Stavros
fb86f443a1
chore: disable kube tests for now
2026-09-22 22:51:14 +03:00
Stavros and Codex
b29e1bddc5
feat: load basic auth password from secret
...
Co-Authored-By: Codex <codex@openai.com >
2026-09-22 22:40:54 +03:00
Stavros
f98c844f28
feat: register crd in kube watcher
2026-09-22 22:30:12 +03:00
Stavros
a62ef392e2
feat: watch for both ingresses and tinyauth crds
2026-09-21 23:03:03 +03:00
Stavros
996316b524
chore: remove gateway extractors
2026-09-21 14:19:05 +03:00
Stavros
34456b94b1
chore: add missing acls service modification for domain normalization
2026-09-20 21:22:56 +03:00
Stavros and Codex
45e165f742
tests: add tests for kubernetes service and extractors
...
Co-authored-by: Codex <noreply@openai.com >
2026-09-20 21:21:36 +03:00
Stavros
b43cf76d9b
refactor: use typed objects for kubernetes
2026-09-20 21:07:06 +03:00
Stavros
5a685c4a6b
Merge branch 'main' into feat/k8s_gateways
2026-09-20 18:51:23 +03:00
Stavros and OpenAI
0cf64e8598
fix: use constant-time secret comparisons
...
Co-Authored-By: OpenAI <noreply@openai.com >
2026-09-06 19:56:58 +03:00
Stavros and GitHub
bbcc8cafa6
feat: add backoff to docker connection for proxies ( #1114 )
2026-09-03 12:14:30 +03:00
Stavros and GitHub
88901d342f
fix: consent screen skip status should get checked after auth ( #1099 )
2026-08-30 20:09:41 +03:00
Stavros and GitHub
847d8325c7
fix: auth module selection ( #1089 )
2026-08-25 17:07:56 +03:00
Stavros and GitHub
be48d712ee
feat: support for custom claims in oauth ( #1087 )
2026-08-22 19:58:05 +03:00
Contre and Claude Sonnet 4.6
e1b1e722e7
fix(acl): only let a label provider define ACLs for domains it routes
...
The app name fallback matches any domain that starts with the app name,
so an app named myapp served on myapp.example.com also defined the ACLs
of myapp.evil.com. Behind a proxy with a catch-all route, a request can
be authorized against the wrong app that way.
Label providers now receive the domain being authorized. The Kubernetes
provider keeps the hosts of every Ingress, HTTPRoute and GRPCRoute it
watches and withholds the apps of the resources that do not route the
domain, which bounds the name fallback to the hosts a resource actually
serves. Wildcard hostnames keep matching as a suffix, so nested
subdomains stay resolvable by app name.
Container labels carry no routing information, so the Docker provider
cannot narrow its results down and keeps yielding every app.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-08-19 12:18:02 +02:00
Contre and Claude Sonnet 4.6
3a216e95e2
Merge branch 'main' into feat/k8s_gateways
...
Reapply the Gateway API support on top of the KubernetesService rework
from main, which moved the service to ding-managed watchers and a
Lookup based LabelProvider, and started requiring an app to match a host
the resource actually routes.
Ingresses declare their hosts in spec.rules[].host while HTTPRoutes and
GRPCRoutes use spec.hostnames, so host extraction is now dispatched per
resource kind. Route hostnames may carry the Gateway API wildcard label,
which is matched as a suffix, and routes without hostnames are skipped
since the hosts of the gateway listeners they attach to cannot be
resolved from the route alone.
The cache key gains the resource kind because an Ingress and an
HTTPRoute may share a name within a namespace, and the catch-all path
warning is extended to HTTPRoute path matches.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-08-19 12:03:13 +02:00
Stavros and GitHub
0c47e68c09
feat: do not show oidc consent screen every time ( #989 )
2026-08-17 02:44:48 +03:00
tsushanth and GitHub
f9939538b9
Remote-Name header returns capitalized uid instead of LDAP cn — cn attribute never fetched ( #1072 )
2026-08-13 15:37:03 +03:00
Stavros
c7077a7c84
fix: do not allow empty ingresses
2026-07-21 00:37:13 +03:00
Stavros and GitHub
80bc87188e
refactor: rework acl fetching for kubernetes and docker ( #1028 )
2026-07-20 16:39:15 +03:00
Stavros and GitHub
f43d690320
refactor: rework scheme validation in oauth controller and frontend ( #1026 )
2026-07-19 00:41:28 +03:00
Stavros
a79438d6ec
fix: fix typo
2026-07-18 16:47:53 +03:00
Stavros
5091fc2d7a
fix: suppress irrelevant debugs logs in acls service
2026-07-18 16:30:12 +03:00
Stavros and GitHub
a7eba59a42
refactor: export cache package ( #1017 )
2026-07-17 02:04:34 +03:00
Stavros
589fe22138
tests: add tests for abstain in oauth whitelist
2026-07-16 14:30:48 +03:00
1165c91fcc
fix: abstain when OAuth whitelist is empty ( #1010 )
...
Co-authored-by: wwhsaber <wwhsaber@foxmail.com >
2026-07-16 14:23:07 +03:00
Stavros and GitHub
dade1e2c8f
refactor: rework rate limit logic ( #1008 )
2026-07-15 15:30:57 +03:00
Stavros and GitHub
6e095fd4f2
refactor: rework the way trusted proxies ip work ( #1007 )
2026-07-15 15:17:55 +03:00
Stavros and GitHub
c22925c2fb
fix: use constant time in user checks ( #1004 )
2026-07-14 16:49:59 +03:00
Stavros and GitHub
e75605b2c5
refactor: move domain check into small helper util ( #1000 )
2026-07-14 14:20:15 +03:00
Florian Ilch and GitHub
79bcccbe43
feat: support proxy environment variables for OAuth requests ( #999 )
2026-07-14 13:18:28 +03:00
Stavros and GitHub
0bd2821a9b
refactor: use tailscale api for user checking instead of tsnet ( #978 )
2026-07-09 01:56:09 +03:00
nv6 and GitHub
364175adc0
feat: try anonymous bind when bind credentials are empty ( #979 )
2026-07-08 17:11:30 +03:00
Stavros and GitHub
a3c4d6ac83
chore: move tailscale to experimental config ( #964 )
2026-07-02 23:17:03 +03:00
Stavros and GitHub
ffafb5bff5
feat: add a reconnect to the initial ldap connection ( #928 )
2026-06-30 15:57:41 +03:00
Stavros and GitHub
69f4206f65
refactor: remove concurrent listeners and rework cookie logic ( #950 )
2026-06-23 13:35:29 +03:00
Stavros and GitHub
efe373084f
feat: support for oidc max age ( #949 )
2026-06-20 00:21:22 +03:00
Stavros and GitHub
7f18b45e21
feat: support for the prompt parameter in the oidc flow ( #948 )
2026-06-20 00:04:41 +03:00
Stavros and GitHub
53af1b99c0
tests: don't use _test suffix in service and controller tests ( #944 )
2026-06-17 17:03:30 +03:00
Stavros and GitHub
654b5cc436
fix: use better limits in lockdown to limit dos attack window ( #943 )
2026-06-17 13:10:58 +03:00
Stavros
a9face749d
chore: remove leftover debug log line from tailscale service
2026-06-17 12:15:51 +03:00
Stavros and GitHub
f404c2ef16
feat: use dig for di in services and controllers ( #936 )
2026-06-16 13:00:48 +03:00
a0e74cd5f2
refactor: move oidc handling to backend and add support for oidc post ( #923 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-06-13 16:45:12 +03:00
Ryc O'Chet and GitHub
49105ce5ff
feat: add ldap bind password file ( #929 )
2026-06-11 13:25:22 +03:00
Stavros and GitHub
426eac2d0b
refactor: rework oidc session storage ( #913 )
2026-06-06 16:26:08 +03:00
Stavros and GitHub
dac844595d
refactor: use new cache store in services ( #912 )
2026-05-31 18:55:06 +03:00
Stavros
940ba6dff7
fix: don't allow tagged devices in tailscale integration
2026-05-31 12:42:00 +03:00
Stavros and GitHub
faee58ca8e
feat: use ding for ordered go routine shutdown order ( #896 )
2026-05-27 12:46:28 +03:00
Stavros
e9b8ca3cf8
fix: cleanup acl logic to match stable one
2026-05-27 12:11:17 +03:00
Stavros and GitHub
0a3e7bf265
fix: use policy engine in oauth whitelist check ( #904 )
2026-05-26 00:07:46 +03:00
Stavros
ContreandClaude Sonnet 4.6
tsushanthandGitHub
Florian IlchandGitHub
nv6andGitHub
Ryc O'ChetandGitHub