Documentation
¶
Index ¶
Constants ¶
const ( EnvUserTokenHeader = "USER_TOKEN_HEADER" EnvUserTokenEncodedKey = "USER_TOKEN_ENCODED_KEY" EnvInternalAPIKeyHeader = "INTERNAL_API_KEY_HEADER" EnvInternalAPIKey = "INTERNAL_API_KEY" EnvClientAPIKeyHeader = "CLIENT_API_KEY_HEADER" EnvClientAPIKey = "CLIENT_API_KEY" EnvTraefikRoutesFile = "TRAEFIK_ROUTES_FILE" EnvTraefikRouterPrefix = "TRAEFIK_ROUTER_PREFIX" EnvTraefikService = "TRAEFIK_SERVICE" EnvTraefikHost = "TRAEFIK_HOST" EnvTraefikEntryPoints = "TRAEFIK_ENTRYPOINTS" EnvTraefikCertResolver = "TRAEFIK_CERT_RESOLVER" EnvTraefikMiddlewaresDefault = "TRAEFIK_MIDDLEWARES_DEFAULT" EnvTraefikMiddlewaresEnriched = "TRAEFIK_MIDDLEWARES_ENRICHED" EnvTraefikMiddlewaresProtected = "TRAEFIK_MIDDLEWARES_PROTECTED" EnvTraefikMiddlewaresAdmin = "TRAEFIK_MIDDLEWARES_ADMIN" )
const ( PolicyEnriched = "enriched" PolicyProtected = "protected" PolicyAdmin = "admin" PolicyInternalKey = "internal-key" )
const ( TraefikAuthVerify = "auth-verify" TraefikAuthEnrich = "auth-enrich" TraefikRateLimitAdmin = "rate-limit-admin" )
Traefik middlewares the shared policies apply at the proxy by default, as defined in the USH Traefik configuration.
Variables ¶
var ( ErrInvalidTraefikName = fmt.Errorf("traefik name is empty or contains whitespace") ErrMissingTraefikService = fmt.Errorf("traefik routes file set without a traefik service") ErrMissingConfig = fmt.Errorf("config missing") ErrInternalKeyTooShort = fmt.Errorf("internal API key shorter than 32 characters") )
Functions ¶
func InternalKeyPolicy ¶
InternalKeyPolicy registers the internal-key policy on the http module. Configure fails without a header or with an internal API key shorter than 32 characters.
func TraefikExporter ¶
func TraefikExporter(cfg TraefikConfig) modules.Option
TraefikExporter adds a route exporter to the http module that writes the defined routes as Traefik configuration. The shared policies get their default Traefik middlewares, or those in SharedPolicyMiddlewares, when the service has registered them. Configure fails on an empty entry point or middleware name, or one containing whitespace, and on replaced middlewares that are empty or for a policy other than enriched, protected or admin.
func UserPolicies ¶
UserPolicies registers the enriched, protected and admin policies on the http module. Configure fails without a header or a valid base64-encoded user token key.
Types ¶
type Config ¶
type Config struct {
// UserToken.Key is the base64-encoded HS256 user token key.
UserToken HeaderKey
InternalKey HeaderKey
// ClientKey is for middleware.ClientKeyAuth. An empty Key disables the
// check.
ClientKey HeaderKey
Traefik TraefikConfig
}
func ConfigFromEnv ¶
func ConfigFromEnv() Config
ConfigFromEnv reads Config from the Env* variables, for a service to call from its settings. No variable is required here; the policy a key is for fails when it is loaded without one. Unset headers get the middleware.Default*Header values and an unset router prefix the Traefik service. SharedPolicyMiddlewares holds only the policies whose variable is set. PolicyMiddlewares is left for the service to set in code.
type TraefikConfig ¶
type TraefikConfig struct {
// RoutesFile is where the Traefik dynamic configuration is written. Empty
// disables the export.
RoutesFile string
RouterPrefix string
// Service is required when RoutesFile is set.
Service string
Host string
EntryPoints []string
CertResolver string
DefaultMiddlewares []string
// PolicyMiddlewares adds Traefik middlewares to the exported routes of a
// policy the service registers itself, e.g. {"bulk-upload": {"rate-limit-upload"}}.
// The shared policies' Traefik middlewares are set with
// SharedPolicyMiddlewares instead.
PolicyMiddlewares map[string][]string
// protected or admin policy, e.g. {"protected": {"auth-test-forward@docker"}}
// where one Traefik serves several environments. A shared policy without an
// entry keeps its default middlewares.
SharedPolicyMiddlewares map[string][]string
}
Source Files