git.iko.soy/typeable/oauth2-proxy
on 8874f73 help sign in
20d4e9c
swap
5 ahead, 1335 behind
4 files changed+37−14
since splitsnapshots
unifiedsplit
docs/configuration/configuration.md+1 oauthproxy.go+12 pkg/apis/options/options.go+16−14 pkg/validation/options_test.go+8
docs/configuration/configuration.md+1
@@ -88,6 +88,7 @@ An example [oauth2-proxy.cfg]({{ site.gitweb }}/contrib/oauth2-proxy.cfg.example
8888| `--provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
8989| `--ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
9090| `--proxy-prefix` | string | the url root path that this proxy should be nested under (e.g. /`<oauth2>/sign_in`) | `"/oauth2"` |
91+| `--proxy-time-out` | duration | timeout for upstream proxy | `"30s"` |
9192| `--proxy-websockets` | bool | enables WebSocket proxying | true |
9293| `--pubjwk-url` | string | JWK pubkey access endpoint: required by login.gov | |
9394| `--real-client-ip-header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |
oauthproxy.go+12
@@ -148,6 +148,18 @@ func (u *UpstreamProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
148148// servers
149149func NewReverseProxy(target *url.URL, opts *options.Options) (proxy *httputil.ReverseProxy) {
150150 proxy = httputil.NewSingleHostReverseProxy(target)
151+ proxy.Transport = &http.Transport{
152+ Proxy: http.ProxyFromEnvironment,
153+ DialContext: (&net.Dialer{
154+ Timeout: time.Duration(opts.ProxyTimeOut) * time.Second,
155+ KeepAlive: 30 * time.Second,
156+ DualStack: true,
157+ }).DialContext,
158+ MaxIdleConns: 100,
159+ IdleConnTimeout: 90 * time.Second,
160+ TLSHandshakeTimeout: 10 * time.Second,
161+ ExpectContinueTimeout: 1 * time.Second,
162+ }
151163 proxy.FlushInterval = opts.FlushInterval
152164 if opts.SSLUpstreamInsecureSkipVerify {
153165 proxy.Transport = &http.Transport{
pkg/apis/options/options.go+16−14
@@ -23,20 +23,21 @@ type SignatureData struct {
2323// Options holds Configuration Options that can be set by Command Line Flag,
2424// or Config File
2525type Options struct {
26− ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
27− PingPath string `flag:"ping-path" cfg:"ping_path"`
28− ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
29− HTTPAddress string `flag:"http-address" cfg:"http_address"`
30− HTTPSAddress string `flag:"https-address" cfg:"https_address"`
31− ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
32− RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
33− ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
34− RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
35− ClientID string `flag:"client-id" cfg:"client_id"`
36− ClientSecret string `flag:"client-secret" cfg:"client_secret"`
37− ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
38− TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
39− TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
26+ ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix"`
27+ PingPath string `flag:"ping-path" cfg:"ping_path"`
28+ ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets"`
29+ HTTPAddress string `flag:"http-address" cfg:"http_address"`
30+ HTTPSAddress string `flag:"https-address" cfg:"https_address"`
31+ ReverseProxy bool `flag:"reverse-proxy" cfg:"reverse_proxy"`
32+ RealClientIPHeader string `flag:"real-client-ip-header" cfg:"real_client_ip_header"`
33+ ForceHTTPS bool `flag:"force-https" cfg:"force_https"`
34+ RawRedirectURL string `flag:"redirect-url" cfg:"redirect_url"`
35+ ClientID string `flag:"client-id" cfg:"client_id"`
36+ ClientSecret string `flag:"client-secret" cfg:"client_secret"`
37+ ClientSecretFile string `flag:"client-secret-file" cfg:"client_secret_file"`
38+ TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`
39+ TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`
40+ ProxyTimeOut time.Duration `flag:"proxy-time-out" cfg:"proxy_time_out" env:"OAUTH2_PROXY_PROXY_TIME_OUT"`
4041
4142 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
4243 KeycloakGroup string `flag:"keycloak-group" cfg:"keycloak_group"`
@@ -166,6 +167,7 @@ func NewOptions() *Options {
166167 ProxyWebSockets: true,
167168 HTTPAddress: "127.0.0.1:4180",
168169 HTTPSAddress: ":443",
170+ ProxyTimeOut: 30, //TIME_OUT in seconds
169171 RealClientIPHeader: "X-Real-IP",
170172 ForceHTTPS: false,
171173 DisplayHtpasswdForm: true,
pkg/validation/options_test.go+8
@@ -140,6 +140,14 @@ func TestRedirectURL(t *testing.T) {
140140 assert.Equal(t, expected, o.GetRedirectURL())
141141}
142142
143+func TestProxyTimeOut(t *testing.T) {
144+ o := testOptions()
145+ o.ProxyTimeOut = 40
146+ assert.Equal(t, nil, o.Validate())
147+ expected := 40
148+ assert.Equal(t, expected, o.ProxyTimeOut)
149+}
150+
143151func TestProxyURLs(t *testing.T) {
144152 o := testOptions()
145153 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")