From 6644d16b6b9def1c83f3d41b0462a0111136a439 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Wed, 5 Feb 2025 14:11:04 +0100 Subject: [PATCH] www/caddy: Add client_ip_headers (#4519) * www/caddy: Add client_ip_headers for https://github.com/opnsense/plugins/issues/4517 , Rewrite copy_headers logic for https://github.com/opnsense/plugins/issues/4488 . Since headers are used in multiple parts of the configuration this creates a single point of truth to ease maintenance burden. * www/caddy: Forgot to add general form options for https://github.com/opnsense/plugins/issues/4517 * www/caddy: Change directive name from AuthCopyHeaders to CopyHeaders since Field Type changed to empty it. The field was introduced in the prior version and optional, so impact low. Changelogs. * www/caddy: Improve helptext for client_ip_headers feature --- www/caddy/Makefile | 2 +- www/caddy/pkg-descr | 7 +++ .../OPNsense/Caddy/forms/general.xml | 16 ++++++- .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 43 ++++++++++--------- .../templates/OPNsense/Caddy/Caddyfile | 8 ++++ .../OPNsense/Caddy/includeAuthProvider | 37 +++++++++++----- 6 files changed, 79 insertions(+), 34 deletions(-) diff --git a/www/caddy/Makefile b/www/caddy/Makefile index 0a03f1284..6c8288cf3 100644 --- a/www/caddy/Makefile +++ b/www/caddy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= caddy -PLUGIN_VERSION= 1.8.1 +PLUGIN_VERSION= 1.8.2 PLUGIN_DEPENDS= caddy-custom PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing PLUGIN_MAINTAINER= cedrik@pischem.com diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index c9583ba43..0dfa6ca70 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -13,6 +13,13 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html Plugin Changelog ================ +1.8.2 + +* Add: client_ip_headers (opnsense/plugins/issues/4517) +* Add: CloudDNS provider (opnsense/plugins/pull/4507) +* Change: Generalize forward_auth copy_headers directive. Existing configuration from (issues/4488) will be emptied. (opnsense/plugins/pull/4519) +* Fix: Shortcut buttons in reverse_proxy.volt (opnsense/plugins/pull/4525) + 1.8.1 * Add: Optional "Authorization" header to forward_auth (opnsense/plugins/issues/4488) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index 9d70fcafa..573fbce1d 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -58,6 +58,16 @@ dropdown + + caddy.general.ClientIpHeaders + + dropdown + select_multiple + 5 + + X-Forwarded-For + + caddy.general.GracePeriod @@ -228,11 +238,13 @@ - caddy.general.AuthCopyHeaders + caddy.general.CopyHeaders + dropdown select_multiple + 5 - + general-settings diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index 88b4853da..7a851ce70 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -1,7 +1,7 @@ //Pischem/caddy Caddy Reverse Proxy - 1.3.4 + 1.3.5 @@ -84,6 +84,17 @@ + + + + OPNsense.Caddy.Caddy + reverseproxy.header + HeaderType,description + %s %s + + + Y + Y 0 @@ -168,27 +179,17 @@ /^(\/.*)?$/u Please enter a valid 'URI' that starts with '/'. - + + + + OPNsense.Caddy.Caddy + reverseproxy.header + HeaderType,description + %s %s + + Y - - Authorization - Remote-User - Remote-Groups - Remote-Name - Remote-Email - X-Authentik-Username - X-Authentik-Groups - X-Authentik-Email - X-Authentik-Name - X-Authentik-Uid - X-Authentik-Jwt - X-Authentik-Meta-Jwks - X-Authentik-Meta-Outpost - X-Authentik-Meta-Provider - X-Authentik-Meta-App - X-Authentik-Meta-Version - - + diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index e81c23bc6..afe989808 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -85,6 +85,14 @@ {% if accessList %} trusted_proxies static {{ accessList.clientIps.split(',') | join(' ') }} {% endif %} + {% if generalSettings.ClientIpHeaders %} + {% for header_uuid in generalSettings.ClientIpHeaders.split(',') %} + {% set header = helpers.toList('Pischem.caddy.reverseproxy.header') | selectattr('@uuid', 'equalto', header_uuid) | first %} + {% if header and header.HeaderType %} + client_ip_headers {{ header.HeaderType }} + {% endif %} + {% endfor %} + {% endif %} {% if generalSettings.LogCredentials|default("0") == "1" %} log_credentials {% endif %} diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider index f179fc845..1c6beb34b 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider @@ -7,16 +7,26 @@ {% set is_ipv6 = (':' in generalSettings.AuthToDomain and generalSettings.AuthToDomain.count(':') >= 2) %} {% set auth_url = (generalSettings.AuthToTls|default("0") == "1" and 'https://' or 'http://') + (is_ipv6 and '[' or '') + generalSettings.AuthToDomain|default("") + (is_ipv6 and ']' or '') + (generalSettings.AuthToPort and ':' + generalSettings.AuthToPort or '') %} {% endif %} +{% macro generate_copy_headers() %} + {% if generalSettings.CopyHeaders %} + {% for header_uuid in generalSettings.CopyHeaders.split(',') %} + {% set header = helpers.toList('Pischem.caddy.reverseproxy.header') | selectattr('@uuid', 'equalto', header_uuid) | first %} + {% if header and header.HeaderType %} + copy_headers {{ header.HeaderType }} + {% endif %} + {% endfor %} + {% endif %} +{% endmacro %} {% if generalSettings.AuthProvider == 'authelia' %} forward_auth {{ auth_url }} { {% if generalSettings.AuthToUri %} uri {{ generalSettings.AuthToUri|default("") }} {% endif %} - {% if generalSettings.AuthCopyHeaders|default("") == "" %} - copy_headers Remote-User Remote-Groups Remote-Name Remote-Email - {% else %} - copy_headers {{ generalSettings.AuthCopyHeaders.split(',') | join(' ') }} - {% endif %} + copy_headers Remote-User + copy_headers Remote-Groups + copy_headers Remote-Name + copy_headers Remote-Email + {{ generate_copy_headers() }} } {% elif generalSettings.AuthProvider == 'authentik' %} reverse_proxy /outpost.goauthentik.io/* {{ auth_url }} { @@ -28,10 +38,17 @@ {% if generalSettings.AuthToUri %} uri {{ generalSettings.AuthToUri|default("") }} {% endif %} - {% if generalSettings.AuthCopyHeaders|default("") == "" %} - copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version - {% else %} - copy_headers {{ generalSettings.AuthCopyHeaders.split(',') | join(' ') }} - {% endif %} + copy_headers X-Authentik-Username + copy_headers X-Authentik-Groups + copy_headers X-Authentik-Email + copy_headers X-Authentik-Name + copy_headers X-Authentik-Uid + copy_headers X-Authentik-Jwt + copy_headers X-Authentik-Meta-Jwks + copy_headers X-Authentik-Meta-Outpost + copy_headers X-Authentik-Meta-Provider + copy_headers X-Authentik-Meta-App + copy_headers X-Authentik-Meta-Version + {{ generate_copy_headers() }} } {% endif %}