artin/sourcegraph
1
0
Fork 0
mirror of https://github.com/sourcegraph/sourcegraph.git synced 2026-02-06 17:11:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

msp/cloudflare: proxy by default (#59505)

Browse Source 
For most use cases, services should be behind the default Cloudflare proxy. Addresses https://github.com/sourcegraph/managed-services/pull/334#discussion_r1446496498

The only services that should not be proxied, pings and telemetry-gateway, both specify `proxied: false` explicitly already (these services should have static IPs available)
This commit is contained in:
Robert Lin 2024-01-11 10:38:46 -08:00 committed by GitHub
parent 74c341af3e
commit 1caacec5d5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dev/managedservicesplatform/internal/resource/cloudflare/cloudflare.go
View File

@ -45,7 +45,7 @@ func New(scope constructs.Construct, id resourceid.ID, config Config) (*Output,
Name: &config.Spec.Subdomain,
Type: pointers.Ptr("A"),
Value: config.Target.ExternalAddress.Address(),
Proxied: pointers.Ptr(config.Spec.Proxied),
Proxied: pointers.Ptr(config.Spec.ShouldProxy()),
Comment: pointers.Ptr("Managed Services Platform service"),
Tags: pointers.Ptr(pointers.Slice([]string{"msp"})),
})

2
dev/managedservicesplatform/operationdocs/operationdocs.go
View File

@ -96,7 +96,7 @@ This service is operated on the [Managed Services Platform (MSP)](https://handbo
if env.EnvironmentServiceSpec != nil {
if domain := env.Domain.GetDNSName(); domain != "" {
overview = append(overview, []string{"Domain", markdown.Link(domain, "https://"+domain)})
if env.Domain.Cloudflare != nil && env.Domain.Cloudflare.Proxied {
if env.Domain.Cloudflare != nil && env.Domain.Cloudflare.ShouldProxy() {
overview = append(overview, []string{"Cloudflare WAF", "✅"})
}
}

12
dev/managedservicesplatform/spec/environment.go
View File

@ -265,13 +265,23 @@ type EnvironmentDomainCloudflareSpec struct {
// Proxied configures whether Cloudflare should proxy all traffic to get
// WAF protection instead of only DNS resolution.
Proxied bool `yaml:"proxied,omitempty"`
//
// Default: true
Proxied *bool `yaml:"proxied,omitempty"`
// Required configures whether traffic can only be allowed through Cloudflare.
// TODO: Unimplemented.
Required bool `yaml:"required,omitempty"`
}
// ShouldProxy evaluates whether Cloudflare WAF proxying should be used.
func (e *EnvironmentDomainCloudflareSpec) ShouldProxy() bool {
if e == nil {
return false
}
return pointers.Deref(e.Proxied, true)
}
type EnvironmentInstancesSpec struct {
Resources EnvironmentInstancesResourcesSpec `yaml:"resources"`
// Scaling specifies the scaling behavior of the service.

2
dev/managedservicesplatform/stacks/cloudrun/internal/builder/service/service.go
View File

@ -250,7 +250,7 @@ func (b *serviceBuilder) Build(stack cdktf.TerraformStack, vars builder.Variable
// Provision SSL cert
var sslCertificate loadbalancer.SSLCertificate
if domain.Cloudflare.Proxied {
if domain.Cloudflare.ShouldProxy() {
sslCertificate = cloudflareorigincert.New(stack,
resourceid.New("cf-origin-cert"),
cloudflareorigincert.Config{