Jeffrey
2d078e10c0
The console will not work from outside without this. WebsocketController hands the browser wss://<node fqdn>:443/api/servers/<uuid>/ws built from Node::getConnectionAddress(), so the browser talks to wings directly and never through the panel. Same for file upload and download, which FileUploadController builds from the same address. Everything else (login, server list, file browsing, power actions, sending console commands) already worked publicly, because those go through the panel API. Adds public listeners for both nodes reusing the existing wings-mc-tls and wings-ark-tls certificates, and a gateway-public parentRef on each route. Extends the wings ClientTrafficPolicy to the two new listeners. Without it the public listeners would negotiate h2 and long-lived consoles would drop: wings only speaks HTTP/1.1, and the idle timeout needs to be 3600s rather than the default. CrowdSec ext_authz already covers every listener on gateway-public, so both nodes are behind the WAF and community blocklist from the moment they are live. Wings itself is JWT-gated and returns 401 unauthenticated.
31 lines
680 B
YAML
31 lines
680 B
YAML
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: wings-mc-route
|
|
namespace: pelican
|
|
spec:
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
namespace: envoy-gateway
|
|
sectionName: wings-mc
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: gateway-public
|
|
namespace: envoy-gateway
|
|
sectionName: wings-mc
|
|
hostnames:
|
|
- "wings-mc.jsme.be"
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: wings-mc
|
|
port: 8080
|
|
kind: Service
|
|
group: ""
|
|
weight: 1
|