allow admin to add PDS that are ssl or not #904
Conversation
-crawl-ssl-policy|RELAY_CRAWL_NONSSL = any|require|none|prod /admin/pds/crawl can add either; public requestCrawl normally SSL only BGS AllowPDSProxies for nested relay setups -allow-pds-proxy|RELAY_ALLOW_PDS_PROXY = true
brianolson
force-pushed
the
bolson/mixed-wss
branch
from
7a00551 to
f0b2d6b
Compare
bgs/bgs.go
Outdated
| @@ -941,7 +944,9 @@ func (bgs *BGS) handleFedEvent(ctx context.Context, host *models.PDS, env *event | |||
| return fmt.Errorf("rebase was true in event seq:%d,host:%s", evt.Seq, host.Host) | |||
| } | |||
|
|
|||
| if host.ID != u.PDS && u.PDS != 0 { | |||
| if bgs.config.AllowPDSProxies { | |||
There was a problem hiding this comment.
Would be neat if we preconfigured the allowed hosts here via env var or something to avoid having the relay connected to itself or weird cases like that.
|
Ok with this for now to get things unblocked, but would love to un-jank all this more in the future, including all the Maybe storing hostnames separately? Also a bit worried if it becomes possible to consume from the same host both with SSL and without. |
|
major tweak: 'allow relay' is now a per-source admin action. No more global flag. snuck this bit of data in next to the rate-limit admin stuff also the dashboard now uses the admin version of |
| if host.ID != u.PDS && u.PDS != 0 { | ||
| if host.RelayAllowed { | ||
| // don't check that source is canonical PDS, allow intermediate relays | ||
| } else if host.ID != u.PDS && u.PDS != 0 { |
There was a problem hiding this comment.
What are the implications here of skipping the createExternalUser bit? Do we end up not creating a row for users that are being echoed by a Relay?
There was a problem hiding this comment.
this is a little weird, as it turns out that narelay does keep a little bit of per-user state so that it can emit a warning if there's a discontinuity in a user's feed ( See #915 )
There was a problem hiding this comment.
I think we'd still probably want to keep track of the users being proxied by a Relay so we can ban them and/or change their upstream status and/or count them right?
There was a problem hiding this comment.
mehhhh, ok, this needs some more consideration, there's some useful stuff inside .createExternalUser() and I can't just throw out the path of code that was under "user from weird place, wat"
BGS and Slurper allow mixed SSL or not upstreams
-crawl-ssl-policy|RELAY_CRAWL_NONSSL = any|require|none|prod
/admin/pds/crawl can add either; public requestCrawl normally SSL only
BGS AllowPDSProxies for nested relay setups
-allow-pds-proxy|RELAY_ALLOW_PDS_PROXY = true