://{{ .Domains.Whoami }} { + forward_auth tinyauth:3000 { + uri /api/auth/caddy + copy_headers Remote-User Remote-Name Remote-Email Remote-Groups + } + reverse_proxy whoami:80 + } + {{ end }} + + http://{{ .Domains.Tinyauth }} { + reverse_proxy tinyauth:3000 + } +{{ end }} \ No newline at end of file diff --git a/integration/suite/proxies/envoy.yaml.tmpl b/integration/suite/proxies/envoy.yaml.tmpl new file mode 100644 index 00000000..6603fe71 --- /dev/null +++ b/integration/suite/proxies/envoy.yaml.tmpl @@ -0,0 +1,137 @@ +{{ define "envoy" }} +envoy: + image: envoyproxy/envoy:v1.33-latest + pull_policy: missing + ports: + - {{ .Proxy.Port }}:80 + configs: + - source: envoy_config + target: /etc/envoy/envoy.yaml + mode: 0664 +{{ end }} + +{{ define "envoy_config" }} +envoy_config: + content: | + static_resources: + listeners: + - name: http + address: + socket_address: + address: 0.0.0.0 + port_value: 80 + + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: ingress_http + use_remote_address: true + + route_config: + name: routes + + virtual_hosts: + {{ if .Services.Whoami.Enabled }} + - name: whoami + domains: + - {{ .Domains.Whoami }} + + request_headers_to_add: + - header: + key: x-real-ip + value: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" + append_action: OVERWRITE_IF_EXISTS_OR_ADD + + routes: + - match: + prefix: / + route: + cluster: whoami + {{ end }} + + - name: tinyauth + domains: + - {{ .Domains.Tinyauth }} + + typed_per_filter_config: + envoy.filters.http.ext_authz: + "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute + disabled: true + + routes: + - match: + prefix: / + route: + cluster: tinyauth + + http_filters: + - name: envoy.filters.http.ext_authz + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz + failure_mode_allow: false + + http_service: + server_uri: + uri: http://tinyauth:3000 + cluster: tinyauth + timeout: 5s + + path_prefix: "/api/auth/envoy?path=" + + authorization_request: + allowed_headers: + patterns: + - exact: cookie + - exact: x-forwarded-for + - exact: x-forwarded-proto + - exact: x-real-ip + - exact: user-agent + + authorization_response: + allowed_upstream_headers: + patterns: + - exact: remote-user + - exact: remote-name + - exact: remote-email + - exact: remote-groups + - exact: remote-sub + - exact: authorization + + allowed_client_headers: + patterns: + - exact: set-cookie + - exact: content-type + + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + + clusters: + {{ if .Services.Whoami.Enabled }} + - name: whoami + type: LOGICAL_DNS + load_assignment: + cluster_name: whoami + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: whoami + port_value: 80 + {{ end }} + + - name: tinyauth + type: LOGICAL_DNS + load_assignment: + cluster_name: tinyauth + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: tinyauth + port_value: 3000 +{{ end }} \ No newline at end of file diff --git a/integration/suite/proxies/nginx.yaml.tmpl b/integration/suite/proxies/nginx.yaml.tmpl new file mode 100644 index 00000000..59b50444 --- /dev/null +++ b/integration/suite/proxies/nginx.yaml.tmpl @@ -0,0 +1,79 @@ +{{ define "nginx" }} +nginx: + image: nginx:1.31.6 + pull_policy: missing + ports: + - {{ .Proxy.Port }}:80 + configs: + - source: nginx_default + target: /etc/nginx/conf.d/default.conf + mode: 0664 + - source: nginx_tinyauth + target: /etc/nginx/conf.d/tinyauth.conf + mode: 0664 + {{ if .Services.Whoami.Enabled }} + - source: nginx_whoami + target: /etc/nginx/conf.d/whoami.conf + mode: 0664 + {{ end }} +{{ end }} + +{{ define "nginx_config" }} +nginx_default: + content: {} +nginx_tinyauth: + content: | + server { + listen 80; + server_name {{ .Domains.Tinyauth }}; + + location / { + proxy_pass http://tinyauth:3000; + + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + } + } +{{ if .Services.Whoami.Enabled }} +nginx_whoami: + content: | + server { + listen 80; + server_name {{ .Domains.Whoami }}; + + location / { + proxy_pass http://whoami:80; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + + auth_request /tinyauth; + auth_request_set $redirection_url $upstream_http_x_tinyauth_location; + error_page 401 403 =302 $redirection_url; + } + + location = /tinyauth { + internal; + + proxy_pass http://tinyauth:3000/api/auth/nginx; + + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Original-Method $request_method; + + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + } + } +{{ end }} +{{ end }} \ No newline at end of file diff --git a/integration/suite/proxies/proxies.go b/integration/suite/proxies/proxies.go new file mode 100644 index 00000000..9018c637 --- /dev/null +++ b/integration/suite/proxies/proxies.go @@ -0,0 +1,27 @@ +package proxies + +import ( + _ "embed" + "html/template" +) + +// Bundle the templates + +//go:embed caddy.yaml.tmpl +var caddyTemplateSource string + +//go:embed envoy.yaml.tmpl +var envoyTemplateSource string + +//go:embed nginx.yaml.tmpl +var nginxTemplateSource string + +//go:embed traefik.yaml.tmpl +var traefikTemplateSource string + +// Compile them and export them + +var CaddyTemplate = template.Must(template.New("caddy").Parse(caddyTemplateSource)) +var EnvoyTemplate = template.Must(template.New("envoy").Parse(envoyTemplateSource)) +var NginxTemplate = template.Must(template.New("nginx").Parse(nginxTemplateSource)) +var TraefikTemplate = template.Must(template.New("traefik").Parse(traefikTemplateSource)) diff --git a/integration/suite/proxies/traefik.yaml.tmpl b/integration/suite/proxies/traefik.yaml.tmpl new file mode 100644 index 00000000..bce18a1b --- /dev/null +++ b/integration/suite/proxies/traefik.yaml.tmpl @@ -0,0 +1,68 @@ +{{ define "traefik" }} +traefik: + image: traefik:v3.7.13 + pull_policy: missing + ports: + - {{ .Proxy.Port }}:80 + configs: + - source: traefik_static + target: /etc/traefik/traefik.yml + mode: 0664 + - source: traefik_dynamic + target: /etc/traefik/dynamic.yml + mode: 0664 +{{ end }} + +{{ define "traefik_config" }} +traefik_static: + content: | + entryPoints: + web: + address: ":80" + + providers: + file: + filename: /etc/traefik/dynamic.yml +traefik_dynamic: + content: | + http: + routers: + {{ if .Services.Whoami.Enabled }} + whoami: + rule: Host(`{{ .Domains.Whoami }}`) + entryPoints: + - web + service: whoami + middlewares: + - tinyauth + {{ end }} + + tinyauth: + rule: Host(`{{ .Domains.Tinyauth }}`) + entryPoints: + - web + service: tinyauth + + middlewares: + tinyauth: + forwardAuth: + address: http://tinyauth:3000/api/auth/traefik + authResponseHeaders: + - Remote-User + - Remote-Name + - Remote-Email + - Remote-Groups + + services: + {{ if .Services.Whoami.Enabled }} + whoami: + loadBalancer: + servers: + - url: http://whoami:80 + {{ end }} + + tinyauth: + loadBalancer: + servers: + - url: http://tinyauth:3000 +{{ end }}