Skip to content

Commit 2feb6cc

Browse files
baudneobaudneo
committed
Add PROXY protocol - not working yet
1 parent 5ed6f3d commit 2feb6cc

File tree

10 files changed

+119
-8
lines changed

10 files changed

+119
-8
lines changed

‎backend/internal/nginx.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,8 @@ const internalNginx = {
157157
for (let i = 0; i < host.locations.length; i++) {
158158
let locationCopy = Object.assign({}, {access_list_id: host.access_list_id}, {certificate_id: host.certificate_id},
159159
{ssl_forced: host.ssl_forced}, {caching_enabled: host.caching_enabled}, {block_exploits: host.block_exploits},
160-
{allow_websocket_upgrade: host.allow_websocket_upgrade}, {http2_support: host.http2_support},
160+
{allow_websocket_upgrade: host.allow_websocket_upgrade}, {enable_proxy_protocol: host.enable_proxy_protocol},
161+
{load_balancer_ip: host.load_balancer_ip}, {http2_support: host.http2_support},
161162
{hsts_enabled: host.hsts_enabled}, {hsts_subdomains: host.hsts_subdomains}, {access_list: host.access_list},
162163
{certificate: host.certificate}, host.locations[i]);
163164

‎backend/migrations/22021009153423_proxy_protocol.js

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
const migrate_name = 'proxy_protocol';
2+
const logger = require('../logger').migrate;
3+
4+
/**
5+
* Migrate
6+
*
7+
* @see http://knexjs.org/#Schema
8+
*
9+
* @param {Object} knex
10+
* @param {Promise} Promise
11+
* @returns {Promise}
12+
*/
13+
exports.up = function (knex/*, Promise*/) {
14+
logger.info('[' + migrate_name + '] Migrating Up...');
15+
16+
return knex.schema.table('proxy_host', function (proxy_host) {
17+
proxy_host.integer('enable_proxy_protocol').notNull().unsigned().defaultTo(0);
18+
proxy_host.string('load_balancer_ip').notNull().defaultTo('');
19+
})
20+
.then(() => {
21+
logger.info('[' + migrate_name + '] proxy_host Table altered');
22+
});
23+
24+
};
25+
26+
/**
27+
* Undo Migrate
28+
*
29+
* @param {Object} knex
30+
* @param {Promise} Promise
31+
* @returns {Promise}
32+
*/
33+
exports.down = function (knex, Promise) {
34+
logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
35+
return Promise.resolve(true);
36+
};

‎backend/schema/endpoints/proxy-hosts.json

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,16 @@
5858
"example": true,
5959
"type": "boolean"
6060
},
61+
"enable_proxy_protocol": {
62+
"description": "Enable PROXY Protocol support",
63+
"example": true,
64+
"type": "boolean"
65+
},
66+
"load_balancer_ip": {
67+
"type": "string",
68+
"minLength": 0,
69+
"maxLength": 255
70+
},
6171
"access_list_id": {
6272
"$ref": "../definitions.json#/definitions/access_list_id"
6373
},
@@ -155,6 +165,12 @@
155165
"allow_websocket_upgrade": {
156166
"$ref": "#/definitions/allow_websocket_upgrade"
157167
},
168+
"enable_proxy_protocol": {
169+
"$ref": "#/definitions/enable_proxy_protocol"
170+
},
171+
"load_balancer_ip": {
172+
"$ref": "#/definitions/load_balancer_ip"
173+
},
158174
"access_list_id": {
159175
"$ref": "#/definitions/access_list_id"
160176
},
@@ -245,6 +261,12 @@
245261
"allow_websocket_upgrade": {
246262
"$ref": "#/definitions/allow_websocket_upgrade"
247263
},
264+
"enable_proxy_protocol": {
265+
"$ref": "#/definitions/enable_proxy_protocol"
266+
},
267+
"load_balancer_ip": {
268+
"$ref": "#/definitions/load_balancer_ip"
269+
},
248270
"access_list_id": {
249271
"$ref": "#/definitions/access_list_id"
250272
},
@@ -318,6 +340,12 @@
318340
"allow_websocket_upgrade": {
319341
"$ref": "#/definitions/allow_websocket_upgrade"
320342
},
343+
"enable_proxy_protocol": {
344+
"$ref": "#/definitions/enable_proxy_protocol"
345+
},
346+
"load_balancer_ip": {
347+
"$ref": "#/definitions/load_balancer_ip"
348+
},
321349
"access_list_id": {
322350
"$ref": "#/definitions/access_list_id"
323351
},

‎backend/templates/_listen.conf

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,25 @@
1+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
2+
listen 88 proxy_protocol;
3+
{% if ipv6 -%}
4+
listen [::]:88 proxy_protocol;
5+
{% endif %}
6+
{% else -%}
17
listen 80;
28
{% if ipv6 -%}
39
listen [::]:80;
4-
{% else -%}
5-
#listen [::]:80;
10+
{% endif %}
611
{% endif %}
712
{% if certificate -%}
13+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true%}
14+
listen 444 ssl{% if http2_support %} http2{% endif %} proxy_protocol;
15+
{% if ipv6 -%}
16+
listen [::]:444 ssl{% if http2_support %} http2{% endif %} proxy_protocol;
17+
{% endif %}
18+
{% else -%}
819
listen 443 ssl{% if http2_support %} http2{% endif %};
920
{% if ipv6 -%}
1021
listen [::]:443 ssl{% if http2_support %} http2{% endif %};
11-
{% else -%}
12-
#listen [::]:443;
22+
{% endif %}
1323
{% endif %}
1424
{% endif %}
1525
server_name {{ domain_names | join: " " }};

‎backend/templates/_proxy_protocol.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{% if enable_proxy_protocol == 1 or enable_proxy_protocol == true %}
2+
{% if load_balancer_ip != '' %}
3+
set_real_ip_from {{ load_balancer_ip }};
4+
real_ip_header proxy_protocol;
5+
{% endif %}
6+
{% endif %}

‎backend/templates/proxy_host.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ server {
1212
{% include "_exploits.conf" %}
1313
{% include "_hsts.conf" %}
1414
{% include "_forced_ssl.conf" %}
15+
{% include "_proxy_protocol.conf" %}
1516

1617
{% if allow_websocket_upgrade == 1 or allow_websocket_upgrade == true %}
1718
proxy_set_header Upgrade $http_upgrade;

‎frontend/js/app/nginx/proxy/form.ejs

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@
7272
</label>
7373
</div>
7474
</div>
75-
<div class="col-sm-12 col-md-12">
75+
<div class="col-sm-6 col-md-6">
7676
<div class="form-group">
7777
<label class="custom-switch">
7878
<input type="checkbox" class="custom-switch-input" name="allow_websocket_upgrade" value="1"<%- allow_websocket_upgrade ? ' checked' : '' %>>
@@ -81,6 +81,21 @@
8181
</label>
8282
</div>
8383
</div>
84+
<div class="col-sm-6 col-md-6">
85+
<div class="form-group">
86+
<label class="custom-switch">
87+
<input type="checkbox" class="custom-switch-input" name="enable_proxy_protocol" value="1"<%- enable_proxy_protocol ? ' checked' : '' %>>
88+
<span class="custom-switch-indicator"></span>
89+
<span class="custom-switch-description"><%- i18n('proxy-hosts', 'enable-proxy-protocol') %> <a href="https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/#introduction" target="_blank"><i class="fe fe-help-circle"></i></a></span>
90+
</label>
91+
</div>
92+
</div>
93+
<div class="col-sm-12 col-md-12">
94+
<div class="form-group">
95+
<label class="form-label"><%- i18n('proxy-hosts', 'load-balancer-ip') %> <a href="https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/#changing-the-load-balancers-ip-address-to-the-client-ip-address" target="_blank"><i class="fe fe-help-circle"></i></a></label>
96+
<input type="text" name="load_balancer_ip" class="form-control text-monospace" placeholder="" value="<%- load_balancer_ip %>" autocomplete="off" maxlength="255" <%- enable_proxy_protocol ? '' : ' disabled' %>>
97+
</div>
98+
</div>
8499

85100
<div class="col-sm-12 col-md-12">
86101
<div class="form-group">

‎frontend/js/app/nginx/proxy/form.js

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,23 @@ module.exports = Mn.View.extend({
4343
dns_provider_credentials: 'textarea[name="meta[dns_provider_credentials]"]',
4444
propagation_seconds: 'input[name="meta[propagation_seconds]"]',
4545
forward_scheme: 'select[name="forward_scheme"]',
46-
letsencrypt: '.letsencrypt'
46+
letsencrypt: '.letsencrypt',
47+
enable_proxy_protocol: 'input[name="enable_proxy_protocol"]',
48+
load_balancer_ip: 'input[name="load_balancer_ip"]'
4749
},
4850

4951
regions: {
5052
locations_regions: '@ui.locations_container'
5153
},
5254

5355
events: {
56+
'change @ui.enable_proxy_protocol': function () {
57+
let checked = this.ui.enable_proxy_protocol.prop('checked');
58+
this.ui.load_balancer_ip
59+
.prop('disabled', !checked)
60+
.parents('.form-group')
61+
.css('opacity', checked ? 1 : 0.5);
62+
},
5463
'change @ui.certificate_select': function () {
5564
let id = this.ui.certificate_select.val();
5665
if (id === 'new') {
@@ -264,6 +273,7 @@ module.exports = Mn.View.extend({
264273
onRender: function () {
265274
let view = this;
266275

276+
this.ui.enable_proxy_protocol.trigger('change');
267277
this.ui.ssl_forced.trigger('change');
268278
this.ui.hsts_enabled.trigger('change');
269279

‎frontend/js/i18n/messages.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,9 @@
133133
"allow-websocket-upgrade": "Websockets Support",
134134
"ignore-invalid-upstream-ssl": "Ignore Invalid SSL",
135135
"custom-forward-host-help": "Add a path for sub-folder forwarding.\nExample: 203.0.113.25/path/",
136-
"search": "Search Host…"
136+
"search": "Search Host…",
137+
"enable-proxy-protocol": "Enable PROXY Protocol",
138+
"load-balancer-ip": "Load balancer or TCP proxy IP / CIDR range "
137139
},
138140
"redirection-hosts": {
139141
"title": "Redirection Hosts",

‎frontend/js/models/proxy-host.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ const model = Backbone.Model.extend({
1919
hsts_subdomains: false,
2020
caching_enabled: false,
2121
allow_websocket_upgrade: false,
22+
enable_proxy_protocol: false,
23+
load_balancer_ip: '',
2224
block_exploits: false,
2325
http2_support: false,
2426
advanced_config: '',

0 commit comments

Comments
 (0)