move policy to portal
Kim committed
Mar 11, 2026 at 11:35 UTC
64f566f96b62841a98b8165dfa9f3c0016a8d9ae
3 files changed
+22
-7
cmd/relay-server/serve.go
+1
-7
@@ -14,7 +14,6 @@ import (
14
"github.com/gosuda/portal/v2/portal"
15
"github.com/gosuda/portal/v2/portal/acme"
16
"github.com/gosuda/portal/v2/portal/admin"
17
- "github.com/gosuda/portal/v2/portal/policy"
17
"github.com/gosuda/portal/v2/types"
18
)
19
@@ -30,12 +29,6 @@ func runServer(cfg relayServerConfig) error {
29
rootHost := portal.PortalRootHost(cfg.PortalURL)
30
apiListenAddr := fmt.Sprintf(":%d", cfg.APIPort)
31
sniListenAddr := fmt.Sprintf(":%d", cfg.SNIPort)
33
- trustedProxyCIDRs, err := policy.ParseTrustedProxyCIDRs(cfg.TrustedProxyCIDRs)
34
- if err != nil {
35
- return fmt.Errorf("parse trusted proxy cidrs: %w", err)
36
- }
37
- policy.SetTrustedProxyCIDRs(trustedProxyCIDRs)
38
-
32
server, err := portal.NewServer(portal.ServerConfig{
33
PortalURL: cfg.PortalURL,
34
ACME: acme.Config{
@@ -50,6 +43,7 @@ func runServer(cfg relayServerConfig) error {
43
},
44
APIListenAddr: apiListenAddr,
45
SNIListenAddr: sniListenAddr,
46
+ TrustedProxyCIDRs: cfg.TrustedProxyCIDRs,
47
TrustProxyHeaders: cfg.TrustProxyHeaders,
48
})
49
if err != nil {
portal/server.go
+6
@@ -33,6 +33,7 @@ type ServerConfig struct {
33
ACME acme.Config
34
APIListenAddr string
35
SNIListenAddr string
36
+ TrustedProxyCIDRs string
37
LeaseTTL time.Duration
38
ClaimTimeout time.Duration
39
IdleKeepaliveInterval time.Duration
@@ -67,6 +68,11 @@ func NewServer(cfg ServerConfig) (*Server, error) {
68
cfg.IdleKeepaliveInterval = durationOrDefault(cfg.IdleKeepaliveInterval, defaultIdleKeepalive)
69
cfg.ReadyQueueLimit = intOrDefault(cfg.ReadyQueueLimit, defaultReadyQueueLimit)
70
cfg.ClientHelloTimeout = durationOrDefault(cfg.ClientHelloTimeout, defaultClientHelloWait)
71
+ trustedProxyCIDRs, err := policy.ParseTrustedProxyCIDRs(cfg.TrustedProxyCIDRs)
72
+ if err != nil {
73
+ return nil, fmt.Errorf("parse trusted proxy cidrs: %w", err)
74
+ }
75
+ policy.SetTrustedProxyCIDRs(trustedProxyCIDRs)
76
rootHost := PortalRootHost(cfg.PortalURL)
77
if rootHost == "" {
78
return nil, errors.New("root host is required")
portal/server_test.go
+15
@@ -95,3 +95,18 @@ func TestServerStartRejectsMismatchedACMEBaseDomain(t *testing.T) {
95
t.Fatalf("Start() error = %v, want base domain mismatch", err)
96
}
97
}
98
+
99
+func TestNewServerRejectsInvalidTrustedProxyCIDRs(t *testing.T) {
100
+ t.Parallel()
101
+
102
+ _, err := NewServer(ServerConfig{
103
+ PortalURL: "https://portal.example.com",
104
+ TrustedProxyCIDRs: "not-a-cidr",
105
+ })
106
+ if err == nil {
107
+ t.Fatal("NewServer() error = nil, want invalid trusted proxy cidr error")
108
+ }
109
+ if !strings.Contains(err.Error(), "parse trusted proxy cidrs") {
110
+ t.Fatalf("NewServer() error = %v, want trusted proxy parse error", err)
111
+ }
112
+}