awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: made SSL header key configurable via env

Browse Source
This commit is contained in:
Sheen Capadngan
2024-08-23 01:38:12 +08:00
parent f88389bf9e
commit 288d7e88ae
4 changed files with 27 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.env.example
View File

@@ -70,3 +70,5 @@ NEXT_PUBLIC_CAPTCHA_SITE_KEY=
PLAIN_API_KEY= PLAIN_API_KEY=
PLAIN_WISH_LABEL_IDS= PLAIN_WISH_LABEL_IDS=
SSL_CLIENT_CERTIFICATE_HEADER_KEY=

3
backend/src/lib/config/env.ts
View File

@@ -141,7 +141,8 @@ const envSchema = z
CAPTCHA_SECRET: zpStr(z.string().optional()), CAPTCHA_SECRET: zpStr(z.string().optional()),
PLAIN_API_KEY: zpStr(z.string().optional()), PLAIN_API_KEY: zpStr(z.string().optional()),
PLAIN_WISH_LABEL_IDS: zpStr(z.string().optional()), PLAIN_WISH_LABEL_IDS: zpStr(z.string().optional()),
DISABLE_AUDIT_LOG_GENERATION: zodStrBool.default("false") DISABLE_AUDIT_LOG_GENERATION: zodStrBool.default("false"),
SSL_CLIENT_CERTIFICATE_HEADER_KEY: zpStr(z.string().optional()).default("x-ssl-client-cert")
}) })
.transform((data) => ({ .transform((data) => ({
...data, ...data,

7
backend/src/server/routes/est/certificate-est-router.ts
View File

@@ -1,10 +1,13 @@
import bcrypt from "bcrypt"; import bcrypt from "bcrypt";
import { z } from "zod"; import { z } from "zod";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
export const registerCertificateEstRouter = async (server: FastifyZodProvider) => { export const registerCertificateEstRouter = async (server: FastifyZodProvider) => {
const appCfg = getConfig();
// add support for CSR bodies // add support for CSR bodies
server.addContentTypeParser("application/pkcs10", { parseAs: "string" }, (_, body, done) => { server.addContentTypeParser("application/pkcs10", { parseAs: "string" }, (_, body, done) => {
try { try {
@@ -99,7 +102,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
return server.services.certificateEst.simpleEnroll({ return server.services.certificateEst.simpleEnroll({
csr: req.body, csr: req.body,
certificateTemplateId: req.params.certificateTemplateId, certificateTemplateId: req.params.certificateTemplateId,
sslClientCert: req.headers["x-ssl-client-cert"] as string sslClientCert: req.headers[appCfg.SSL_CLIENT_CERTIFICATE_HEADER_KEY] as string
}); });
} }
}); });
@@ -126,7 +129,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
return server.services.certificateEst.simpleReenroll({ return server.services.certificateEst.simpleReenroll({
csr: req.body, csr: req.body,
certificateTemplateId: req.params.certificateTemplateId, certificateTemplateId: req.params.certificateTemplateId,
sslClientCert: req.headers["x-ssl-client-cert"] as string sslClientCert: req.headers[appCfg.SSL_CLIENT_CERTIFICATE_HEADER_KEY] as string
}); });
} }
}); });

17
nginx/default.dev.conf
View File

@@ -14,6 +14,23 @@ server {
proxy_cookie_path / "/; HttpOnly; SameSite=strict"; proxy_cookie_path / "/; HttpOnly; SameSite=strict";
} }
location /.well-known/est {
proxy_set_header X-Real-RIP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-NginX-Proxy true;
proxy_set_header X-SSL-Client-Cert $ssl_client_escaped_cert;
proxy_pass http://backend:4000;
proxy_redirect off;
# proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
proxy_cookie_path / "/; HttpOnly; SameSite=strict";
}
location / { location / {
include /etc/nginx/mime.types; include /etc/nginx/mime.types;