mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: cache authelia's 200 verdicts on the log and metric ingest routes

Browse source
This commit is contained in:
atlas 2026-11-14 22:05:08 +01:00
commit f5e99fe248
2 changed files with 167 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

45
nix/module-eval/core-toggle.nix
View file

@ -1113,6 +1113,51 @@ let
&& !(lib.hasInfix "error_page" l)
&& lib.hasInfix "error_page" browser;
}
{
# The two ingest routes ask authelia through a subrequest that caches a
# 200 for a minute, keyed on the bearer and the route. Everything else
# that asks authelia (the browser routes, `/metrics`) keeps the plain
# subrequest: the `!` arms on `/__hive_authelia` and `/__metrics_authelia`
# are paired with the positive arms on the ingest subrequests, so a
# misspelt location name cannot pass.
name = "the ingest routes cache authelia's 200 verdicts per bearer and no other authelia subrequest does";
ok =
let
nginx = allLocal.services.nginx;
http = nginx.appendHttpConfig;
logs = nginx.virtualHosts."logs.t.local".locations;
metrics = nginx.virtualHosts."metrics.t.local".locations;
cached =
zone: nocache: loc:
lib.hasInfix "proxy_cache ${zone};" loc.extraConfig
&& lib.hasInfix ''proxy_cache_key "$http_authorization|$http_host$request_uri";'' loc.extraConfig
&& lib.hasInfix "proxy_cache_valid 200 60s;" loc.extraConfig
&& !(lib.hasInfix "proxy_cache_valid 401" loc.extraConfig)
&& !(lib.hasInfix "proxy_cache_valid any" loc.extraConfig)
&& lib.hasInfix "proxy_cache_lock on;" loc.extraConfig
&& lib.hasInfix "proxy_cache_bypass ${nocache};" loc.extraConfig
&& lib.hasInfix "proxy_no_cache ${nocache};" loc.extraConfig
&& lib.hasInfix ''proxy_set_header Cookie "";'' loc.extraConfig
&& lib.hasInfix "internal;" loc.extraConfig;
in
lib.hasInfix "auth_request /__swarm_logs_ingest_authz;"
logs."= /insert/opentelemetry/v1/logs".extraConfig
&&
lib.hasInfix "auth_request /__metrics_ingest_authz;"
metrics."= /opentelemetry/api/v1/push".extraConfig
&& cached "swarm_logs_ingest_authz" "$swarm_logs_ingest_nocache" logs."= /__swarm_logs_ingest_authz"
&&
cached "swarm_metrics_ingest_authz" "$swarm_metrics_ingest_nocache"
metrics."= /__metrics_ingest_authz"
&& lib.hasInfix "map $http_authorization $swarm_logs_ingest_nocache" http
&& lib.hasInfix "map $http_authorization $swarm_metrics_ingest_nocache" http
&& nginx.proxyCachePath.swarm_logs_ingest_authz.enable
&& nginx.proxyCachePath.swarm_metrics_ingest_authz.enable
&& !(lib.hasInfix "proxy_cache" logs."= /__hive_authelia".extraConfig)
&& !(lib.hasInfix "proxy_cache" logs."/".extraConfig)
&& !(lib.hasInfix "proxy_cache" metrics."= /__metrics_authelia".extraConfig)
&& !(lib.hasInfix "proxy_cache" metrics."= /metrics".extraConfig);
}
{
# The store authenticates nothing itself, so a location that forwards to
# it without `auth_request` is open to anything that can reach the

4
nix/module-eval/swarm-otel-identity.nix
View file

@ -329,7 +329,9 @@ let
&& lib.all (p: policy "user:someone" p == "deny") (collectorPaths ++ readPaths)
&& lib.all (p: policy "group:admins" p == "deny") collectorPaths
&& lib.all (p: policy "group:admins" p == "one_factor") readPaths
&& lib.hasInfix "auth_request /__metrics_authelia;" locs."= /opentelemetry/api/v1/push".extraConfig
&&
lib.hasInfix "auth_request /__metrics_ingest_authz;"
locs."= /opentelemetry/api/v1/push".extraConfig
&& lib.hasInfix "auth_request /__metrics_authelia;" locs."= /metrics".extraConfig;
}
{