1
0
mirror of https://github.com/umputun/reproxy.git synced 2026-04-24 19:13:44 +02:00

517 Commits

Author SHA1 Message Date
Umputun 71fc7f67e5 docs: document forward-health-checks for file and static providers 2026-03-16 02:10:52 -05:00
Dmitry Andreev c18f34362e Add per-route forward-health-checks option (#246)
* add ForwardHealthChecks field to URLMapper and all providers

Add a new per-route boolean option `forward-health-checks` to URLMapper,
parsed by all providers (docker, file, consul-catalog, static).
When enabled, reproxy will forward /ping and /health requests to the
backend instead of handling them with built-in responses.

Made-with: Cursor

* forward /ping and /health to backend for routes with forward-health-checks

Modify pingHandler and healthMiddleware to check if the matched route has
ForwardHealthChecks enabled. If so, the request is forwarded to the backend
instead of being intercepted by reproxy's built-in responses.

Made-with: Cursor

* fixed linter issues

* fix inconsistent forward-health-checks value parsing across providers

Docker now inspects the label value (true/yes/y/1) instead of just
checking key presence. Static provider checks for explicit positive
values instead of treating any non-empty string as truthy.

Made-with: Cursor
2026-03-16 02:09:30 -05:00
Umputun feac4fe375 Merge pull request #248 from paskal/ci/workflow-hardening
ci: harden workflows, upgrade actions, fix caching
2026-03-14 13:48:35 -05:00
Dmitry Verkhoturov 6deccaaa24 ci: harden workflows, upgrade actions, fix caching 2026-03-14 08:01:09 +00:00
Umputun f3f7ade038 Merge pull request #245 from paskal/fix/ci-security-hardening
harden docker workflow against CI injection attacks
2026-03-05 11:51:30 -06:00
Umputun 8cd52c828d fix: add http.Flusher to metrics responseWriter for SSE streaming (#247)
metrics middleware wraps http.ResponseWriter to capture status codes,
but the wrapper did not implement http.Flusher. This caused
httputil.ReverseProxy to fall back to buffered mode, breaking SSE
streaming when MGMT_ENABLED=true.

Also fix wrong error variable in MaxSize parse error wrapping
(err → perr) in main.go.
v1.5.0
2026-03-03 15:39:27 -06:00
Dmitry Verkhoturov e3975c977c remove unused version output from prep step 2026-03-02 21:30:34 +00:00
Dmitry Verkhoturov ec4b282167 pass step outputs via env: in manifest push steps
steps.tags.outputs.* values derived from head_branch were still
interpolated via ${{ }} in run: blocks. Now passed via env:.
2026-03-02 21:16:22 +00:00
Dmitry Verkhoturov 61361183d3 harden docker workflow against CI injection attacks
- add permissions: contents: read, packages: write (least privilege)
- add event == 'push' guard to prevent workflow_run firing on PR events
- use env: mapping for head_branch instead of direct ${{ }} interpolation in shell
2026-03-02 20:52:06 +00:00
Umputun 9b1b4828b9 chore: exclude new gosec taint analysis rules in golangci config 2026-02-17 21:36:18 -06:00
Dmitry Verkhoturov 4089c35899 Add shell completions for bash, zsh, and fish (#244)
* Add shell completions for bash, zsh, and fish

Add completion wrapper scripts that use go-flags' built-in
GO_FLAGS_COMPLETION mechanism. Update .goreleaser.yml to include
completions in release archives, Homebrew formula, and deb/rpm
packages. Suppress version banner in completion mode.

* use verbose completions for zsh and fish descriptions
2026-02-17 21:34:13 -06:00
Umputun 2204ac940c Merge pull request #242 from 2128506/master
implemented cli / environment option for disabling HTTP to HTTPS redirect
2026-02-13 12:20:49 -06:00
Umputun 49f6e0c8d6 fix(lint): suppress revive var-naming for plugin package in golangci config 2026-02-13 11:52:33 -06:00
Umputun 255f0dbdc8 docs: clarify that asset routes require path prefix, not regex
add test reproducing issue #243 where regex route with assets:true
does not match. update README with multi-domain static sites example
and note about path prefix requirement. fix lint issues in handlers,
main and conductor_test.

Related to #243
2026-02-13 11:41:21 -06:00
Victor Kirhenshtein 3385d0792e implemented cli / environment option for disabling HTTP to HTTPS redirect 2026-02-13 13:24:02 +02:00
Umputun 16591a07fe fix(brew): add directory field to publish formula to Formula/
Related to umputun/homebrew-apps#1
2026-02-03 10:56:42 -06:00
Umputun 0eb747801d chore: update zed editor file scan exclusions 2026-01-02 16:07:14 -06:00
Umputun 52444ea624 chore: expand .dockerignore to reduce build context
exclude git, ide configs, test artifacts, private files, examples,
and markdown docs (except README) to minimize docker build context.
2026-01-02 15:50:56 -06:00
Umputun ce922a4290 chore: add zed editor configuration
add .zed/settings.json with file exclusions and .zed/tasks.json with
run configurations for static, docker, and file providers plus build,
test, lint, and coverage tasks. also add coverage.html to .gitignore.
2026-01-02 15:46:32 -06:00
Umputun 2f85c78d31 remove arm/v7 from builds v1.4.0 2026-01-02 13:55:39 -06:00
Umputun d33e949056 disable gpg signing in goreleaser 2026-01-02 13:51:51 -06:00
Umputun 0225d9ff78 handle api-version with v prefix gracefully
Allows users to specify version as "v1.44" or "1.44" - both work correctly.
Adds test for v-prefix handling.
2026-01-02 13:36:44 -06:00
Umputun 9a2dd63f23 add configurable docker API version flag (#241)
Adds --docker.api-version flag (env: DOCKER_API_VERSION) to allow users
to specify the Docker API version. Defaults to 1.24 for backward
compatibility. Users on Docker 29+ should set this to 1.44.

Related to #240
2026-01-02 13:32:56 -06:00
Umputun e264a6e931 feat(metrics): add low-cardinality mode for prometheus metrics
add --mgmt.low-cardinality flag to use route patterns instead of raw
paths for http_response_time_seconds histogram labels. this reduces
metrics cardinality when proxying services with dynamic URLs.

Closes #160
2025-12-11 03:07:19 -06:00
Umputun 9a70a1c8fa fix(auth): address code review findings
- add tests for passwords containing colons
- add test for empty password edge case
- clarify test name for username with colon rejection
- fix comment precision in validateBasicAuthCredentials
- make ParseOnlyFrom filter empty entries like ParseAuth
2025-12-11 01:36:36 -06:00
Umputun 0cee9a87ad fix(test): improve proxy test reliability on CI
- increase test timeout from 120s to 180s
- increase context timeouts to 10s
- increase waitForServer timeout to 5s with 100ms dial timeout
- increase inline Eventually timeouts to 5s
- add missing defer ds.Close() to prevent goroutine leaks
- remove flaky network call in TestHttp_matchHandler
2025-12-11 01:36:36 -06:00
Umputun 76ec9eb79a feat(auth): add per-route basic authentication
add support for per-route basic authentication via AuthUsers field in URLMapper.
routes can now specify their own credentials independent of global basic auth.

- add PerRouteAuth handler with shared credential validation
- support AuthUsers field in file, docker, and consul-catalog providers
- document per-route auth configuration in README
2025-12-11 01:36:36 -06:00
Umputun ed44d5535e Modernize release automation with GoReleaser and multi-arch Docker builds (#238)
* ci: modernize release automation with GoReleaser and multi-arch Docker builds

- Add release.yml workflow for automatic binary publishing via GoReleaser
- Add docker.yml workflow with parallel multi-arch builds (amd64/arm64)
- Remove Docker build steps from ci.yml (now CI-only)
- Add Homebrew tap configuration to goreleaser.yml
- Remove obsolete Dockerfile.artifacts and Makefile dist target
- Update README with Homebrew installation instructions

* fix: use t.Context() in proxy tests to prevent goroutine leaks

* chore: address review feedback - add fetch-depth and update checkout version

* fix goroutine leak in mergeEvents and use t.Context() in tests

the mergeEvents function could block forever when sending to the output
channel after context cancellation. this caused test timeouts and
potential production goroutine leaks. also replaced context.Background()
with t.Context() in tests for proper cleanup on test completion.

* fix flaky TestHttp_healthHandler test

use assert.Eventually to wait for server readiness instead of fixed
sleep. this makes the test more reliable on slow CI runners.

* increase CI test timeout to 120s

* fix flaky proxy tests with require.Eventually for server readiness

replace 10ms sleep after h.Run() with require.Eventually polling
to wait for server to accept connections. this fixes intermittent
"connection refused" errors on slow CI runners.
2025-12-07 17:58:24 -06:00
Umputun c458f8bc10 docs: add missing DNS provider documentation
add GoDaddy, Namecheap, Scaleway, Porkbun, DNSimple, and DuckDNS
to the supported DNS providers list in README
2025-12-06 03:02:43 -06:00
Umputun b7694d034a modernize code for Go 1.24+ linter
- replace interface{} with any
- use range over int instead of traditional for loops
- use slices.Contains instead of manual Contains wrapper
- use strings.SplitSeq, CutPrefix, CutSuffix
- remove unnecessary tt := tt loop captures
- use sync.WaitGroup.Go() where applicable
- update .golangci.yml with intrange and copyloopvar linters
2025-12-06 02:57:08 -06:00
Umputun 484901ba0b fix race condition in plugin registration
use separate regErr variable in AfterFunc goroutine to avoid
data race with the err return value
2025-12-06 02:57:08 -06:00
Umputun d907ae71c2 fix flaky tests with waitForServer helper
use require.Eventually to poll TCP connection until server is ready,
replacing unreliable time.Sleep in TestHttp_health and TestHttp_UpstreamConfig
2025-12-06 02:57:08 -06:00
Umputun 803797ac00 replace httpbin.org with echo.umputun.com in tests
- remove external httpbin.org dependency causing flaky tests
- use echo.umputun.com which is more reliable
2025-12-06 02:57:08 -06:00
Umputun e6be428bb0 fix flaky Test_Main by increasing response header timeout
- increase proxy response header timeout to 30s for external httpbin.org calls
- increase http client timeout to 30s in test
2025-12-06 02:57:08 -06:00
Umputun c48adbb3b5 add DNS-01 providers: Porkbun, DNSimple, DuckDNS
- add libdns providers for Porkbun, DNSimple, and DuckDNS

- add CLI flags for each provider configuration

- add tests for new provider configurations
2025-12-06 02:57:08 -06:00
Umputun 81bf17b937 add DNS-01 providers: GoDaddy, Namecheap, Scaleway
- add libdns providers for GoDaddy, Namecheap, and Scaleway

- add CLI flags for each provider configuration

- add tests for new provider configurations
2025-12-06 02:57:08 -06:00
Umputun 77be32f116 add DNS-01 challenge providers: DigitalOcean, Hetzner, Linode
- add libdns providers for DigitalOcean, Hetzner, and Linode

- add CLI flags for each provider configuration

- add tests for new provider configurations

- update README with new provider documentation

- update CLAUDE.md with provider addition guide

note: Vultr not included due to API incompatibility with libdns v1.1.x
2025-12-06 02:57:08 -06:00
Umputun 9d8e18e570 chore: update goreleaser to v2.13.0 for go 1.25 support
upgrade from goreleaser v1.26.1 (go 1.22) to v2.13.0 (go 1.25)
to fix make dist build failure. also update deprecated --skip-publish
flag to --skip=publish syntax.
2025-12-06 01:51:08 -06:00
Umputun 2c919357b5 docs: document dynamic SSL certificate discovery for ACME providers v1.3.0 2025-12-05 23:43:33 -06:00
Umputun c9c8414f08 Add configurable upstream connection limits (#235)
* add configurable upstream connection limits

Add new --upstream.max-idle-conns and --upstream.max-conns options
to configure the HTTP transport connection pool settings.

- max-idle-conns: max idle connections total (default: 100)
- max-conns: max connections per upstream host, 0=unlimited (default: 0)

This allows users to limit concurrent connections to backend servers,
preventing connection exhaustion when upstreams have limited capacity.

Related to #159

* fix flaky TestHttp_withBasicAuth test

Use require.Eventually to wait for server readiness instead of
fixed sleep, preventing connection refused errors on CI.
2025-11-27 00:38:38 -06:00
Umputun 39650753be update SSL autocert to dynamically check discovered servers (#234)
The DecisionFunc in makeAutocertManager now checks both static FQDNs
and dynamic servers from discovery providers. This allows new services
(docker containers, file config changes, consul updates) to get SSL
certificates without requiring reproxy restart.

Also fixes a race condition in discovery logging by using %T instead
of %s when formatting providers to prevent reflection on context fields.

Related to #207
2025-11-26 23:53:29 -06:00
Umputun 5f0253942f add tests to improve coverage for mgmt, main, and proxy packages
- add tests for metrics Middleware and ResponseWriter in mgmt package
- add tests for makeSSLConfig, makeLBSelector, fqdns in main package
- add tests for gzipHandler in proxy package
2025-11-26 23:25:34 -06:00
Umputun 4adb02f2ed Merge pull request #233 from umputun/maint/deps-update-nov2025
Maintenance: update dependencies and fix linter warnings
2025-11-26 23:14:27 -06:00
Umputun 089e683067 fix linter warnings after updating golangci-lint config
- add new linter rules to .golangci.yml (errorlint, wrapcheck, testifylint, nestif)
- fix errorlint: use errors.Is/As instead of direct comparison
- fix wrapcheck: wrap errors with context using %w
- fix testifylint: use assert.Len, assert.Empty, assert.True/False, require.ErrorIs
- fix go-require: use assert in goroutines and HTTP handlers
- update CI: add disk space cleanup, bump Go to 1.25, update actions versions
2025-11-26 23:06:35 -06:00
Umputun 305b4e3d21 update dependencies and fix breaking API changes
- bump all dependencies (go get -u ./...)
- fix libdns/route53 and libdns/libdns breaking API changes
- update acmez v2 to v3
- add CLAUDE.md for project context
2025-11-26 23:00:38 -06:00
Umputun b56560f72c docs: clarify ACME challenge selection process 2025-04-22 20:36:18 -05:00
Umputun da9954b50d docs: add DNS-01 challenge support info to README 2025-04-22 20:29:24 -05:00
Umputun 399f07bfca bump deps but keep certmagic
we can't update it yet due to missing support of github.com/libdns/gandi
2025-04-22 20:20:58 -05:00
Umputun 75191307b1 fix: use alternative port for ACME HTTP challenge in CI environments
- Configure CertMagic to use RedirHTTPPort as AltHTTPPort for HTTP challenges
- Improve HTTP-to-HTTPS redirect handler to omit standard HTTPS port in URL
- Update tests to use random high-numbered ports for HTTP challenges
- Fix various linting issues in the code
2025-04-22 03:49:39 -05:00
Umputun 231d7b002b Merge pull request #202 from Semior001/feature/110/acme-challenge-certmagic
add acme DNS-01 challenge support via certmagic
2025-04-19 12:47:55 -05:00