http.Server was built with only Addr and Handler, so every timeout was infinite.
Behind a reverse proxy that is survivable because the proxy has its own; serving
TLS directly, which SERVER_CERT_FILE now allows, it means a slow client can hold
a connection and its goroutine indefinitely.
ReadHeaderTimeout and IdleTimeout are short. ReadTimeout is 10 minutes: it has
to clear a 150 MiB upload on a slow link, so it is a ceiling on a stalled
connection rather than a throughput rule. WriteTimeout is deliberately left
unset for the same reason.
Reported by CodeRabbit (CWE-400) on #7514.
The minio/minio repository is no longer on Docker Hub: the repo and the
pinned tag both return 404 and anonymous pulls are refused, so
Test_S3HandlerGetUploadURL fails on every Linux CI run with "pull access
denied for minio/minio".
The same release is published at quay.io/minio/minio, digest
sha256:a1ea29fa28355559ef137d71fc570e508a214ec84ff8083e39bc5428980b015e,
so the testcontainers request points there and keeps the pinned tag.
The clients refuse a plaintext upload service: they ask it for an upload URL and
then PUT the bundle to whatever comes back, so a plaintext hop exposes both. An
operator pointing their deployment at this server therefore needs it to speak
https, and until now it could only do so behind a separate terminator.
SERVER_CERT_FILE and SERVER_KEY_FILE switch it to ListenAndServeTLS. They must
be set together. Unset keeps the current plaintext listener, for a deployment
that does terminate TLS in front of it.
Add an upload bundle option with the flag --upload-bundle; by default, the upload will use a NetBird address, which can be replaced using the flag --upload-bundle-url.
The upload server is available under the /upload-server path. The release change will push a docker image to netbirdio/upload image repository.
The server supports using s3 with pre-signed URL for direct upload and local file for storing bundles.
riccardom