sneak
38c72bcbcc
All checks were successful
check / check (push) Successful in 3m46s
The plaintext listener bound `:PORT`, so it answered on every interface with no way to say otherwise. That published the admin UI and the unauthenticated receiver in cleartext beside whatever TLS proxy was in front of them, reachable from any host that could route to the machine. BIND_ADDRESS now selects the address. The binary defaults to 127.0.0.1, which is the safe answer for a bare host: reaching webhooker from elsewhere becomes a deliberate act. The image sets 0.0.0.0, which is the correct answer inside a container, where the network namespace is already the boundary and exposure is decided by the publish flag instead — so `-p 127.0.0.1:8080:8080` is what the README shows. Existing container deployments are unaffected. Only IP address literals are accepted: hostnames, host:port and CIDR blocks abort startup naming the variable and the value, and a literal that is not an address of this host fails at listen and exits non-zero. The http.Server is now built in New rather than in the serving goroutine, and sentryEnabled is atomic. Both fields were written by the serving goroutine and read by the fx stop hook with nothing ordering them, and the OnStart hook returns before that goroutine has necessarily run: cleanShutdown could dereference a nil httpServer on an early SIGTERM, and both reads raced. No test started and stopped the server, so nothing observed it. Closes #226. README gains a "Deployment behind a reverse proxy" section: a working nginx server block, and the five things that are silent when wrong — bind or firewall the app port, WEBHOOKER_ENVIRONMENT=prod, TRUSTED_PROXIES, Host as $http_host rather than $host, and keeping the proxy's access log because webhooker's own records only the proxy.
84 lines
2.5 KiB
Go
84 lines
2.5 KiB
Go
package server
|
|
|
|
import (
|
|
"errors"
|
|
"net"
|
|
"net/http"
|
|
"strconv"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
// httpReadTimeout is the maximum duration for reading the
|
|
// entire request, including the body.
|
|
httpReadTimeout = 10 * time.Second
|
|
|
|
// httpWriteTimeout is the maximum duration before timing out
|
|
// writes of the response. It must stay above the router's
|
|
// requestTimeout (60s, in routes.go) so the middleware timeout
|
|
// fires first and returns a clean 503, rather than the transport
|
|
// cutting the connection at the socket write deadline.
|
|
httpWriteTimeout = 65 * time.Second
|
|
|
|
// httpMaxHeaderBytes is the maximum number of bytes the
|
|
// server will read parsing the request headers.
|
|
httpMaxHeaderBytes = 1 << 20
|
|
)
|
|
|
|
// listenAddr renders the address the HTTP listener binds.
|
|
//
|
|
// The host half is always present: an empty host would be the
|
|
// wildcard, and the whole point of BIND_ADDRESS is that binding every
|
|
// interface is a choice the operator makes rather than one the
|
|
// process makes for them. Config guarantees a literal, so
|
|
// JoinHostPort's bracketing is enough to make IPv6 well formed.
|
|
func (s *Server) listenAddr() string {
|
|
return net.JoinHostPort(
|
|
s.params.Config.BindAddress,
|
|
strconv.Itoa(s.params.Config.Port),
|
|
)
|
|
}
|
|
|
|
// newHTTPServer builds the HTTP server for this Server's
|
|
// configuration.
|
|
//
|
|
// It is called from New, on the constructing goroutine, rather than
|
|
// from the serving goroutine that used to assign s.httpServer
|
|
// directly. Two goroutines reach that field — the serving goroutine
|
|
// and the fx stop hook, which calls Shutdown on it — with nothing
|
|
// ordering them. Constructing it during New puts the write before
|
|
// every hook fx will later run, which both removes the race and rules
|
|
// out the nil dereference a stop that arrived before the serving
|
|
// goroutine had run would have caused.
|
|
func (s *Server) newHTTPServer() *http.Server {
|
|
return &http.Server{
|
|
Addr: s.listenAddr(),
|
|
ReadTimeout: httpReadTimeout,
|
|
WriteTimeout: httpWriteTimeout,
|
|
MaxHeaderBytes: httpMaxHeaderBytes,
|
|
Handler: s,
|
|
}
|
|
}
|
|
|
|
func (s *Server) serveUntilShutdown() {
|
|
// add routes
|
|
// this does any necessary setup in each handler
|
|
s.SetupRoutes()
|
|
|
|
s.log.Info("http begin listen", "listenaddr", s.httpServer.Addr)
|
|
|
|
err := s.httpServer.ListenAndServe()
|
|
if err != nil && !errors.Is(err, http.ErrServerClosed) {
|
|
s.log.Error("listen error", "error", err)
|
|
s.shutdownOnListenFailure()
|
|
}
|
|
}
|
|
|
|
// ServeHTTP delegates to the router.
|
|
func (s *Server) ServeHTTP(
|
|
w http.ResponseWriter,
|
|
r *http.Request,
|
|
) {
|
|
s.router.ServeHTTP(w, r)
|
|
}
|