From 15f7f41afe116aae5193ce44bd73b4867e112935 Mon Sep 17 00:00:00 2001 From: akdk7 <97784161+akdk7@users.noreply.github.com> Date: Fri, 14 Feb 2025 09:23:36 +0100 Subject: [PATCH] =?UTF-8?q?This=20push=20request=20is=20about=20handling?= =?UTF-8?q?=20Traefik=20ipallowlist=20to=20synapse-ad=E2=80=A6=20(#4063)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * This push request is about handling Traefik ipallowlist to synapse-admin application. It's my first push request. If I forgot something please let me know. :-) * Changed position of variable and naming for better expandebility of traefik options * Remove useless `noqa var-naming` comment and too many blank lines at the end of the file --------- Co-authored-by: AkDk7 Co-authored-by: Slavi Pantaleev --- roles/custom/matrix-synapse-admin/defaults/main.yml | 5 +++++ roles/custom/matrix-synapse-admin/templates/labels.j2 | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml index 9fcf9532e..50ebe9098 100644 --- a/roles/custom/matrix-synapse-admin/defaults/main.yml +++ b/roles/custom/matrix-synapse-admin/defaults/main.yml @@ -49,6 +49,11 @@ matrix_synapse_admin_container_labels_traefik_priority: 0 matrix_synapse_admin_container_labels_traefik_entrypoints: web-secure matrix_synapse_admin_container_labels_traefik_tls: "{{ matrix_synapse_admin_container_labels_traefik_entrypoints != 'web' }}" matrix_synapse_admin_container_labels_traefik_tls_certResolver: default # noqa var-naming +# This setting is to define a list ip addresses to allow access to synapse-admin. +# Each IP address should be in CIDR format, e.g. xxx.xxx.xxx.xxx/xx. +# For more information, see: https://doc.traefik.io/traefik/middlewares/http/ipallowlist/ +# If the list is empty, all IP addresses are allowed. +matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange: [] # Controls which additional headers to attach to all HTTP responses. # To add your own headers, use `matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom` diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2 index b4e973e00..eeb29756e 100644 --- a/roles/custom/matrix-synapse-admin/templates/labels.j2 +++ b/roles/custom/matrix-synapse-admin/templates/labels.j2 @@ -9,6 +9,11 @@ traefik.http.services.matrix-synapse-admin.loadbalancer.server.port=80 {% set middlewares = [] %} +{% if matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %} +traefik.http.middlewares.matrix-synapse-admin-ipallowlist.ipallowlist.sourcerange={{ matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }} +{% set middlewares = middlewares + ['matrix-synapse-admin-ipallowlist'] %} +{% endif %} + {% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %} traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$ traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.replacement=${1}/