Skip to content

[proxy] Proxy websocket traffic to slow-server deployment according to Sec-WebSocket-Protocol header #14778

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 21, 2022
Merged

[proxy] Proxy websocket traffic to slow-server deployment according to Sec-WebSocket-Protocol header #14778

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0de1dd8
Run `caddy fmt`
Nov 17, 2022
9481f76
Reverse proxy by `Sec-WebSocket-Protocol` header
Nov 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 40 additions & 28 deletions components/proxy/conf/Caddyfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@

# configure plugin order
# https://caddyserver.com/docs/caddyfile/directives#directive-order
order gitpod.cors_origin before header
order gitpod.workspace_download before redir
order gitpod.headless_log_download before rewrite
order gitpod.configcat before rewrite
order gitpod.sec_websocket_key before header
order gitpod.cors_origin before header
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm assuming the formatting is based on the Caddy fmt command

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

correct 👍

order gitpod.workspace_download before redir
order gitpod.headless_log_download before rewrite
order gitpod.configcat before rewrite
order gitpod.sec_websocket_key before header

servers {
protocols h1 h2 h2c
}
protocols h1 h2 h2c
}
}

(compression) {
Expand All @@ -31,15 +31,15 @@
(security_headers) {
header {
# enable HSTS
Strict-Transport-Security max-age=31536000
Strict-Transport-Security max-age=31536000
# disable clients from sniffing the media type
X-Content-Type-Options nosniff
X-Content-Type-Options nosniff
# Define valid parents that may embed a page
Content-Security-Policy "frame-ancestors 'self' https://*.{$GITPOD_DOMAIN} https://{$GITPOD_DOMAIN}"
Content-Security-Policy "frame-ancestors 'self' https://*.{$GITPOD_DOMAIN} https://{$GITPOD_DOMAIN}"
# keep referrer data off of HTTP connections
Referrer-Policy no-referrer-when-downgrade
Referrer-Policy no-referrer-when-downgrade
# Enable cross-site filter (XSS) and tell browser to block detected attacks
X-XSS-Protection "1; mode=block"
X-XSS-Protection "1; mode=block"

defer # delay changes
}
Expand Down Expand Up @@ -143,10 +143,10 @@

# public-api
api.{$GITPOD_DOMAIN} {
log {
level DEBUG
output stdout
}
log {
level DEBUG
output stdout
}

gitpod.cors_origin {
allowed_origins https://{$GITPOD_DOMAIN}
Expand All @@ -155,7 +155,6 @@ api.{$GITPOD_DOMAIN} {
reverse_proxy public-api-server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:9002
}


# always redirect to HTTPS
http:// {
redir https://{host}{uri} permanent
Expand Down Expand Up @@ -206,15 +205,28 @@ https://{$GITPOD_DOMAIN} {
}

@backend_wss {
path /api/gitpod
path /api/gitpod
}
handle @backend_wss {
gitpod.sec_websocket_key
gitpod.sec_websocket_key

@slow {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧡 Love this change - simply on-point 😄

I'd only suggest we user a custom header instead of the websocket one. Also, we should check this on other HTTP routes that are sent against server as well 👇 .

header "Sec-WebSocket-Protocol" "slow-database"
}

@fast {
not header "Sec-WebSocket-Protocol" "slow-database"
}

uri strip_prefix /api

reverse_proxy @fast server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 {
import upstream_headers
}

uri strip_prefix /api
reverse_proxy server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 {
import upstream_headers
}
reverse_proxy @slow slow-server.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:3000 {
import upstream_headers
}
}

@backend path /api/* /headless-logs/*
Expand Down Expand Up @@ -309,7 +321,7 @@ https://*.*.{$GITPOD_DOMAIN} {
import workspace_transport
import upstream_headers

header_up X-WSProxy-Host {http.request.host}
header_up X-WSProxy-Host {http.request.host}
}
}

Expand All @@ -320,19 +332,19 @@ https://*.*.{$GITPOD_DOMAIN} {
import upstream_headers

header_up X-Gitpod-WorkspaceId {re.host.workspaceID}
header_up X-Gitpod-Port {re.host.workspacePort}
header_up X-WSProxy-Host {http.request.host}
header_up X-Gitpod-Port {re.host.workspacePort}
header_up X-WSProxy-Host {http.request.host}
}
}

@workspace header_regexp host Host ^(?P<workspaceID>[a-z0-9][0-9a-z\-]+).ws(?P<location>-[a-z0-9]+)?.{$GITPOD_DOMAIN}
@workspace header_regexp host Host ^(?P<workspaceID>[a-z0-9][0-9a-z\-]+).ws(?P<location>-[a-z0-9]+)?.{$GITPOD_DOMAIN}
handle @workspace {
reverse_proxy https://ws-proxy.{$KUBE_NAMESPACE}.{$KUBE_DOMAIN}:9090 {
import workspace_transport
import upstream_headers

header_up X-Gitpod-WorkspaceId {re.host.workspaceID}
header_up X-WSProxy-Host {http.request.host}
header_up X-WSProxy-Host {http.request.host}
}
}

Expand Down