fix: allow health checks from internal ips only

rewardenv · Jan 27, 2025 · 9a42da9 · 9a42da9
1 parent 65fb326
commit 9a42da9
Show file tree

Hide file tree

Showing 15 changed files with 197 additions and 71 deletions.
diff --git a/.github/workflows/lint-dockerfiles.yml b/.github/workflows/lint-dockerfiles.yml
@@ -33,4 +33,4 @@ jobs:
       - name: Run Hadolint
         run: |
           set -euo pipefail
-          find ./images/varnish -type f -name "tpl.Dockerfile" -print0 | xargs -I{} -0 /bin/bash -c "echo {}; hadolint <(gomplate -f {} -o -)"
+          find ./images -type f -name "tpl.Dockerfile" -print0 | xargs -I{} -0 /bin/bash -c "echo {}; hadolint <(gomplate -f {} -o -)"
diff --git a/images/nginx/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/nginx/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -71,6 +71,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/images/nginx/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/images/nginx/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;

diff --git a/images/php-fpm-rootless/magento2-web/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/php-fpm-rootless/magento2-web/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -68,6 +68,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/...fpm-rootless/magento2-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/...fpm-rootless/magento2-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;

diff --git a/images/php-fpm-rootless/shopware-web/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/php-fpm-rootless/shopware-web/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -32,6 +32,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/...fpm-rootless/shopware-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/...fpm-rootless/shopware-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;

diff --git a/images/php-fpm-rootless/wordpress-web/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/php-fpm-rootless/wordpress-web/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -32,6 +32,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/...pm-rootless/wordpress-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/...pm-rootless/wordpress-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;

diff --git a/images/php-fpm/magento2-web/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/php-fpm/magento2-web/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -68,6 +68,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/images/php-fpm/magento2-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/images/php-fpm/magento2-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;

diff --git a/images/php-fpm/shopware-web/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/php-fpm/shopware-web/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -32,6 +32,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/images/php-fpm/shopware-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/images/php-fpm/shopware-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;

diff --git a/images/php-fpm/wordpress-web/context/rootfs/etc/nginx/conf.d/default.conf.template b/images/php-fpm/wordpress-web/context/rootfs/etc/nginx/conf.d/default.conf.template
@@ -32,6 +32,26 @@ map $http_x_forwarded_proto $fastcgi_https {
     https on;
 }
 
+geo $internal_ip {
+    default 0;
+    127.0.0.1 1;
+    10.0.0.0/8 1;
+    172.16.0.0/12 1;
+    192.168.0.0/16 1;
+}
+
+map $http_x_health_check $health_check {
+    "internal" 1;
+    default 0;
+}
+
+map $internal_ip$health_check $allowed {
+    "00" 0;
+    "01" 1;
+    "10" 1;
+    "11" 1;
+}
+
 include /etc/nginx/snippets.d/http-*.conf;
 include /etc/nginx/snippets/http-*.conf;
 

diff --git a/images/php-fpm/wordpress-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template b/images/php-fpm/wordpress-web/context/rootfs/etc/nginx/snippets.d/server-status.conf.template
@@ -1,20 +1,18 @@
 location = /healthz/nginx {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     add_header Content-Type text/plain;
     return 200 "ok";
 }
 
 location ~ ^/healthz/php-fpm(-status)?$ {
-    allow 127.0.0.1;
-    allow 10.0.0.0/8;
-    allow 172.16.0.0/12;
-    allow 192.168.0.0/16;
-    deny all;
+    if ($allowed = 0) {
+        return 403;
+    }
+
     access_log off;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_index index.php;