edge: port 80 serves the full Forgejo UI in cleartext — no HTTP→HTTPS redirect #64
Labels
No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
open-platform/mitosis#64
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found while validating a fresh wb-gate germination (plat.local).
curl --resolve git.plat.local:80:127.0.0.1 http://git.plat.local/→ HTTP/1.1 200 with the full Forgejo HTML (login form posts credentials in cleartext); expected 301/308 to https. Traefik ships no redirectscheme middleware / websecure-only entrypoint in gitops. Low risk on a local k3d loopback, real on any host-exposed :80 (HYB single-VPS path exposes traefik behind the tunnel — the tunnel terminates TLS, but a direct-IP :80 hit still lands plaintext). Fix: gitops traefik config — global entrypoint redirection web→websecure (or a router-level redirectscheme middleware), carried to daughters via the next seed refresh.Status: first approach FAILED validation on the live daughter and was reverted there — do not ship. Attaching a
redirectSchememiddleware at the entrypoint (ports.web.middlewares: [traefik-redirect-to-https@kubernetescrd], middleware via chartextraObjects) makes traefik v3.5 404 EVERY router on the web entrypoint: at boot the Ingress-provider routers build before the CRD provider snapshot merges, each logsmiddleware …@kubernetescrd does not exist, and the config never converges even after clean restarts. Findings + constraints for the rework: (a) the HYB-1 tunnel forwards plain HTTP intoweb(http://traefik.kube-system.svc), so a NAIVE entrypointredirectionswould loop tunnel traffic unless the tunnel contract moves to an https origin (cloudflared supports noTLSVerify); (b) cloudflared setsX-Forwarded-Proto: https, so a scheme-aware redirect + trusted forwardedHeaders remains the semantics we want IF the middleware can be defined provider-locally (file provider / static config) instead of cross-provider; (c) registry mirror path bypasses traefik (Caddy → forgejo-http:3000) — unaffected either way. Rework in progress on branchfix/web-entrypoint-https-redirect(plat/gitops).Rework shipped: plat/gitops#11 (plat/gitops#11) replaces the failed
@kubernetescrdentrypoint-middleware attempt with a file-provider middleware — chart-nativeproviders.file.contentrendersredirect-to-httpsinto a ConfigMap loaded at boot before any Kubernetes provider syncs, so the entrypoint reference is first-try-safe on a fresh germination (the@kubernetescrdref raced the CRD provider's first sync and 404'd every Ingress-provider web router, never converging). Validated on the live k3d daughter with the byte-identical change flux-applied to its gitops main: barehttp://git.plat.local/→301 https://git.plat.local/(path+query preserved),:443→ 200, in-cluster plain-HTTP with trustedX-Forwarded-Proto: https→ 200 with no redirect (HYB-1 tunnel semantics intact viaforwardedHeaders.trustedIPson the pod/service CIDRs), same request without the header → 301, app ingress (pulse) → 200, and every assertion re-passed identically after arollout restartboot-race check with zeromiddleware does not existlog lines.Fixed by plat/gitops#11 (file-provider redirectScheme + trusted XFP), merged to gitops main and carried in the genesis seed. Validated on two platforms incl. germinated-first-boot + traefik-restart race checks; the failed entrypoint@kubernetescrd approach is documented above for posterity.