owncloud / owncloud/ocis

Suggestion: Add support to unix domain socket in proxy addr

Open
#12,473 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 2h
Merged PRs (30d)
106

Description

## Is your feature request related to a problem? Please describe.
This could be a security and performance enhancement of ocis, especially when deployed without docker (dpkg packages, etc.). The ocis processes can be in a namespace / container with full network isolation and optional partial filesystem isolation, using a socket as a bridge between reverse proxies and ocis (with proper user/group settings to grant rw to proxy and ocis), preventing unexpected off-proxy accesses to many unprotected ports (#5844)

My current setting: A namespace is set in systemd (separated network, same filesystem) so that no listened port will be exposed to any user other than the ocis service user. A socat process is managed by systemd, started before ocis, listening to a socket (permission is u=www-data g=ocis 0660) and set proxy addr to that socket in nginx. This works fine mostly, but sometimes the socat service fails and won't start without a system reboot.

## Describe the solution you'd like
Allow setting something like `PROXY_HTTP_ADDR=unix:///var/run/ocis.sock`.

## Additional context
Reissues #11840 .

Contributor guide

Open the contributing guide

Research direction

Begin with the code that parses PROXY_HTTP_ADDR and configures the proxy listener; compare the requested behavior with reissue #11840. Done means a unix:///var/run/ocis.sock value is accepted for the proxy address and allows the reverse proxy to connect through the Unix socket.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.