pascal
0cb02bd906
fix path handling + extract targets to separate table + guard resource/peer deletion
2026-02-10 17:12:34 +01:00
mlsmaycon
08d3867f41
update error page
2026-02-10 16:54:05 +01:00
mlsmaycon
b16d63643c
Add group-based access control for SSO reverse proxy authentication
...
Implement user group validation during OAuth callback to ensure users
belong to allowed distribution groups before granting access to reverse
proxies. This provides account isolation and fine-grained access control.
Key changes:
- Add ValidateUserGroupAccess to ProxyServiceServer for group membership checks
- Redirect denied users to error page with access_denied parameter
- Handle OAuth error responses in proxy middleware
- Add comprehensive integration tests for auth callback flow
2026-02-10 16:25:00 +01:00
Eduard Gert
940d01bdea
Merge remote-tracking branch 'origin/prototype/reverse-proxy' into prototype/reverse-proxy
2026-02-10 14:39:48 +01:00
Eduard Gert
ba9158d159
Remove peer card from proxy error page
2026-02-10 14:39:25 +01:00
pascal
ca9a7e11ef
continue on host lookup failure
2026-02-10 14:38:15 +01:00
pascal
a803f47685
add network map support for clustering
2026-02-10 14:29:20 +01:00
Viktor Liu
79fed32f01
Add wg port configuration
2026-02-10 19:55:48 +08:00
Viktor Liu
6b00bb0a66
Strip session_token on redirect
2026-02-10 18:27:31 +08:00
mlsmaycon
e2adef1eea
add back notBefore and now to cert log
2026-02-09 20:37:20 +01:00
pascal
9e5fa11792
handle multiple path
2026-02-09 19:25:30 +01:00
pascal
1ff75acb31
handle default ports
2026-02-09 19:23:39 +01:00
pascal
1754160686
handle default ports
2026-02-09 19:21:43 +01:00
pascal
423f6266fb
handle default ports
2026-02-09 18:18:53 +01:00
pascal
16d1b4a14a
handle default ports
2026-02-09 18:15:26 +01:00
pascal
7c14056faf
fix resource lookup
2026-02-09 17:58:28 +01:00
pascal
62e37dc2e2
fix host resolution
2026-02-09 17:56:38 +01:00
pascal
6a08695ee8
Merge branch 'main' into prototype/reverse-proxy
2026-02-09 17:16:00 +01:00
pascal
9a67a8e427
send updates on changes
2026-02-09 17:06:04 +01:00
Viktor Liu
73aa0785ba
Add cert health info to checks
2026-02-09 22:55:12 +08:00
Viktor Liu
53c1016a8e
Add graceful shutdown for Kubernetes
2026-02-09 22:55:12 +08:00
Viktor Liu
fd442138e6
Add cert hot reload and cert file locking
...
Adds file-watching certificate hot reload, cross-replica ACME
certificate lock coordination via flock (Unix) and Kubernetes lease
objects.
2026-02-09 22:55:12 +08:00
pascal
be5f30225a
fix embedded exception
2026-02-09 15:28:48 +01:00
pascal
7467e9fb8c
use portrange
2026-02-09 14:46:23 +01:00
pascal
2390c2e46e
change network map calc to inject proxy policies
2026-02-09 14:41:22 +01:00
Zoltan Papp
6981fdce7e
[client] Fix race condition and ensure correct message ordering in Relay ( #5265 )
...
* Fix race condition and ensure correct message ordering in
connection establishment
Reorder operations in OpenConn to register the connection before
waiting for peer availability. This ensures:
- Connection is ready to receive messages before peer subscription
completes
- Transport messages and onconnected events maintain proper ordering
- No messages are lost during the connection establishment window
- Concurrent OpenConn calls cannot create duplicate connections
If peer availability check fails, the pre-registered connection is
properly cleaned up.
* Handle service shutdown during relay connection initialization
Ensure relay connections are properly cleaned up when the service is not running by verifying `serviceIsRunning` and removing stale entries from `c.conns` to prevent unintended behaviors.
2026-02-09 11:34:24 +01:00
Viktor Liu
08403f64aa
[client] Add env var to skip DNS probing ( #5270 )
2026-02-09 11:09:11 +01:00
Viktor Liu
391221a986
[client] Fix uspfilter duplicate firewall rules ( #5269 )
2026-02-09 10:14:02 +01:00
mlsmaycon
778c223176
fix api handler path
2026-02-09 02:30:06 +01:00
mlsmaycon
36cd0dd85c
temp fix import cycle
2026-02-09 02:10:21 +01:00
mlsmaycon
09a1d5a02d
rename endpoint
2026-02-09 01:48:51 +01:00
mlsmaycon
7c996ac9b5
add AuthCallbackURL
2026-02-09 01:18:49 +01:00
mlsmaycon
cf9fd5d960
add AuthClientID
2026-02-08 19:41:52 +01:00
mlsmaycon
1c5ab7cb8f
add logger support to acme manager
2026-02-08 19:11:27 +01:00
Viktor Liu
aaad3b25a7
Increase client startup timeout
...
The client has to start mgmt, signal, relay and wireguard/netstack.
If this times out, the client shuts down and never manages to start.
2026-02-09 02:02:18 +08:00
Viktor Liu
9904235a2f
Improve embed client error detection and reporting
2026-02-09 01:51:53 +08:00
Viktor Liu
780e9f57a5
Improve mgmt backoff
2026-02-09 01:51:53 +08:00
mlsmaycon
a8db73285b
add issued time log and CT timestamp logs
2026-02-08 18:13:50 +01:00
Viktor Liu
3b43c00d12
Use unique static path for auth assets to avoid collision with routes
2026-02-09 01:10:50 +08:00
Viktor Liu
2f390e1794
Conflate default ports
2026-02-09 00:57:08 +08:00
Viktor Liu
3630ebb3ae
Add option to rewrite redirects
2026-02-09 00:44:47 +08:00
Viktor Liu
260c46df04
Fix broken auth redirect
2026-02-09 00:02:54 +08:00
Viktor Liu
7f11e3205d
Validate target id
2026-02-08 23:44:31 +08:00
Viktor Liu
1c8f92a96f
Fix management nil pointer
2026-02-08 23:29:16 +08:00
Viktor Liu
7b6294b624
Refuse to service a service if auth setup failed
2026-02-08 23:24:43 +08:00
Viktor Liu
156d0b1fef
Fix duplicate path
2026-02-08 21:41:32 +08:00
Viktor Liu
2cf00dba58
Fix missing route
2026-02-08 21:36:55 +08:00
Viktor Liu
d2a7f3ae36
Fix pass host header
2026-02-08 21:33:48 +08:00
Viktor Liu
6a64d4e4dd
Remove test deployment specs
2026-02-08 21:13:22 +08:00
Viktor Liu
51e63c246b
Add health status to debug
2026-02-08 21:04:46 +08:00
pascal