http.Server was built with only Addr and Handler, so every timeout was infinite.
Behind a reverse proxy that is survivable because the proxy has its own; serving
TLS directly, which SERVER_CERT_FILE now allows, it means a slow client can hold
a connection and its goroutine indefinitely.
ReadHeaderTimeout and IdleTimeout are short. ReadTimeout is 10 minutes: it has
to clear a 150 MiB upload on a slow link, so it is a ceiling on a stalled
connection rather than a throughput rule. WriteTimeout is deliberately left
unset for the same reason.
Reported by CodeRabbit (CWE-400) on #7514.
The clients refuse a plaintext upload service: they ask it for an upload URL and
then PUT the bundle to whatever comes back, so a plaintext hop exposes both. An
operator pointing their deployment at this server therefore needs it to speak
https, and until now it could only do so behind a separate terminator.
SERVER_CERT_FILE and SERVER_KEY_FILE switch it to ListenAndServeTLS. They must
be set together. Unset keeps the current plaintext listener, for a deployment
that does terminate TLS in front of it.
- introduce variables to avoid publishing latest docker tags and installers
- Refactor .goreleaser.yaml to simplify docker configurations and add environment-driven flags
- removed management debug containers (it was doing only log var)
- Stopped building arm v6 32bits in favor of v7 32 bits for services (not client)
- Add target argument to docker files
This will allow running netbird commands (including debugging) against the daemon and provide a flow similar to non-container usages.
It will by default both log to file and stderr so it can be handled more uniformly in container-native environments.
Add an upload bundle option with the flag --upload-bundle; by default, the upload will use a NetBird address, which can be replaced using the flag --upload-bundle-url.
The upload server is available under the /upload-server path. The release change will push a docker image to netbirdio/upload image repository.
The server supports using s3 with pre-signed URL for direct upload and local file for storing bundles.
riccardom